WO2021073147A1

WO2021073147A1 - Credibility authentication method for sdn nodes

Info

Publication number: WO2021073147A1
Application number: PCT/CN2020/098582
Authority: WO
Inventors: 黄刚; 刘强; 柴萍萍
Original assignee: 山东超越数控电子股份有限公司
Priority date: 2019-10-16
Filing date: 2020-06-28
Publication date: 2021-04-22
Also published as: CN110602150A; CN110602150B

Abstract

Disclosed is a credibility authentication method for SDN nodes. The method comprises: integrating a root of trust into an SDN controller; performing credibility authentication, by means of the root of trust, on SDN node devices intending to access an SDN network; and allowing SDN node devices that have passed the credibility authentication to access the SDN network. The root of trust is used as a starting point to build a trusted blockchain for SDN node devices. The present invention provides a technical solution ensuring that SDN node devices newly achieving access to an SDN network architecture have all passed credibility authentication of identity information, in which the root of trust is integrated such that the credibility of the SDN node devices newly connected to the SDN network can be confirmed in a safe and effective manner.

Description

A trusted authentication method between SDN nodes

Technical field

The present invention relates to the field of communication technology, in particular, to a trusted authentication method between SDN nodes based on blockchain technology.

Background technique

Software Defined Network (SDN) is a new type of network architecture. With the rapid development of Internet technology, network control has shifted from hardware to software. As a result, multiple devices are merged into one SDN controller, enabling network engineers to Control the entire network. SDN uses a controller to separate the network control plane from the data plane, which improves network management and control capabilities. It has a good application space in many industries. At present, the primary problem with SDN is security. How to confirm the credibility of the SDN node equipment newly connected to the network under the environment needs to be solved.

Network equipment authentication in SDN refers to the authentication implemented by the controller on the network equipment, which occurs when the network equipment is connected to the SDN network. At present, this type of authentication can use the traditional public key and private key method to implement authentication, that is, use the public key infrastructure to complete the two-way authentication of the network device and the controller. There is no doubt that this authentication method is feasible. However, due to the need to use public key infrastructure, this authentication method is difficult to construct and deploy, and the public key information of each entity needs to be transmitted multiple times during authentication. In addition, the authentication of traditional network equipment may be artificially cracked under some technical means. With the promotion and application of SDN, the number of network devices managed by the controller is gradually increasing, and a more secure and effective device authentication method is needed.

Summary of the invention

The purpose of the present invention is to provide a trusted authentication method between SDN nodes, which is used to solve the difficulties in the construction and arrangement of traditional public key and private key authentication methods in the existing authentication technology; traditional network equipment authentication exists under some technical means Problems such as the possibility of artificial cracking.

Based on the above objective, the present invention provides a trusted authentication method between SDN nodes, including: integrating a trusted root in an SDN controller; performing trusted authentication on SDN node devices that are expected to access the SDN network through the trusted root; The trusted and authenticated SDN node device is connected to the SDN network.

Further, integrating the root of trust in the SDN controller also includes: taking the root of trust as a starting point to establish a trusted blockchain of the SDN node equipment.

Further, the step of performing trusted authentication on the SDN node device that is expected to access the SDN network through the trusted root further includes: performing device trusted registration on the trusted blockchain for the SDN node device that is expected to access the SDN network.

Further, the trusted authentication includes the trusted authentication of the identity information of the SDN node device that performs the trusted registration by the trusted root.

Further, it also includes: in response to the credible authentication of the identity information of the SDN node device being passed, adding the credible confirmation information of the SDN node device to the trusted blockchain.

Further, the method further includes: transmitting the trusted confirmation information to the next SDN node device that is expected to access according to the transfer rule of the trusted blockchain.

Further, it also includes that the next SDN node device that is expected to access continues to perform credible authentication on the next SDN node device that is expected to access according to the credibility confirmation information.

Further, trusted certification includes certification of static trustworthiness.

Further, the authentication points for performing static credibility authentication on the SDN node device include: device hardware, startup sequence, controller operating system, and controller policy application.

Further, the root of trust includes the TCM module integrated with the hardware platform of the SDN controller.

The present invention has the following beneficial technical effects: The trusted authentication method between SDN nodes provided by the present invention can ensure that all SDN node devices newly accessing the SDN network architecture have passed the credible authentication of identity information, and can realize new access more safely and effectively. Confirmation of the credibility of the SDN node equipment of the SDN network.

Description of the drawings

In order to explain the embodiments of the present invention or the technical solutions in the prior art more clearly, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the drawings in the following description are only These are some embodiments of the present invention. For those of ordinary skill in the art, other embodiments can be obtained according to the drawings without creative work.

FIG. 1 is a schematic diagram of a method for adding SDN node device information to a trusted blockchain according to an embodiment of the present invention.

2 is a schematic diagram of a flow chart of trusted authentication between SDN nodes based on blockchain technology according to an embodiment of the present invention.

Fig. 3 is a block diagram of the method according to the present invention.

Detailed ways

In order to make the objectives, technical solutions, and advantages of the present invention clearer, the following describes the embodiments of the present invention in detail in conjunction with specific embodiments and with reference to the accompanying drawings.

The invention provides a trusted authentication method between SDN nodes.

Fig. 1 shows a schematic block diagram of a method for adding SDN node device information to a trusted blockchain according to an embodiment of the present invention.

The premise of this method is that the SDN network has been established and the SDN network environment is a trusted environment. Under this premise, first, the trusted authentication method between SDN nodes includes the following steps:

Integrate the root of trust in the SDN controller;

Perform trusted authentication for SDN node devices that expect to access the SDN network through the trusted root;

SDN node devices that have passed trusted authentication are allowed to access the SDN network.

The step of integrating the trusted root in the SDN controller also includes: taking the trusted root as a starting point to establish a trusted blockchain 100 of the SDN node device.

Wherein, the step of performing trusted authentication 101 on the SDN node device that is expected to access the SDN network through the trusted root further includes:

It is expected that new SDN node devices that access the SDN network will apply for device trusted registration on the trusted blockchain.

In an embodiment of the present invention, the trusted authentication is the trusted authentication of the trusted root to the identity information of the SDN node device performing the trusted registration.

According to some embodiments of the present invention, in response to the credible authentication of the identity information of the new SDN node device, the credible confirmation information of the new SDN node device is added to the trust blockchain.

According to a further embodiment of the present invention, in the trusted blockchain 100, the next SDN node device that is expected to access according to the trusted confirmation information continues to follow the “integration of the trusted root in the SDN controller; The SDN node device that accesses the SDN network performs trusted authentication; the SDN node device that has passed the trusted authentication is allowed to access the SDN network." The next step is to perform trusted authentication on the next SDN node device that is expected to access.

According to a further embodiment of the present invention, the method further includes: after the trusted confirmation information of the SDN node device is added to the trusted blockchain, transmitting the trusted confirmation information to the next SDN node device that is expected to access according to the trust blockchain transfer rule.

According to some embodiments of the present invention, when the identity information of the trusted SDN node device 10 passes the trusted authentication, the trusted confirmation information 1 is added to the trusted blockchain 100, and the trusted confirmation information 1 is added according to the transfer rules of the trusted blockchain. Transfer to the next SDN node device 20 that expects to join. The SDN node device 20 becomes the trusted node device 20 after passing the trusted authentication 101, and continues to add the trusted confirmation information 2 of the SDN node device 20 to the trusted blockchain 100, and transmits it downward in turn, that is, it is expected to be added later. The n-th SDN node device n0 of the SDN network performs credibility authentication according to the credibility confirmation information n-1 of the n-1 th credible node device in the order described above. The blockchain background service uses the built-in hash cryptographic algorithm to generate the trusted confirmation information of the switch node for the entire information data block.

Among them, credible authentication includes authentication of static credibility. Authentication points for static credibility authentication of SDN node devices include: device hardware, startup sequence, controller operating system, controller policy application, etc.;

Figure 2 shows a schematic diagram of a flow chart of trusted authentication between SDN nodes based on blockchain technology in an embodiment of the present invention.

As shown in FIG. 2, block 201 is to integrate the root of trust in the main SDN controller; according to some embodiments of the present invention, the hardware platform of the SDN controller integrates the TCM module 3 as the root of trust. Take the root of trust as the starting point to establish a trusted blockchain for SDN node equipment.

Block 202 is an access request of a new SDN node device expecting to access the SDN network. First of all, it is expected that the SDN node devices that access the SDN network will first perform device trusted registration on the trusted blockchain. In some embodiments of the invention, the device information includes: production date, manufacturer, user unit, management department, product color, number of network interfaces, network MAC address information, network speed, etc. related information, startup sequence, operating system, strategy Information, configuration information, deployment location, service period, etc., fill in the information form, and apply for new node device registration;

The background service integrates the information, and then uses the root of trust (such as the TCM module) to perform trusted authentication on the SDN node devices that are expected to access the SDN network, where the trusted authentication is the authentication of static credibility. Authentication points for performing static credibility authentication on SDN node devices include: device hardware, startup sequence, controller operating system, controller policy application, etc.

If the credible authentication of the identity information of the SDN node device passes, the credible confirmation information of the SDN node device is added to the trusted blockchain. If the credible authentication of the identity information of the SDN node device fails, the credible confirmation information of the SDN node device is refused to be added to the trusted blockchain.

Block 203 is to determine whether the trusted confirmation information of the SDN node device is on the trusted blockchain. When the judgment is "Yes", that is, the trusted confirmation information of the SDN node device is on the trust blockchain, the SDN node device is allowed to access the SDN network; when the judgment is "No", that is, the SDN node device is trusted If it is confirmed that the information is not on the trusted blockchain, the SDN node device is denied access to the SDN network.

Other devices put their own information on the blockchain according to the above method one by one, so that no matter which device owner or illegal user has other attempts, if you want to change the information of one of the devices, you need to change all the device nodes. The relevant confirmation information of the equipment of the blockchain is determined by the characteristics of the blockchain, and the cost to be paid is too high. Therefore, the blockchain technology ensures that all who want to access the SDN network have been confirmed and obtained the SDN controller trust root The uniqueness of the device for authentication.

Finally, it should be noted that those of ordinary skill in the art can understand that the implementation of all or part of the processes in the above-mentioned embodiment methods can be completed by instructing relevant hardware through computer programs, and the programs of the method for creating storage volume mirroring based on applications can be stored in In a computer readable storage medium, when the program is executed, it may include the procedures of the above-mentioned method embodiments. Among them, the storage medium of the program can be a magnetic disk, an optical disk, a read-only memory (ROM) or a random access memory (RAM), etc. The foregoing computer program embodiment can achieve the same or similar effects as any of the foregoing corresponding method embodiments.

In addition, the method disclosed according to the embodiment of the present invention may also be implemented as a computer program executed by a processor, and the computer program may be stored in a computer-readable storage medium. When the computer program is executed by the processor, it executes the above-mentioned functions defined in the method disclosed in the embodiment of the present invention.

The steps of the method or algorithm described in combination with the disclosure herein may be directly included in hardware, a software module executed by a processor, or a combination of the two. The software module may reside in RAM memory, flash memory, ROM memory, EPROM memory, EEPROM memory, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor such that the processor can read information from or write information to the storage medium. In an alternative, the storage medium may be integrated with the processor. The processor and the storage medium may reside in the ASIC. The ASIC can reside in the user terminal. In an alternative, the processor and the storage medium may reside as discrete components in the user terminal.

The above are exemplary embodiments disclosed by the present invention, but it should be noted that various changes and modifications can be made without departing from the scope of the disclosure of the embodiments of the present invention as defined by the claims. The functions, steps and/or actions of the method claims according to the disclosed embodiments described herein do not need to be performed in any specific order. In addition, although the elements disclosed in the embodiments of the present invention may be described or required in individual forms, they may also be understood as plural unless explicitly limited to a singular number.

It should be understood that as used herein, unless the context clearly supports exceptions, the singular form "a" is intended to also include the plural form. It should also be understood that "and/or" as used herein refers to any and all possible combinations including one or more items listed in association.

The serial numbers of the disclosed embodiments of the foregoing embodiments of the present invention are only for description, and do not represent the superiority of the embodiments.

Those of ordinary skill in the art can understand that all or part of the steps in the above-mentioned embodiments can be completed by hardware, or by a program instructing related hardware to be completed. The program can be stored in a computer-readable storage medium. The storage medium can be a read-only memory, a magnetic disk or an optical disk, etc.

Those of ordinary skill in the art should understand that the discussion of any of the above embodiments is only exemplary, and is not intended to imply that the scope of disclosure (including the claims) of the embodiments of the present invention is limited to these examples; under the idea of the embodiments of the present invention The above embodiments or the technical features in different embodiments can also be combined, and there are many other changes in different aspects of the above embodiments of the present invention, which are not provided in the details for the sake of brevity. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principle of the embodiments of the present invention should be included in the protection scope of the embodiments of the present invention.

Claims

A trusted authentication method between SDN nodes, characterized in that the method includes:

Integrate the root of trust in the SDN controller;

Performing trusted authentication on the SDN node device that expects to access the SDN network through the trusted root;

Allowing the SDN node device that has passed the trusted authentication to access the SDN network.
The method for trusted authentication between SDN nodes according to claim 1, wherein said integrating a trusted root in the SDN controller further comprises:

Take the root of trust as the starting point to establish a trusted blockchain for SDN node equipment.
The method for trusted authentication between SDN nodes according to claim 2, wherein the step of performing trusted authentication on the SDN node device that desires to access the SDN network through the trusted root further comprises:

The SDN node device that is expected to access the SDN network performs trusted device registration on the trusted blockchain.
The method for trusted authentication between SDN nodes according to claim 3, wherein the trusted authentication includes trusted authentication of the identity information of the SDN node device that performs trusted registration by the trusted root.
The method for trusted authentication between SDN nodes according to claim 4, further comprising:

In response to the passing of the credible authentication of the identity information of the SDN node device, the credible confirmation information of the SDN node device is added to the trusted blockchain.
The method for trusted authentication between SDN nodes according to claim 5, further comprising:

The trusted confirmation information is transmitted to the next SDN node device that is expected to access according to the transmission rule of the trusted blockchain.
The trusted authentication method between SDN nodes according to claim 6, characterized in that it further comprises:

The SDN node device that is expected to be accessed next continues to perform trusted authentication on the SDN node device that is expected to be accessed next according to the credibility confirmation information.
The method for trusted authentication between SDN nodes according to claim 6, wherein the trusted authentication includes authentication of static trustworthiness.
The method for authenticating trust between SDN nodes according to claim 8, wherein the authentication points for performing static credibility authentication on SDN node devices include: device hardware, startup sequence, controller operating system, and controller policy application.
The trusted authentication method between SDN nodes according to claim 1, wherein the trusted root comprises a TCM module integrated with the hardware platform of the SDN controller.