WO2018095263A1 - 基于sdn网络的数据传输方法 - Google Patents

基于sdn网络的数据传输方法 Download PDF

Info

Publication number
WO2018095263A1
WO2018095263A1 PCT/CN2017/111298 CN2017111298W WO2018095263A1 WO 2018095263 A1 WO2018095263 A1 WO 2018095263A1 CN 2017111298 W CN2017111298 W CN 2017111298W WO 2018095263 A1 WO2018095263 A1 WO 2018095263A1
Authority
WO
WIPO (PCT)
Prior art keywords
node
network
target
data transmission
firewall
Prior art date
Application number
PCT/CN2017/111298
Other languages
English (en)
French (fr)
Inventor
祖立军
何朔
刘国宝
Original Assignee
中国银联股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中国银联股份有限公司 filed Critical 中国银联股份有限公司
Publication of WO2018095263A1 publication Critical patent/WO2018095263A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/029—Firewall traversal, e.g. tunnelling or, creating pinholes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures

Definitions

  • the present invention relates to a data transmission method, and more particularly to a data transmission method based on an SDN network.
  • connection establishment phase slow channel process
  • FTP-based applications the process of data transmission between conventional applications
  • connection establishment phase slow channel process
  • the source node sends a connection establishment request to a predetermined port of the target node (for example, port 21 of the FTP server), and then negotiates a data packet transmission port used for subsequent actual data transmission
  • an actual data transmission phase Fast channel process
  • the above prior art solution has the following problem: when it is required to transmit data with high security requirements (for example, sensitive data for payment) between the source node and the target node, all communication between the two physical nodes (both slow channel process and fast channel process) must pass through the firewall, so the firewall will become the bottleneck of network transmission, that is, all network traffic needs to be forwarded through the firewall to implement security judgment, so there is a potential data processing performance bottleneck.
  • data with high security requirements for example, sensitive data for payment
  • the present invention proposes an SDN network-based data transmission method with high data transmission performance.
  • a data transmission method based on SDN network wherein the data transmission method based on SDN network includes Column steps:
  • the central controller of the SDN network performs an initialization operation to control the on and off of the data flow between the physical nodes in the SDN network by means of a flow table;
  • the source node sends a connection establishment request to the target node via the firewall node, and then negotiates network connection parameters with the target node via the firewall node, and then based on the negotiated network connection parameters And performing actual data communication directly with the target node without passing through the firewall node.
  • the step (A1) further comprises: the central controller initially setting a disconnection between any two nodes in the SDN network.
  • the step (A3) further comprises: after the network connection between the source node and the target node is opened, the source node is The predetermined port of the target node sends the connection establishment request and subsequent data packets for negotiating network connection parameters, wherein the firewall node receives the connection establishment request and subsequent data packets for negotiating network connection parameters The security check is then performed in accordance with predetermined security rules, and the connection establishment request and subsequent data packets for negotiating network connection parameters are forwarded to the target node if the verification is passed.
  • the step (A3) further comprises: after receiving the connection establishment request, the target node determines network connection parameters for subsequent actual data transmission, and The determined network connection parameters are transmitted to the firewall node in the form of data packets.
  • the network connection parameter includes an identifier of a target transmission port for subsequent actual data transmission.
  • the step (A3) further comprises: after receiving the network connection parameter, the firewall node requests the center according to a target transmission port indicated by the network connection parameter The controller turns on its connectivity.
  • the step (A3) further comprises: after receiving the request from the firewall node, the central controller turns on network connectivity of the target transmission port, and Notifying the firewall node that the target transmission port has been opened.
  • the step (A3) further comprises: after the target transmission port has been opened, the firewall node transmits the network connection parameter to the source in the form of a data packet node.
  • the step (A3) further comprises: after receiving the network connection parameter, the source node directly connects according to the network without using the firewall node
  • the target transmission port indicated by the parameter performs actual data communication with the target node in the form of a data packet.
  • the predetermined security rule includes verifying the feature-based digital signature.
  • the SDN network-based data transmission method disclosed by the present invention has the following advantages: since the slow channel process and the fast channel process adopt different transmission strategies, that is, the fast channel process does not pass through the firewall node, it has significantly improved network data transmission performance.
  • FIG. 1 is a flow chart of a SDN network based data transmission method in accordance with an embodiment of the present invention.
  • the SDN network-based data transmission method disclosed by the present invention includes the following steps: (A1) The central controller of the SDN network performs an initialization operation to control the physics in the SDN network by means of a flowtable (flowtable) (A2) when a source node in the SDN network needs to transmit data to a target node, the source node requests the central controller to be activated with the target node and fire (A3) the source node sends a connection establishment request to the target node via the firewall node, and then negotiates network connection parameters with the target node via the firewall node, and The negotiated network connection parameters and actual data communication with the target node directly without passing through the firewall node.
  • A1 The central controller of the SDN network performs an initialization operation to control the physics in the SDN network by means of a flowtable (flowtable)
  • A2 when a source node in the SDN network needs to transmit data to a target node, the source node requests the central controller to be activated with the target node and fire
  • the step (A1) further includes: the central controller initially setting a disconnection between any two nodes in the SDN network ( That is, the network connection between the nodes is opened in the form of a white list).
  • the step (A3) further includes: after the network connection between the source node and the target node is opened, the source node is The firewall node sends the connection establishment request and a subsequent data packet for negotiating network connection parameters to a predetermined port of the target node (for example, port 21 for FTP), wherein the firewall node receives the After the connection establishment request and the subsequent data packet for negotiating the network connection parameters are checked for security according to a predetermined security rule, and the verification establishment is made, the connection establishment request and the subsequent negotiation for the network connection are performed. The data packet of the parameter is forwarded to the target node.
  • a predetermined port of the target node for example, port 21 for FTP
  • the step (A3) further includes: after receiving the connection establishment request, the target node determines to be used for subsequent actual data transmission.
  • Network connection parameters, and the determined network connection parameters are transmitted to the firewall node in the form of data packets.
  • the network connection parameter includes an identifier (ie, a target port number) of a target transmission port for subsequent actual data transmission.
  • the step (A3) further includes: after receiving the network connection parameter, the firewall node is indicated according to the network connection parameter
  • the target transmission port requests the central controller to turn on its connectivity.
  • the step (A3) further includes: after receiving the request from the firewall node, the central controller turns on the target transmission port Network connectivity, and then inform the firewall node that the target transport port has been opened.
  • the step (A3) further includes: after the target transmission port has been opened, the firewall node sends the network in the form of a data packet. Connection parameters are passed to the source node.
  • the step (A3) further includes: after receiving the network connection parameter, the source node does not pass through the firewall node.
  • the actual data communication with the target node is performed in the form of a data packet directly according to the target transmission port indicated by the network connection parameter.
  • the predetermined security rule comprises verifying the feature-based digital signature.
  • the SDN network-based data transmission method disclosed in the present invention has the following advantages: since the slow channel process and the fast channel process adopt different transmission strategies, that is, the fast channel process does not pass through the firewall node, the network data is significantly improved. Transmission performance.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明提出了基于SDN网络的数据传输方法，所述方法包括：SDN网络的中心控制器实施初始化操作，以通过流表的方式控制SDN网络中的物理节点之间的数据流的通断和传输；在SDN网络中的源节点需要向目标节点传送数据时，源节点请求中心控制器开通与目标节点和防火强节点的连通性；源节点经由防火墙节点向目标节点发送连接建立请求，并随之经由防火墙节点与目标节点协商网络连接参数，以及随之基于所协商的网络连接参数并在不经由防火墙节点的情况下直接与目标节点进行实际的数据通信。本发明所公开的方法具有高的数据传输性能。

Description

基于SDN网络的数据传输方法 技术领域
本发明涉及数据传输方法，更具体地，涉及基于SDN网络的数据传输方法。
背景技术
目前，随着计算机和网络应用的日益广泛以及不同领域的业务种类的日益丰富，通过网络(尤其是SDN网络)进行节点之间的数据传输变得越来越重要。
在现有的基于SDN(软件定义网络)网络的技术方案中，通常以如下方式进行物理节点之间的数据传输：SDN网络的中心控制器基于流表的形式控制整个网络中任意物理节点之上的应用之间的报文的转发和丢弃，其中，常规的应用(例如基于FTP的应用)之间进行数据传输的过程典型地分为如下两个阶段：(1)连接建立阶段(慢通道过程)，即源节点向目标节点的预定端口(例如FTP服务器端的21端口)发送连接建立请求，并随之协商后续的实际数据传输所使用的数据报文传输端口；(2)实际数据传输阶段(快通道过程)，即使用所协商的数据报文传输端口进行实际的数据传输过程。
然而，上述现有的技术方案存在如下问题：当需要在源节点和目标节点之间传输安全性要求较高的数据(例如用于支付的敏感数据)时，两个物理节点之间的所有通信(包括慢通道过程和快通道过程两者)必须经由防火墙，故防火墙将成为网络传输的瓶颈，即所有网络流量均需要通过防火墙实施安全判断后进行转发，故存在潜在的数据处理性能瓶颈。
因此，存在如下需求：提供具有高的数据传输性能的基于SDN网络的数据传输方法。
发明内容
为了解决上述现有技术方案所存在的问题，本发明提出了具有高的数据传输性能的基于SDN网络的数据传输方法。
本发明的目的是通过以下技术方案实现的：
一种基于SDN网络的数据传输方法，所述基于SDN网络的数据传输方法包括下 列步骤：
(A1)SDN网络的中心控制器实施初始化操作，以通过流表的方式控制SDN网络中的物理节点之间的数据流的通断和传输；
(A2)在所述SDN网络中的源节点需要向目标节点传送数据时，所述源节点请求所述中心控制器开通与所述目标节点和防火强节点的连通性；
(A3)所述源节点经由所述防火墙节点向所述目标节点发送连接建立请求，并随之经由所述防火墙节点与所述目标节点协商网络连接参数，以及随之基于所协商的网络连接参数并在不经由所述防火墙节点的情况下直接与所述目标节点进行实际的数据通信。
在上面所公开的方案中，优选地，所述步骤(A1)进一步包括：所述中心控制器初始设定所述SDN网络中的任意两个节点之间不连通。
在上面所公开的方案中，优选地，所述步骤(A3)进一步包括：在所述源节点和所述目标节点之间的网络连接开通后，所述源节点经由所述防火墙节点向所述目标节点的预定端口发送所述连接建立请求以及随后的用于协商网络连接参数的数据包，其中，所述防火墙节点在接收到所述连接建立请求以及随后的用于协商网络连接参数的数据包后按照预定的安全规则对其进行安全性核查，并在核查通过的情况下将所述连接建立请求以及随后的用于协商网络连接参数的数据包转发至所述目标节点。
在上面所公开的方案中，优选地，所述步骤(A3)进一步包括：在接收到所述连接建立请求后，所述目标节点确定用于随后的实际的数据传输的网络连接参数，并将所确定的网络连接参数以数据包的形式传送至所述防火墙节点。
在上面所公开的方案中，优选地，所述网络连接参数包括用于后续的实际数据传输的目标传输端口的标识符。
在上面所公开的方案中，优选地，所述步骤(A3)进一步包括：在接收到所述网络连接参数后，所述防火墙节点根据所述网络连接参数所指示的目标传输端口请求所述中心控制器开启其连通性。
在上面所公开的方案中，优选地，所述步骤(A3)进一步包括：在接收到来自所述防火墙节点的请求后，所述中心控制器开启所述目标传输端口的网络连通性，并随之通知所述防火墙节点该目标传输端口已开通。
在上面所公开的方案中，优选地，所述步骤(A3)进一步包括：在所述目标传输端口已开通后，所述防火墙节点以数据包的形式将所述网络连接参数传送至所述源节点。
在上面所公开的方案中，优选地，所述步骤(A3)进一步包括：在接收到所述网络连接参数后，所述源节点在不经由所述防火墙节点的情况下直接根据所述网络连接参数所指示的目标传输端口以数据包的形式与所述目标节点进行实际的数据通信。
在上面所公开的方案中，优选地，所述预定的安全规则包括对基于特征的数字签名进行校验。
本发明所公开的基于SDN网络的数据传输方法具有以下优点：由于慢通道过程和快通道过程采用不同的传输策略，即快通道过程不经由防火墙节点，故具有显著提高的网络数据传输性能。
附图说明
结合附图，本发明的技术特征以及优点将会被本领域技术人员更好地理解，其中：
图1是根据本发明的实施例的基于SDN网络的数据传输方法的流程图。
具体实施方式
图1是根据本发明的实施例的基于SDN网络的数据传输方法的流程图。如图1所示，本发明所公开的基于SDN网络的数据传输方法包括下列步骤：(A1)SDN网络的中心控制器实施初始化操作，以通过流表(flowtable)的方式控制SDN网络中的物理节点之间的数据流的通断和传输；(A2)在所述SDN网络中的源节点需要向目标节点传送数据时，所述源节点请求所述中心控制器开通与所述目标节点和防火强节点的连通性；(A3)所述源节点经由所述防火墙节点向所述目标节点发送连接建立请求，并随之经由所述防火墙节点与所述目标节点协商网络连接参数，以及随之基于所协商的网络连接参数并在不经由所述防火墙节点的情况下直接与所述目标节点进行实际的数据通信。
优选地，在本发明所公开的基于SDN网络的数据传输方法中，所述步骤(A1)进一步包括：所述中心控制器初始设定所述SDN网络中的任意两个节点之间不连通(即以白名单形式开通节点之间的网络连接)。
优选地，在本发明所公开的基于SDN网络的数据传输方法中，所述步骤(A3)进一步包括：在所述源节点和所述目标节点之间的网络连接开通后，所述源节点经由所述防火墙节点向所述目标节点的预定端口(例如针对FTP的21号端口)发送所述连接建立请求以及随后的用于协商网络连接参数的数据包，其中，所述防火墙节点在接收到所述连接建立请求以及随后的用于协商网络连接参数的数据包后按照预定的安全规则对其进行安全性核查，并在核查通过的情况下将所述连接建立请求以及随后的用于协商网络连接参数的数据包转发至所述目标节点。
优选地，在本发明所公开的基于SDN网络的数据传输方法中，所述步骤(A3)进一步包括：在接收到所述连接建立请求后，所述目标节点确定用于随后的实际的数据传输的网络连接参数，并将所确定的网络连接参数以数据包的形式传送至所述防火墙节点。
优选地，在本发明所公开的基于SDN网络的数据传输方法中，所述网络连接参数包括用于后续的实际数据传输的目标传输端口的标识符(即目标端口号)。
优选地，在本发明所公开的基于SDN网络的数据传输方法中，所述步骤(A3)进一步包括：在接收到所述网络连接参数后，所述防火墙节点根据所述网络连接参数所指示的目标传输端口请求所述中心控制器开启其连通性。
优选地，在本发明所公开的基于SDN网络的数据传输方法中，所述步骤(A3)进一步包括：在接收到来自所述防火墙节点的请求后，所述中心控制器开启所述目标传输端口的网络连通性，并随之通知所述防火墙节点该目标传输端口已开通。
优选地，在本发明所公开的基于SDN网络的数据传输方法中，所述步骤(A3)进一步包括：在所述目标传输端口已开通后，所述防火墙节点以数据包的形式将所述网络连接参数传送至所述源节点。
优选地，在本发明所公开的基于SDN网络的数据传输方法中，所述步骤(A3)进一步包括：在接收到所述网络连接参数后，所述源节点在不经由所述防火墙节点的情况下直接根据所述网络连接参数所指示的目标传输端口以数据包的形式与所述目标节点进行实际的数据通信。
优选地，在本发明所公开的基于SDN网络的数据传输方法中，所述预定的安全规则包括对基于特征的数字签名进行校验。
由上可见，本发明所公开的基于SDN网络的数据传输方法具有下列优点：由于慢通道过程和快通道过程采用不同的传输策略，即快通道过程不经由防火墙节点，故具有显著提高的网络数据传输性能。
尽管本发明是通过上述的优选实施方式进行描述的，但是其实现形式并不局限于上述的实施方式。应该认识到：在不脱离本发明主旨和范围的情况下，本领域技术人员可以对本发明做出不同的变化和修改。

Claims (10)

  1. 一种基于SDN网络的数据传输方法，所述基于SDN网络的数据传输方法包括下列步骤：
    (A1)SDN网络的中心控制器实施初始化操作，以通过流表的方式控制SDN网络中的物理节点之间的数据流的通断和传输；
    (A2)在所述SDN网络中的源节点需要向目标节点传送数据时，所述源节点请求所述中心控制器开通与所述目标节点和防火强节点的连通性；
    (A3)所述源节点经由所述防火墙节点向所述目标节点发送连接建立请求，并随之经由所述防火墙节点与所述目标节点协商网络连接参数，以及随之基于所协商的网络连接参数并在不经由所述防火墙节点的情况下直接与所述目标节点进行实际的数据通信。
  2. 根据权利要求1所述的基于SDN网络的数据传输方法，其特征在于，所述步骤(A1)进一步包括：所述中心控制器初始设定所述SDN网络中的任意两个节点之间不连通。
  3. 根据权利要求2所述的基于SDN网络的数据传输方法，其特征在于，所述步骤(A3)进一步包括：在所述源节点和所述目标节点之间的网络连接开通后，所述源节点经由所述防火墙节点向所述目标节点的预定端口发送所述连接建立请求以及随后的用于协商网络连接参数的数据包，其中，所述防火墙节点在接收到所述连接建立请求以及随后的用于协商网络连接参数的数据包后按照预定的安全规则对其进行安全性核查，并在核查通过的情况下将所述连接建立请求以及随后的用于协商网络连接参数的数据包转发至所述目标节点。
  4. 根据权利要求3所述的基于SDN网络的数据传输方法，其特征在于，所述步骤(A3)进一步包括：在接收到所述连接建立请求后，所述目标节点确定用于随后的实际的数据传输的网络连接参数，并将所确定的网络连接参数以数据包的形式传送至所述防火墙节点。
  5. 根据权利要求4所述的基于SDN网络的数据传输方法，其特征在于，所述网 络连接参数包括用于后续的实际数据传输的目标传输端口的标识符。
  6. 根据权利要求5所述的基于SDN网络的数据传输方法，其特征在于，所述步骤(A3)进一步包括：在接收到所述网络连接参数后，所述防火墙节点根据所述网络连接参数所指示的目标传输端口请求所述中心控制器开启其连通性。
  7. 根据权利要求6所述的基于SDN网络的数据传输方法，其特征在于，所述步骤(A3)进一步包括：在接收到来自所述防火墙节点的请求后，所述中心控制器开启所述目标传输端口的网络连通性，并随之通知所述防火墙节点该目标传输端口已开通。
  8. 根据权利要求7所述的基于SDN网络的数据传输方法，其特征在于，所述步骤(A3)进一步包括：在所述目标传输端口已开通后，所述防火墙节点以数据包的形式将所述网络连接参数传送至所述源节点。
  9. 根据权利要求8所述的基于SDN网络的数据传输方法，其特征在于，所述步骤(A3)进一步包括：在接收到所述网络连接参数后，所述源节点在不经由所述防火墙节点的情况下直接根据所述网络连接参数所指示的目标传输端口以数据包的形式与所述目标节点进行实际的数据通信。
  10. 根据权利要求9所述的基于SDN网络的数据传输方法，其特征在于，所述预定的安全规则包括对基于特征的数字签名进行校验。
PCT/CN2017/111298 2016-11-23 2017-11-16 基于sdn网络的数据传输方法 WO2018095263A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201611035389.9 2016-11-23
CN201611035389.9A CN106657015B (zh) 2016-11-23 2016-11-23 基于sdn网络的数据传输方法

Publications (1)

Publication Number Publication Date
WO2018095263A1 true WO2018095263A1 (zh) 2018-05-31

Family

ID=58811051

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/111298 WO2018095263A1 (zh) 2016-11-23 2017-11-16 基于sdn网络的数据传输方法

Country Status (3)

Country Link
CN (1) CN106657015B (zh)
TW (1) TWI665891B (zh)
WO (1) WO2018095263A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106657015B (zh) * 2016-11-23 2020-09-22 中国银联股份有限公司 基于sdn网络的数据传输方法

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104104561A (zh) * 2014-08-11 2014-10-15 武汉大学 一种基于OpenFlow协议的SDN防火墙状态检测方法及系统
US20150026794A1 (en) * 2013-07-18 2015-01-22 Palo Alto Networks, Inc. Packet classification for network routing
CN105721334A (zh) * 2014-12-04 2016-06-29 中国移动通信集团公司 确定传输路径和更新acl的方法及设备
CN105745886A (zh) * 2013-09-23 2016-07-06 迈克菲股份有限公司 在两个实体之间提供快速路径
CN106657015A (zh) * 2016-11-23 2017-05-10 中国银联股份有限公司 基于sdn网络的数据传输方法

Family Cites Families (9)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7403995B2 (en) * 2003-01-08 2008-07-22 Outhink, Inc. Symmetrical bi-directional communication
CN103457920B (zh) * 2012-06-04 2016-12-14 中国科学院声学研究所 一种基于重叠网的分布式防火墙安全策略配置方法和系统
CN103369613A (zh) * 2013-07-05 2013-10-23 中国科学院计算机网络信息中心 基于OpenFlow实现移动切换的系统和方法
US9654418B2 (en) * 2013-11-05 2017-05-16 Telefonaktiebolaget L M Ericsson (Publ) Method and system of supporting operator commands in link aggregation group
CN104702577B (zh) * 2013-12-09 2018-03-16 华为技术有限公司 数据流安全处理方法及装置
US20150312215A1 (en) * 2014-01-28 2015-10-29 Lov Kher Generating optimal pathways in software-defined networking (sdn)
CN105262686B (zh) * 2014-07-18 2020-04-24 中兴通讯股份有限公司 一种网络连通性验证方法和装置
CN105656841B (zh) * 2014-11-11 2018-12-11 新华三技术有限公司 一种软件定义网络中实现虚拟防火墙的方法和装置
CN105681305B (zh) * 2016-01-15 2019-08-09 北京工业大学 一种sdn防火墙系统及实现方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20150026794A1 (en) * 2013-07-18 2015-01-22 Palo Alto Networks, Inc. Packet classification for network routing
CN105745886A (zh) * 2013-09-23 2016-07-06 迈克菲股份有限公司 在两个实体之间提供快速路径
CN104104561A (zh) * 2014-08-11 2014-10-15 武汉大学 一种基于OpenFlow协议的SDN防火墙状态检测方法及系统
CN105721334A (zh) * 2014-12-04 2016-06-29 中国移动通信集团公司 确定传输路径和更新acl的方法及设备
CN106657015A (zh) * 2016-11-23 2017-05-10 中国银联股份有限公司 基于sdn网络的数据传输方法

Also Published As

Publication number Publication date
CN106657015B (zh) 2020-09-22
TW201820825A (zh) 2018-06-01
TWI665891B (zh) 2019-07-11
CN106657015A (zh) 2017-05-10

Similar Documents

Publication Publication Date Title
US10616379B2 (en) Seamless mobility and session continuity with TCP mobility option
EP3272094B1 (en) End-to-end authentication at the service layer using public keying mechanisms
EP3298719B1 (en) Network device and method for processing a session using a packet signature
EP2823605B1 (en) Methods of operating forwarding elements including shadow tables and related forwarding elements
US9608963B2 (en) Scalable intermediate network device leveraging SSL session ticket extension
EP3281377B1 (en) Methods and devices for access control of data flows in software defined networking system
WO2014021870A1 (en) Feature enablement or disablement determination based on discovery message
CN104283701A (zh) 配置信息的下发方法、系统及装置
US9503446B2 (en) Authentication within openflow network
WO2009000178A1 (fr) Procédé et système de réseau visant à négocier une capacité de sécurité entre un pcc et un pce
CN109792389A (zh) 接入固定网络的方法和接入网关网元
WO2014173365A1 (zh) Ftp的应用层报文过滤方法及装置、计算机存储介质
WO2021218872A1 (zh) 确定安全保护方法、系统及装置
CN108989342B (zh) 一种数据传输的方法及装置
WO2018095263A1 (zh) 基于sdn网络的数据传输方法
WO2016058463A1 (zh) 业务功能链中协议报文的处理方法、系统及业务功能节点
US11038994B2 (en) Technique for transport protocol selection and setup of a connection between a client and a server
WO2015157947A1 (zh) 基于软件定义网络的组网方法及设备
KR20190024581A (ko) 보안을 위한 보안 소켓 계층 복호화 방법
WO2019000599A1 (zh) 一种动态虚拟专用网络建立方法及装置
WO2018001042A1 (zh) 报文传输方法、装置及系统
TW200525960A (en) Distributed exterior gateway protocol
WO2016139911A1 (ja) 情報処理装置、情報処理方法及びプログラムを格納した非一時的なコンピュータ可読媒体
WO2017020204A1 (zh) 节点切换方法、装置及系统
US20180375731A1 (en) System and method for wide area zero-configuration network auto configuration

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17872970

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17872970

Country of ref document: EP

Kind code of ref document: A1