TW202034658A - Ipv6 accessing management system based on software defined network and method thereof - Google Patents
Ipv6 accessing management system based on software defined network and method thereof Download PDFInfo
- Publication number
- TW202034658A TW202034658A TW108106999A TW108106999A TW202034658A TW 202034658 A TW202034658 A TW 202034658A TW 108106999 A TW108106999 A TW 108106999A TW 108106999 A TW108106999 A TW 108106999A TW 202034658 A TW202034658 A TW 202034658A
- Authority
- TW
- Taiwan
- Prior art keywords
- ipv6
- traffic
- software
- defined network
- network
- Prior art date
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
Description
本發明「針對位於中小型企業、校園網路或是家用網路環境內部的機房資料中心(Data Center),針對其網路訊務在IPv6上的通訊安全,導入軟體定義網路(SDN)技術,讓機房網路的存取開與閉,取決於使用者的認證授權機制,保障機房內部資訊系統的IPv6通訊安全。The present invention "For Data Centers located in small and medium-sized enterprises, campus networks, or home network environments, the software-defined network (SDN) technology is introduced for the communication security of its network traffic on IPv6 , The opening and closing of the computer room network access depends on the user’s authentication and authorization mechanism to ensure the IPv6 communication security of the computer room’s internal information system.
機房資料中心(Data Center)主要透過封包交換(Packet Switching)技術的電路交換技術,用於將資訊傳遞至所需之處。由於資料中心經常儲放機敏性高的資料,為了保障資料可以被安全存取,依據網路訊務的交換區域,大致上可以分成兩種保護方式,來確保資料被交換的安全性。The data center of the computer room mainly uses the circuit switching technology of packet switching technology to deliver information to where it is needed. Since data centers often store sensitive data, in order to ensure that data can be accessed safely, based on the exchange area of network traffic, roughly two protection methods can be divided to ensure the security of data exchange.
第一種為IPv6內部訊務交換策略,用於交換第一跳(First Hop)路由器與機房伺服器之間的IPv6網路訊務。第二種為IPv6外部訊務交換策略,用於交換外部網際網路與內部機房網路之間的IPv6網路訊務。The first is the IPv6 internal traffic exchange strategy, which is used to exchange IPv6 network traffic between the First Hop router and the server in the computer room. The second is the IPv6 external traffic exchange strategy, which is used to exchange IPv6 network traffic between the external Internet and the internal computer room network.
針對內部網路訊務,傳統解決方式是在交換機中,網路管理員導入IEEE所規範的802.1X協定。此為一種基於實體埠的網路接取控制機制,將每一台銜接於交換機的網路設備,將其認證資訊傳遞給驗證伺服器,唯有認證通過的設備,交換機才會為其提供封包機換的服務。For internal network traffic, the traditional solution is in the switch, the network administrator imports the IEEE 802.1X protocol. This is a physical port-based network access control mechanism. Each network device connected to the switch transmits its authentication information to the verification server. Only the devices that pass the authentication will the switch provide packets for it Machine exchange service.
IEEE 802.1X雖然可鞏固內部網路的存取安全,但前提是機房資訊中心的軟硬體都必須支援此協定,才能完全發揮認證設備的功效,因此網路管理員,每當遇到伺服器上架至時,都必須與機房內部的交換機,進行IEEE 802.1X的互連測試,確保資訊運作的流暢性。因此,無形中增加人力成本,也提升添購錯誤設備的風險。另外,資訊中心的伺服器可能隸屬在不同的管理單位,認證程序可能因為行政上的疏失,或是相關人員的專業背景不足,造成設定上的錯誤,提高網路除錯的門檻。Although IEEE 802.1X can consolidate the access security of the internal network, the premise is that the software and hardware of the computer room information center must support this protocol in order to fully play the role of the authentication device. Therefore, network administrators, whenever they encounter a server When it is put on the shelf, it is necessary to conduct an IEEE 802.1X interconnection test with the switch inside the computer room to ensure the smoothness of information operation. Therefore, the labor cost is virtually increased, and the risk of purchasing the wrong equipment is also increased. In addition, the server of the information center may belong to different management units, and the certification process may be due to administrative negligence or insufficient professional background of the relevant personnel, which may cause setting errors and increase the threshold of network debugging.
針對資料中心欲提供資料,給位於外部的使用者時,往往導入IPSec VPN技術,在既有開放的網際網路上面,提供一個安全的網路通道給使用者存取,達到類似私有網路的安全性與便利性之功效。近幾年來,SSL VPN急速竄起,此技術改良IPSec VPN的連線與安裝設定…等問題,其技術的親民性,慢慢侵蝕傳統IPSec VPN的市場,特別在這個行動裝置興盛的時代,一般使用者打開手機內部的瀏覽器,使用https協定就可以建立與資料中心的安全連線,而且透過SSL VPN技術,可以有效突破防火牆、網路位址轉換(NAT)甚至是Proxy Cache等網路安全設備的連線限制,提升使用彈性,逐漸成為VPN市場的主流技術。但是SSL VPN依然有其缺點,對於資料中心若提供非Web類的雲端應用服務,其使用情境就會受到限制,不利於資料中心的發展。When the data center wants to provide data to users located outside, it often introduces IPSec VPN technology to provide a secure network channel for users to access on the existing open Internet, achieving a similar private network The effect of safety and convenience. In recent years, SSL VPN has rapidly risen. This technology has improved the connection and installation settings of IPSec VPN... and other issues. The technology’s affinity for the people has slowly eroded the traditional IPSec VPN market, especially in this era of prosperous mobile devices. The user opens the browser inside the phone and uses the https protocol to establish a secure connection with the data center, and through the SSL VPN technology, it can effectively break through the network security such as firewall, network address translation (NAT) and even Proxy Cache The connection restriction of the equipment has improved the flexibility of use, and has gradually become the mainstream technology in the VPN market. However, SSL VPN still has its shortcomings. If the data center provides non-Web cloud application services, its use context will be restricted, which is not conducive to the development of the data center.
伴隨著IPv4位址用鑿,機房資料中心導入IPv6為國際趨勢,但是啟用一個新協定也伴隨新的風險。資料中心之資訊安全,如持續延用上述IEEE 8021.X與IPSec/SSLVPN…等類似機制,除了軟硬體功能本身上是否支援IPv6外,對於IEEE 8021.X與IPSec/SSLVPN支援IPv6的完整性也充滿許多危險。另外IPv6協定本身設計芳鄰找尋機制,協助機房伺服器擁有基礎區域網路的的IPv6通訊能力,此運作流程與IPv4協定有極大的差異,因此傳統保護機制無法直接從IPv4上面,延伸套用到IPv6協定上,也因此就會衍生資安上的漏洞。With the use of IPv4 addresses, the introduction of IPv6 into the computer room data center is an international trend, but the launch of a new agreement also brings new risks. Information security of the data center, such as continuing to use the above-mentioned IEEE 8021.X and IPSec/SSLVPN... and other similar mechanisms, in addition to whether the software and hardware functions support IPv6, the integrity of IPv6 support for IEEE 8021.X and IPSec/SSLVPN It is also full of dangers. In addition, the IPv6 protocol itself designs a neighbor finding mechanism to assist the server in the computer room to have the IPv6 communication capabilities of the basic local area network. This operation process is very different from the IPv4 protocol. Therefore, the traditional protection mechanism cannot be directly extended from IPv4 to the IPv6 protocol. Therefore, there will be loopholes in information security.
對於中小型企業網路或校園網路而言,建置自家的資料中心(Data Center),用於確保內外部資訊系統正常運作,以及存放高機敏性的資料。因此基於資訊安全的考量,需要有高強度的資訊防禦機制,讓重要資訊可在安全的環境下,僅提供權限給合法使用者於網際網路上存取。For small and medium-sized enterprise networks or campus networks, build your own data center (Data Center) to ensure the normal operation of internal and external information systems and store highly sensitive data. Therefore, based on the consideration of information security, a high-strength information defense mechanism is required so that important information can be accessed in a safe environment and only authorized by legitimate users on the Internet.
雖然可透過添購新型高防禦力的資訊安全設備,快速提升資料中心的網路防護能力,但是礙於行政預算的考量,無法添購高單價的資訊安全設備。因此造成資訊中心之網路架構強度不足,讓惡意駭客有可乘之機,肆意入侵與竊取寶貴資訊,進而造成民生經濟與國家安全的損失。Although it is possible to quickly improve the network protection capabilities of the data center by purchasing new high-defense information security equipment, due to administrative budget considerations, it is impossible to purchase high-unit-price information security equipment. As a result, the strength of the network structure of the information center is insufficient, and malicious hackers have the opportunity to invade and steal valuable information wantonly, which in turn causes the loss of people's livelihood, economy and national security.
有鑑於此,本發明致力於發明一套智能化網路管理系統,藉由軟體定義網路交換機,取代市售的商業交換機,降低硬體採購成本,並且利用SDN技術實作出高防護力的資訊防禦系統,保障資料中心的網路運作。In view of this, the present invention is dedicated to inventing an intelligent network management system, which replaces commercially available commercial switches with software-defined network switches, reduces hardware procurement costs, and uses SDN technology to achieve high protection information The defense system protects the network operation of the data center.
本發明針對資料中心(Data Center)的網路資訊防護,提出一種立基於軟體定義網路之IPv6存取管理系統,本系統利用交換機可被軟體程式化的特性,即時動態開通交換機制,並使其與認證功能進行結合,提升資料中心於IPv6訊務中的網路存取安全。Aiming at the network information protection of the data center (Data Center), the present invention proposes an IPv6 access management system based on a software-defined network. The system uses the feature that the switch can be programmed by software to dynamically activate the switch mechanism in real time and enable It is combined with the authentication function to enhance the network access security of the data center in IPv6 communications.
依據資料中心網路訊務的特性,大致上可將軟體定義網路交換機的交換場域,分類成兩種:第一種為IPv6外部訊務交換規則,用於交換外部網際網路與內部機房網路之間的IPv6網路訊務,第二種為IPv6內部訊務交換規則,用於交換第一跳(First Hop)路由器與機房伺服器之間的IPv6網路訊務。According to the characteristics of data center network traffic, the switching fields of software-defined network switches can be roughly classified into two types: The first is the IPv6 external traffic exchange rules, which are used to exchange external Internet and internal computer rooms. IPv6 network traffic between networks, the second type is IPv6 internal traffic exchange rules, used to exchange IPv6 network traffic between the First Hop router and the server in the computer room.
當一使用者使用IPv6位址,有意登入機房內部伺服器時,首先會利用內部機房網路登入網頁,透過智能管理系統的驗證功能,輸入驗證因子,進行使用者的身分與權限確認作業。若判定為合法用戶,則智能網路管理系統呼叫SDN媒合程式,啟動SDN控制機(Controller),策略性設定SDN白牌交換機(即:SDN交換機)之IPv6外部訊務交換規則。When a user uses an IPv6 address and intends to log in to the internal server of the computer room, he will first use the internal computer room network to log in to the web page, enter the authentication factor through the authentication function of the intelligent management system, and confirm the user's identity and authority. If it is determined to be a legitimate user, the intelligent network management system calls the SDN matching program, activates the SDN controller (Controller), and strategically sets the IPv6 external traffic exchange rules of the SDN white card switch (ie: SDN switch).
由於同一使用者可能因為行動裝置,或是個人使用地點,導致IPv6位址會有異動的可能性,因此會針對合法使用者,記錄當時所在的IPv6位址,並且利用SDN媒合程式,客製化其IPv6訊務之交換規則,最終透過SDN控制機,將IPv6訊務交換規則寫入SDN白牌交換機中,此作法一來可限制該使用者的IPv6位址,才能存取機房的內部網路,再來也可依據該使用者的存取權限,限制可存取機房的IPv6伺服器,因此在IPv6連線源頭(使用者)或是IPv6連線的目的地(機房內部伺服器),都確保端點對端點(End-to-End)傳輸的連線能力受到管控。Since the same user may change the IPv6 address due to mobile device or personal location, it will record the current IPv6 address for legitimate users, and use the SDN matching program to customize Change its IPv6 traffic switching rules, and finally write the IPv6 traffic switching rules into the SDN white-label switch through the SDN controller. This approach can restrict the user’s IPv6 address to access the computer room’s intranet In the future, you can also restrict access to the IPv6 server in the computer room based on the user’s access rights, so at the source of the IPv6 connection (user) or the destination of the IPv6 connection (the internal server in the computer room), Both ensure that the end-to-end (End-to-End) transmission connection capability is controlled.
當此系統為使用者順利開通IPv6訊務後,如遭遇使用者欲登出資訊中心,或是登入時間超出該IPv6外部訊務交換規則的時限後,會觸發網路智能管理機,抹除所有與該使用者相依的交換規則,關閉該使用者從外部網路存取資料中心的網路訊務,降低資訊中心曝露於網路網際的風險。When this system successfully activates IPv6 traffic for users, if the user wants to log out of the information center, or the login time exceeds the time limit of the IPv6 external traffic exchange rules, it will trigger the network intelligent management machine and erase all The exchange rules that depend on the user shut down the user's access to the data center's network traffic from the external network, reducing the risk of the information center being exposed to the Internet.
雖然透過認證功能結合SDN機制,可降低惡意使用者,從外部網路威脅機房內部的風險,但難保使用者誤使用被惡意程式感染的設備,登入資訊中心的IPv6伺服器,造成資訊中心二度感染的風險,進而轉變成殭屍電腦,利用IPv6芳鄰找尋機制(Neighbor Discovery)的弱點,駭客利用惡意程式產生IPv6訊息,間接探測機房中心的其他IPv6節點,並嘗試攻擊其他資料中心的IPv6伺服器,剽竊重要資訊。Although the authentication function combined with the SDN mechanism can reduce the risk of malicious users from threatening the inside of the computer room from the external network, it is difficult to ensure that users mistakenly use devices infected by malicious programs to log in to the IPv6 server of the information center, causing the information center to second The risk of infection turns into a zombie computer. Using the weakness of IPv6 Neighbor Discovery, hackers use malicious programs to generate IPv6 messages, indirectly detect other IPv6 nodes in the center of the computer room, and try to attack IPv6 servers in other data centers. , Plagiarize important information.
為了降低該IPv6伺服器被當成跳板機的風險,本發明持續引用SDN技術,鞏固該伺服器彼此之間的IPv6通訊強度,當資料中心一旦加入一台實體或是虛擬的伺服器時,透過網路智能管理機,針對該伺服器客製化產生IPv6內部訊務交換規則,用於規範IPv6第一跳的交換規則,除了限制該伺服器僅能與預設閘道器進行通訊外,更限制其利用IPv6位址所產生的ICMPv6訊息,防止找尋其他IPv6節點,藉此保障機房內部IPv6通訊安全。In order to reduce the risk of the IPv6 server being used as a springboard, the present invention continues to use SDN technology to consolidate the strength of IPv6 communication between the servers. Once a physical or virtual server is added to the data center, the network Road intelligent management machine, customized for the server to generate IPv6 internal communication exchange rules, used to regulate the IPv6 first hop exchange rules, in addition to restricting the server to only communicate with the default gateway, it is more restrictive It uses the ICMPv6 message generated by the IPv6 address to prevent finding other IPv6 nodes, thereby ensuring the security of IPv6 communication in the computer room.
本發明的立基於軟體定義網路之IPv6存取管理系統,係包含網路智能管理機、軟體定義網路控制機及軟體定義網路交換機。網路智能管理機根據至少一驗證因子驗證IPv6設備以及IPv6設備使用者中的至少其中之一的合法性,藉此產生至少一IPv6訊務交換策略。軟體定義網路控制機與網路智能管理機連結,依據至少一IPv6訊務交換策略產生相對應的至少一IPv6訊務交換規則。軟體定義網路交換機與軟體定義網路控制機連結,接收至少一IPv6訊務交換規則,並將至少一IPv6訊務交換規則寫入儲存於軟體定義網路交換機的IPv6訊務交換表,其中IPv6訊務交換表用於識別IPv6訊務的特徵值以進行IPv6訊務的封包交換。The IPv6 access management system based on the software-defined network of the present invention includes a network intelligent management machine, a software-defined network controller and a software-defined network switch. The network intelligent management machine verifies the legitimacy of at least one of the IPv6 device and the user of the IPv6 device according to at least one verification factor, thereby generating at least one IPv6 traffic exchange strategy. The software-defined network control machine is connected with the network intelligent management machine, and generates at least one IPv6 traffic exchange rule corresponding to at least one IPv6 traffic exchange strategy. The software-defined network switch is connected to the software-defined network controller, receives at least one IPv6 traffic exchange rule, and writes at least one IPv6 traffic exchange rule into the IPv6 traffic exchange table stored in the software-defined network switch, where IPv6 The traffic exchange table is used to identify the characteristic values of IPv6 traffic to exchange packets of IPv6 traffic.
本發明的立基於軟體定義網路之IPv6存取管理方法,係包含下列步驟:利用一網路智能管理機判斷IPv6設備使用者以及IPv6設備中的至少其中之一之合法性,藉此透過軟體定義網路媒合程式產生至少一IPv6訊務交換策略;透過網路智能管理機,建立至少一通訊連線以連結一軟體定義網路控制機,其中軟體定義網路控制機將至少一IPv6訊務交換策略轉換成至少一IPv6訊務交換規則;以及透過軟體定義網路控制機,建立至少一通訊連線以連結一軟體定義網路交換機,其中軟體定義網路交換機接收至少一IPv6訊務交換規則,並將至少一IPv6訊務交換規則寫入儲存於軟體定義網路交換機的IPv6訊務交換表,其中IPv6訊務交換表用於識別IPv6訊務的特徵值以進行IPv6訊務的封包交換。The IPv6 access management method based on software-defined network of the present invention includes the following steps: using a network intelligent management machine to determine the legitimacy of at least one of the IPv6 device user and the IPv6 device, thereby using software Define the network matching program to generate at least one IPv6 traffic exchange strategy; establish at least one communication connection to connect to a software-defined network controller through the network intelligent management machine, where the software-defined network controller will at least one IPv6 communication The service switching strategy is converted into at least one IPv6 traffic switching rule; and at least one communication connection is established through the software-defined network controller to connect to a software-defined network switch, where the software-defined network switch receives at least one IPv6 traffic switching Rules, and write at least one IPv6 traffic switching rule into the IPv6 traffic switching table stored in the software-defined network switch, where the IPv6 traffic switching table is used to identify the characteristic values of IPv6 traffic for packet switching of IPv6 traffic .
為讓本發明的上述特徵和優點能更明顯易懂,下文特舉實施例,並配合所附圖式作詳細說明如下。In order to make the above-mentioned features and advantages of the present invention more comprehensible, the following specific embodiments are described in detail in conjunction with the accompanying drawings.
本發明如下所述僅為舉例,說明立基於軟體定義網路之IPv6存取管理系統1,可以其它的不同的實施例實現,本發明並不以此為限。The following description of the present invention is only an example to illustrate that the IPv6
以下將參照相關圖式,說明立基於軟體定義網路之IPv6存取管理系統及其方法之實施例,為便於了解,下述實施例中之相同元件係以相同之符號標示來說明。Hereinafter, embodiments of an IPv6 access management system and method based on a software-defined network will be described with reference to related drawings. For ease of understanding, the same components in the following embodiments are described with the same symbols.
本發明針對於中小型企業、校園網路或是家用網路環境中,內部的機房資料中心(Data Center),因應儲放機敏性高的資料,仍有高強度資訊防禦的需求,讓重要資訊可在安全環境下,提供權限給合法使用者,於網際網路上存取,然而礙於基礎網路建設成本的考量,無法引用高防禦力的資安設備,如防火牆、入侵防禦系統…等,造成基礎網路架構不夠堅固,讓駭客有可乘之機,肆意鑽縫入侵與竊取寶貴資訊,進而造成民生經濟與國家安全的損失。有鑑於此,本發明發明一套系統與方法,透過導入軟體定義網路(SDN)技術,利用低單價的SDN白牌交換機,透過軟體來定義交換機的交換規則,應用此特性打造客制化的IPv6訊務交換策略,識別網路訊務的IPv6特徵值,條件吻合的封包才能被交換機所處理。並將使用者的登入狀態,與機房交換的開關功能作緊密結合,達到機房資安防禦的效果。The present invention is aimed at small and medium-sized enterprises, campus networks or home network environments, the internal data center (Data Center) of the computer room, in response to the storage of highly sensitive data, there is still a need for high-strength information defense, allowing important information In a secure environment, it can provide permissions to legitimate users for access on the Internet. However, due to the cost of basic network construction, it is impossible to use high-defense information security equipment, such as firewalls, intrusion prevention systems, etc., As a result, the basic network structure is not strong enough, allowing hackers to take advantage of intrusions and stealing valuable information, which in turn causes the loss of people's livelihood, economy and national security. In view of this, the present invention has invented a system and method. By importing software-defined network (SDN) technology, using low-cost SDN white-brand switches, the switching rules of the switches are defined by software, and this feature is used to create customized The IPv6 traffic switching strategy identifies the IPv6 characteristic value of network traffic, and only packets with matching conditions can be processed by the switch. And the user's login status is closely combined with the switch function of the computer room exchange to achieve the effect of computer room information security defense.
圖1A根據本發明的實施例繪示一種立基於軟體定義網路之IPv6存取管理系統1的示意圖。存取管理系統1包含網路智能管理機10、軟體定義網路控制機11及軟體定義網路交換機12。網路智能管理機10、軟體定義網路控制機11及軟體定義網路交換機12分別具有處理單元(如:處理器但不限於此)、通訊單元(例如:各類通訊晶片、藍芽晶片、WiFi晶片等但不限於此)及儲存單元(例如:可移動隨機存取記憶體、快閃記憶體、硬碟等但不限於此)等必要構件。IPv6設備(或IPv6設備使用者)可透過外部網路或內部網路連接至軟體定義網路交換機12,如圖1B所示。圖1B根據本發明的實施例繪示立基於軟體定義網路之IPv6存取管理系統1與IPv6設備(或IPv6設備使用者)13、14的示意圖。IPv6設備13(或IPv6設備14)可經由外部網路EN連接至軟體定義網路交換機12,而使得IPv6存取管理系統1可透過外部網路EN管理IPv6設備13(或IPv6設備14)的IPv6訊務。另一方面,IPv6設備14(或IPv6設備13)可經由內部網路IN連接至軟體定義網路交換機12,而使得IPv6存取管理系統1可透過內部網路IN管理IPv6設備14(或IPv6設備13)的IPv6訊務。IPv6設備14可例如是作為資料中心的伺服器,本發明不限於此。FIG. 1A illustrates a schematic diagram of an IPv6
參照圖1A。網路智能管理機10包含身分認證模組101、設備認證模組102與軟體定義網路媒合模組103。Refer to Figure 1A. The network
軟體定義網路控制機11與網路智能管理機10連結,並且包含控制訊息策略模組111、控制訊息轉換模組112。The software-defined
軟體定義網路交換機12與軟體定義網路控制機11連結,並且包含IPv6外部訊務交換模組121與IPv6內部訊務交換模組122。The software-defined
本發明實施方式亦可套用在IPv4訊務交換機制上,但由於IPv6訊務的實施方式相較於IPv4更為複雜,因此以IPv6為主要的實施方式說明。The embodiment of the present invention can also be applied to the IPv4 traffic exchange mechanism, but since the implementation of the IPv6 traffic is more complicated than that of the IPv4, the IPv6 is the main implementation.
圖2根據本發明的實施例繪示管理IPv6內部網路訊務的流程圖,其中圖2所揭露的方法可由如圖1A所示的IPv6存取管理系統1實施。需注意的是,圖2所揭露之方法中,適用於IPv6設備13(或IPv6設備13的使用者)之步驟亦可適用於如圖1B所示的IPv6設備14或任何一種支援IPv6(或IPv4)的電子設備,本發明不限於此。FIG. 2 shows a flow chart of managing IPv6 internal network traffic according to an embodiment of the present invention. The method disclosed in FIG. 2 can be implemented by the IPv6
步驟S1-1 設備註冊:在一IPv6設備13欲連結軟體定義網路(例如:外部網路EN或內部網路IN)中的資訊中心之前,IPv6設備13須將該IPv6設備13之硬體參數註冊至網路智能管理機10,並由網路智能管理機10的設備認證模組102儲存IPv6設備13之硬體參數。設備認證模組102所儲存的IPv6設備13之硬體參數可作為日後用於驗證IPv6設備13之合法性的驗證因子。Step S1-1 Device registration: Before an IPv6 device 13 wants to connect to the information center in a software-defined network (for example: external network EN or internal network IN), the IPv6 device 13 must have the hardware parameters of the IPv6 device 13 Register to the network
步驟S1-2 內部訊務策略生成:當設備認證模組102有新增一筆資訊時,該網路智能管理機10啟動內部訊務策略生成程序,藉以產生IPv6訊務交換策略,其中IPv6訊務交換策略包含IPv6內部訊務交換策略。具體來說,當IPv6設備13登入至軟體定義網路時(例如:存取位於外部網路EN或內部網路IN的電子設備),設備認證模組102可將IPv6設備13提供的資訊與IPv6設備13所註冊的硬體參數(或驗證因子)進行比對以驗證IPv6設備13的合法性。若IPv6設備13合法,則軟體定義網路媒合模組103可自設備認證模組102接收IPv6設備13所提供的資訊並且根據該資訊執行軟體定義網路媒合程式以產生專屬IPv6設備13的IPv6內部訊務交換策略,並且配置對應的交換表識別碼,其中該交換表識別碼用於識別軟體定義網路交換機12存放IPv6訊務交換規則的所在處。Step S1-2 Internal traffic strategy generation: When the
步驟S1-3 IPv6軟體定義機制應用方法:一旦IPv6內部訊務交換策略產生後,該網路智能管理機10啟動IPv6軟體定義機制應用方法。首先,網路智能管理機10利用軟體定義網路媒合模組103與軟體定義網路控制機11進行連結,並且傳送IPv6內部訊務交換策略至軟體定義網路控制機11。軟體定義網路控制機11內的控制訊息轉換模組112會解析IPv6內部訊務交換策略的策略語法以將IPv6內部訊務交換策略轉換成IPv6內部訊務交換規則。接著,軟體定義網路控制機11的控制訊息策略模組111可依據軟體定義協定訊息格式攜帶IPv6內部訊務交換規則以及交換表識別碼於給軟體定義網路交換機12的網路訊息中。Step S1-3 IPv6 software-defined mechanism application method: Once the IPv6 internal communication exchange strategy is generated, the network
步驟S1-4 IPv6內部網路訊務交換方法:當軟體定義網路控制機11連結至軟體定義網路交換機12時,軟體定義網路交換機12會依據交換表識別碼,將攜帶IPv6內部訊務交換規則的軟體定義協定訊息,寫入指定的IPv6內部訊務交換模組122中的Ipv6訊務交換表,其中Ipv6訊務交換表係用於識別IPv6訊務的特徵值,並且IPv6內部訊務交換模組122係用於限制該IPv6設備僅能與對應該IPv6設備13的網路第一跳的網路設備(例如:路由器或閘道器)進行通訊。具體來說,IPv6內部訊務交換模組122可自IPv6設備13接收IPv6訊務,並且根據IPv6內部訊務交換規則比對IPv6訊務的特徵值。若IPv6訊務的特徵值與IPv6內部訊務交換規則吻合,則代表IPv6設備13與對應該IPv6設備13的網路第一跳的網路設備進行通訊的權限。如此,則IPv6內部訊務交換模組122進行IPv6設備13與對應於IPv6設備13的網路第一跳的網路設備之間的IPv6訊務的封包交換。反之,若IPv6訊務的特徵值與IPv6內部訊務交換規則不吻合,則IPv6內部訊務交換模組122丟棄IPv6設備13的IPv6訊務的封包。Step S1-4 IPv6 internal network traffic exchange method: When the software-defined
如此一來,透過軟體定義網路交換機11之IPv6內部訊務交換模組122,IPv6設備13被限縮為僅能與單一IPv6芳鄰節點,也就是第一跳(First Hop)路由器進行IPv6通訊,藉此實現IETF國際標準於RFC 7113所闡述的RA Guard與RFC 7610所闡述的DHCPv6 Shield,防止惡意使用者藉由機房內部網路(例如:內部網路IN),產生IPv6芳鄰阻斷式攻擊,癱瘓整個伺服器之IPv6運作。In this way, through the IPv6 internal
圖3根據本發明的實施例繪示管理IPv6外部網路訊務的流程圖,其中圖3所揭露的方法可由如圖1A所示的IPv6存取管理系統1實施。需注意的是,圖3所揭露之方法中,適用於IPv6設備13(或IPv6設備13的使用者)之步驟亦可適用於如圖1B所示的IPv6設備14或任何一種支援IPv6(或IPv4)的電子設備,本發明不限於此。FIG. 3 shows a flow chart of managing IPv6 external network traffic according to an embodiment of the present invention. The method disclosed in FIG. 3 can be implemented by the IPv6
步驟S2-1 使用者註冊:在管理員如欲開放軟體定義網路(例如:內部網路IN)中的資訊中心給外部的電子設備存取之前,驗證IPv6設備13之使用者先將使用者資訊註冊於身分認證模組101,並且設定可存取資訊中心的IPv6設備13與對應IPv6設備13的TCP/UDP Port。身分認證模組101所儲存的使用者資訊可作為日後用於驗證IPv6設備13之使用者之合法性的驗證因子。Step S2-1 User registration: Before the administrator wants to open the information center in the software-defined network (for example: internal network IN) to external electronic devices, verify that the user of IPv6 device 13 first The information is registered in the
步驟S2-2 使用者登入與認證:當有一使用者欲從外部網路(例如:外部網路EN)連結至資訊中心時,使用者操作的IPv6設備13可經由軟體定義網路交換機12連接至網路智能管理機10。網路智能管理機10可自該使用者的IPv6設備13取得相關於使用者的資訊。接著,網路智能管理機10的身分認證模組101可將使用者提供的資訊與儲存於身分認證模組101的使用者資訊(或驗證因子)進行比對以驗證該名IPv6設備13使用者的合法性。若該名IPv6設備13使用者合法,則身分認證模組101將儲存IPv6設備13的IP位址。Step S2-2 User login and authentication: When a user wants to connect to the information center from the external network (for example: external network EN), the IPv6 device 13 operated by the user can be connected to the information center via the software-defined
步驟S2-3 外部訊務策略生成:當網路智能管理機10判定該使用者具備合法身分後,則擷取連結與該使用者的IPv6設備13所使用的IPv6位址,並且從設備認證模組102確認該IPv6設備13的授權權限,藉以啟動外部訊務策略生成程序而產生IPv6訊務交換策略,其中IPv6訊務交換策略包含IPv6外部訊務交換策略。具體來說,在身分認證模組101確認IPv6設備13的使用者為合法的使用者後,軟體定義網路媒合模組103可自身分認證模組101或設備認證模組102接收由IPv6設備13或其使用者所提供的資訊(例如:IPv6設備13的IPv6位址)並且根據該資訊執行軟體定義網路媒合程式以產生專屬該名使用者的外部訊務交換策略,並且配置對應的交換表識別碼,其中該交換表識別碼用於識別軟體定義網路交換機12存放IPv6訊務交換規則的所在處。Step S2-3: Generation of external traffic strategy: When the network
步驟S2-4 IPv6軟體定義機制應用方法:一旦IPv6外部訊務交換策略產生後,該網路智能管理機10啟動IPv6軟體定義機制應用方法。首先,網路智能管理機10利用軟體定義網路媒合模組103與軟體定義網路控制機11進行連結,並且傳送IPv6外部訊務交換策略至軟體定義網路控制機11。軟體定義網路控制機11內的控制訊息轉換模組112,會解析IPv6外部訊務交換策略的策略語法以將IPv6外部訊務交換策略轉換成IPv6外部訊務交換規則。接著,軟體定義網路控制機11的控制訊息策略模組111可依據軟體定義協定訊息格式攜帶IPv6外部訊務交換規則以及交換表識別碼於給軟體定義網路交換機12的網路訊息中。Step S2-4 IPv6 software-defined mechanism application method: Once the IPv6 external traffic exchange strategy is generated, the network
S2-5 IPv6外部網路訊務交換方法:當軟體定義網路控制機11連結至軟體定義網路交換機12時,會依據交換表識別碼,將攜帶IPv6外部訊務交換規則的軟體定義協定訊息,寫入指定的IPv6外部訊務交換模組121中的Ipv6訊務交換表,其中Ipv6訊務交換表係用於識別IPv6訊務的特徵值,並且IPv6外部訊務交換模組121係用於管理位於外部網路EN的IPv6設備13(如圖1B所示)之使用者與位於內部網路IN的IPv6設備14(如圖1B所示)之間的端點對端點傳輸。具體來說,IPv6外部訊務交換模組121可自端點對端點傳輸接收IPv6設備13的IPv6訊務並且根據IPv6外部訊務交換規則比對IPv6訊務的特徵值。若IPv6訊務的特徵值與IPv6外部訊務交換規則吻合,則代表IPv6設備13具有與目標對象(例如:IPv6設備14)進行端點對端點傳輸的權限。如此,則IPv6外部訊務交換模組121進行IPv6訊務的封包交換。反之,若IPv6訊務的特徵值與IPv6外部訊務交換規則不吻合,則IPv6外部訊務交換模組121丟棄IPv6訊務的封包。S2-5 IPv6 external network traffic exchange method: When the software-defined
當軟體定義網路交換機12接收到來自合法使用者的封包,就可以依照交換表所填寫的交換規則,限制IPv6使用者的存取權限,藉此打造客制化的IPv6路由策略。When the software-defined
[特點及功效][Features and Effects]
本發明設計將使用者與設備認證授權機制,與軟體定義交換技術作緊密的結合,透過置放於機房資訊中心的閘道口的軟體定義網路交換機,其IPv6訊務交換啟動機制,可依據使用者的登出與登入,進行相對應的開啟與關閉,藉此保護機房資訊中心的安全。The present invention is designed to closely integrate the user and equipment authentication authorization mechanism with software-defined switching technology. Through the software-defined network switch placed at the gateway of the computer room information center, the IPv6 traffic switching activation mechanism can be used according to User’s logout and login, corresponding opening and closing, so as to protect the security of the computer room information center.
雖然本發明已以實施例揭露如上,然其並非用以限定本發明,任何所屬技術領域中具有通常知識者,在不脫離本發明的精神和範圍內,當可作些許的更動與潤飾,故本發明的保護範圍當視後附的申請專利範圍所界定者為準。Although the present invention has been disclosed in the above embodiments, it is not intended to limit the present invention. Anyone with ordinary knowledge in the technical field can make some changes and modifications without departing from the spirit and scope of the present invention. The scope of protection of the present invention shall be determined by the scope of the attached patent application.
1:立基於軟體定義網路之IPv6存取管理系統 10:網路智能管理機 11:軟體定義網路控制機 12:軟體定義網路交換機 13、14:IPv6設備 101:身分認證模組 102:設備認證模組 103:軟體定義網路媒合模組 111:控制訊息策略模組 112:控制訊息轉換模組 121:IPv6外部訊務交換模組 122:IPv6內部訊務交換模組 EN:外部網路 IN:內部網路 S1-1、S1-2、S1-3、S1-4、S2-1、S2-2、S2-3、S2-4、S2-5:步驟1: Establish an IPv6 access management system based on software-defined networks 10: Network intelligent management machine 11: Software-defined network controller 12: Software-defined network switch 13, 14: IPv6 equipment 101: Identity Authentication Module 102: Equipment Certification Module 103: Software-defined network matching module 111: Control Message Strategy Module 112: Control message conversion module 121: IPv6 external traffic switching module 122: IPv6 internal communication exchange module EN: external network IN: Intranet S1-1, S1-2, S1-3, S1-4, S2-1, S2-2, S2-3, S2-4, S2-5: steps
圖1A根據本發明的實施例繪示一種立基於軟體定義網路之IPv6存取管理系統的示意圖。 圖1B根據本發明的實施例繪示立基於軟體定義網路之IPv6存取管理系統與IPv6設備的示意圖。 圖2根據本發明的實施例繪示管理IPv6內部網路訊務的流程圖。 圖3根據本發明的實施例繪示管理IPv6外部網路訊務的流程圖。FIG. 1A illustrates a schematic diagram of an IPv6 access management system based on a software-defined network according to an embodiment of the present invention. FIG. 1B illustrates a schematic diagram of an IPv6 access management system and IPv6 equipment based on a software-defined network according to an embodiment of the present invention. FIG. 2 shows a flowchart of managing IPv6 internal network traffic according to an embodiment of the present invention. Fig. 3 shows a flow chart of managing IPv6 external network traffic according to an embodiment of the invention.
S1-1、S1-2、S1-3、S1-4:步驟 S1-1, S1-2, S1-3, S1-4: steps
Claims (13)
Priority Applications (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
TW108106999A TWI692956B (en) | 2019-03-04 | 2019-03-04 | Ipv6 accessing management system based on software defined network and method thereof |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
TW108106999A TWI692956B (en) | 2019-03-04 | 2019-03-04 | Ipv6 accessing management system based on software defined network and method thereof |
Publications (2)
Publication Number | Publication Date |
---|---|
TWI692956B TWI692956B (en) | 2020-05-01 |
TW202034658A true TW202034658A (en) | 2020-09-16 |
Family
ID=71896063
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
TW108106999A TWI692956B (en) | 2019-03-04 | 2019-03-04 | Ipv6 accessing management system based on software defined network and method thereof |
Country Status (1)
Country | Link |
---|---|
TW (1) | TWI692956B (en) |
Families Citing this family (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
TWI763449B (en) * | 2021-04-21 | 2022-05-01 | 中華電信股份有限公司 | Method for accessing private network service and service gateway equipment |
Family Cites Families (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN103561011B (en) * | 2013-10-28 | 2016-09-07 | 中国科学院信息工程研究所 | A kind of SDN controller method and system for preventing blind DDoS attacks on |
US9491190B2 (en) * | 2013-12-26 | 2016-11-08 | Guardicore Ltd. | Dynamic selection of network traffic for file extraction shellcode detection |
TWI625047B (en) * | 2015-11-26 | 2018-05-21 | 財團法人資訊工業策進會 | Network packet management server, network packet management method and computer program product thereof |
US10506083B2 (en) * | 2017-06-27 | 2019-12-10 | Cisco Technology, Inc. | Segment routing gateway storing segment routing encapsulating header used in encapsulating and forwarding of returned native packet |
TWI630488B (en) * | 2017-08-04 | 2018-07-21 | 中華電信股份有限公司 | Vpn service provision system with diversified end-to-end network isolation support |
CN107995121B (en) * | 2017-11-27 | 2021-09-24 | 中国科学技术大学苏州研究院 | Method for counting flow in software defined network based on wildcard |
-
2019
- 2019-03-04 TW TW108106999A patent/TWI692956B/en active
Also Published As
Publication number | Publication date |
---|---|
TWI692956B (en) | 2020-05-01 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10630725B2 (en) | Identity-based internet protocol networking | |
Karmakar et al. | SDN-enabled secure IoT architecture | |
US10581839B2 (en) | Secure communications with internet-enabled devices | |
Pradhan et al. | Solutions to vulnerabilities and threats in software defined networking (SDN) | |
US11190493B2 (en) | Concealing internal applications that are accessed over a network | |
US10135791B2 (en) | Secure communications with internet-enabled devices | |
US8707395B2 (en) | Technique for providing secure network access | |
US8683059B2 (en) | Method, apparatus, and computer program product for enhancing computer network security | |
Yackoski et al. | Applying self-shielding dynamics to the network architecture | |
Sebbar et al. | Detection MITM attack in multi-SDN controller | |
Pradana et al. | The dhcp snooping and dhcp alert method in securing dhcp server from dhcp rogue attack | |
Bouras et al. | Teaching network security in mobile 5G using ONOS SDN controller | |
TWI692956B (en) | Ipv6 accessing management system based on software defined network and method thereof | |
Heeb et al. | The impact of manufacturer usage description (mud) on iot security | |
Alabady | Design and implementation of a network security model using static VLAN and AAA server | |
van Oorschot et al. | Firewalls and tunnels | |
Fink et al. | DEMONS: Extended Manufacturer Usage Description to Restrain Malicious Smartphone Apps | |
TWI730925B (en) | Time management system based on software defined network and method thereof | |
Zúquete et al. | A security architecture for protecting LAN interactions | |
Ali et al. | Design and implementation of a secured remotely administrated network | |
Varadharajan et al. | Security Architecture for IoT | |
Zhou | Comparing Dedicated and Integrated Firewall Performance | |
Arkin | Bypassing network access control systems | |
Kule et al. | Design of effectively efficient techniques for circumvent wireless network security threats and attacks | |
Teku | A study on the nature of ipv6 intrusions and the road map towards their detection & prevention |