KR20210027737A - Method, apparatus and computer program for network separation of software defined network - Google Patents

Abstract

The present invention relates to a method, a device, and a computer program for software defined network-based network separation intended to separate a software defined network into a personal network and a business network. To this end, the present invention relates to a method for separating a network based on a software defined network. The method comprises the steps of: (a) creating, by a controller, a network table including the host′s network IDVLN setting information; (b) transmitting, by a switch, a packet transmitted by a first host to the controller as a packet-in message; (c) extracting, by the controller, a VLAN tag included in the packet-in message, retrieving ID of a network to which the first host belongs from the network table, and inserting the retrieved ID into the packet-in mssage; and (d) transmitting, by the controller, the packet-in message to the switch so that the first host is treated as belonging to the network. According to the present invention, it is possible to divide a network into networks with different purposes.

Description

Software-defined network-based network separation method, device and computer program {METHOD, APPARATUS AND COMPUTER PROGRAM FOR NETWORK SEPARATION OF SOFTWARE DEFINED NETWORK}

The present invention relates to a method of managing a network, and more particularly, the present invention relates to a method of separating networks having different purposes in a software defined network.

Software Defined Network (hereinafter referred to as SDN) refers to a technology that manages all network equipment in the network by an intelligent central management system. SDN technology has the advantage of being able to develop and assign various functions compared to the existing network structure by processing the control operation related to packet processing performed by the existing hardware type network equipment itself in the form of a software controller. .

The SDN system generally includes a controller server that controls the entire network, a plurality of openflow switches that are controlled by the controller server and handles packets, and a host corresponding to a lower layer of the openflow switch. Here, the openflow switch is responsible for only the packet transmission/reception function, and packet routing, management, and control are all performed by the controller server. In other words, separating the Data Plane and Control Plane constituting the network equipment can be regarded as the basic structure of SDN.

1 is a diagram for explaining a configuration of a software defined network. Referring to FIG. 1, a software defined network may include a controller server 100, a network device 200, and a host 300. The network equipment 200 and the host 300 may be referred to as a node, and a link may mean a connection between two nodes.

The controller server 100 functions to manage the network equipment 200 and manages and controls a plurality of network equipment 200 in a centralized manner. Specifically, the controller server 100 includes an application program that functions such as topology management, path management related to packet processing, link discovery, and flow management, which is a packet flow. It can be implemented in a mounted form.

The network equipment 200 functions to process packets under the control of the controller server 100. Examples of the network equipment 200 include a mobile communication base station, a base station controller, a gateway equipment, a switch in a wired network, a router, and the like.

In a software defined network, the controller server 100 and the openflow switch 200 must exchange information with each other, and the OpenFlow protocol is widely used as a protocol for this purpose. That is, the openflow protocol is a standard standard that allows the controller server 100 and the openflow switch 200 to communicate with each other.

According to the open flow protocol, the switch 200 exchanges information with the controller server 100 through a control channel, and one or more flow tables, group tables, and One or more ports may be used as a meter table and/or a network interface for packet delivery.

Open Networking Foundation, "OpenFlow Specification 1.3.0"

The present invention is to solve the above-described problem, and an object of the present invention is to distinguish network networks having different purposes in a software defined network.

The present invention for achieving this purpose is a method for separating a network based on a software-defined network, in step a of generating a network table including a network ID of a host in a controller, and transmitted by a first host in a switch. Step b of transmitting a packet to the controller as a packet-in message, in the controller, extracting a VLAN tag included in the packet-in message, searching the network table for an ID of the network to which the first host belongs, and Step c of inserting into the message, and step d of allowing the first host to process the first host as belonging to the network by transmitting the message, which is the packet, to the switch.

According to the present invention as described above, network networks having different purposes can be distinguished in a software defined network. Furthermore, according to the present invention, since a network ID can be flexibly assigned to a host, convenience and stability of network management can be provided at the same time.

1 is a diagram for explaining a software-defined network configuration;
2 is a diagram for explaining a difference between a conventional method for network separation and the present invention;
3 is a diagram showing a network separation system according to an embodiment of the present invention;
4 is a flowchart illustrating a network separation method according to an embodiment of the present invention.

The above-described objects, features, and advantages will be described later in detail with reference to the accompanying drawings, and accordingly, a person of ordinary skill in the art to which the present invention pertains will be able to easily implement the technical idea of the present invention. In describing the present invention, if it is determined that a detailed description of a known technology related to the present invention may unnecessarily obscure the subject matter of the present invention, a detailed description will be omitted.

In the drawings, the same reference numerals are used to indicate the same or similar elements, and all combinations described in the specification and claims may be combined in any manner. And, unless otherwise specified, it should be understood that references to the singular may include more than one, and references to the singular may also include the plural.

The terms used in this specification are for the purpose of describing specific exemplary embodiments only and are not intended to be limiting. Singular expressions as used herein may also be intended to include plural meanings unless clearly indicated otherwise in the corresponding sentence. The term "and/or," "and/or" includes all combinations and any of the items listed in connection therewith. The terms "comprises", "comprising", "comprising", "having", "having", "having", etc. have inclusive meanings, and accordingly, these terms are used for the described features, integers, It specifies steps, actions, elements, and/or components, and does not preclude the presence or addition of one or more other features, integers, steps, actions, elements, components, and/or groups thereof. The steps, processes, and actions of the methods described herein should not be construed as necessarily performing their performance in the particular order discussed or illustrated, unless the order in which they are specifically performed is determined. . It should also be understood that additional or alternative steps may be used.

In addition, each component may be implemented as a hardware processor, the above components may be integrated to be implemented as a single hardware processor, or the above components may be combined with each other to be implemented as a plurality of hardware processors.

In addition, the term'flow rule' used in the specification of the present invention should be understood to mean a network policy applied by a controller server in a software defined network from the standpoint of a person skilled in the relevant industry.

In the network separation, in the first network and the second network, which are network networks having different purposes, the terminal (or PC) that can access the first network blocks access to the second network, and the terminal that can access the second network (or The access network of the first network and the second network is separated from each other by blocking access of the PC) to the first network. For example, as shown in FIG. 2, the conventional network separation method is divided into physical network separation (FIG. 2-a) and logical network separation (FIG. 2-b, c, and d). Physical network separation is separating a terminal accessible to the Internet network and a terminal accessible to the business network. Since both the network and the terminal are configured separately, the safety is very high, but the cost is significant.

The logical network separation is divided into three methods. First, referring to b of FIG. 2, the terminal (or PC) accesses the Internet network, and the virtual system accesses the business network to separate the network. This method is useful in preventing the leakage of important information such as industrial secrets because all the results of work through the business network are stored in the virtual system, so important information is not stored in the terminal. However, such a method is vulnerable to external attacks, so the security of the PC system is very important.

Referring to FIG. 2C, the terminal (or PC) accesses the business network and accesses the Internet network in a virtual system to separate the network. Referring to FIG. By installing the system, the Internet network can be used as a virtual system, and the network can be separated using the business network from the terminal itself. Access to the business network is blocked in the virtual system, so even if a malicious program penetrates through the Internet network, important systems or data in the business network can be protected. In this way, when logical network separation is performed through a virtual system, there is a possibility that the user intentionally avoids applying the network separation, or data stored in the terminal may be leaked by accessing another network through wireless Internet or tethering.

In the conventional network separation method as described above, the user can intentionally avoid network separation because the network accesses the network using only the VLAN of the packet without separate authentication. When moving to a different port, there is a disadvantage in that mobility is significantly reduced because of the hassle of resetting all tables.

Accordingly, the present invention devised a method for performing logical network separation using a software-defined network, and can implement logical network separation using an openflow protocol without the need to add additional dedicated network equipment.

More specifically, according to an embodiment of the present invention, a network ID policy for a host to access a network is managed by a controller rather than a switch, and the network Host mobility (IP Mobility) can be provided by dynamically setting the ID. In the present invention, all information capable of distinguishing a network, such as VLAN, VXLAN, and SRC MAC, can be used as a network ID.

For example, in the software defined network of FIG. 3, the controller 15 may collect network topology information and designate a traffic path using packets generated by the hosts 40, 43, 46, and 49. At this time, the controller 15 according to an embodiment of the present invention may generate a network table including network topology information.

For example, the controller 15 allocates a first network ID to the first network 10 and a second network ID to the second network 20, and the MAC address of the hosts 40 and 46 belonging to the first network and /Or the IP address, port information, and the first network ID, the MAC address and/or the IP address of the host (43, 49) belonging to the second network, port information, and the second network ID to create a network table. I can. The generated network table may be stored in the storage of the controller 15.

The controller 15 checks the MAC address and/or IP address of the host 40 included in the packet-in message, confirms that the network to which the host 40 belongs is the first network 10, and You can check the VLANs assigned to. Thereafter, the controller 15 may set the switch 30 so that the host 40 belongs to the first network 10. More specifically, the controller 15 may set a flow rule in the switch 30 for processing packets of the host 40 as if the host 40 belongs to the first network.

On the other hand, a case where the host 40 moves and disconnects the physical connection with the switch 30 and connects it to the switch 35 may be considered. That is, when the host 40 belonging to the first network moves its physical location, the switch 35 corresponding to the moved port does not have a flow rule for the host 40, so that the host 40 is a new host. It is determined as, and the packet received from the host 40 may be transmitted to the controller 15 in the form of a message, which is a packet. Upon receiving the message, which is a packet from the host 40, the controller checks the MAC address and/or IP address of the host 40 in the network table, corrects the port information of the host 40, and then sends the host ( 40) may transmit a flow rule to belong to the first network.

As described above, according to an embodiment of the present invention, when the controller determines the network of the host, it is sufficient to process the packet according to the flow rule that follows the open flow protocol without the need to change the VLAN in the host.

According to this, even if the switch accessing the network is changed, the network administrator can dynamically receive the network separation service without having to separately configure the corresponding switch. A specific example of the flow rule for setting the ID of the network to which the host belongs will be described later in the description of FIG. 4.

According to another embodiment of the present invention, the controller may set the security of the network by recording the correspondence between the MAC address of the host and the IP address in the network table, and control the network based on this.

More specifically, the controller may use the network table to control access to the network of unauthorized hosts. In addition, a network linking table indicating the network linkage between one or more networks is further added so that the host can use more than one network. Can be generated. The controller 15 checks the MAC address and/or IP address of the host that can access the switch using the network table and the network association table, and controls the switch to process only packets having the permitted addresses to secure the entire network. You can raise the level.

According to such an embodiment of the present invention, it is possible to provide a function to detect and respond to an endpoint threat by managing a host connected to a network in a controller without the need to install a separate security device for network access control. A specific example for implementing the security policy will be described later in the accompanying description of FIG. 4.

4 is a flowchart illustrating a method of setting a network ID of a host and processing a packet according to the network ID according to an embodiment of the present invention. In the example of FIG. 4, the controller controls a software defined network including a switch.

In step S100, the controller according to the embodiment of the present invention may generate a network table including a correspondence relationship between MAC addresses and IP addresses of all hosts belonging to the first network and the second network, and the ID of the network to which the host belongs. .

More specifically, the controller may create a network table based on a network administrator's setting or a network management policy. For example, the controller records the MAC address and/or IP address of the host belonging to the first network, port information, and the first network ID assigned to the first network, and the MAC address of the host belonging to the second network and/or A network table may be generated by recording the IP address, port information, and the second network ID allocated to the second network.

Furthermore, the controller can create a network connection table together with the network table. For example, the controller records the MAC address and/or IP address of a host belonging to the first network and accessible to the second network, and the MAC address and/or IP address of a host belonging to the second network and accessible to the first network. You can create a network connection table. In addition, the controller may also set the access directions of the first network and the second network, and may be one-way or two-way depending on the setting.

As described above, the present invention can improve network access flexibility by using a network association table. According to an embodiment of the present invention, for example, in a road infrastructure network, in order to separate a traffic equipment network (first network) and an IoT equipment network (second network), a network by physically separating the traffic equipment and the IoT equipment The controller can logically separate the network using the ID of the first and second networks without the need to construct or change the VLAN setting of the device, thereby increasing the convenience of network management.

In step S200, when the switch receives a packet from the connected first host, the switch processes the packet according to the flow rule, and when the first host is a new host in which no flow rule exists, the switch may transmit a message, which is a packet, to the controller.

Furthermore, if the port corresponding to the first switch is down or the first host does not respond for a predetermined period of time or more, the switch may determine that the connection with the first host is cut off and delete the flow rule. At this time, since the switch determines that a flow rule for the first host does not exist, it may determine that the first host is a new host and transmit a packet received from the first host to the controller in the form of a message as a packet.

In step S300, the controller may extract a VLAN tag from a message, which is a packet received from the switch, and temporarily store it in the memory. The VLAN tag for connecting the host to the network is replaced by the network ID to which the host belongs by the network table of the controller. Therefore, the VLAN tag area is emptied from the packet by temporarily extracting the VLAN tag that the packet of the first host already has. You can insert the network ID of the network to which the user belongs.

In step S400, the controller may check the MAC address and/or IP address of the first host included in the packet-in message, and search the network table for the network ID of the network to which the first host belongs. For example, in the network table generated in step S100, when the first host belongs to the first network, the controller can confirm that the ID of the network to which the first host belongs is the first network ID.

At this time, if the MAC address and/or IP address of the first host included in the packet-in message is not included in the network table, the controller determines that the host does not meet the network separation requirements and drops the packet received from the first host to the switch. In addition, a flow rule configured to block the first host from accessing the network may be transmitted.

Furthermore, when the controller checks the MAC address and/or IP address of the first host, the MAC address and/or IP address of the first host connected to the first port of the switch is connected to the second port of the same switch or another switch. 2 When the host is the same (duplicate), the controller may determine the first host as an abnormal host and transmit a flow rule setting to block and drop a message, which is a packet received from the first host, to the switch. Furthermore, the original VLAN has a disadvantage in that security is weak, but when a software-defined network is used as in the embodiment of the present invention, the controller authenticates the host (terminal) using the MAC address and/or IP address of the host as the KEY, and Since the network is separated by setting the ID, the security of logical network separation can be strengthened.

The controller, which has confirmed that the network ID of the network to which the first host belongs is the first network ID, inserts the first network ID into a blank area (VLAN tag) of the message, which is a packet, so that the first host belongs to the first network ( S500). Further, the controller transmits a message in which the first network ID is inserted to the switch (S600), so that the first host may be set to belong to the first network. In addition, the controller may further transmit a flow rule to the switch so that the VLAN tag temporarily stored in the memory corresponds to the first host.

Through this process, the controller can use the network table to identify the network to which the host's packet belongs and treat the switch as belonging to the identified network, even if the network administrator does not separately set the VLAN for the host on the switch. have.

Thereafter, the controller may further verify the destination MAC address and/or IP address of the packet-in-message. If the destination MAC address and/or IP address of the packet-in message does not exist on another port, the controller determines that the destination is invalid and transmits a flow rule to the switch to block and drop the packet-in message received from the first host. I can.

Furthermore, if the destination included in the message, which is a packet of the first host, is valid, the controller may identify a network corresponding to the MAC address and/or IP address of the destination. If the network corresponding to the MAC address and/or IP address of the packet-in message is the first network, and the network corresponding to the MAC address and/or IP address of the packet-in message is the second network, the controller checks the network association table. By checking, it is possible to check whether the first host can communicate with the second network. When the controller identifies in the network association table that the first host belonging to the first network is unable to communicate with the second network, the controller may transmit a flow rule setting to block and drop a message, which is a packet of the first host, to the switch.

Furthermore, if the controller identifies in the network association table that the first host belonging to the first network can communicate with the second network, the controller may transmit a flow rule to the switch for setting the first host to use the second network as well.

According to an embodiment of the present invention, when a switch corresponding to the MAC address and/or IP address of the destination receives a packet transmitted by a switch to which the first host belongs, removes the network ID included in the packet, and removes the network ID from the controller in advance. After inserting the VLAN tag of the first host according to the received flow rule, the packet may be transmitted to the destination host.

According to an embodiment of the present invention, as in the present invention, a controller can assign a network ID and control access to other networks, thereby providing a dynamic network separation service to the host and increasing the network security level at the same time. There is.

The embodiments of the present invention disclosed in the present specification and drawings are provided only to provide specific examples to easily explain the technical content of the present invention and to aid understanding of the present invention, and are not intended to limit the scope of the present invention. It is obvious to those of ordinary skill in the art that other modifications based on the technical idea of the present invention can be implemented in addition to the embodiments disclosed herein.

Claims (6)

In a method of separating a network based on a software defined network,
A step of generating, at the controller, a network table including a network ID of the host;
A step b of transmitting, at the switch, the packet transmitted by the first host to the controller as a message as a packet;
C, in the controller, extracting a VLAN tag included in the packet-in message, searching the network table for an ID of a network to which the first host belongs, and inserting it into the packet-in message;
And a step d of allowing the controller to process the first host as belonging to the network by transmitting the message as the packet to the switch.
The method of claim 1,
In the step a, the controller generates the network table including at least one of an IP address, a MAC address, and an ID of a network to which the host belongs, using a message that is the packet received from the switch. Network separation method comprising the step of.
The method of claim 2,
In the step c, in the case where the MAC address of the first host in the network table corresponds to a second host of another port, the switch includes setting the packet to block and drop the message. How to separate the net.
The method of claim 2,
In the step c, if the MAC address of the destination included in the packet-in message in the network table is not included in the network table, the switch blocks and drops the packet-in message. How to separate the net.
The method of claim 2,
The step a includes, in the controller, generating a network association table recording a relationship between a first network to which the host belongs and another second network,
In step c, in the controller, if the MAC address of the destination included in the packet-in message in the network table is a second network, the network association table determines whether the first host can access the second network, Otherwise, the switch blocking and dropping the packet.
The method of claim 1,
When the switch receives the packet-in message from the controller, the packet-in message is transmitted to a switch to which a destination port belongs,
And the destination switch removing the ID of the network from the message as the packet and inserting the VLAN tag temporarily stored in the memory of the controller.

Images