TW202220413A - Time management system based on software defined network and method thereof - Google Patents

Abstract

The present invention is a time management system based on a software-defined network and method thereof. A network controller predefines the time range of network access in a service and defines information of legal terminal equipment through a network controller, thereby the network controller controls the network access time of legal terminal equipment. The network controller also provides network access that can be combined with an external authentication mechanism outside of the control time, so as to meet the demand for network access in non-time control. In the present invention, the network controller is used to control the rules on the network switch to limit the network access time of legal terminal equipment, it can be effectively limit the network access time and management control mechanism of legal terminal equipment, and combine the authentication mechanism to increase network security in the control domain.

Description

Network time management system and method based on software-defined network

The present invention relates to the technology of network time management, in particular to a network time management system and method based on software defined network.

When it comes to network security management and control, in the current complex information security environment, it is often difficult to define the aspects of network security, but from a technical point of view, network time management is the most direct network One of the safety management methods. For enterprises, the common threat comes from Trojan horses or malicious programs that may be brought by the user's connection to the network, and the other is the device brought in by the user, causing the same virus threat. However, in either case, if Being able to control the import time of the network usage of the device will reduce the threat of the enterprise intranet.

In a prior art, Taiwan Patent No. I353137 "Network Connection Time Management Method and System" discloses that when a client requests to obtain a connection, it captures a preset restricted time period according to the client's identity data, And compare the connection time limit stored in the pre-stored time management with the current time required for connection, and confirm whether it is currently within the limit time period. If so, the client will be restricted from accessing the Internet. Periodically monitor whether the connection time of the connected client has reached or exceeded the limit period, and then automatically decides to limit or open the Internet. The time management mechanism of the case is divided into three Types: Immediate Restriction, Immediate Internet Access, and Time Setting. However, this mechanism is managed with an Internet Service Provider (ISP) account. Compared with an enterprise network, it is an Ethernet Plug-and-Play n-Play) feature, this time management mechanism cannot be applied to the corporate LAN; in addition, the network management method of this mechanism is to discard the "destination" IP address belonging to the user whose Internet access is to be banned, so as to achieve the purpose of not being able to use the network. However, this method cannot immediately discard the "source" IP address belonging to the user whose Internet access is to be prohibited, resulting in many invalid "source" IP address packets on the network, occupying network bandwidth resources.

For the time management and control of mobile terminals, another prior art proposes a patent (CN103825898A) for "Controlling and Controlling Internet Time of Mobile Terminals", in which the administrator opens a user account and password on the service platform, and sets the Internet time and password based on the user account. The management and control strategy includes the time period and the time information of the time allowed to surf the Internet. On the mobile terminal under control, it is necessary to install an application for Internet time control, and it is necessary to enter the user account and password for identity authentication with the service platform. If the identity is legal, then Start the application so that the mobile terminal can use the network. The application determines in real time that the Internet access time of the mobile terminal has expired. If so, it controls the Internet access function of the mobile terminal to be in a dormant state. However, in the above method, software must be installed on the terminal. With a large number of terminals or frequent changes, the installation of software becomes complicated and management is not easy, and it is easy to cause inconvenience to users.

In yet another prior art, Taiwan Patent No. I259371 "Time Management System and Method" uses a time method to control the use time of information equipment to improve the confidentiality of information equipment. The system includes a security verification module, a Setting the management module and a control execution module, the method is to establish a usage time setting program in the information equipment, so that the management personnel with the usage authority can set the usage time of the information equipment through the setting program, so that the information equipment can be based on the The set time determines the open authority, so that it will automatically shut down when the set use time range is exceeded, thereby achieving the effect of limiting the use time of the information equipment and preventing the data stored inside from being easily seen by others. However, the above-mentioned time management The method is still to install the software on the information device, and it is also necessary to change the user-end device before time management can be performed. In addition, if you want to change the time setting, there is no unified management mechanism, and you must log in to set the settings one by one. It will be very inconvenient.

In view of this, how to provide a network time management technology, if it can be controlled from the source device IP address, it can also avoid many invalid packets on the network and affect the network, especially, it does not need to be in the user equipment. The purpose of network management can be achieved by installing any software on the terminal, which will become the goal that those in the technical field are striving to pursue.

In order to solve the above-mentioned problems of the prior art, the present invention proposes a network time management method based on a software-defined network, which includes: creating a sub-network in a network controller, setting a network service gateway, and setting a connection time and time-out networking service information; when the terminal device is connected to the network controller, the network controller enables the terminal device according to the information of the sub-network, and sets the network transmission rules to in the network switch for the terminal device to use the networking function; and making the network controller perform detection according to the networking time, so that when the terminal device is within the networking time, the terminal device can normally use the Networking function, and when the terminal device is outside the networking time and is provided with the timeout networking service, the network access control system performs timeout processing.

In one embodiment, the steps of creating a sub-network in the network controller, setting a network service gateway, and setting a connection time and time-out network service information include the following sub-steps: setting the network service gateway; The scope of the terminal equipment under the jurisdiction of the network controller to become the subnet; according to the service gateway that the terminal equipment needs to connect to, set the subnet to connect to the service gateway in the network controller and parameters to connect to the service gateway; create a network time service cluster, a timeout network service cluster, the network An access control system and setting a permanent network service cluster, wherein the network access control system is used for authentication of the network connection function of the terminal device under control; and setting the time period of the connection time, the timeout connection service the time of use and the network and authentication systems accessed by the network access control system.

In one embodiment, the step of enabling the terminal device by the network controller according to the information of the sub-network includes the following sub-steps: importing the terminal device data or automatically detecting The terminal equipment joins the service cluster established when the sub-network is created; and based on the service clusters joined by the terminal equipment and the parameters and connection ports of the service gateway, the network controller is based on the service added by the terminal equipment. The cluster activates the network connection service of the terminal equipment, and generates the corresponding network transmission rule, so as to set the network transmission rule in the network switch.

In one embodiment, the step of the network controller detecting according to the connection time includes making the network controller periodically check whether the current time is within the set connection time, so that the current time is within the connection time. When the network time is within the network time, it is further judged whether the service has been activated, and if the current time is not within the network connection time, the timeout processing is executed.

In one embodiment, the step of judging whether the service has been activated comprises: making the network controller determine whether the terminal equipment in the network connection time service cluster has opened the service; And if it is not activated, the service activation of the terminal equipment is performed.

In one embodiment, the step of executing the timeout processing by the network access control system includes: under the network controller setting the network access control system and the timeout networking service, making the terminal device Connect to the network access control system for authentication by the network access control system; and after the terminal device is authenticated successfully, make the network controller enable the network connection function of the terminal device, and periodically detect Whether the timeout connection time has been reached.

In the above-mentioned embodiment, the step of making the terminal equipment connect to the network access control system for authentication by the network access control system includes the following sub-steps: making the network controller clear the terminal equipment the network routing rules at the network switch; and causing the network controller to set up a connection to the network access control in the network switch according to the additional services set when the subnet was created The network transmission rules of the system so that the terminal device can only connect to the network access control system for authentication.

In the above-mentioned embodiment, the step of enabling the network controller to enable the networking function of the terminal device includes the following sub-steps: enabling the network controller to add the terminal device that has passed the authentication to the timeout networking service cluster and enable it. service to generate a timeout network transmission rule for the terminal equipment that has passed the authentication to connect to the service gateway, and transmit the timeout network transmission rule to the network switch, so as to make the terminal equipment that has passed the authentication Use the networking function normally within the time-out networking service time; and make the network controller continue to detect the time-out time of the terminal equipment in the time-out networking service cluster, so as to enable the authentication within the usage time The passed terminal equipment continues to use the networking function, and after the time expires, the network controller removes the timeout network transmission rule of the authenticated terminal equipment.

In the above method, the method further includes detecting the connection port of the network switch by using a network traffic detection tool, so that when the terminal device still has more than a predetermined number of packets continuously sent outside the network connection time or the timeout connection service , judge that the terminal device is abnormal.

The present invention further proposes a network time management system based on a software-defined network, which includes: a server, which is used to store the information of the network connection time of the terminal equipment and the time-out network service; a network switch, which is used for a transmission packet; a physical controller for setting network transmission rules in the network switch, and a timer for periodically checking the time in the physical controller; and a network access control system for When the terminal device is outside the networking time and the timeout networking service is provided, execute the terminal The network connection authentication of the terminal equipment, wherein the timer is used to confirm whether the current time is at the connection time, so that when the current time is at the connection time, the packet sent by the terminal equipment is transmitted through the network switch to The service gateway receives the response packet returned by the service gateway through the network switch, and when the current time is outside the connection time and the timeout connection service is provided, the service gateway passes through the network The access control system performs authentication to record the new network routing rules on the server and update the original network routing rules in the network switch, so that the packets sent by the terminal equipment can be sent by the network switch. send.

To sum up, the present invention is a method for using a software-defined network architecture to control and manage network access time. If the network access time is exceeded, the network function will be stopped, and the external authentication mechanism will be used to meet the network connection requirements outside the network access time. Furthermore, as a software-defined network architecture, the network access time is controlled and managed. , you can define multiple groups of different network access time ranges or define services without time management, and add legitimate terminal devices with different network access time requirements to different services, effectively controlling the network The controller manages legal terminal devices with different access time requirements, which increases the convenience of network control and flexibility for network administrators to control the network access time of different terminal devices. In addition, the software-defined network-based network time management system and method disclosed in the present invention utilize the characteristics of software-defined networks to centrally manage the network opening time of devices without installing any software on the user equipment. , the purpose of network management can be achieved. Furthermore, the time management method of the present invention is controlled from the source device IP address, which will not cause many invalid packets on the network, which will affect the network.

11-15: Stages

111-114: Process

121-122: Process

131-132: Process

141-142: Process

151-153: Process

211-216: Process

311-319: Process

31: Network Manager

32, 42: Network Controller

33, 43: Terminal equipment

34, 44: Network switch

35, 45: Service Gateway

36, 46: Network access control system

321, 421: Timer

322, 422: Server

S11-S13: Steps

FIG. 1 is a step diagram of a network time management method based on a software-defined network of the present invention.

FIG. 2 is a sequence flow chart of the network time management method based on the software-defined network of the present invention.

FIG. 3 is a schematic diagram of a flow chart of setting network time management and activation of the software-defined network-based network time management system and method of the present invention.

FIG. 4 is a schematic diagram showing the flow of out-of-time management, control and activation of the software-defined network-based network time management system and method thereof according to the present invention.

FIG. 5 is a structural diagram of a network time management system based on a software-defined network of the present invention.

The following describes the technical content of the present invention through specific embodiments, and those skilled in the art can easily understand the advantages and effects of the present invention from the content disclosed in this specification. However, the present invention can also be implemented or applied by other different specific embodiments.

There is no concept of time management and control in traditional switch equipment, and it is more difficult to uniformly manage and control, and it lacks dynamic opening and blocking of terminal equipment. The present invention is based on the network controller to define various services with different access times to provide different needs. Users can dynamically give different users the network access time for operating legitimate terminal devices according to their self-defined services, and can additionally set and combine external authentication mechanisms to meet network access requirements during non-controlled time. .

FIG. 1 is a step diagram of a network time management method based on a software-defined network of the present invention. The present invention proposes a network time management method for centralized management and control of the network connection function of terminal equipment. According to the needs of the network administrator, sub-networks and network time management rules are set in the network controller to limit normal network connection. Function time, and network access control system authentication can be set as required, so that the authentication device can use the networking function outside the time.

In step S11 , create a sub-network in the network controller, set the network service gateway, and set the connection time and the information of the timeout connection service. In this step, which can be regarded as the stage of creating a sub-network, the network administrator creates a sub-network in the network controller, and configures the network service gateway and sets additional services and related time settings.

In one embodiment, step S11 further includes the following steps: setting the range of the terminal equipment under the jurisdiction of the network controller to become the sub-network; according to the service gateway that the terminal equipment needs to connect to, the network Setting the sub-network connection to the service gateway and parameters connected to the service gateway in the controller; creating a network time service cluster, a timeout network service cluster, the network access control system, and setting permanent Networking service cluster, wherein the network access control system is used for the authentication of the networking function of the terminal device under control; and setting the period of the networking time, the usage time of the overtime networking service, and the network Access control system access network and authentication system.

In step S12, when the terminal device is connected, the network controller is made to activate the terminal device according to the information of the sub-network, and the network transmission rule is set in the network switch for the terminal device to use Internet function. In this step, it can be regarded as the terminal device activation stage. When the terminal device is connected, the network controller will open the terminal device according to the applied subnet, and set the network transmission rules in the network switch for the terminal device. The device uses the networking function.

In one embodiment, step S12 further includes the following steps: importing the terminal equipment data or automatically detecting the terminal equipment to join the service cluster established when the sub-network is created; and based on each terminal equipment The service cluster that the device joins and the parameters and connection ports of the service gateway, so that the network controller activates the network service of the terminal device according to the service cluster that the terminal device joins, and generates the corresponding network transmission rules to Set the network transmission rule in the network switch.

In step S13, the network controller is made to perform detection according to the networking time, so that when the terminal device is within the networking time, the terminal device can normally use the networking function, and when the terminal device is in the networking When it is outside the network time and the timeout network service is provided, the network access control system executes the timeout processing. In this step, which can be regarded as a time detection stage, the network controller will perform detection according to the connection time.

In one embodiment, step S13 further includes the following steps: the network controller regularly checks whether the current time is within the set networking time, so as to further determine whether the network has been activated when the current time is within the networking time service, and if the current time is not within the networking time, execute the timeout process. In addition, the aforementioned method of judging whether the service has been activated, that is, the network controller determines whether the terminal equipment in the network time service cluster has been activated and passed the service. Then the service of the terminal equipment is activated.

The steps of executing the timeout processing by the aforementioned network access control system include: when the network controller is configured with the network access control system and the timeout networking service, making the terminal device connect to the The network access control system is used for authentication by the network access control system, and after the terminal device is authenticated successfully, the network controller enables the network connection function of the terminal device, and regularly detects whether the timeout is reached Internet connection time. In short, the above can be regarded as the timeout processing stage and the timeout activation stage. The network controller will use the terminal device to connect to the network according to whether the network access control system and the timeout networking service are set. The network transmission rules of the access control system, that is, the terminal device must be authenticated by the access control system before it can use the networking function. Regularly detect whether the timeout connection time has been reached.

The aforementioned step of making the terminal equipment connect to the network access control system for authentication by the network access control system includes: the network controller clearing the terminal equipment located in the network communication the network transmission rules of the switch; and the network controller configures the network transmission in the network switch to connect to the network access control system according to the additional services set when the sub-network was created rules so that the terminal device can only connect to the network access control system for authentication.

The aforementioned step of enabling the network controller to activate the networking function of the terminal device includes: the network controller adds the terminal device that has passed the authentication to the timeout networking service cluster and activates the service, so as to generate the terminal that has passed the authentication. The time-out network transmission rule that the device connects to the service gateway, and the time-out network transmission rule is transmitted to the network switch, so that the terminal device that has passed the authentication is connected to the network service time in the time-out period and the network controller continuously detects the timeout period of the terminal equipment in the overtime networking service cluster, so as to allow the terminal equipment that has passed the authentication to continue to use the networking function within the usage time , and after the time expires, the network controller removes the timeout network transmission rule of the authenticated terminal device.

In the present invention, the scope of jurisdiction and the required service functions and service time can be set through the stage of creating a sub-network, and in the stage of opening the terminal equipment, the use of the terminal equipment under the jurisdiction can be imported or automatically detected to the corresponding In the service cluster, the terminal device starts to detect whether the set time has passed during the opening phase. If it exceeds the timeout processing stage, the terminal device cannot use the networking function or can only connect to the network access control system for authentication, and the timeout is opened. In this stage, the authenticated terminal device networking function will be enabled, thereby helping network administrators to efficiently manage terminal devices and increase network security.

The present invention is described below through specific embodiments. The present invention is a network time management system and method for centrally managing and controlling the networking function of terminal equipment based on a software-defined network, which can set the subnet and network time in the network controller according to the network manager. Management system, the terminal equipment in this sub-network setting can use the networking function normally according to the time set by the network time management system, and will stop using the networking function outside the time set by the network time management system. this network time tube The management system and the method thereof can be integrated with the network access control system. If the user needs to use the networking function outside the time set by the network time management system, the network controller can be authenticated by the network access control system successfully. Then enable the terminal device networking function service and record the log.

Fig. 2 is the sequence flow chart of the network time management method based on the software-defined network of the present invention. As shown in the figure, the system flow of the present invention is mainly divided into five stages, namely the creation of the sub-network stage 11, the terminal equipment The activation stage 12 , the time detection stage 13 , the timeout processing stage 14 and the timeout activation stage 15 .

In the sub-network creation stage 11, the network manager sets up the sub-network and the network time management system for various services to the network controller according to the network segment and terminal equipment under its jurisdiction, which includes the steps of the process 111. Create a sub-network, set the external service gateway in the process 112, set the additional service in the process 113, and set the content of the additional service in the process 114.

First, in the process 111, the network administrator needs to create a sub-network in the network controller, and the network administrator needs to first set the scope of the terminal equipment under the jurisdiction, including but not limited to IPv4 network segment, IPv6 network segment, source network Switch ports and other ranges to set subnets, and when a terminal device within the set range joins the network, the subnets that match the settings will be added. Then, in the process 112, the network administrator sets the external service gateway connected to the sub-network in the network controller, and can set the parameters for connecting the service gateway, including but not limited to VLAN, network Switch ports and other information, and remember the port location of the service gateway. Afterwards, in the process 113, the network administrator creates a network connection time service cluster, and can also choose to create a timeout network connection service cluster and a network access control system, so that the terminal devices under management and control can use the network connection function through authentication , In addition, you can also set up a permanent network service cluster, add terminal devices that do not need to be controlled and can use the networking function permanently. Finally, in the process 114, the network administrator sets the network time management at this stage, and sets the time period of the connection time service. If there is a timeout connection in the process 113, The network service and network access control system must also set the usage time of the overtime network service together with the network and authentication system accessed by the network access control system.

After completing the creation of the sub-network stage 11, the terminal device opening stage 12 is entered. The network administrator starts to use the import or detection method to add the terminal devices under its jurisdiction to the sub-network, and select each terminal device to be added to the service. After clustering, the network controller downloads the network transmission rules to the network switch to achieve the terminal equipment networking function, including the terminal equipment embedded in the subnet in the process 121 and the service activation function in the process 122 . In short, in the process 121, the network administrator will import the terminal device data or the subnet set in the sub-network creation stage 11 by automatic detection, and join the service cluster created in the sub-network creation stage 11 , and then, in the process 122, the network controller joins the service cluster according to each terminal device, and the parameters and connection ports of the service gateway set in the sub-network stage 11, and the network controller joins according to the terminal device. The service cluster activates the networking service and generates the corresponding network transmission rules, and sets the network transmission rules in the network switch, so that the terminal devices applying the service cluster can use the network connection function normally. If there is a set connection time For service clusters, it is necessary to enter the time detection stage 13 to determine the time management. If only a permanent networked service cluster is set, it is not necessary to enter the time detection stage 13 to permanently enable the networking function.

In the time detection stage 13, the network controller will start to check the status of the network time service cluster according to the connection time set in the sub-network creation stage 11, which includes whether the detection in the process 131 times out and the judgment in the process 132 Whether the service has been activated. In short, in the process 131, the network controller will regularly check whether the current time is within the network time service set by the network administrator according to the normal network connection time set by the network connection time service in the sub-network creation stage 11. During the network connection time, if the current time is within the network connection time of the network connection time service, the process 132 is entered; otherwise, the timeout processing stage 14 is entered. In the process 132 of judging whether the service has been activated, the network controller will Determine the terminals in this networked time service cluster Whether the device has been opened and passed the service, if so, go back to the process 131 to continuously determine whether it is within the time, if not, go back to the process 122 of the terminal device opening stage 12 .

When the time exceeds the network connection time, it will enter the timeout processing stage 14. Because the time has exceeded the time set by the network connection time service, the network controller needs to process the network transmission rules of the terminal device, which includes the process of 141. Disconnect the networking functionality and additional service processing and authentication of process 142. In the process 141, because the network connection time set in the sub-network creation stage 11 has been set, the network controller clears the network of the terminal equipment located in the network switch according to the terminal equipment information in the service cluster at the network connection time. At this time, all terminal devices in the network service cluster will be disconnected from the network function. If the network administrator has set additional services (such as timeout connection) in the sub-network creation stage 11, then The process 142 will be entered, and the network controller will set the network transmission rules (ie timeout network transmission rules) connected to the network access control system according to the additional services in the stage 11 of creating a sub-network, and the terminal device will try to When using the network connection function, you can only connect to the network access control system for authentication. If the authentication is unsuccessful, go back to the time detection stage 13 to determine whether the time is within the network connection time and then open the network. If the authentication is successful, go to Timeout to open phase 15.

In the timeout activation stage 15, the network controller will set the network transmission rules according to the timeout network service set in the sub-network creation stage 11, and remove the corresponding network transmission after the time set by the timeout network service. The rules include the activation of the timeout networking service in the process 151 , the detection of whether the timeout is within the valid time limit in the process 152 , and the function of clearing the timeout networking in the process 153 . In the process 151, after the authentication is successful in the timeout processing stage 14, the network controller will add the authenticated terminal device to the timeout network service cluster according to the information from the network access control system, activate the service, and generate the authentication. The time-out network transmission rule of the successful terminal device connected to the service gateway is sent to the network switch, so that the terminal device can use the network connection function normally within the time set by the time-out network connection, and then in the process 152, the network The circuit controller continues to detect the timeout period of the terminal equipment in the timeout network service cluster. In addition, when the time is up, the process 153 is entered, and the network controller will remove the timeout network transmission rule of the terminal device. At this time, the terminal device will cut off the network connection function and return to the time detection stage 13 .

FIG. 3 is a schematic diagram of a network time management and activation process of the software-defined network-based network time management system and method of the present invention, which illustrates the sub-network configuration and activation process. As shown in the figure, first, in the process 211, the network manager 31 sets up the subnet, the service used, the network time management system and the network access control system, then, in the process 212, the network controller 32 sets the network transmission rules to the network switch according to the opening data of the terminal device 33 imported by the network administrator 31, and in the process 213, when When the terminal device 33 is connected to the network, it passes through the network switch 34. In the process 214, the network switch 34 sends the packet to the service gateway 35 according to the network transmission rules for the terminal device 33 that has passed through. Then, In the process 215 , the service gateway 35 sends back the response packet to the network switch 34 , and finally, in the process 216 , the response packet is sent back to the terminal device 33 according to the network transmission rules set by the activation, so that the terminal device 33 can be normal. Use the Internet connection function.

Since there is no concept of time management and control in the traditional switch equipment, the present invention can record the network access time information in the network controller 32 through the software-defined network architecture, and the network controller 32 classifies the different legal The terminal device 33 performs time management, and because of the software-defined network architecture, all network switches 34 can be controlled by a single network controller 32, so that the network administrator 31 can conveniently and flexibly control any legal terminal device 33 access capacity and time.

FIG. 4 is a schematic diagram of the out-of-time control and activation flow of the software-defined network-based network time management system and method of the present invention, which illustrates the timeout activation flow of the network access control system. As shown in the figure, in the process 311, the timer (Timer) 321 inside the network controller 32 will periodically detect the time. If the time has exceeded the network connection time, the process will enter the process 312, that is, the network controller 32 needs to be removed Networking time network transmission rules, then in the process 313, the network controller 32 will remove the network switch according to the setting 34 and setting the network transmission rule for connecting to the network access control system 36, and then, in the process 314, when the terminal device 33 uses the networking function at this time, the process 315 is entered, The network switch 34 will send the packet to the network access control system 36 , and if the authentication is successful, the process 316 is entered, and the network access control system 36 will send the information of the terminal device 33 to the internal network controller 32 . The physical server 322 stores, and the network controller 32 generates the network transmission rules for connecting the terminal device 33 to the service gateway 35 according to the terminal device 33 opened by the network access control system 36, and sets it in the network exchange In the device 34, later, when the terminal device 33 uses the networking function, that is, the process 318, the network switch 34 will send the packet to the service gateway 35, that is, the process 319, and the terminal device 33 can use the networking function normally. .

The purpose of the present invention is to make a user's legal terminal equipment a time decentralization management and control mechanism, according to the network administrator to define the network access time of different users, and according to the use requirements, the network access time can be required outside the network access time. When there are additional networking requirements, the authentication mechanism can be used for time management and access to facilitate the recording of the user's connection time. In addition, general passive network devices or Internet of Things (IoT) devices can be used with services without time management. , so that such devices are not limited by the time of network access.

The service content of the network access time is preset by the network controller 32, and the legal terminal device 33 is added to the service. After the addition, the network controller 32 will regularly check whether the current time is set by the network administrator 31. If it is within the time, it will not be processed. If it exceeds the time, the network disconnection function will be triggered through the network controller 32, and the blocking rules will be sent to the network switch 34 for connection. Network blocking, the terminal device 33 blocked by the network connection cannot access the network. If the service that the legitimate terminal device 33 joins provides an external authentication mechanism, the user can enter the authentication through the web page and then access the network. The network controller 32 transmits the rules for enabling the legal terminal device to the network switch 34, so the network administrator 31 only needs to operate the network controller 32 to control the legal terminal device 33 under the global network architecture. It provides network security and convenience through software-defined network architecture control and management of network access time.

FIG. 5 is a structural diagram of a network time management system based on a software-defined network of the present invention. As shown in the figure, the network time management system includes a server 422 and a network controller 42 with a timer 421, a network switch 44 connected to the server 422, terminal equipment 43, service gateway 45 and network access The control system 46, the server 422 is a schematic diagram of a software-defined network (SDN) controller, including both software and hardware, not limited to a hardware server, and the network switch 44 is a schematic diagram of an SDN switch, including software and hardware Any, not limited to hardware switches, the system can be generalized to the architecture of multiple SDN switches, and the terminal device 43 is not limited to hardware and software, and can be generalized to the architecture of multiple terminal devices.

The server 422 will periodically check the time with the timer 421 according to the network connection, timeout service and other information set by the network administrator, and set the corresponding network transmission rules in the network switch 44. The switch 44 is used as a function of transmitting packets. The terminal equipment 43 can send the packets to the service gateway 45 during the network connection time. If there is a set timeout service outside the network connection time, it can only be connected to the network access control. The system 46 performs authentication, and after the authentication is completed, it is recorded on the server 422 and the network transmission rules of the network switch 44 are updated, so that the terminal device 43 can send packets to the service gateway 45, and its detailed operation steps and processes as described in the previous method.

The design of the present invention focuses on the centralized management of terminal equipment and sets up a network time management system to control the networking function of terminal equipment, and can coordinate with a network controller supporting the same method to set up sub-networks to form multi-domain terminal equipment The network time management system, and according to the network time management system set by the network administrator, the terminal device normally uses the networking function within the network time management, while outside the network time management, it depends on whether there are additional timeouts and authentication. Service, implement the function set by the network administrator, this method can enable the network administrator to manage the terminal equipment more effectively and increase the network security.

The present invention can be applied to several different terminal devices for network administrators to set. The time setting requirements of the general worker terminal equipment need to meet the network time management function. The network administrator can create a network time service cluster in the subnet, and set the normal work connection time, and connect the general worker terminal equipment to the network time service cluster. Joining the network connection time service cluster is only allowed to use the network connection function during the network connection time at work, and passive terminal devices, including but not limited to IoT terminal devices such as access control card swiping machines, etc., need to be able to use the network connection function at any time. Network service cluster, terminal devices that join this service cluster can use the networking function at any time, and IoT terminal devices such as access control card swiping machines are added to the permanent network service cluster. If the general worker needs to work overtime, the terminal device needs to use the networking function outside the time set by the networking time service cluster. The network administrator can set the network access control system and the timeout networking service cluster in the subnet. function, and set the network usage time of the timeout network service cluster, and the network and authentication system that the network access control can access. If the general worker needs to use the networking function after the time set by the networking time service cluster, it is only allowed to connect to the internet access control system. The device joins the timeout network service cluster and can use the networking function normally within the usage time. After the set time is exceeded, the terminal device will be removed from the timeout network service cluster and the network connection function will be cut off. It needs to access the network again. After the control system is authenticated or waits for the time set by the network time service cluster, the network function can be used normally again. This function can be widely used in schools or corporate networks, so that ordinary users can only use the network connection function within the set time of the network time service cluster. The access control system can only be used after obtaining the authentication, and will record the log in the network controller for the network administrator to confirm the identity, effectively manage the terminal equipment and increase the network security. General passive terminal equipment including but not limited to access control systems, projectors, etc. are all added to the permanent network service cluster.

In addition to using the network time management system method to control the terminal equipment, the present invention can also be used to detect whether the control network terminal equipment has an abnormal state. Control the terminal equipment in the network time server Outside the time set by the service cluster, through the network traffic detection tool, through the port detection of the network switch, if the terminal equipment continues to send a large number of packets outside the management time, the network administrator can know this information after To confirm whether the terminal device is abnormal, or whether there are illegal users trying to use the networking function outside the time, or even intending to attack other terminal devices or network systems such as distributed denial of service, the network administrator can deal with it in time and solve the problem. Terminal equipment problems or the detection of illegally used terminal equipment.

The core of the method of the present invention lies in the management of the network connection function of the terminal equipment. By setting the normal network connection time service cluster, the terminal equipment that joins the service cluster can only use the network connection function normally within the time set by the network connection time service cluster. The network connection function must be approved by the network administrator. Otherwise, the network connection function cannot be used again until the next normal connection time. The network access control system and the timeout connection service can be set.

The implementation of the present invention is based on a software-defined network architecture, using the programmable characteristics of the software-defined network architecture and the characteristics of the network controller to centrally manage the network switch, and the network controller according to the network manager. The service and network time management system manages its terminal equipment and network controllers to effectively manage terminal equipment and increase network security to meet the needs of terminal equipment control.

In summary, the present invention is a network time management system and method for centrally managing and controlling the networking function of terminal equipment based on a software-defined network. Compared with the prior art, the present invention has the following advantages: (1) The present invention There is no need to bind the ISP system, and it can be applied to the enterprise local area network. (2) The present invention does not need to install software on the terminal, and only requires the network administrator to set relevant services on the network controller, and all terminal devices can be included in the management and control. (3) Compared with the prior art, software is still installed on the information equipment and there is no unified management mechanism. The present invention can modify the relevant functions of the time management system only by operating the network controller. (4) The present invention can give different users dynamic network access time for operating legal terminal devices according to user-defined services, and can additionally set and combine external authentication mechanisms to achieve network access within non-controlled time. need beg. (5) The present invention is based on the network time management system set by the network administrator. The terminal device normally uses the networking function within the network time management, and outside the network time management, it depends on whether there is an additional service of timeout and authentication, Implement the function set by the network administrator, this method can enable the network administrator to manage the terminal equipment more effectively and increase the network security.

The above-mentioned embodiments are only illustrative, and are not intended to limit the present invention. Any person skilled in the art can modify and change the above embodiments without departing from the spirit and scope of the present invention. Therefore, the scope of the right protection of the present invention is defined by the scope of the patent application attached to the present invention, as long as the effect and implementation purpose of the present invention are not affected, it shall be included in the technical content disclosed herein.

S11-S13: Steps

Claims (10)

A network time management method based on a software-defined network, comprising: Information on creating sub-networks in the network controller, setting up network service gateways, and setting connection times and timeouts for connection services; When the terminal device is connected to the network controller, the network controller is made to activate the terminal device according to the information of the sub-network, and the network transmission rule is set in the network switch for the terminal the device uses the Internet connection; and Make the network controller perform detection according to the networking time, so that when the terminal device is within the networking time, the terminal device can normally use the networking function, and when the terminal device is outside the networking time and When the timeout connection service is provided, the network access control system executes timeout processing. The software-defined network-based network time management method as claimed in claim 1, wherein the network controller is used to create a subnet, set a network service gateway, and set a connection time and a connection timeout. The information steps of the web service include the following sub-steps: set the range of terminal equipment under the jurisdiction of the network controller to become the sub-network; According to the service gateway to be connected to the terminal equipment, set the parameters of the sub-network to be connected to the service gateway and the parameters of the connection to the service gateway in the network controller; Create a network time service cluster, a timeout network service cluster, the network access control system, and set a permanent network service cluster, wherein the network access control system is used to manage the network connection function of the terminal device under control certification; and Set the period of the connection time, the usage time of the timeout connection service, and the network and authentication system accessed by the network access control system. The software-defined network-based network time management method according to claim 1, wherein the step of enabling the terminal device by the network controller according to the information of the sub-network includes the following sub-steps: By importing the terminal equipment data or by automatic detection, the terminal equipment joins the service cluster established when the sub-network was created; and Based on the service clusters joined by the terminal equipment and the parameters and connection ports of the service gateway, the network controller is made to activate the network connection service of the terminal equipment according to the service clusters joined by the terminal equipment, and generate the corresponding network delivery rule, to set the network delivery rule in the network switch. The software-defined network-based network time management method as claimed in claim 1, wherein the step of the network controller detecting according to the network connection time includes making the network controller periodically check whether the current time is set When the current time is within the network connection time, it is further judged whether the service has been activated, and if the current time is not within the network connection time, the timeout processing is executed. The software-defined network-based network time management method according to claim 4, wherein the step of judging whether the service has been activated comprises: making the network controller determine whether the terminal equipment in the network time service cluster has been activated Through the service, if it has passed, it will continue to periodically check whether it has timed out, and if it has not been activated, the service activation of the terminal device will be carried out. The software-defined network-based network time management method as claimed in claim 1, wherein the step of executing the timeout processing by the network access control system comprises: When the network controller is configured with the network access control system and the timeout networking service, the terminal device is connected to the network access control system for authentication by the network access control system ;as well as After the terminal device is successfully authenticated, make the network controller enable the network connection function of the terminal device, and Regularly detect whether the timeout connection time is reached. The software-defined network-based network time management method as described in claim 6, wherein the step of connecting the terminal device to the network access control system for authentication by the network access control system is: Includes the following sub-steps: cause the network controller to clear the network routing rule for the end device at the network switch; and Make the network controller set in the network switch a network transmission rule for connecting to the network access control system according to the additional service set when the sub-network is created, so that the terminal device can only Connect to the network access control system for authentication. The software-defined network-based network time management method as described in claim 6, wherein the step of enabling the network controller to activate the networking function of the terminal device includes the following sub-steps: Make the network controller add the authenticated terminal device to the timeout network service cluster and activate the service, so as to generate a timeout network transmission rule for connecting the authenticated terminal device to the service gateway, and then transmit the The timeout network transmission rule is sent to the network switch, so that the terminal equipment that has passed the authentication can normally use the network connection function within the time period of the timeout network connection service; and Make the network controller continue to detect the timeout period of the terminal equipment in the timeout networking service cluster, so that the terminal equipment that has passed the authentication continues to use the networking function within the use time, and after the time expires, the The network controller removes the timeout network delivery rule for the authenticated terminal device. The software-defined network-based network time management method as described in claim 1, further comprising using a network traffic detection tool to detect the connection port of the network switch, so that when the terminal device is connected to the network time or the timeout When more than a predetermined number of packets continue to be sent outside the networking service, it is determined that the terminal device is abnormal. A network time management system based on a software-defined network, comprising: The server is used to store the connection time of the terminal device and the information of the overtime connection service; a network switch, which is used to transmit packets; a physical controller for setting network transmission rules in the network switch, and having a timer for periodically checking the time in the physical controller; and A network access control system is used to execute the network authentication of the terminal device when the terminal device is outside the network connection time and the timeout network connection service is provided, Wherein, the timer is used to confirm whether the current time is at the connection time, so that when the current time is at the connection time, the network switch sends the packet sent by the terminal device to the service gateway and through the network switch The network switch receives the response packet returned by the service gateway, and performs authentication through the network access control system when the current time is outside the networking time and the timeout networking service is provided , so as to record the new network transmission rule in the server and update the original network transmission rule in the network switch, so that the packet sent by the terminal device is transmitted by the network switch.

Images