WO2017152754A1 - 软件定义网路sdn安全通信的方法及装置 - Google Patents

软件定义网路sdn安全通信的方法及装置 Download PDF

Info

Publication number
WO2017152754A1
WO2017152754A1 PCT/CN2017/074331 CN2017074331W WO2017152754A1 WO 2017152754 A1 WO2017152754 A1 WO 2017152754A1 CN 2017074331 W CN2017074331 W CN 2017074331W WO 2017152754 A1 WO2017152754 A1 WO 2017152754A1
Authority
WO
WIPO (PCT)
Prior art keywords
user
request
sdn controller
detection result
network
Prior art date
Application number
PCT/CN2017/074331
Other languages
English (en)
French (fr)
Inventor
柯志勇
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017152754A1 publication Critical patent/WO2017152754A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network

Definitions

  • the present disclosure relates to the field of information security technologies, for example, to a software defined network (SDN) secure communication method and apparatus.
  • SDN software defined network
  • SDN Software Defined Network
  • Managers can view all areas of the network and modify the network through the SDN network. By changing and modifying the network, the rules can be changed in time to bring better security to the system. Managers can centrally view the internal capabilities of the network and the ability to quickly limit and make changes. For example, when malware occurs in the network, malware-related traffic is blocked through the centralized control planes of the SDN and OpenFlow protocols, thereby limiting the outbreak of such traffic without requiring access to multiple routers or switches.
  • cloud security services have also become a service model of SDN.
  • Cloud security services have advantages in terms of performance, scalability, availability, and fault tolerance, but cloud access also has certain security risks. Therefore, the cloud security service provider controls the SDN computing and storage services, which has great security risks.
  • the present disclosure provides a method and an apparatus for software-defined network SDN secure communication, which can avoid the security risks existing when the cloud security service provider in the related art controls the SDN computing and storage services.
  • the embodiment of the present disclosure provides a method for software-defined network SDN secure communication, which is applied to a first SDN controller, including:
  • the user request of the user end includes at least one of: a user access request of the cloud user and at least one first network authorization request of the user terminal having the terminal application, where the at least one first network authorization request includes The user name of the user terminal, the password corresponding to the user name, and the domain name of the user terminal.
  • the sending the user request to the cloud server, and receiving a detection result returned by the cloud server for performing security detection on the user request include:
  • a detection result returned by the cloud server for performing security detection on the user access request where the detection result includes: detecting, by the cloud server, security of the user access request and generating a denial of access to the first The detection result of the SDN controller or accepts the detection result of accessing the first SDN controller.
  • processing the processing result, generating a processing result, and sending at least one of the detection result and the processing result to the user end including:
  • the flow entry record includes: a status field corresponding to the user access request.
  • the method further includes: when the user request of the user end is a user access request of the cloud user, after the obtaining the user request from the user end, the method further includes:
  • a processing result of the user access request for the cloud user where the processing result includes: recording, by using the flow entry entry, that the user access request of the cloud user has been
  • the cloud server detects security and generates a test result that accepts access to the first SDN controller.
  • the sending the user request to the cloud server, and receiving the security request by the cloud server for the user request Detecting the returned test results the method comprising:
  • the detection result includes: detecting whether a username of the first network authorization request exists in the first SDN controller Second network authorization request with the same password and domain name.
  • processing the processing result, generating a processing result, and sending at least one of the detection result and the processing result to the user end including:
  • the first SDN controller does not have a second network authorization request that is the same as the user name, the password, and the domain name in the first network authorization request, according to the first network authorization request, Generating a first token code uniquely corresponding to the first network authorization request;
  • processing the processing result, generating a processing result, and sending at least one of the detection result and the processing result to the user end including:
  • the sending the user request to the cloud server, and receiving, by the cloud server, the request for the user The test results returned by the safety test, including:
  • the method before processing the detection result, generating a processing result, and sending at least one of the detection result and the processing result to the user end, the method further includes:
  • the method before acquiring the user request from the user end, the method further includes:
  • the first SDN controller is connected to at least one second SDN controller, wherein the at least one second SDN controller is in a different domain than the first SDN controller;
  • the embodiment of the present disclosure further provides a method for software-defined network SDN secure communication, which is applied to a cloud server, and includes:
  • the receiving the user request forwarded by the first SDN controller includes:
  • the performing the security detection on the user request, and generating the detection result including:
  • the receiving the user request forwarded by the first SDN controller includes:
  • At least one first network authorization request sent by the user terminal having the terminal application where the at least one first network authorization request includes: a username of the user terminal, and the user name The corresponding password and the domain name of the user terminal.
  • the performing the security detection on the user request, and generating the detection result including:
  • the method further includes:
  • the authorization target object includes: the first network authorization request and a first token code generated by the first SDN controller Any of the two token codes.
  • the method further includes:
  • the embodiment of the present disclosure further provides a device for software-defined network SDN security communication, which is disposed in the first SDN controller, and includes:
  • a first obtaining module configured to obtain a user request from the user end
  • transceiver module configured to send the user request to the cloud server, and receive a detection result returned by the cloud server for performing security detection on the user request
  • the first processing module is configured to process the detection result, generate a processing result, and send at least one of the detection result and the processing result to the user end.
  • the embodiment of the present disclosure further provides a device for software-defined network SDN secure communication, which is disposed in a cloud server, and includes:
  • a receiving module configured to receive a user request forwarded by the first SDN controller, where the user request is sent by the user end to the first SDN controller;
  • a second processing module configured to send the detection result to the first SDN controller, process the detection result by the first SDN controller, generate a processing result, and send the detection result and the location At least one of the processing results is described to the client.
  • the present disclosure also provides a non-transitory computer readable storage medium storing computer executable instructions arranged to perform the above method.
  • the present disclosure also provides a first SDN controller, including:
  • At least one processor At least one processor
  • the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to execute a software defined network SDN applied to a first SDN controller The method of secure communication.
  • the present disclosure also provides a cloud server, including:
  • At least one processor At least one processor
  • the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to cause the at least one processor to perform software-defined network SDN secure communication applied to a cloud server method.
  • the first SDN controller is connected to the cloud server, and the cloud server is used to perform security detection on the user request, so that the cloud security of the first SDN controller can be improved; and the application service layer in the first SDN network And the data layer respectively performs data interaction with the first SDN controller, and the interaction data is detected by the cloud server for security detection, thereby avoiding the security risk existing between the first SDN controller and the storage service; and the cloud server may be used to assist the first SDN control.
  • the device handles user requests and relieves the burden of monitoring data by the SDN controller.
  • FIG. 1 is a schematic flowchart 1 of a method for software-defined network SDN secure communication applied to a first SDN controller according to an embodiment of the present disclosure
  • FIG. 2 is a second schematic flowchart of a method for software-defined network SDN secure communication applied to a first SDN controller according to an embodiment of the present disclosure
  • FIG. 3 is a schematic flowchart 3 of a method for software-defined network SDN secure communication applied to a first SDN controller according to an embodiment of the present disclosure
  • FIG. 4 is a schematic flowchart 1 of step 120 in a method for software-defined network SDN secure communication applied to a first SDN controller according to an embodiment of the present disclosure
  • FIG. 5 is a schematic flowchart of step 130 in a method for software-defined network SDN secure communication applied to a first SDN controller according to an embodiment of the present disclosure
  • FIG. 6 is a software-defined network SDN security applied to a first SDN controller according to an embodiment of the present disclosure Schematic diagram 2 of step 120 of the method of communication;
  • FIG. 7 is a schematic diagram of a token authorization process of a method for software-defined network SDN secure communication applied to a first SDN controller according to an embodiment of the present disclosure
  • FIG. 8 is a schematic flowchart diagram of a method for software-defined network SDN secure communication applied to a cloud server according to an embodiment of the present disclosure
  • FIG. 9 is a schematic structural diagram of an apparatus for software-defined network SDN secure communication set in a first SDN controller according to an embodiment of the present disclosure.
  • FIG. 10 is a schematic structural diagram of cross-domain token authorization of a device for software-defined network SDN secure communication according to an embodiment of the present disclosure
  • FIG. 11 is a schematic flowchart of a process of processing a data packet of a first SDN controller and a data forwarding layer according to an embodiment of the present disclosure
  • FIG. 12 is a schematic structural diagram of an apparatus for software-defined network SDN secure communication set in a cloud server according to an embodiment of the present disclosure
  • FIG. 13 is a schematic structural diagram of a cloud server according to an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram 1 of a first SDN controller and a cloud server according to an embodiment of the present disclosure
  • FIG. 15 is a schematic structural diagram 2 of a first SDN controller and a cloud server according to an embodiment of the present disclosure
  • FIG. 16 is a schematic structural diagram of hardware of a cloud server according to an embodiment of the present disclosure.
  • the software-defined network SDN secure communication method of the embodiment of the present disclosure is applied to a first SDN controller.
  • step 110 a user request from the client is obtained.
  • the user end may refer to a terminal of an application service layer in an SDN network, and the application service layer may include a command line application, a network management application, a security application, and other various applications.
  • the command line application can The application is accessed by the first SDN controller manager.
  • the command line reserved by the first SDN controller can perform operations such as configuration and query on the first SDN controller to implement some verification and debugging functions.
  • the network management application can implement network configuration of the first SDN controller and view network status, such as alarm and topology.
  • the security application can be used by third-party organizations of cloud servers accessed in the network to provide users with security services and guarantees.
  • the other plurality of applications may refer to reserved processing applications, such as first SDN controller software upgrade, open log, and memory leak detection.
  • step 120 the user request is sent to the cloud server, and a detection result returned by the cloud server for performing security detection on the user request is received.
  • step 130 the detection result is processed, a processing result is generated, and at least one of the detection result and the processing result is sent to the user end.
  • the first SDN controller is connected to the cloud server, and the user is requested to perform security detection through the cloud server, so that the cloud security of the first SDN controller can be improved; and the application service layer and data in the first SDN network are The layer performs data interaction with the first SDN controller, and the interaction data is secured by the cloud server, which avoids the security risks between the first SDN controller and the storage service; and the cloud server can also be used to assist the first SDN controller to process the user. Request to relieve the burden of monitoring data by the SDN controller.
  • the software of the embodiment of the present disclosure defines a method for network SDN secure communication, where the user request of the user terminal may include at least one of: a user access request of a cloud user and at least one user terminal having a terminal application.
  • a network authorization request where the first network authorization request includes: a username of the user terminal, a password corresponding to the username, and a domain name of the user terminal.
  • the cloud user may be a user accessing the cloud security service, including an individual user and an enterprise user.
  • the first SDN server can not only implement information interaction with the cloud server, but also interact with the application service layer, and use the cloud server to detect the interaction information of the first SDN controller, thereby improving the first SDN server and the application service.
  • Layers communicate interactively for security.
  • the method for software-defined network SDN security communication in the embodiment of the present disclosure may further include: step 1210 and step 1220, when the user of the user end requests the user access request of the cloud user.
  • step 1210 the user access request of the cloud user is detected as a user access request sent for the first time.
  • the user access request is sent to the cloud server.
  • the information of the cloud server may be provided by a third party other than the first party SDN controller manager and the APP application, and the second party SDN controller and the related database, thereby implementing outsourcing or separate setting of the access, which is convenient for the cloud.
  • Users provide access to secure services.
  • the cloud server provides security for users in the form of services. It can also cluster multiple cloud servers to form a system that specifically addresses cloud access security issues.
  • a detection result returned by the cloud server for performing security detection on the user access request is received, and the detection result includes: detecting, by the cloud server, security of the user access request and generating a denial of access to the first SDN The detection result of the controller or the detection result of accessing the first SDN controller.
  • the detection of the security of the user access request by the cloud server includes: data integrity detection, unified user management, and network attack detection.
  • the data integrity detection may include: a username in the user request and a password corresponding to the username.
  • the unified user management may include: storing a user name and a corresponding password in the user request.
  • the network attack detection may include: monitoring an illegally invaded Trojan or virus in the network.
  • the cloud server can be utilized to implement the detection of at least one of the above security.
  • the first SDN controller may use the cloud server to determine the security of the user access request for the first-time user access request, and ensure the security of the first SDN controller.
  • the software of the embodiment of the present disclosure defines a method for network SDN secure communication, and the foregoing step 130 may include: steps 1310 and 1320.
  • step 1310 the detection result is processed to generate a first-class entry record.
  • the flow entry record may be added by adding at least one state attribute (such as a State state) and at least a next state (such as Next_State) to a basic structure of the flow table defined by the OpenFlow protocol.
  • the present disclosure redefines the process of matching a data packet with a flow entry record, so that the matching process depends not only on the information of the data frame header but also on the state of the data frame itself. If the data packet and the flow entry record match are unsuccessful, the data forwarding layer sends a PacketIn request message to the first SDN controller, where the PacketIn request message includes information of the data frame header and the data frame. Its own status information.
  • the first SDN controller sends a FlowMod message to the data forwarding layer and adds a corresponding record to the data forwarding layer in response.
  • the state in the connection state table is assigned to the next state of the corresponding record in the transformation flow table.
  • step 1320 the detection result and the flow entry record are sent to the cloud user, where the flow entry record includes: a status field corresponding to the user access request.
  • the status field may synchronize the terminal in the data forwarding layer with the update of the connection status table of the SDN controller.
  • the cloud server may be used to assist the first SDN controller to process the user request, thereby reducing the monitoring data of the SDN controller.
  • the burden also improves the efficiency of cloud security detection.
  • the method for software-defined network SDN secure communication may further include, after the step 110, when the user of the user requests the user access request of the cloud user, the method for defining the network SDN secure communication may also be Step 140 and step 150 are included.
  • step 140 it is detected that there is a flow entry record corresponding to the user access request of the cloud user, and it is determined that the user access request is not a first-time user access request.
  • step 150 the processing result of the user access request for the cloud user is returned to the cloud user, where the processing result includes: recording, by the flow entry, that the user access request of the cloud user has been recorded by the cloud
  • the server detects security and generates a test result that accepts access to the first SDN controller.
  • the first SDN controller that performs the access is recorded through the pre-established flow entry, the verification process is reduced, the access efficiency is improved, and the The cloud server detects and improves the security of user access requests.
  • the foregoing step 120 may include: Step 1230 And step 1240.
  • step 1230 the first network authorization request is sent to the cloud server.
  • step 1240 the detection result returned by the cloud server for performing security detection on the first network authorization request is received, where the detection result includes: detecting whether the first SDN controller has the first network authorization request A second network authorization request with the same username, password, and domain name.
  • the first network authorization request is sent to the first SDN controller
  • the cloud server may be used to assist the first SDN controller to detect the security of the first network authorization request, because the cloud server stores the authorization with the first network. Requesting relevant data, so it is possible to determine whether there is a first network authorization request in the stored data, reduce the burden on the first SDN controller, and improve the first SDN control. The security of the data interaction of the controller.
  • step 130 includes: step 1330 and step 1340.
  • step 1330 when the detection result is that the second network authorization request that is the same as the user name, password, and domain name of the first network authorization request does not exist in the first SDN controller, according to the first network authorization.
  • the request generates a first token code uniquely corresponding to the first network authorization request.
  • step 1340 the user name, the password, and the domain name in the first network authorization request are verified, and when the verification is passed, an authorization target object carrying the first network authorization request and the first token code is generated. And sending the authorized target object to the user terminal.
  • the verifying the username, the password, and the domain name in the first network authorization request may include: verifying the username, the password, and the domain name in the first network authorization request; When the username, the password, and the domain name are all complete, it is determined whether the password in the first network authorization request is correct; when the password in the first network authorization request is correct, the first network authorization request is verified. This can enhance the accuracy of the application of the first network authorization request.
  • step 1340 when the authorized target object is sent to the user terminal, the authorized target object is sent to the cloud server for storage, which is beneficial for the later cloud server to determine whether the first network authorization request is the first user request, and reduce the pair. Duplicate authorization for the same network authorization request.
  • the first corresponding token code is generated and fed back to the authorized target object of the user terminal, so that the token authorization can be implemented, and only the token authorization is guaranteed.
  • the new network authorization request issues a new access token code to avoid repeated issuance of the access token code.
  • step 130 may include: step 1350.
  • step 1350 when the detection result is that the first network controller has the same user name, password, and domain name as the first network authorization request, the second network authorization request is unique.
  • Corresponding second token code generating an authorization target object carrying the first network authorization request and the second token code, and transmitting the authorization target object to the user terminal.
  • the “first” and “second” in the first network authorization request and the second network authorization request in the present disclosure do not limit the order of the network authorization request, but are convenient to distinguish the currently transmitted “first”.
  • the relationship between the "first network authorization request” and the previously stored “second network authorization request” may include: the content of the "first network authorization request”
  • the content of the "Second Network Authorization Request” that has been previously stored is different, and the content of the "First Network Authorization Request” is the same as the content of the "Second Network Authorization Request” that has been previously stored.
  • the authorized target object When the authorized target object is sent to the user terminal in step 1350, the authorized target object is sent to the cloud server for storage, which is beneficial for the later cloud server to determine whether the first network authorization request is the first time sent user access request. Reduce the number of duplicate authorizations for the same user.
  • the cloud server By storing the authorization target object in the cloud server, it is convenient for the late SDN controller to receive a new network authorization request, and the cloud server is used to detect whether there is a network authorization request.
  • the first SDN controller may not regenerate the new token code, and may use The token code of the same second network authorization request has been stored, and the current first network authorization request generates an authorization target object, and multiple refreshes of the same first network authorization request generate only one authorized target object, thereby avoiding more When a plurality of authorized target objects are generated when the same first network authorization request is refreshed, the efficiency of generating the authorization target object is improved, and the accuracy of generating the authorization target object is improved.
  • the step 120 may include Step 1250, step 1260, and step 1270.
  • the plurality of first network authorization requests are more than one first network authorization request.
  • step 1250 a priority is assigned to each of the first network authorization requests.
  • Each of the first network authorization requests refers to different requests of the same user.
  • Each first network authorization request may be assigned a priority according to the type of request requested by the application in each of the first network authorization requests.
  • step 1260 the plurality of first network authorization requests are sent to the cloud server according to the priority.
  • step 1270 the detection result returned by the cloud server for the security detection return for the plurality of first network authorization requests is received according to the priority.
  • the processing of the plurality of first network authorization requests can be completed according to the priority order, thereby avoiding conflicts. According to priority Each first network authorization request can be treated differently, which improves the efficiency of processing.
  • the software-defined network SDN secure communication method may further include: converting, by using a predetermined interface, a data format of the detection result and the first The data format of the SDN controller matches.
  • the first SDN controller can use the predetermined interface to accurately interpret the data of the cloud server and perform corresponding processing.
  • the predetermined interface may be an application programming interface (API), and the predetermined interface may include a three-part function to convert the data format sent by the cloud service layer into the same format as the control layer, wherein the three functions may be Including: management of network behavior, routing selection, and delivery of flow tables.
  • the management function of the network behavior is responsible for the network behavior generated by the cloud server on the first SDN controller, and converts the generated network behavior into a form of a flow entry.
  • an instruction is issued whether to forward the data, thereby ensuring the access security of the cloud user, and also counting the physical address related information of the cloud server, and translating the service name requested by the user into a corresponding The physical related address completes the resource discovery in the network with the service name as the dependency.
  • the routing function ensures that user access requests pass through the cloud server, and the optimal path is selected for the user according to the topology information and link loss of the entire network.
  • the function of sending the flow table ensures that the flow table generated by the first SDN controller is sent to the OpenFlow switch to implement data flow deployment.
  • the API interface is a data conversion interface between the cloud service layer and the controller, and can be responsible for the interaction between the cloud service layer and the controller.
  • the API interface can be an interface of the cloud server to the controller.
  • the API interface part of the function policy can be pre-stored in the first SDN controller. When the API interface part function policy is required, the first SDN controller issues the API interface part function policy. Go to the OpenFlow switch.
  • the data format of the API interface can implement data interaction between the cloud server and the first SDN controller, and the API interface can control access routes of the cloud user, and can provide services for accessing the cloud server.
  • the software-defined network SDN security communication may further include: step 160 and step 170.
  • step 160 the first SDN controller is established to be connected to at least one second SDN controller, wherein the at least one second SDN controller is in a different domain than the first SDN controller.
  • the handover machine managed by the SDN controller may be a domain, and different SDN controllers may manage different domains. There may also be backup SDN controllers in the same domain.
  • step 170 a user request from a client of the domain in which the at least one second SDN controller is located is obtained.
  • the user request of the user end of the domain where the at least one second SDN controller is located is obtained, and the multi-domain or cross-domain user end is implemented. Token authorization, token authorization and security detection for users in different domains.
  • step 710 the user terminal sends a first user authorization request, and the first SDN controller receives the first user authorization request and joins the prioritized application application queue.
  • step 720 the first SDN controller verifies the first user authorization request of the received user terminal.
  • step 730 it is determined whether the path of the first network authorization request is a termination address, and the address that the first network authorization request path allows access to (the address may include an IP address) is returned. If the IP address is not the address of the first network authorization request, if the IP address is not the address of the first network authorization request, the process proceeds to step 740; if the IP address is not empty, the judgment is performed. If the path of the first network authorization request is not an IP address that is allowed to be accessed, step 750 is performed.
  • the method for determining whether the path of the first network authorization request is terminated is, for example, a Uniform Resoure Locator (URL) and a Remote Procedure Call Protocol (RPC) address in the first network authorization request sent. The access method is judged and carried in the message of the returned authorized target object.
  • URL Uniform Resoure Locator
  • RPC Remote Procedure Call Protocol
  • step 740 the first SDN controller releases the token authorization concurrent message to the end user, and the token authorization fails.
  • the first SDN controller creates a token authorization, creates and assigns a token code uniquely associated with the end user of the first network authorization request.
  • step 760 the first SDN controller applies for registration of the first network authorization request.
  • step 770 the first SDN controller verifies the user name and the password and the domain name corresponding to the username in the first network authorization request. If the username, password, and domain name in the first network authorization request are incomplete or incorrect, Then, in step 740, if the username, password, and domain name in the first network authorization request are complete, step 780 is performed.
  • step 780 it is determined whether the password is correct. If the password is correct, step 790 is performed.
  • step 790 it is determined whether the token authorization type is a password authorization mode. If it is not the password authorization mode, step 7130 is performed.
  • step 7100 if it is a password authorization mode, the user name and password in the first network authorization request are retrieved, and the user name, password, and token code are used to generate a password authorization object.
  • step 7110 the domain name is retrieved in the first network authorization request.
  • an authorization target object is generated using the password authorization object and the domain name, the authorization target object being provided by the licensor after verifying the required user name, password, and domain name.
  • step 7130 it is determined whether the token authorization type is a refresh token authorization mode, and if yes, step 7140 is performed.
  • the refresh token is to prevent the requester from sending the same request twice or more within a preset time period (the time difference between the client and the server allowed by the server).
  • step 7140 a second network authorization request of the same refresh token authorization mode as the first network authorization request is obtained.
  • the authorization target object is generated using the username, password, and domain name of the second network authorization request.
  • step 7160 the first SDN controller returns a response carrying the authorized target object.
  • the first network authorization request of the accessed terminal user is authenticated and token authorized by using the token authorization manner, and the identity of the first network authorization request is verified by the first SDN controller, and subsequently
  • the authorization target object can be used to request an access token from the first SDN controller.
  • the software-defined network SDN secure communication method of the embodiment of the present disclosure is applied to a cloud server.
  • step 810 a user request forwarded from a first SDN controller is received, wherein the user request is sent by the user to the first SDN controller.
  • the user end includes a cloud user and an end user, and can implement data security detection of multiple terminals.
  • step 820 security detection is performed for the user request and a detection result is generated.
  • step 830 the detection result is sent to the first SDN controller, by the first The SDN controller processes the detection result, generates a processing result, and sends at least one of the detection result and the processing result to the user end.
  • the first SDN controller is provided with an access security function by using the cloud server, and the user terminal is provided with security protection in the form of a service, and the access security problem can be serviced, and the first SDN controller cloud service is improved. Security.
  • the step 810 may include: receiving a user access request sent by the cloud user forwarded by the first SDN controller.
  • the cloud server receives the user access request forwarded by the first SDN controller, and performs security detection on the user access request, thereby improving the security of the user access request to access the first SDN controller.
  • the step 820 may include: detecting, for the user access request, security of the user access request and generating a denial of access to the first SDN control The detection result of the device or the detection result of accessing the first SDN controller.
  • the cloud user is fed back to the first SDN controller to complete the feedback of the security detection process of the user access request.
  • the step 810 may include: receiving, by the first SDN controller, at least one first network authorization request sent by the user terminal that has the terminal application, where The first network authorization request includes: a username of the user terminal, a password corresponding to the username, and a domain name of the user terminal.
  • the load of the first SDN controller may be alleviated.
  • the step 820 may include: detecting whether the first SDN controller has the same username, password, and domain name as the first network authorization request.
  • the second network authorization request generates a detection result that detects that the first SDN controller has the second network authorization request or the first SDN controller does not have the second network authorization request.
  • the cloud server may store the second network authorization request that is the same as the first network authorization request, and the first SDN controller may use the stored token code of the second network authorization request to perform a token on the first network authorization request.
  • the new token code may not be regenerated, the process of token authorization of the first SDN controller is reduced, and the load of the first SDN controller is reduced.
  • the method of software-defined network SDN secure communication of an embodiment of the present disclosure may further include step 840.
  • step 840 the authorization target object sent by the first SDN controller is received and stored, where the authorization target object includes: the first network authorization request and the first generated by the first SDN controller Any of the token code and the second token code.
  • the cloud server stores an authorization target object related to the first network authorization request, which facilitates subsequent authentication and determination of the first network authorization request that is refreshed or resent, and reduces the load of the first SDN controller. It also improves the security of data interaction.
  • the method for software-defined network SDN secure communication of an embodiment of the present disclosure may further include: step 850.
  • step 850 the network attack information of the first SDN controller is detected, the network attack information is prohibited from being opened, and the network attack information is deleted, wherein the network attack information carries the information of stealing information and forwarding the network. information.
  • the above behavior information is information that forwards information multiple times or requires copying of network content.
  • the method of the embodiment of the present disclosure may shield the network attack information of the first SDN controller.
  • the first SDN controller is provided with security in the form of a service of the network attack information by the cloud server, and the plurality of cloud servers may be clustered together to form a system for responding to the access security problem; the cloud server further has Very good scalability can also make up for the shortcomings of traditional networks in terms of poor defense ability, slow response speed and small system size, etc., to meet a variety of security needs.
  • the software-defined network SDN secure communication device of the embodiment of the present disclosure is disposed on the first SDN controller.
  • the device for defining the network SDN secure communication includes: a first obtaining module 91, a transceiver module 92, and a first processing module 93.
  • the first obtaining module 91 is arranged to acquire a user request from the client.
  • the transceiver module 92 is configured to send the user request to the cloud server, and receive a detection result returned by the cloud server for performing security detection on the user request.
  • the first processing module 93 is configured to process the detection result, generate a processing result, and send at least one of the detection result and the processing result to the client.
  • the first SDN controller is connected to the cloud server, and the user is requested to perform security detection through the cloud server, so that the cloud security of the first SDN controller can be improved; and the application service layer and data in the first SDN network are Layers respectively perform data interaction with the first SDN controller, and the interaction data is safely detected by the cloud server to avoid security risks between the first SDN controller and the storage service; and the cloud server can be used to assist the first SDN controller to process the user. Request to reduce the burden of monitoring data by the first SDN controller.
  • the apparatus provided by the present disclosure is an apparatus applying the above-described software-defined network SDN secure communication method, and all of the above embodiments applied to the first SDN controller software-defined network SDN secure communication method are applicable to the apparatus.
  • the user request of the user terminal may include at least one of the following: a user access request of the cloud user and at least one first network authorization of the user terminal having the terminal application.
  • the request, wherein the at least one first network authorization request comprises: a username of the user terminal, a password corresponding to the username, and a domain name of the user terminal.
  • the transceiver module 92 may include: a detecting unit and a receiving unit, when the user of the user requests the user access request of the cloud user.
  • the detecting unit is configured to forward the user access request to the cloud server when detecting that the user access request of the cloud user is a first-time user access request.
  • the receiving unit is configured to receive a detection result returned by the cloud server for performing security detection on the user access request, where the detection result includes: detecting, by the cloud server, the security of the user access request and generating a Refusing to access the detection result of the first SDN controller or accepting the detection result of accessing the first SDN controller.
  • the first processing module 93 may include: a generating unit and a first sending unit.
  • the generating unit is configured to process the detection result to generate a first-class entry record.
  • the first sending unit is configured to send the detection result and the flow entry record to the cloud user,
  • the flow entry record includes: a status field corresponding to the user access request.
  • the apparatus for software-defined network SDN secure communication may further include: a detecting module and a feedback module.
  • the detecting module is configured to detect that there is a flow entry record corresponding to the user access request of the cloud user, and determine that the user access request is not a first-time user access request.
  • the feedback module is configured to return a processing result of the user access request for the cloud user to the cloud user, where the processing result includes: recording, by the flow entry entry, a user access request of the cloud user The security has been detected by the cloud server and a test result that accepts access to the first SDN controller is generated.
  • the transceiver module 92 may include: a sending submodule and receiving Submodule.
  • the sending submodule is configured to send the first network authorization request to the cloud server.
  • the receiving submodule is configured to receive a detection result returned by the cloud server for performing security detection on the first network authorization request, where the detection result includes: detecting whether the first SDN controller exists and the first A second network authorization request with the same username, password, and domain name of the network authorization request.
  • the first processing module 93 may include: a generating unit and a first processing unit.
  • the generating unit is configured to: according to the first network authorization request that is not the same as the user name, password, and domain name of the first network authorization request, in the first SDN controller, according to the first The network authorization request generates a first token code uniquely corresponding to the first network authorization request.
  • the first processing unit is configured to verify the user name, the password, and the domain name in the first network authorization request, and when the verification is passed, generate the first network authorization request and the first The authorization target object of the token code and the authorization target object is sent to the user terminal.
  • the first processing module 93 may include a second processing unit.
  • the second processing unit is configured to acquire the second when the detection result is that the first SDN controller has a second network authorization request that is the same as the user name, the password, and the domain name of the first network authorization request.
  • the network authorization request uniquely corresponding second token code, generating and carrying And an authorization target object with the first network authorization request and the second token code and sending the authorization target object to the user terminal.
  • the transceiver module 92 may include: an allocating unit, Two transmitting units and transceiver units.
  • the allocation unit is arranged to assign a priority to each of the first network authorization requests.
  • the second sending unit is configured to send the plurality of first network authorization requests to the cloud server according to the priority.
  • the transceiver unit is configured to receive, according to the priority, a detection result returned by the cloud server for performing security detection on the plurality of first network authorization requests.
  • the device for software-defined network SDN secure communication may further include: a conversion module.
  • the conversion module is configured to convert the data format of the detection result through the predetermined interface to match the data format of the first SDN controller.
  • the apparatus for software-defined network SDN secure communication may further include: an establishing module and an obtaining module.
  • the establishing module is configured to establish that the first SDN controller is connected to the at least one second SDN controller, wherein the at least one second SDN controller is in a different domain from the first SDN controller.
  • the obtaining module is configured to obtain a user request from a client of the domain in which the at least one second SDN controller is located.
  • establishing a connection of an end user in different domains may implement token authorization in a cross-domain situation.
  • the cross-domain structure for example, the application App2 of the end user is the authorized party, and the application App3 of the end user is the resource side. If the application App2 of the end user wants to access the resources of the application App3 of the end user, the access token can be obtained from the token of the first SDN controller 1001. The first way is that the end user's application App2 obtains the end user's application App3 to obtain the authorized target object, and uses the authorized target object to obtain the access token from the token.
  • the second method is that the application App3 of the end user turns the network authorization request of the application App2 of the terminal user to the token, and after the token of the second SDN controller 1002 is used to authenticate the application App3 of the terminal user, The application App3 of the end user issues an authorization target object to the application App2 of the end user, and the end user's The application App2 obtains the access token code from the token using the authorization target object.
  • the processing procedure of the data packet of the first SDN controller and the data forwarding layer in the embodiment of the present disclosure includes:
  • the packet header information extraction module of the data forwarding layer extracts the key information of the packet header in the data frame header information data packet, and processes and stores the key information of the packet header;
  • the data forwarding layer compares and matches the key information of the header with the status table 21. If there is no record about the key information of the header in the status table 21, the related record is added, and the state of the key information of the header is set to the default DEFAULT;
  • the matching result information is transmitted together with the status information, and compared and matched with the converted stream table 22. If there is no corresponding record in the converted stream table 22, the data forwarding layer sends a PacketIn message to the first SDN controller 23, and the connection state table 21 matched by the first SDN controller 23 sends a flow group (FlowMod) to the data.
  • FlowMod flow group
  • the data forwarding layer sends a data status (DATA_STATE_IN) message to the first SDN controller 23 to update the status table 21 in the first SDN controller 23.
  • DATA_STATE_IN data status
  • the software-defined network SDN secure communication device of the embodiment of the present disclosure is disposed in a cloud server.
  • the apparatus for software-defined network SDN secure communication in this embodiment includes: a receiving module 1201, a generating module 1202, and a second processing module 1203.
  • the receiving module 1201 is configured to receive a user request forwarded from the first SDN controller, wherein the user request is sent by the user terminal to the first SDN controller.
  • the generation module 1202 is configured to perform security detection for the user request and generate a detection result.
  • the second processing module 1203 is configured to send the detection result to the first SDN controller, and the first SDN controller processes the detection result, generates a processing result, and sends the detection result and the location At least one of the processing results is described to the client.
  • the first SDN controller is provided with an access security function by using a cloud server,
  • the form of the service provides security for the client, and can serve the access security problem, improving the security of the first SDN controller cloud service.
  • the apparatus provided by the present disclosure is an apparatus for applying the above-described software-defined network SDN secure communication method, and all of the above embodiments of the software-defined network SDN secure communication method applied to the cloud server are applicable to the apparatus.
  • the receiving module 1201 may be further configured to receive a user access request sent by the cloud user forwarded by the first SDN controller.
  • the generating module 1202 may be configured to:
  • the receiving module 1201 may be configured to: receive at least one first network authorization request sent by a user terminal having a terminal application forwarded by the first SDN controller.
  • the first network authorization request includes: a username of the user terminal, a password corresponding to the username, and a domain name of the user terminal.
  • the generating module 1202 may be configured to: detect whether the user name and password of the first network authorization request are present in the first SDN controller, and a second network authorization request with the same domain name, detecting that the first SDN controller has the detection result of the second network authorization request or the first SDN controller does not have the second network authorization request result.
  • the apparatus for software-defined network SDN secure communication may further include a receiving storage module.
  • the receiving storage module is configured to receive and store an authorization target object sent by the first SDN controller, where the authorization target object includes: the first network authorization request and the first generated by the first SDN controller Any of the token code and the second token code.
  • the apparatus for software-defined network SDN secure communication may further include a detection control module.
  • the detection control module is configured to detect network attack information of the first SDN controller, and prohibit opening The network attacks the information and deletes the network attack information, where the network attack information carries behavior information of stealing information and forwarding the network.
  • the cloud server can cooperate with the cloud service provider, which has big data computing capability, and applies a large number of different types of storage devices in the network through the functions of cluster application, grid technology or distributed file system.
  • Software that brings together work together to provide a system for data storage, processing, and business access functions.
  • the security service cloud (equivalent to the above-mentioned cloud server) places the cloud computing access cloud server outside the cloud service provider and is provided by a third party, which can realize outsourcing of access and provide access security for cloud users.
  • Service providing security for users in the form of services.
  • an application description is performed by a cloud service provider and a security service cloud, and multiple cloud service providers and security service clouds may also be deployed.
  • the OpenFlow switch 43 may be based on the service type of the user access request (the service type may include: data integrity detection, unified user management). And network attack detection) assigning a user access request to the security service cloud 41 for execution;
  • the cloud service provider 44 implements storage and processing of user data for the user access request and provides the storage processing result to the first SDN controller 42;
  • the security service cloud 41 processes the user access request, determines the forwarding, blocking, or user access access or denial of access of the data of the user accessing the request, and notifies the first SDN controller 42 of the decision result through the API interface 421;
  • the first SDN controller 42 generates a corresponding flow entry, which is sent to the OpenFlow switch 43 (the OpenFlow switch 43 is an application entity of the data forwarding layer, which is merely exemplified herein), and the OpenFlow switch 43 performs operations.
  • the OpenFlow switch 43 can perform an operation according to the flow entry of the service history, and the user access request does not need to pass through the security service cloud 41 again.
  • the corresponding flow entry can be configured on the first SDN controller to complete the specified function, and the first SDN controller 42 sends the response of the OpenFlow switch 43 and the cloud user and the terminal user 46 to the security service cloud 41.
  • the application of the first SDN controller and the cloud server in the embodiment of the present disclosure is as follows.
  • the SDN network includes five layers, wherein five layers are: an application service layer 51 (corresponding to the above-mentioned end user), an interface supervision layer 52 (a corresponding application entity may be a terminal display), and a control layer 53 (equivalent The first SDN controller described above, the data forwarding layer 54 (the corresponding application entity may be a switch), and the cloud service layer 55 (corresponding to the cloud server described above).
  • the application service layer 51 sends a network authorization request to the control layer 53, and the control layer 53 analyzes the state of the control layer 53 according to various request types of the application service layer 51, formulates the network authorization request priority, and verifies the received digital signature from the application.
  • the network authorization request is verified, and an access authorization token is sent to the application service layer 51.
  • the interface supervision layer 52 is configured to display token authorization information, token authorization process, conflict analysis and decision results, network topology, alarms, and links in the network.
  • the control layer 53 receives a plurality of user requests of the application service layer 51, sets a corresponding priority according to the application type, and gives the user a token authorization module (corresponding to at least one of the first processing unit second processing unit described above). Requesting to issue an authorization code, or issuing a stop authorization code, and requesting a priority for each user through a priority analysis algorithm; communicating with the data forwarding layer 54 through a FlowMode message and a PacketIn message.
  • the control layer 53 sends the first SDN controller-switch information (data forwarding layer 54 data is also implemented by the control layer 53) for controlling the operation of the OpenFlow switch, including communication handshake, switch flow table configuration, modification of switch status, and data queue. Set up, switch status reading and delivery methods to achieve security.
  • the applications of the application service layer 51 may be classified into four types according to the source and the function: a command line application 511, a network management application 512, a security application 513, and other applications 514, where
  • the command line application 511 is an application accessed by the controller administrator.
  • the command line (non-open source) reserved by the controller implements operations such as configuration and query of the controller, and can implement some functions of verification and debugging.
  • the network management application 512 is used to implement network administrators to perform various configurations on the controller and view network status, such as alarms and topology.
  • the security application 513 refers to a third-party security service cloud that is accessed in the network to provide users with security services and guarantees.
  • Other applications 514 may refer to reserved processing applications, such as controller software upgrades, open logs, and memory leak detection.
  • the interface management layer 52 includes a user interface 521 and an interface processing module 522.
  • the user interface 521 is configured to acquire data from the interface processing module 522, convert the data into a graphical interface, provide a configuration window for the network administrator, and issue a Representational State Transfer (REST) or Hypertext Transfer Protocol (HyperText Transfer Protocolc).
  • the HTTP HTTP protocol sends the configuration to the interface processing module 522.
  • the interface processing module 522 receives the feedback module 531 information, sends the response result to the user interface 521 in a REST, HTTP protocol manner, and buffers the user interface 521 and sends the response to the feedback module 531.
  • control layer 53 includes a feedback module 531, a token authorization module 532, an authentication authorization module 533, a priority analysis module 534, a flow table management module 535, a command delivery and connection state table synchronization module 536, a storage module 537, and API interface module 538 (equivalent to the conversion module described above).
  • the feedback module 531 (equivalent to the feedback module) can implement feedback authentication authorization information, priority analysis and decision information to the network administrator.
  • the token authorization module 532 (corresponding to at least one of the first processing unit and the second processing unit described above) may request an access token from the authorization server by using a network authorization request sent by the Token service of the application service layer 51, and access the The token is sent to the authentication and authorization module 533.
  • the authentication and authorization module 533 (corresponding to the transceiver module) receives the authorization request of the application service layer 51 and the token code of the token authorization module, sets an application access priority level, and issues an authorization and a token code to the application to be accessed.
  • the priority analysis module 534 (corresponding to the transceiver module) analyzes the importance of each user request, and determines whether there is a conflict with the existing flow rules in the flow table management module 535. If there is a conflict, the conflict is mitigated according to the analysis algorithm.
  • the flow rule receiving or rejecting operation requested by the user is updated by the flow table management module 535.
  • the priority analysis module 534 also defines a connection status table of the SDN controller, which is responsible for maintaining synchronization with the connection status table in the SDN switch of the data forwarding module, and when receiving the PacketIn message from the OpenFlow switch, the module can provide the header information and status. The information is compared with the connection state table or the firewall rule set, and the corresponding state is assigned, and the converted flow table is delivered to the OpenFlow switch.
  • the flow table management module 535 (equivalent to the first processing module) is configured to save all flow table information that is running in the network.
  • the flow table management module 535 is a flow rule requested by the user, and may be a priority analysis module. 534 provides services.
  • the flow table management module 535 can also provide a flow rule to the command delivery and connection state table synchronization module, so as to send an OpenFlow message to the switch.
  • the command delivery and connection state table synchronization module 536 (equivalent to the first processing module) is configured to establish a connection state table on the first SDN controller end, keep synchronized with the state table in the OpenFlow switch, and send the PacketIn when receiving the OpenFlow switch.
  • the module compares the header information and status information of the OpenFlow switch with the connection status table or the firewall rule set, assigns the corresponding status, and delivers the converted flow table to the OpenFlow switch.
  • the storage module 537 (equivalent to the first processing module) can store the data of each module, implement the persistence of the user authentication data, realize the storage of the topology resources, and the like, and ensure the recovery of the data after the power is cut off.
  • the API module 538 (equivalent to the API interface) may be an interface with the controller or an interface with the cloud service module, and is responsible for the interaction between the cloud service module and the SDN controller, and ensures that the network management policy of the cloud server is delivered to the OpenFlow switch.
  • the implementation is performed by the OpenFlow switch.
  • the data forwarding layer 54 includes a switch information extraction module 541, a state table module 542, a change flow table module 543, a data queue module 544, and a data detection module 545.
  • the data forwarding layer 54 uses the Transport Layer Security (TLS) to authenticate and encrypt traffic between the network device side and the first SDN controller, and uses TLS to help verify the controller and network device or the first SDN controller. Prevent eavesdropping and falsification of southbound communications. Sending a PacketIn message to the first SDN controller through the OpenFlow switch, indicating a refresh of the network behavior of the first SDN controller and a switch state change, deploying an SDN firewall in the first SDN controller and the OpenFlow switch, and adding a new one in the OpenFlow protocol. The message and the addition of the relevant status field enable the deployment of the SDN firewall.
  • TLS Transport Layer Security
  • the switch information extraction module 541 is configured to extract key information in the data frame packet header, where the key information includes a source address, a source port, a destination address, a destination port, a sequence number, a confirmation number, and a transmission control protocol (Transmission Control Protocol) of the data packet. , TCP) flag bit.
  • TCP Transmission Control Protocol
  • the state table module 542 is configured to establish a connection state table in the data forwarding layer and simultaneously synchronize the update of the connection state table to the first SDN controller, and the update of the connection state table of the module will be transformed by the flow
  • the table is controlled by instructions such as the SET_STATE instruction.
  • the transform flow table module 543 is configured to forward the data in the data forwarding by the first SDN controller A transform flow table is established in the layer, which is responsible for the state transition process and the packet forwarding operation.
  • the data queue module 544 is configured to set a data queue for sending messages, and store queue information such as Hello messages, response requests, and response requests.
  • the data detecting module 545 is configured to determine that the data packet coming to the data forwarding layer is acquired in the connection between the terminal and the SDN controller in the data forwarding layer, and verify the validity of the connection state.
  • the connection status table synchronizes the first SDN controller and the data forwarding layer 54 by transmitting messages to the first SDN controller and the data forwarding layer 54, respectively.
  • the data forwarding layer 54 is forwarded.
  • the switch sends a message and also commands the status table of the data forwarding layer 54 switch to update and return to the update state.
  • the status table in the switch of the data forwarding layer 54 is updated, a message is sent to the first SDN controller, and the first SDN controller is also instructed to update the data and return to the update state.
  • the flow table is executed according to the state, and the connection status table is updated, and the firewall in the data forwarding layer is deployed, and the first SDN control can also be implemented.
  • the device is securely authenticated, providing users with access security services in the north, providing users with security through token authorization, supporting cluster controllers and a large number of network devices, and supporting cloud security services for a large number of network devices. And feedback the network status to the user in real time.
  • the first SDN controller generates a corresponding flow entry, which is sent to the OpenFlow switch for implementation, and implements data flow deployment, and sends the feedback information of the OpenFlow switch to the first SDN controller or the network administrator to make a decision.
  • Embodiments of the present disclosure also provide a non-transitory computer readable storage medium storing computer executable instructions arranged to perform any of the methods described above.
  • the cloud server includes:
  • At least one processor 1600 which is exemplified by a processor 1600 in FIG. 16; and a memory 1601, may further include a communication interface 1602 and a bus 1603.
  • the processor 1600, the communication interface 1602, and the memory 1601 can complete communication with each other through the bus 1603.
  • Communication interface 1602 can be used for information transfer.
  • the processor 1600 can invoke the logic instructions in the memory 1601 to perform the above-described method of software-defined network SDN secure communication applied to the cloud server.
  • logic instructions in the above memory 1601 can be implemented in the form of a software functional unit. And when sold or used as a stand-alone product, it can be stored on a computer readable storage medium.
  • the memory 1601 is a computer readable storage medium, and can be used to store a software program, a computer executable program, a program instruction or a module corresponding to a method of software-defined network SDN secure communication applied to a cloud server in the embodiment of the present disclosure.
  • the processor 1600 performs functional applications and data processing by running software programs, instructions or modules stored in the memory 1601.
  • the memory 1601 may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application required for at least one function; the storage data area may store data created according to usage of the terminal, and the like. Further, the memory 1601 may include a high speed random access memory, and may also include a nonvolatile memory.
  • the technical solution of the present disclosure may be embodied in the form of a software product stored in a storage medium, including one or more instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) Performing all or part of the steps of the method of the embodiments of the present disclosure.
  • the foregoing storage medium may be a non-transitory storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.
  • the method and device for software-defined network SDN secure communication provided by the present disclosure can avoid the security risks existing when the cloud security service provider in the related art controls the SDN computing and storage services.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本公开提供一种软件定义网路SDN安全通信的方法及装置，其中，应用于第一SDN控制器的软件定义网络SDN安全通信的方法，包括：获取来自用户端的用户请求；发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果；以及对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端。

Description

软件定义网路SDN安全通信的方法及装置 技术领域
本公开涉及信息安全技术领域，例如涉及一种软件定义网路(Software Defined Network，SDN)安全通信的方法及装置。
背景技术
软件定义网络(Software Defined Network，SDN)是一种开放的网络架构，其核心技术OpenFlow通过将网络设备控制面与数据面分离开，从而实现了网络流量的灵活控制。
管理人员可以通过SDN网络查看网络所有区域及修改网络，通过查看及修改网络来及时改变规则，为系统带来更好的安全性。管理人员可以集中查看网络内部能力和快速限制能力，进行更改。例如，在网络中出现恶意软件时，通过SDN和OpenFlow协议集中控制平面阻止与恶意软件有关的流量，从而限制这种流量的爆发，而不需要访问多个路由器或交换机。
随着云计算的应用及发展，云安全服务也成为SDN的一种服务模式。云安全服务在性能、可扩展性、可用性以及容错能力等方面具有优势，但是云接入也存在一定的安全隐患。因此云安全服务提供商控制SDN计算与存储业务，存在极大的安全隐患。
发明内容
本公开提供一种软件定义网路SDN安全通信的方法及装置，能够避免相关技术中的云安全服务提供商控制SDN计算与存储业务时，存在的安全隐患。
本公开实施例提供一种软件定义网络SDN安全通信的方法，应用于第一SDN控制器，包括：
获取来自用户端的用户请求；
发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果；以及
对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处 理结果中的至少一个至所述用户端。
可选的，所述用户端的用户请求包括以下至少一个：云用户的用户接入请求和具有终端应用的用户终端的至少一个第一网络授权请求，其中，所述至少一个第一网络授权请求包括：所述用户终端的用户名、与所述用户名对应的密码及所述用户终端所在域名。
可选的，在用户端的用户请求为云用户的用户接入请求时，所述发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果，包括：
检测所述云用户的用户接入请求为首次发送的用户接入请求时，转发所述用户接入请求至所述云服务器；以及
接收由所述云服务器针对所述用户接入请求进行安全检测返回的检测结果，所述检测结果包括：由所述云服务器检测所述用户接入请求的安全并产生一拒绝访问所述第一SDN控制器的检测结果或接受访问所述第一SDN控制器的检测结果。
可选的，所述对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端，包括：
对所述检测结果进行处理，产生一流表项记录；以及
发送所述检测结果及所述流表项记录至所述云用户，所述流表项记录包括：与所述用户接入请求对应的状态字段。
可选的，在所述获取来自用户端的用户请求之后，所述用户端的用户请求为云用户的用户接入请求时，所述方法还包括：
检测存在与所述云用户的用户接入请求对应的流表项记录，确定所述用户接入请求不为首次发送的用户接入请求；以及
将针对所述云用户的用户接入请求的处理结果返回给所述云用户，其中，所述处理结果包括：通过所述流表项记录记录所述云用户的用户接入请求已经由所述云服务器检测安全并产生一接受访问所述第一SDN控制器的检测结果。
可选的，在用户端的用户请求为具有终端应用的用户终端的一个第一网络授权请求时，所述发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果，所述方法包括：
发送所述第一网络授权请求至所述云服务器；以及
接收由所述云服务器针对所述第一网络授权请求进行安全检测返回的检测结果，所述检测结果包括：检测所述第一SDN控制器中是否存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求。
可选的，所述对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端，包括：
在所述检测结果为所述第一SDN控制器不存在与所述第一网络授权请求中的用户名、密码及域名均相同的第二网络授权请求时，根据所述第一网络授权请求，生成与所述第一网络授权请求唯一对应的第一令牌码；以及
验证所述第一网络授权请求中的所述用户名、所述密码及所述域名，并在验证通过时，生成携带有所述第一网络授权请求及所述第一令牌码的授权目标对象并发送所述授权目标对象至所述用户终端。
可选的，所述对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端，包括：
在所述检测结果为所述第一SDN控制器存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求时，获取所述第二网络授权请求唯一对应的第二令牌码，生成携带有所述第一网络授权请求及所述第二令牌码的授权目标对象并发送所述授权目标对象至所述用户终端。
可选的，在用户端的用户请求为具有终端应用的用户终端的多个第一网络授权请求时，所述发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果，包括：
为每个第一网络授权请求分配优先级；
按照所述优先级发送所述多个第一网络授权请求至所述云服务器；以及
按照所述优先级接收由所述云服务器针对所述多个第一网络授权请求进行安全检测返回的检测结果。
可选的，在对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端之前，所述方法还包括：
通过预定接口转换所述检测结果的数据格式与所述第一SDN控制器的数据 格式相匹配。
可选的，在获取来自用户端的用户请求之前，所述方法还包括：
建立所述第一SDN控制器与至少一个第二SDN控制器连接，其中，所述至少一个第二SDN控制器与所述第一SDN控制器处于不同域；以及
获取来自所述至少一个第二SDN控制器所在域的用户端的用户请求。
本公开实施例还提供一种软件定义网络SDN安全通信的方法，应用于云服务器，包括：
接收来自第一SDN控制器转发的用户请求，其中，所述用户请求由用户端向所述第一SDN控制器发送；
针对所述用户请求进行安全检测，并产生检测结果；以及
将所述检测结果发送至所述第一SDN控制器，由所述第一SDN控制器对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端。
可选的，所述接收来自第一SDN控制器转发的用户请求，包括：
接收来自第一SDN控制器转发的由云用户发送的用户接入请求。
可选的，所述针对所述用户请求进行安全检测，并产生检测结果，包括：
针对所述用户接入请求，检测所述用户接入请求的安全并产生一拒绝访问所述第一SDN控制器的检测结果或接受访问所述第一SDN控制器的检测结果。
可选的，所述接收来自第一SDN控制器转发的用户请求，包括：
接收来自第一SDN控制器转发的由具有终端应用的用户终端发送的至少一个第一网络授权请求，所述至少一个第一网络授权请求包括：所述用户终端的用户名、与所述用户名对应的密码及所述用户终端所在域名。
可选的，所述针对所述用户请求进行安全检测，并产生检测结果，包括：
检测所述第一SDN控制器中是否存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求，产生一检测所述第一SDN控制器存在所述第二网络授权请求的检测结果或所述第一SDN控制器不存在所述第二网络授权请求的检测结果。
可选的，所述方法还包括：
接收并存储所述第一SDN控制器发送的授权目标对象，其中，所述授权目标对象包括：所述第一网络授权请求及由所述第一SDN控制器产生的第一令牌码及第二令牌码中的任一令牌码。
可选的，所述方法还包括：
检测所述第一SDN控制器的网络攻击信息，禁止打开所述网络攻击信息，并删除所述网络攻击信息，其中，所述网络攻击信息携带有窃取信息及转发网络的行为信息。
本公开实施例还提供一种软件定义网络SDN安全通信的装置，设置于第一SDN控制器中，包括：
第一获取模块，设置为获取来自用户端的用户请求；
收发模块，设置为发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果；以及
第一处理模块，设置为对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端。
本公开实施例还提供一种软件定义网络SDN安全通信的装置，设置于云服务器中，包括：
接收模块，设置为接收来自第一SDN控制器转发的用户请求，其中，所述用户请求由用户端向所述第一SDN控制器发送；
产生模块，设置为针对所述用户请求进行安全检测，并产生检测结果；以及
第二处理模块，设置为将所述检测结果发送至所述第一SDN控制器，由所述第一SDN控制器对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端。
本公开还提供了一种非暂态计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行上述方法。
本公开还提供了一种第一SDN控制器，包括：
至少一个处理器；以及
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器执行应用于第一SDN控制器的软件定义网络SDN安全通信的方法。
本公开还提供了一种云服务器，包括：
至少一个处理器；以及
与所述至少一个处理器通信连接的存储器；其中，
所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器执行应用于云服务器的软件定义网络SDN安全通信的方法。
本公开实施例的方案中，第一SDN控制器与云服务器连接，通过云服务器对用户请求进行安全检测，可以提高第一SDN控制器的云安全性；由于第一SDN网络中的应用服务层及数据层分别与第一SDN控制器进行数据交互，交互数据经云服务器进行安全检测，避免了第一SDN控制器与存储业务之间存在的安全隐患；还可以利用云服务器协助第一SDN控制器处理用户请求，减轻SDN控制器监控数据的负担。
附图说明
图1为本公开实施例的应用于第一SDN控制器的软件定义网络SDN安全通信的方法的流程示意图一；
图2为本公开实施例的应用于第一SDN控制器的软件定义网络SDN安全通信的方法的流程示意图二；
图3为本公开实施例的应用于第一SDN控制器的软件定义网络SDN安全通信的方法的流程示意图三；
图4为本公开实施例的应用于第一SDN控制器的软件定义网络SDN安全通信的方法中步骤120的流程示意图一；
图5为本公开实施例的应用于第一SDN控制器的软件定义网络SDN安全通信的方法中步骤130的流程示意图；
图6为本公开实施例的应用于第一SDN控制器的软件定义网络SDN安全 通信的方法的步骤120的流程示意图二；
图7为本公开实施例的应用于第一SDN控制器的软件定义网络SDN安全通信的方法的令牌授权流程示意图；
图8为本公开实施例的应用于云服务器的软件定义网络SDN安全通信的方法的流程示意图；
图9为本公开实施例的设置于第一SDN控制器中的软件定义网络SDN安全通信的装置的结构示意图；
图10为本公开实施例的软件定义网络SDN安全通信的装置的跨域令牌授权的结构示意图；
图11为本公开实施例的第一SDN控制器与数据转发层的数据包的处理过程流程示意图；
图12为本公开实施例的设置于云服务器中的软件定义网络SDN安全通信的装置的结构示意图；
图13为本公开实施例的云服务器的的结构示意图；
图14为本公开实施例的第一SDN控制器及云服务器的结构示意图一；
图15为本公开实施例的第一SDN控制器及云服务器的结构示意图二；以及
图16为本公开实施例提供的云服务器的硬件结构示意图。
具体实施方式
为使本公开的技术方案更加清楚，下面将结合附图及实施例进行详细描述。在不冲突的情况下，本公开以下实施例以及实施例中的技术特征可以相互任意组合。
如图1所示，本公开实施例的软件定义网络SDN安全通信的方法，应用于第一SDN控制器。
在步骤110中，获取来自用户端的用户请求。
其中，用户端可以是指SDN网络中的应用服务层的终端，该应用服务层可以包括命令行应用、网管应用、安全应用和其它多种应用。该命令行应用可以 是由第一SDN控制器管理人员接入的应用，通过第一SDN控制器预留的命令行，可以对第一SDN控制器进行配置和查询等操作，实现一些验证和调试的功能。该网管应用可以实现网络管理员对第一SDN控制器进行网络多种配置并查看网络状态，如告警和拓扑等状态。该安全应用可用于网络中接入的云服务器的第三方机构，为用户提供安全方面的服务和保障。该其它多种应用可以指预留的处理应用，实现比如第一SDN控制器软件升级、开启日志以及内存泄露检测等等功能。
在步骤120中，发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果。
在步骤130中，对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端。
本公开实施例中，第一SDN控制器与云服务器连接，通过云服务器对用户请求进行安全检测，可以提高第一SDN控制器的云安全性；由于第一SDN网络中的应用服务层及数据层分别与第一SDN控制器进行数据交互，交互数据经云服务器进行安全，避免了第一SDN控制器与存储业务之间存在的安全隐患；还可以利用云服务器协助第一SDN控制器处理用户请求，减轻SDN控制器监控数据的负担。
如图2所示，本公开实施例的软件定义网络SDN安全通信的方法，所述用户端的用户请求可以包括以下至少一个：云用户的用户接入请求和具有终端应用的用户终端的至少一个第一网络授权请求，其中，第一网络授权请求包括：所述用户终端的用户名、与所述用户名对应的密码及所述用户终端所在域名。
所述云用户可以为接入云安全服务的用户，包括个人用户以及企业用户等。
本公开实施例中，第一SDN服务器不仅可以实现与云服务器的信息交互，还与应用服务层进行交互，利用云服务器检测第一SDN控制器的交互信息，提高了第一SDN服务器与应用服务层进行交互的通信安全性。
如图2所示，本公开实施例的软件定义网络SDN安全通信的方法，在用户端的用户请求为云用户的用户接入请求时，步骤120还可以包括：步骤1210和步骤1220。
在步骤1210中，检测该云用户的用户接入请求为首次发送的用户接入请求 时，发送该用户接入请求至该云服务器。
其中，云服务器的信息可由除第一方SDN控制器管理人员和APP应用，和第二方SDN控制器及相关数据库之外的第三方提供，从而实现接入的外包或单独设置，方便为云用户提供接入安全的服务。云服务器以服务的形式为用户提供安全保障，还可以将多个云服务器集群在一起，形成专门应对云接入安全问题的系统。
在步骤1220中，接收由该云服务器针对该用户接入请求进行安全检测返回的检测结果，该检测结果包括：由该云服务器检测该用户接入请求的安全并产生一拒绝访问该第一SDN控制器的检测结果或接受访问该第一SDN控制器的检测结果。
云服务器对该用户接入请求的安全性的检测包括：数据完整性检测、统一用户管理及网络攻击检测。其中，该数据完整性检测可以包括：用户请求中的用户名及用户名对应的密码。该统一用户管理可以包括：存储用户请求中的用户名及对应的密码。网络攻击检测可以包括：监测网络中非法入侵的木马或病毒。可以利用云服务器实现上述至少一项安全性的检测。
本公开实施例中，第一SDN控制器可以对首次发送的用户接入请求，利用云服务器判断用户接入请求的安全性，保证第一SDN控制器的安全性。
如图2所示，本公开实施例的软件定义网络SDN安全通信的方法，上述步骤130可以包括：步骤1310和1320。
在步骤1310中，对该检测结果进行处理，产生一流表项记录。
其中，流表项记录可以是通过对OpenFlow协议定义的流表的基本结构添加至少一个状态属性(如State状态)以及至少下一个状态(如Next_State)。本公开重新定义了数据包与流表项记录匹配的过程，可以使匹配过程不仅仅依赖于数据帧包头的信息，同时也依赖数据帧自身的状态。如数据包与流表项记录匹配不成功，数据转发层将向第一SDN控制器发送一个收入封包数(PacketIn)请求消息，其中，该PacketIn请求消息包含数据帧包头的信息，也包含数据帧自身的状态信息。第一SDN控制器会向数据转发层发送一个流组(FlowMod)消息并向数据转发层添加相应记录，作为回应。当数据包与流表项记录匹配成功时，将连接状态表中状态赋值为变换流表中相应记录的下一个状态。
在步骤1320中，发送该检测结果及该流表项记录至该云用户，其中，该流表项记录包括：与该用户接入请求对应的状态字段。
状态字段可以使数据转发层中的终端与SDN控制器的连接状态表的更新同步。
本公开实施例中，通过生成一个流表项记录，当后续有相同的用户请求时，无需再次进行验证，可以利用云服务器协助第一SDN控制器处理用户请求，减轻SDN控制器的监控数据的负担，也提高了云安全性的检测效率。
如图3所示，本公开实施例的软件定义网络SDN安全通信的方法在上述步骤110之后，用户端的用户请求为云用户的用户接入请求时，该软件定义网络SDN安全通信的方法还可以包括步骤140和步骤150。
在步骤140中，检测存在与该云用户的用户接入请求对应的流表项记录，确定该用户接入请求不为首次发送的用户接入请求。
在步骤150中，将针对该云用户的用户接入请求的处理结果返回给该云用户，其中，该处理结果包括：通过该流表项记录记录该云用户的用户接入请求已经由该云服务器检测安全并产生一接受访问该第一SDN控制器的检测结果。
本公开实施例中，在判断云用户不是首次发送的用户请求时，通过预先建立的流表项，记录进行访问的第一SDN控制器，减少了验证过程，提高了接入的效率，并通过云服务器进行检测，提高了用户接入请求的安全性。
如图4所示，本公开实施例的软件定义网络SDN安全通信的方法中，在用户端的用户请求为具有终端应用的用户终端的一个第一网络授权请求时，上述步骤120可以包括：步骤1230和步骤1240。
在步骤1230中，发送该第一网络授权请求至该云服务器。
在步骤1240中，接收由该云服务器针对该第一网络授权请求进行安全检测返回的检测结果，其中，该检测结果包括：检测该第一SDN控制器中是否存在与该第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求。
本公开实施例中，将第一网络授权请求发送给第一SDN控制器，利用云服务器可以协助第一SDN控制器检测第一网络授权请求的安全性，由于云服务器存储有与第一网络授权请求相关的数据，因此可以在存储的数据中判断是否存在第一网络授权请求，减轻了第一SDN控制器的负担，也提高了第一SDN控 制器数据交互的安全性。
如图4所示，本公开实施例的软件定义网路SDN安全通信的方法中，上述步骤130包括：步骤1330和步骤1340。
在步骤1330中，在该检测结果为该第一SDN控制器中不存在与该第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求时，根据所述第一网络授权请求，生成与该第一网络授权请求唯一对应的第一令牌码。
在步骤1340中，验证该第一网络授权请求中的该用户名、该密码及该域名，并在验证通过时，生成携带有该第一网络授权请求及该第一令牌码的授权目标对象并发送该授权目标对象至该用户终端。
其中，验证该第一网络授权请求中的该用户名、该密码及该域名的可以包括：验证该第一网络授权请求中该用户名、该密码及该域名是否完整；在第一网络授权请求中该用户名、该密码及该域名均完整时，判断第一网络授权请求中的密码是否正确；在第一网络授权请求中的密码正确时，该第一网络授权请求为验证通过。这样可以增强第一网络授权请求的应用的准确性。
在步骤1340中，发送该授权目标对象至该用户终端时，并发送该授权目标对象至给云服务器进行存储，有利于后期云服务器判断第一网络授权请求是否为首次发出的用户请求，减少对同一网络授权请求的重复授权。
本公开实施例中，在用户端的用户请求为云用户的用户接入请求时，生成唯一对应的第一令牌码，并反馈给用户终端的授权目标对象，可以实现令牌授权，保证只给新的网络授权请求发放新的访问令牌码，避免重复发放访问令牌码的情况。
如图5所示，本公开实施例的软件定义网路SDN安全通信的方法中，上述步骤130可以包括：步骤1350。
在步骤1350中，在该检测结果为该第一SDN控制器中存在与该第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求时，获取该第二网络授权请求唯一对应的第二令牌码，生成携带有该第一网络授权请求及该第二令牌码的授权目标对象并发送该授权目标对象至该用户终端。
本公开中第一网络授权请求及第二网络授权请求中的“第一”和“第二”，并不是对网络授权请求的顺序进行限定，而是为了方便区分当前发送的“第一 网络授权请求”与之前已存储的“第二网络授权请求”。“第一网络授权请求”与之前已存储的“第二网络授权请求”的关系可以包括：“第一网络授权请求”的内容与之前已存储的“第二网络授权请求”的内容不相同，和“第一网络授权请求”的内容与之前已存储的“第二网络授权请求”的内容相同。
步骤1350中的在发送该授权目标对象至该用户终端时，并发送该授权目标对象至给云服务器进行存储，有利于后期云服务器判断第一网络授权请求是否为首次发送的用户接入请求，减少对同一用户的重复授权的情况。通过将授权目标对象存储在云服务器，方便后期SDN控制器接收到新的网络授权请求时，利用云服务器检测是否存在网络授权请求。
本公开实施例中，判断已经存在与该第一网络授权请求中的用户名、密码及域名均相同的第二网络授权请求，第一SDN控制器可以不重新生成新的令牌码，可以利用已经存储相同的第二网络授权请求的令牌码，和当前的第一网络授权请求生成授权目标对象，对同一第一网络授权请求的多次刷新，只产生一个授权目标对象，避免了在多次刷新同一第一网络授权请求时产生多个授权目标对象的情况，提高了生成授权目标对象的效率，提高了生成授权目标对象的准确性。
如图6所示，本公开实施例的软件定义网路SDN安全通信的方法中，在用户端的用户请求为具有终端应用的用户终端的多个第一网络授权请求时，所述步骤120可以包括：步骤1250、步骤1260和步骤1270。其中，所述多个第一网络授权请求为数量多于一个的第一网络授权请求。
在步骤1250中，为每个第一网络授权请求分配优先级。
其中，每个第一网络授权请求是指同一用户的不同请求。可以根据每个第一网络授权请求中的应用请求的请求类型，为每个第一网络授权请求分配优先级。
在步骤1260中，按照该优先级发送该多个第一网络授权请求至该云服务器。
在步骤1270中，按照该优先级接收由该云服务器针对该多个第一网络授权请求进行安全检测返回的检测结果。
本公开实施例中，通过为多个第一网络授权请求分配优先级，按照优先级顺序，能够完成对多个第一网络授权请求的处理，避免了冲突。按照优先级也 可以区别对待每个第一网络授权请求，提高了处理的效率。
本公开实施例的软件定义网络SDN安全通信的方法中，在上述步骤130之前，所述的软件定义网络SDN安全通信的方法还可以包括：通过预定接口转换该检测结果的数据格式与该第一SDN控制器的数据格式相匹配。第一SDN控制器就可以利用预定接口，将云服务器的数据进行准确解读，并进行相应处理。
所述预定接口可以为应用程序编程接口(Application Programming Interface，API)，该预定接口可以包括三部分功能将云服务层下发的数据格式转换为与控制层的格式相同其中，这三部分功能可以包括：网络行为的管理、路由的选择和流表的下发。网络行为的管理功能负责第一SDN控制器上云服务器产生的网络行为，将产生的网络行为转为流表项的形式。依据用户接入请求的许可或拒绝，发出是否进行数据转发的指令，以此保证云用户的接入安全性，还可以统计云服务器的物理地址相关信息，将用户请求的服务名称翻译成对应的物理相关地址，完成网络中以服务名称为依赖的资源发现。路由的选择功能保障用户访问请求通过云服务器，根据全网的拓扑信息和链路损耗，为用户选择最优路径。流表的下发功能保证第一SDN控制器产生的流表下发到OpenFlow交换机中，实现数据流的调配等。
API接口是云服务层和控制器之间的数据转换接口，可以负责云服务层和控制器的交互。API接口可以为云服务器到控制器的接口，API接口部分功能策略可以预先存放在第一SDN控制器中，在需要API接口部分功能策略时，第一SDN控制器将API接口部分功能策略下发到OpenFlow交换机。
本公开实施例中，API接口的数据格式，可以实现云服务器与第一SDN控制器的数据交互，API接口可以控制云用户的访问路由，能够提供接入云服务器的服务。
本公开实施例的软件定义网络SDN安全通信的方法中，在上述步骤110之前，该软件定义网络SDN安全通信还可以包括：步骤160和步骤170。
在步骤160中，建立该第一SDN控制器与至少一个第二SDN控制器连接，其中，该至少一个第二SDN控制器与该第SDN控制器处于不同域。
其中，SDN控制器所管理的交接机可以为一个域(domain)，不同SDN控制器可以管理不同的域。同一域中还可能有备份SDN控制器。
在步骤170中，获取来自该至少一个第二SDN控制器所在域的用户端的用户请求。
本公开实施例中，通过将第一SDN控制器与至少一个第二SDN控制器建立连接，获取该至少一个第二SDN控制器所在域的用户端的用户请求，实现多域或跨域的用户端的令牌授权，对不同域内的用户端进行令牌授权及安全检测。
第二实施例
如图7所示，本公开实施例的令牌授权的流程如下。
在步骤710中，用户终端发送第一用户授权请求，第一SDN控制器接收第一用户授权请求并加入具有优先级的应用申请列队。
在步骤720中，第一SDN控制器对接收到的用户终端的第一用户授权请求进行验证。
在步骤730中，判断第一网络授权请求的路径是否为终结地址，返回第一网络授权请求路径允许访问的地址(该地址可以包括IP地址)。判断该IP地址是否合法，如果IP地址为空(Null)等的地址，判断第一网络授权请求的路径是允许访问的IP地址，则执行步骤740；如果IP地址不为空等的地址，判断第一网络授权请求的路径不是允许访问的IP地址，则执行步骤750。上述判断第一网络授权请求的路径是否终结的方法是对发送的第一网络授权请求中如统一资源定位器(Uniform Resoure Locator，URL)以及远程过程调用协议(Remote Procedure Call Protocol，RPC)地址等等访问方式进行判断得到，并携带在返回的授权目标对象的消息中。
在步骤740中，第一SDN控制器释放令牌授权并发消息给终端用户，令牌授权失败。
在步骤750中，第一SDN控制器创建令牌授权，创建并分配一个与第一网络授权请求的终端用户唯一对应的令牌码。
在步骤760中，第一SDN控制器申请注册鉴权第一网络授权请求。
在步骤770中，第一SDN控制器验证该第一网络授权请求中的用户名、用户名对应的密码及域名，如果第一网络授权请求中的用户名、密码及域名不完整或不对时，则执行步骤740，如果第一网络授权请求中的用户名、密码及域名完整，则执行步骤780。
在步骤780中，判断密码是否正确，如果所述密码正确，则执行步骤790。
在步骤790中，判断令牌授权类型是否为密码授权方式，如果不是密码授权方式，则执行步骤7130中。
在步骤7100中，如果是密码授权方式，取出第一网络授权请求中的用户名及密码，并把用户名、密码及令牌码生成密码授权对象。
在步骤7110中，在第一网络授权请求中取出域名。
在步骤7120中，利用密码授权对象及域名生成授权目标对象，该授权目标对象是由验证所需用户名、密码和域名之后由授权者提供的。
在步骤7130中，判断令牌授权类型是否为刷新令牌授权方式，如是，则执行步骤7140中。其中，刷新令牌是避免请求者在预设时间段(服务器允许的客户端和服务端的时间差)内发送同样的请求两次或以上。
在步骤7140中，获取与第一网络授权请求相同的刷新令牌授权方式的第二网络授权请求。
在步骤7150中，利用第二网络授权请求的用户名、密码及域名生成授权目标对象。
在步骤7160中，第一SDN控制器返回携带有授权目标对象的响应。
本公开实施例中，利用令牌授权的方式，对接入的终端用户的第一网络授权请求进行认证和令牌授权，在第一SDN控制器对第一网络授权请求的身份进行验证，后续可以利用授权目标对象向第一SDN控制器请求访问令牌。
第三实施例
如图8所示，本公开实施例的软件定义网络SDN安全通信的方法，应用于云服务器。
在步骤810中，接收来自第一SDN控制器转发的用户请求，其中，所述用户请求由用户端向所述第一SDN控制器发送。
其中，该用户端包括云用户及终端用户，可以实现多个终端的数据安全检测。
在步骤820中，针对所述用户请求进行安全检测，并产生检测结果。
在步骤830中，将所述检测结果发送至所述第一SDN控制器，由所述第一 SDN控制器对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端。
本公开实施例中，通过云服务器对第一SDN控制器提供接入安全功能，以服务的形式为用户端提供安全保障，可以对接入安全问题进行服务，提高了第一SDN控制器云服务的安全性。
本公开实施例的软件定义网络SDN安全通信的方法中，所述步骤810可以包括：接收来自第一SDN控制器转发的由云用户发送的用户接入请求。
本公开实施例中，云服务器接收第一SDN控制器转发的用户接入请求，并对该用户接入请求进行安全检测，提高了用户接入请求接入第一SDN控制器的安全性。
本公开实施例的软件定义网络SDN安全通信的方法中，所述步骤820可以包括：针对所述用户接入请求，检测所述用户接入请求的安全并产生一拒绝访问所述第一SDN控制器的检测结果或接受访问所述第一SDN控制器的检测结果。
本公开实施例中，云服务器对用户接入请求的安全检测之后，反馈该用户接入请求是否可以访问第一SDN控制器，完成对用户接入请求的安全检测处理的反馈。
本公开实施例的软件定义网络SDN安全通信的方法中，所述步骤810可以包括：接收来自第一SDN控制器转发的由具有终端应用的用户终端发送的至少一个第一网络授权请求，其中，所述第一网络授权请求包括：所述用户终端的用户名、与所述用户名对应的密码及所述用户终端所在域名。
本公开实施例中，由于云服务器存储与网络授权请求相关的授权目标对象，利用云服务器接收并判断第一网络授权请求，可以减轻第一SDN控制器的负荷。
本公开实施例的软件定义网络SDN安全通信的方法中，所述步骤820可以包括：检测所述第一SDN控制器中是否存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求，产生一检测所述第一SDN控制器存在所述第二网络授权请求的检测结果或所述第一SDN控制器不存在所述第二网络授权请求的检测结果。
本公开实施例中，如果第一网络授权请求不是首次发送的网络授权请求， 那么云服务器可以存储有与第一网络授权请求相同的第二网络授权请求，第一SDN控制器就可以利用存储过的第二网络授权请求的令牌码，对第一网络授权请求进行令牌授权，可以不重新生成新的令牌码，减少了第一SDN控制器的令牌授权的流程，减轻了第一SDN控制器的负荷。
本公开实施例的软件定义网络SDN安全通信的方法还可以包括步骤840。
在步骤840中，接收并存储所述第一SDN控制器发送的授权目标对象，其中，所述授权目标对象包括：所述第一网络授权请求及由所述第一SDN控制器产生的第一令牌码及第二令牌码中的任一令牌码。
本公开实施例中，云服务器存储有与第一网络授权请求相关的授权目标对象，有利于后续对刷新或重新发送的第一网络授权请求进行认证判断，减轻了第一SDN控制器的负荷，也提高了数据交互的安全性。
本公开实施例的软件定义网络SDN安全通信的方法还可以包括：步骤850。
在步骤850中，检测所述第一SDN控制器的网络攻击信息，禁止打开所述网络攻击信息，并删除所述网络攻击信息，其中，所述网络攻击信息携带有窃取信息及转发网络的行为信息。
上述行为信息为多次转发信息或要求复制网络内容的信息。
本公开实施例的方法，可以对第一SDN控制器的网络攻击信息进行屏蔽。
本公开实施例中，通过云服务器以网络攻击信息的服务的形式为第一SDN控制器提供安全保障，多个云服务器可以集群放在一起，形成应对接入安全问题的系统；云服务器还具有很好的扩展性，也能弥补传统网络在防御能力差、响应速度慢以及系统规模小等等方面存在的不足，满足多种安全需要。
第四实施例
如图9所示，本公开实施例的软件定义网络SDN安全通信的装置，设置于第一SDN控制器。所述软件定义网络SDN安全通信的装置包括：第一获取模块91、收发模块92和第一处理模块93。
第一获取模块91设置为获取来自用户端的用户请求。
收发模块92设置为发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果。
第一处理模块93设置为对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端。
本公开实施例中，第一SDN控制器与云服务器连接，通过云服务器对用户请求进行安全检测，可以提高第一SDN控制器的云安全性；由于第一SDN网络中的应用服务层及数据层分别与第一SDN控制器进行数据交互，交互数据经云服务器进行安全检测，避免第一SDN控制器与存储业务之间存在的安全隐患；还可以利用云服务器协助第一SDN控制器处理用户请求，减轻第一SDN控制器监控数据的负担。
本公开提供的装置是应用上述软件定义网络SDN安全通信方法的装置，则上述应用于第一SDN控制器软件定义网络SDN安全通信方法的所有实施例均适用于该装置。
本公开一实施例的软件定义网络SDN安全通信的装置中，所述用户端的用户请求可以包括以下至少之一：云用户的用户接入请求和具有终端应用的用户终端的至少一个第一网络授权请求，其中，所述至少一个第一网络授权请求包括：所述用户终端的用户名、与所述用户名对应的密码及所述用户终端所在域名。
本公开一实施例的软件定义网络SDN安全通信的装置中，在用户端的用户请求为云用户的用户接入请求时，所述收发模块92可以包括：检测单元和接收单元。
检测单元设置为检测所述云用户的用户接入请求为首次发送的用户接入请求时，转发所述用户接入请求至所述云服务器。
接收单元设置为接收由所述云服务器针对所述用户接入请求进行安全检测返回的检测结果，其中，所述检测结果包括：由所述云服务器检测所述用户接入请求的安全并产生一拒绝访问所述第一SDN控制器的检测结果或接受访问所述第一SDN控制器的检测结果。
本公开一实施例的软件定义网络SDN安全通信的装置中，所述第一处理模块93，可以包括：产生单元和第一发送单元。
产生单元设置为对所述检测结果进行处理，产生一流表项记录。
第一发送单元设置为发送所述检测结果及所述流表项记录至所述云用户， 其中，所述流表项记录包括：与所述用户接入请求对应的状态字段。
本公开一实施例的软件定义网络SDN安全通信的装置还可以包括：检测模块和反馈模块。
检测模块设置为检测存在与所述云用户的用户接入请求对应的流表项记录，确定所述用户接入请求不为首次发送的用户接入请求。
反馈模块设置为将针对所述云用户的用户接入请求的处理结果返回给所述云用户，其中，所述处理结果包括：通过所述流表项记录记录所述云用户的用户接入请求已经由所述云服务器检测安全并产生一接受访问所述第一SDN控制器的检测结果。
本公开一实施例的软件定义网络SDN安全通信的装置中，在用户端的用户请求为具有终端应用的用户终端的一个第一网络授权请求时，所述收发模块92可以包括：发送子模块和接收子模块。
发送子模块设置为发送所述第一网络授权请求至所述云服务器。
接收子模块设置为接收由所述云服务器针对所述第一网络授权请求进行安全检测返回的检测结果，其中，所述检测结果包括：检测所述第一SDN控制器中是否存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求。
本公开一实施例的软件定义网络SDN安全通信的装置中，所述第一处理模块93可以包括：生成单元和第一处理单元。
生成单元设置为在所述检测结果为所述第一SDN控制器中不存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求时，根据所述第一网络授权请求，生成与所述第一网络授权请求唯一对应的第一令牌码。
第一处理单元设置为验证所述第一网络授权请求中的所述用户名、所述密码及所述域名，并在验证通过时，生成携带有所述第一网络授权请求及所述第一令牌码的授权目标对象并发送所述授权目标对象至所述用户终端。
本公开一实施例的软件定义网络SDN安全通信的装置中，所述第一处理模块93可以包括第二处理单元。第二处理单元设置为在所述检测结果为所述第一SDN控制器存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求时，获取所述第二网络授权请求唯一对应的第二令牌码，生成携 带有所述第一网络授权请求及所述第二令牌码的授权目标对象并发送所述授权目标对象至所述用户终端。
本公开一实施例的软件定义网络SDN安全通信的装置中，在用户端的用户请求为具有终端应用的用户终端的多个第一网络授权请求时，所述收发模块92可以包括：分配单元、第二发送单元和收发单元。
分配单元设置为为每个第一网络授权请求分配优先级。
第二发送单元设置为按照所述优先级发送所述多个第一网络授权请求至所述云服务器。
收发单元设置为按照所述优先级接收由所述云服务器针对所述多个第一网络授权请求进行安全检测返回的检测结果。
本公开一实施例的软件定义网络SDN安全通信的装置还可以包括：转换模块。
转换模块设置为通过预定接口转换所述检测结果的数据格式与所述第一SDN控制器的数据格式相匹配。
本公开一实施例的软件定义网络SDN安全通信的装置还可以包括：建立模块和获取模块。
建立模块设置为建立所述第一SDN控制器与至少一个第二SDN控制器连接，其中，所述至少一个第二SDN控制器与所述第一SDN控制器处于不同域。
获取模块设置为获取来自所述至少一个第二SDN控制器所在域的用户端的用户请求。
本公开实施例中，建立不同域的终端用户的连接，可以实现跨域情况下的令牌授权。如图10所示跨域的结构，比如，终端用户的应用App2为被授权方，终端用户的应用App3为资源方。如果终端用户的应用App2要访问终端用户的应用App3的资源，可以从第一SDN控制器1001的令牌(Token)获取访问令牌。第一种方式是终端用户的应用App2获得终端用户的应用App3得到授权目标对象，使用授权目标对象从令牌(Token)得到访问令牌。第二种方式是终端用户的应用App3把终端用户的应用App2的网络授权请求转向到令牌(Token)，通过第二SDN控制器1002的令牌(Token)对终端用户的应用App3认证后，终端用户的应用App3给终端用户的应用App2发放授权目标对象，终端用户的 应用App2使用授权目标对象从令牌(Token)获得访问令牌码。
如图11所示，本公开实施例的第一SDN控制器与数据转发层的数据包的处理过程包括：
数据转发层的包头信息提取模块提取数据帧包头信息数据包中的包头关键信息，并对包头关键信息进行处理和存储；
数据转发层将包头关键信息与状态表21进行比较和匹配，如果状态表21中没有关于该包头关键信息的记录，则添加相关记录，并将包头关键信息的状态置为默认DEFAULT；
将匹配结果信息与该状态信息一并发送，与变换流表22进行比较和匹配。若变换流表22中没有相应记录，数据转发层发送收入封包数(PacketIn)消息到第一SDN控制器23，第一SDN控制器23匹配的连接状态表21下发流组(FlowMod)到数据转发层；
按照第一SDN控制器23指令更新变换流表22，同时执行相应数据转发操作；
将变换流表22中下一个状态的相关信息写回到状态表21；以及
数据转发层向第一SDN控制器23发送数据状态(DATA_STATE_IN)消息对第一SDN控制器23中的状态表21进行更新。
第五实施例
如图12所示，本公开实施例的软件定义网络SDN安全通信的装置，设置于云服务器中。本实施例中的软件定义网络SDN安全通信的装置包括：接收模块1201、产生模块1202和第二处理模块1203。
接收模块1201设置为接收来自第一SDN控制器转发的用户请求，其中，所述用户请求由用户端向所述第一SDN控制器发送。
产生模块1202设置为针对所述用户请求进行安全检测，并产生检测结果。
第二处理模块1203设置为将所述检测结果发送至所述第一SDN控制器，由所述第一SDN控制器对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端。
本公开实施例中，通过云服务器对第一SDN控制器提供接入安全功能，以 服务的形式为用户端提供安全保障，可以对接入安全问题进行服务，提高了第一SDN控制器云服务的安全性。
本公开提供的装置是应用上述软件定义网络SDN安全通信的方法的装置，则上述应用于云服务器的软件定义网络SDN安全通信的方法的所有实施例均适用于该装置。
本公开一实施例的软件定义网络SDN安全通信的装置中，所述接收模块1201还可以设置为接收来自第一SDN控制器转发的由云用户发送的用户接入请求。
本公开一实施例的软件定义网络SDN安全通信的装置中，所述产生模块1202可以设置为：
针对所述用户接入请求，检测所述用户接入请求的安全并产生一拒绝访问所述第一SDN控制器的检测结果或接受访问所述第一SDN控制器的检测结果。
本公开一实施例的软件定义网络SDN安全通信的装置中，所述接收模块1201可以设置为：接收来自第一SDN控制器转发的由具有终端应用的用户终端发送的至少一个第一网络授权请求，其中，所述第一网络授权请求包括：所述用户终端的用户名、与所述用户名对应的密码及所述用户终端所在域名。
本公开一实施例的软件定义网络SDN安全通信的装置中，所述产生模块1202可以设置为：检测所述第一SDN控制器中是否存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求，产生一检测所述第一SDN控制器存在所述第二网络授权请求的检测结果或所述第一SDN控制器不存在所述第二网络授权请求的检测结果。
本公开一实施例的软件定义网络SDN安全通信的装置还可以包括接收存储模块。
接收存储模块设置为接收并存储所述第一SDN控制器发送的授权目标对象，其中，所述授权目标对象包括：所述第一网络授权请求及由所述第一SDN控制器产生的第一令牌码及第二令牌码中的任一令牌码。
本公开一实施例的软件定义网络SDN安全通信的装置还可以包括检测控制模块。
检测控制模块设置为检测所述第一SDN控制器的网络攻击信息，禁止打开 所述网络攻击信息，并删除所述网络攻击信息，其中，所述网络攻击信息携带有窃取信息及转发网络的行为信息。
如图13所示，本公开实施例的云服务器的应用的流程如下。
云服务器可以与云服务提供商进行配合，该云服务提供商具有大数据计算能力，通过集群应用、网格技术或分布式文件系统等功能，将网络中大量多种不同类型的存储设备通过应用软件集合起来协同工作，共同提供数据存储、处理和业务访问功能的一个系统。安全服务云(相当于上述的云服务器)，把云计算的接入云服务器放在云服务提供商之外，由第三方提供，可以实现接入的外包，可以为云用户提供接入安全的服务，以服务的形式为用户提供安全保障。本实施例以一个云服务提供商和一个安全服务云进行应用说明，也可以部署多个云服务提供商和安全服务云。
当云用户(包括个人用户451或企业用户452)的用户接入请求要求进行安全服务时，OpenFlow交换机43根据用户接入请求的服务类型(该服务类型可以包括：数据完整性检测、统一用户管理以及网络攻击探测)将用户接入请求分配给安全服务云41执行；
云服务供应商44实现对用户接入请求的用户数据的存储和处理并将存储处理结果提供给第一SDN控制器42；
安全服务云41处理用户接入请求，决定用户接入请求的用户的数据的转发、阻断或用户接入访问或者拒绝访问，将决定结果通过API接口421通知第一SDN控制器42；以及
第一SDN控制器42生成相应的流表项，下发给OpenFlow交换机43(该OpenFlow交换机43为数据转发层的一个应用实体，在此仅仅为举例说明)，OpenFlow交换机43执行操作。当后面有相同的用户接入请求时，OpenFlow交换机43可根据服务历史记录的流表项执行操作，用户接入请求无需再次通过安全服务云41。对于云用户定制的服务，可以在第一SDN控制器上配置对应流表项完成指定功能，第一SDN控制器42把OpenFlow交换机43和云用户、终端用户46的响应发送给安全服务云41。
如图14和图15所示，本公开实施例的第一SDN控制器及云服务器的应用如下。
在实施过程中，SDN网络包括五层，其中五层分别为：应用服务层51(相当于上述的终端用户)、界面监管层52(对应的应用实体可以为终端显示器)、控制层53(相当于上述的第一SDN控制器)、数据转发层54(对应的应用实体可以为交换机)以及云服务层55(相当于上述的云服务器)。
应用服务层51向控制层53发送网络授权请求，控制层53根据应用服务层51的多种请求类型，分析控制层53状态，制定网络授权请求优先级，验证接收到的来自应用携带的数字签名，对网络授权请求进行验证，向应用服务层51发送访问授权令牌。
界面监管层52设置为显示网络中的令牌授权信息，令牌授权过程，冲突分析和决策结果，网络拓扑、告警和链路等信息。
控制层53接收应用服务层51的多种用户请求，根据应用类型设定相应的优先级，通过令牌授权模块(相当于上述的第一处理单元第二处理单元中的至少一个)向给用户请求发放授权码、或发放停止授权码，并通过优先级分析算法给每个用户请求设定优先级；通过FlowMode消息和PacketIn消息与数据转发层54进行通讯。控制层53发出第一SDN控制器-交换机信息(数据转发层54数据也通过控制层53实现)，用于控制OpenFlow交换机的操作，包括通讯握手、交换机流表配置、修改交换机状态、数据队列的设置、交换机状态的读取以及发包方法，实现安全保障。
上述应用服务层51的应用根据来源和功能可以分为四种类型：命令行应用511、网管应用512、安全应用513和其它应用514，其中，
命令行应用511是由控制器管理人员接入的应用，通过控制器预留的命令行(非开源)实现对控制器的配置、查询等操作，可实现一些验证和调试的功能。
网管应用512是用来实现网络管理员对控制器进行网络多种配置，并查看网络状态，如告警和拓扑等状态。
安全应用513是指网络中接入的安全服务云第三方机构，为用户提供安全方面的服务和保障。
其它应用514可以指预留的处理应用，实现比如控制器软件升级、开启日志以及内存泄露检测等等功能。
可选的，上述界面监管层52包括用户界面521和界面处理模块522。
用户界面521设置为从界面处理模块522获取数据，把数据转为图形界面，为网管人员提供配置的窗口，并下发表征状态转移(Representational State Transfer，REST)或超文本传输协议(HyperText Transfer Protocolc，HTTP)协议发送配置至界面处理模块522。
界面处理模块522，接收反馈模块531信息，以REST、HTTP协议的方式将响应结果发送给用户界面521，并把用户界面521指令缓存后，发送给反馈模块531。
可选的，控制层53包括反馈模块531、令牌授权模块532，认证授权模块533、优先级分析模块534、流表管理模块535、命令下发及连接状态表同步模块536、存储模块537及API接口模块538(相当于上述的转换模块)。
反馈模块531(相当于反馈模块)可以实现把认证授权信息、优先级分析与决策信息反馈给网络管理人员。
令牌授权模块532(相当于上述的第一处理单元和第二处理单元中的至少一个)可以通过应用服务层51的Token服务发来的网络授权请求向授权服务器请求访问令牌，并把访问令牌发送给认证授权模块533。
认证授权模块533(相当于收发模块)接收应用服务层51的授权请求和令牌授权模块的令牌码，设置应用访问优先级别，并给要访问应用发放授权和令牌码。
优先级分析模块534(相当于收发模块)分析每个用户请求的重要性，并判断是否与流表管理模块535中已有的流规则存在冲突，若存在冲突，则根据分析算法缓解冲突，对用户请求的流规则接收或拒绝操作，对流表管理模块535进行更新。优先级分析模块534还定义SDN控制器的连接状态表，负责和数据转发模块的SDN交换机中的连接状态表保持同步，同时当收到OpenFlow交换机发送PacketIn消息时，该模块可以将包头信息和状态信息与连接状态表或者防火墙规则集进行对比，分配相应状态，同时下发变换流表到OpenFlow交换机中。
流表管理模块535(相当于第一处理模块)设置为保存网络中正在运行的所有流表信息。流表管理模块535是用户请求的流规则，可以为优先级分析模块 534提供服务。流表管理模块535也可以向命令下发及连接状态表同步模块提供流规则，以便向交换机进行下发OpenFlow消息。
命令下发及连接状态表同步模块536(相当于第一处理模块)设置为在第一SDN控制器端建立连接状态表，与OpenFlow交换机中的状态表保持同步，同时当收到OpenFlow交换机发送PacketIn消息时，该模块将会将OpenFlow交换机中的包头信息和状态信息与连接状态表或者防火墙规则集进行对比，分配相应状态，同时下发变换流表到OpenFlow交换机中。
存储模块537(相当于第一处理模块)可以对每个模块的数据进行存储，实现用户认证数据的持久化，实现拓扑资源的存储等等，保证断电后，数据的恢复。
API模块538(相当于API接口)可以是与控制器的接口，也可以是与云服务模块的接口，负责云服务模块与SDN控制器的交互，保证云服务器的网络管理策略下发到OpenFlow交换机上，由OpenFlow交换机执行实施。
可选的，数据转发层54包括交换机信息提取模块541、状态表模块542、变化流表模块543、数据队列模块544和数据检测模块545。
数据转发层54使用安全传输层协议(Transport Layer Security，TLS)来认证和加密网络设备端与第一SDN控制器之间的流量，使用TLS帮助验证控制器和网络设备或第一SDN控制器，防止窃听和伪造南向通信。通过OpenFlow交换机向第一SDN控制器发送PacketIn消息，指示第一SDN控制器的网络行为的刷新和交换机状态变更，在第一SDN控制器和OpenFlow交换机中部署SDN防火墙，在OpenFlow协议中添加新的消息和添加相关状态字段实现了SDN防火墙的部署。
交换机信息提取模块541设置为提取数据帧包头部中关键信息，所述的关键信息包括数据包的源地址、源端口、目的地址、目的端口、序列号、确认号以及传输控制协议(Transmission Control Protocol，TCP)标志位。
状态表模块542设置为在所述的数据转发层中建立连接状态表，并同时将连接状态表的更新同步到所述的第一SDN控制器中，该模块的连接状态表的更新将由变换流表通过指令控制，如SET_STATE指令。
变换流表模块543设置为在由第一SDN控制器下发指令在所述的数据转发 层中建立变换流表，负责状态转换过程以及数据包转发操作。
数据队列模块544设置为设置发送消息的数据队列，并存储队列信息，如Hello报文、响应请求以及应答请求等。
数据检测模块545设置为判别来到所述数据转发层的数据包是在第几次数据转发层中的终端与SDN控制器的连接中获取的，检验连接状态的合法性。
连接状态表通过分别向第一SDN控制器和数据转发层54发送消息，实现第一SDN控制器和数据转发层54的同步，当第一SDN控制器中的数据更新时，向数据转发层54交换机发送消息，也命令数据转发层54交换机的状态表进行更新，并返回更新状态。当数据转发层54交换机中的状态表更新时，向第一SDN控制器发送消息，也命令第一SDN控制器对数据进行更新，并返回更新状态。
本公开实施例中，通过对OpenFlow协议的扩展，增加状态字段，使流表依据状态执行，实现对连接状态表的更新，实现在数据转发层的防火墙的部署，也可以实现针对第一SDN控制器的安全认证，北向为用户提供接入安全方面的服务，通过令牌授权的方式，为用户提供安全保障，并支持集群控制器和大量网络设备，支持对大量网络设备应用的云安全服务，并实时将网络状态反馈给用户。第一SDN控制器产生相应的流表项，下发给OpenFlow交换机执行，实现数据流的调配，同时将OpenFlow交换机的反馈信息发送给第一SDN控制器或网络管理人员决策。
本公开实施例还提供了一种非暂态计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行上述任一方法。
本公开实施例还提供了一种云服务器的硬件结构示意图。参见图16，该云服务器包括：
至少一个处理器(processor)1600，图16中以一个处理器1600为例；和存储器(memory)1601，还可以包括通信接口(Communications Interface)1602和总线1603。其中，处理器1600、通信接口1602、存储器1601可以通过总线1603完成相互间的通信。通信接口1602可以用于信息传输。处理器1600可以调用存储器1601中的逻辑指令，以执行上述应用于云服务器的软件定义网络SDN安全通信的方法。
此外，上述的存储器1601中的逻辑指令可以通过软件功能单元的形式实现 并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。
存储器1601作为一种计算机可读存储介质，可用于存储软件程序、计算机可执行程序，如本公开实施例中应用于云服务器的软件定义网络SDN安全通信的方法对应的程序指令或模块。处理器1600通过运行存储在存储器1601中的软件程序、指令或模块，从而执行功能应用以及数据处理。
存储器1601可包括存储程序区和存储数据区，其中，存储程序区可存储操作系统、至少一个功能所需的应用程序；存储数据区可存储根据终端的使用所创建的数据等。此外，存储器1601可以包括高速随机存取存储器，还可以包括非易失性存储器。
本公开的技术方案可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括一个或多个指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本公开实施例所述方法的全部或部分步骤。而前述的存储介质可以是非暂态存储介质，包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等多种可以存储程序代码的介质，也可以是暂态存储介质。
工业实用性
本公开提供的软件定义网路SDN安全通信的方法及装置，能够避免相关技术中的云安全服务提供商控制SDN计算与存储业务时，存在的安全隐患。

Claims (21)

  1. 一种软件定义网络SDN安全通信的方法，应用于第一SDN控制器，包括：
    获取来自用户端的用户请求；
    发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果；以及
    对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端。
  2. 如权利要求1所述的方法，其中，
    所述用户端的用户请求包括以下至少一个：云用户的用户接入请求和具有终端应用的用户终端的至少一个第一网络授权请求，所述至少一个第一网络授权请求包括：所述用户终端的用户名、与所述用户名对应的密码及所述用户终端所在域名。
  3. 如权利要求2所述的方法，其中，
    在用户端的用户请求为云用户的用户接入请求时，所述发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果，包括：
    检测所述云用户的用户接入请求为首次发送的用户接入请求时，转发所述用户接入请求至所述云服务器；以及
    接收由所述云服务器针对所述用户接入请求进行安全检测返回的检测结果，所述检测结果包括：由所述云服务器检测所述用户接入请求的安全并产生一拒绝访问所述第一SDN控制器的检测结果或接受访问所述第一SDN控制器的检测结果。
  4. 如权利要求3所述的方法，其中，
    所述对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端，包括：
    对所述检测结果进行处理，产生一流表项记录；以及
    发送所述检测结果及所述流表项记录至所述云用户，所述流表项记录包括：与所述用户接入请求对应的状态字段。
  5. 如权利要求2所述的方法，
    在所述获取来自用户端的用户请求之后，所述用户端的用户请求为云用户的用户接入请求时，所述方法还包括：
    检测存在与所述云用户的用户接入请求对应的流表项记录，确定所述用户接入请求不为首次发送的用户接入请求；以及
    将针对所述云用户的用户接入请求的处理结果返回给所述云用户，其中，所述处理结果包括：通过所述流表项记录记录所述云用户的用户接入请求已经由所述云服务器检测安全并产生一接受访问所述第一SDN控制器的检测结果。
  6. 如权利要求2所述的方法，其中，在用户端的用户请求为具有终端应用的用户终端的一个第一网络授权请求时，所述发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果，包括：
    发送所述第一网络授权请求至所述云服务器；以及
    接收由所述云服务器针对所述第一网络授权请求进行安全检测返回的检测结果，所述检测结果包括：检测所述第一SDN控制器中是否存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求。
  7. 如权利要求6所述的方法，其中，
    所述对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端，包括：
    在所述检测结果为所述第一SDN控制器中不存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求时，根据所述第一网络授权请求，生成与所述第一网络授权请求唯一对应的第一令牌码；以及
    验证所述第一网络授权请求中的所述用户名、所述密码及所述域名，并在验证通过时，生成携带有所述第一网络授权请求及所述第一令牌码的授权目标对象并发送所述授权目标对象至所述用户终端。
  8. 如权利要求6所述的方法，其中，
    所述对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端，包括：
    在所述检测结果为所述第一SDN控制器存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求时，获取所述第二网络授权请求唯一对应的第二令牌码，生成携带有所述第一网络授权请求及所述第二令牌码的授权目标对象并发送所述授权目标对象至所述用户终端。
  9. 如权利要求2所述的方法，其中，在用户端的用户请求为具有终端应用的用户终端的多个第一网络授权请求时，所述发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果，包括：
    为每个第一网络授权请求分配优先级；
    按照所述优先级发送所述多个第一网络授权请求至所述云服务器；以及
    按照所述优先级接收由所述云服务器针对所述多个第一网络授权请求进行安全检测返回的检测结果。
  10. 如权利要求1至9任一项所述的方法，在对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端之前，所述方法还包括：
    通过预定接口转换所述检测结果的数据格式与所述第一SDN控制器的数据格式相匹配。
  11. 如权利要求1至9任一项所述的方法，在获取来自用户端的用户请求之前，所述方法还包括：
    建立所述第一SDN控制器与至少一个第二SDN控制器连接，其中，所述至少一个第二SDN控制器与所述第一SDN控制器处于不同域；以及
    获取来自所述至少一个第二SDN控制器所在域的用户端的用户请求。
  12. 一种软件定义网络SDN安全通信的方法，应用于云服务器，包括：
    接收来自第一SDN控制器转发的用户请求，其中，所述用户请求由用户端向所述第一SDN控制器发送；
    针对所述用户请求进行安全检测，并产生检测结果；以及
    将所述检测结果发送至所述第一SDN控制器，由所述第一SDN控制器对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端。
  13. 如权利要求12所述的方法，其中，所述接收来自第一SDN控制器转发的用户请求，包括：
    接收来自第一SDN控制器转发的由云用户发送的用户接入请求。
  14. 如权利要求13所述的方法，其中，所述针对所述用户请求进行安全检测，并产生检测结果，包括：
    针对所述用户接入请求，检测所述用户接入请求的安全并产生一拒绝访问所述第一SDN控制器的检测结果或接受访问所述第一SDN控制器的检测结果。
  15. 如权利要求12所述的方法，其中，所述接收来自第一SDN控制器转发的用户请求，包括：
    接收来自第一SDN控制器转发的由具有终端应用的用户终端发送的至少一个第一网络授权请求，所述至少一个第一网络授权请求包括：所述用户终端的用户名、与所述用户名对应的密码及所述用户终端所在域名。
  16. 如权利要求15所述的方法，其中，所述针对所述用户请求进行安全检测，并产生检测结果，包括：
    检测所述第一SDN控制器中是否存在与所述第一网络授权请求的用户名、密码及域名均相同的第二网络授权请求，产生一检测所述第一SDN控制器存在所述第二网络授权请求的检测结果或所述第一SDN控制器不存在所述第二网络授权请求的检测结果。
  17. 如权利要求16所述的方法，还包括：
    接收并存储所述第一SDN控制器发送的授权目标对象，其中，所述授权目标对象包括：所述第一网络授权请求及由所述第一SDN控制器产生的第一令牌码及第二令牌码中的任一令牌码。
  18. 如权利要求12至16任一项所述的方法，还包括：
    检测所述第一SDN控制器的网络攻击信息，禁止打开所述网络攻击信息，并删除所述网络攻击信息，其中，所述网络攻击信息携带有窃取信息及转发网络的行为信息。
  19. 一种软件定义网络SDN安全通信的装置，设置于第一SDN控制器中，包括：
    第一获取模块，设置为获取来自用户端的用户请求；
    收发模块，设置为发送所述用户请求至云服务器，并接收由所述云服务器针对所述用户请求进行安全检测返回的检测结果；以及
    第一处理模块，设置为对所述检测结果进行处理，产生处理结果，并发送 所述检测结果和所述处理结果中的至少一个至所述用户端。
  20. 一种软件定义网络SDN安全通信的装置，设置于云服务器中，包括：
    接收模块，设置为接收来自第一SDN控制器转发的用户请求，其中，所述用户请求由用户端向所述第一SDN控制器发送；
    产生模块，设置为针对所述用户请求进行安全检测，并产生检测结果；以及
    第二处理模块，设置为将所述检测结果发送至所述第一SDN控制器，由所述第一SDN控制器对所述检测结果进行处理，产生处理结果，并发送所述检测结果和所述处理结果中的至少一个至所述用户端。
  21. 一种非暂态计算机可读存储介质，存储有计算机可执行指令，所述计算机可执行指令设置为执行权利要求1-18中任一项的方法。
PCT/CN2017/074331 2016-03-11 2017-02-22 软件定义网路sdn安全通信的方法及装置 WO2017152754A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610139226.9 2016-03-11
CN201610139226.9A CN107181720B (zh) 2016-03-11 2016-03-11 一种软件定义网路sdn安全通信的方法及装置

Publications (1)

Publication Number Publication Date
WO2017152754A1 true WO2017152754A1 (zh) 2017-09-14

Family

ID=59789977

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/074331 WO2017152754A1 (zh) 2016-03-11 2017-02-22 软件定义网路sdn安全通信的方法及装置

Country Status (2)

Country Link
CN (1) CN107181720B (zh)
WO (1) WO2017152754A1 (zh)

Cited By (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111049886A (zh) * 2019-11-29 2020-04-21 紫光云(南京)数字技术有限公司 多区域sdn控制器数据同步方法、服务器及系统
CN113315704A (zh) * 2021-05-20 2021-08-27 中国联合网络通信集团有限公司 报文转发方法、sdn控制器、交换机及系统
CN114978942A (zh) * 2022-05-13 2022-08-30 深信服科技股份有限公司 一种路由器检测方法、装置及电子设备和存储介质
US11722570B1 (en) * 2022-05-13 2023-08-08 Microsoft Technology Licensing, Llc Sharing SDN policy state information between SDN appliances
WO2024104405A1 (zh) * 2022-11-15 2024-05-23 杭州阿里云飞天信息技术有限公司 表项一致性检查方法、电子设备及存储介质

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN109561054B (zh) * 2017-09-26 2020-12-01 华为技术有限公司 一种数据传输方法、控制器及接入设备
CN108512699B (zh) * 2018-03-15 2020-08-14 中国联合网络通信集团有限公司 区块链业务服务器数据异常检测方法、设备及区块链系统
CN108768932A (zh) * 2018-04-09 2018-11-06 中国电信股份有限公司上海分公司 一种轻量级sdn交换机与控制器的安全连接方法
CN108881059B (zh) * 2018-05-29 2022-05-24 新华三技术有限公司 控制器角色确定方法、网络交换设备、控制器及网络系统
CN108810001A (zh) * 2018-06-20 2018-11-13 郑州云海信息技术有限公司 一种基于sdn的安全服务控制系统及方法
CN109743598A (zh) * 2018-12-29 2019-05-10 深圳Tcl新技术有限公司 授权第三方接入电视的方法、系统及可读存储介质
CN110932814B (zh) * 2019-12-05 2020-10-02 北京邮电大学 软件定义的网络授时安全防护方法、装置及系统
CN112217902B (zh) * 2020-10-22 2022-03-22 新华三信息安全技术有限公司 一种防火墙数据同步方法及装置
CN112637154B (zh) * 2020-12-09 2022-06-21 迈普通信技术股份有限公司 设备认证方法、装置、电子设备及存储介质
CN114143065B (zh) * 2021-11-26 2024-07-05 杭州安恒信息安全技术有限公司 一种安全事件处理方法、装置、设备及介质
CN114338400B (zh) * 2021-12-31 2024-05-14 中国电信股份有限公司 Sdn网络动态控制方法及装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103051557A (zh) * 2012-12-27 2013-04-17 华为技术有限公司 数据流处理方法及系统、控制器、交换设备
CN104104561A (zh) * 2014-08-11 2014-10-15 武汉大学 一种基于OpenFlow协议的SDN防火墙状态检测方法及系统
CN104219218A (zh) * 2013-06-04 2014-12-17 杭州华三通信技术有限公司 一种主动安全防御的方法及装置
CN104363203A (zh) * 2014-10-16 2015-02-18 贵州中科博智科技有限公司 一种基于sdn的安全云接入方法
US20150304281A1 (en) * 2014-03-14 2015-10-22 Avni Networks Inc. Method and apparatus for application and l4-l7 protocol aware dynamic network access control, threat management and optimizations in sdn based networks
CN105227344A (zh) * 2015-08-21 2016-01-06 武汉烽火网络有限责任公司 基于OpenStack的软件定义网络模拟系统及方法

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103607379A (zh) * 2013-11-04 2014-02-26 中兴通讯股份有限公司 一种软件定义网络安全实施方法、系统及控制器
CN104767696B (zh) * 2014-01-07 2018-05-04 上海诺基亚贝尔股份有限公司 Sdn化的接入网中控制用户接入的方法及装置
CN104113839A (zh) * 2014-07-14 2014-10-22 蓝盾信息安全技术有限公司 基于sdn的移动数据安全保护系统及方法

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103051557A (zh) * 2012-12-27 2013-04-17 华为技术有限公司 数据流处理方法及系统、控制器、交换设备
CN104219218A (zh) * 2013-06-04 2014-12-17 杭州华三通信技术有限公司 一种主动安全防御的方法及装置
US20150304281A1 (en) * 2014-03-14 2015-10-22 Avni Networks Inc. Method and apparatus for application and l4-l7 protocol aware dynamic network access control, threat management and optimizations in sdn based networks
CN104104561A (zh) * 2014-08-11 2014-10-15 武汉大学 一种基于OpenFlow协议的SDN防火墙状态检测方法及系统
CN104363203A (zh) * 2014-10-16 2015-02-18 贵州中科博智科技有限公司 一种基于sdn的安全云接入方法
CN105227344A (zh) * 2015-08-21 2016-01-06 武汉烽火网络有限责任公司 基于OpenStack的软件定义网络模拟系统及方法

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111049886A (zh) * 2019-11-29 2020-04-21 紫光云(南京)数字技术有限公司 多区域sdn控制器数据同步方法、服务器及系统
CN111049886B (zh) * 2019-11-29 2023-07-07 紫光云(南京)数字技术有限公司 多区域sdn控制器数据同步方法、服务器及系统
CN113315704A (zh) * 2021-05-20 2021-08-27 中国联合网络通信集团有限公司 报文转发方法、sdn控制器、交换机及系统
CN114978942A (zh) * 2022-05-13 2022-08-30 深信服科技股份有限公司 一种路由器检测方法、装置及电子设备和存储介质
US11722570B1 (en) * 2022-05-13 2023-08-08 Microsoft Technology Licensing, Llc Sharing SDN policy state information between SDN appliances
CN114978942B (zh) * 2022-05-13 2024-05-24 深信服科技股份有限公司 一种路由器检测方法、装置及电子设备和存储介质
WO2024104405A1 (zh) * 2022-11-15 2024-05-23 杭州阿里云飞天信息技术有限公司 表项一致性检查方法、电子设备及存储介质

Also Published As

Publication number Publication date
CN107181720A (zh) 2017-09-19
CN107181720B (zh) 2021-06-15

Similar Documents

Publication Publication Date Title
WO2017152754A1 (zh) 软件定义网路sdn安全通信的方法及装置
US11641361B2 (en) Dynamic access control to network resources using federated full domain logon
US11695757B2 (en) Fast smart card login
US11489872B2 (en) Identity-based segmentation of applications and containers in a dynamic environment
US10116700B2 (en) Installing configuration information on a host
US10021088B2 (en) Fast smart card logon
EP3162017B1 (en) Security in software defined network
WO2018095416A1 (zh) 信息处理方法、装置及系统
CN112422532B (zh) 业务通信方法、系统、装置及电子设备
JP2020502616A (ja) フェデレーテッド・シングル・サインオン（ｓｓｏ）のための非侵入型セキュリティの実施
US9882965B2 (en) Techniques for network process identity enablement
US20200213215A1 (en) Access device blockchain network systems and methods
CN113341798A (zh) 远程访问应用的方法、系统、装置、设备及存储介质
US10791119B1 (en) Methods for temporal password injection and devices thereof
CN115486030A (zh) 流氓证书检测
JP6832990B2 (ja) ソフトウェア定義ネットワークにおけるセキュリティ
US20170331838A1 (en) Methods and computing devices to regulate packets in a software defined network
US9680871B2 (en) Adopting policy objects for host-based access control
Basu et al. Strengthening Authentication within OpenStack Cloud Computing System through Federation with ADDS System
US9172717B2 (en) Security-aware admission control of requests in a distributed system

Legal Events

Date Code Title Description
NENP Non-entry into the national phase

Ref country code: DE

121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17762440

Country of ref document: EP

Kind code of ref document: A1

122 Ep: pct application non-entry in european phase

Ref document number: 17762440

Country of ref document: EP

Kind code of ref document: A1