WO2024016642A1 - 一种基于sdn的智能船网络系统 - Google Patents

一种基于sdn的智能船网络系统 Download PDF

Info

Publication number
WO2024016642A1
WO2024016642A1 PCT/CN2023/075805 CN2023075805W WO2024016642A1 WO 2024016642 A1 WO2024016642 A1 WO 2024016642A1 CN 2023075805 W CN2023075805 W CN 2023075805W WO 2024016642 A1 WO2024016642 A1 WO 2024016642A1
Authority
WO
WIPO (PCT)
Prior art keywords
network
ship
smart ship
sdn
smart
Prior art date
Application number
PCT/CN2023/075805
Other languages
English (en)
French (fr)
Inventor
胡青
刘家兵
Original Assignee
大连海事大学
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 大连海事大学 filed Critical 大连海事大学
Priority to ZA2023/08261A priority Critical patent/ZA202308261B/en
Publication of WO2024016642A1 publication Critical patent/WO2024016642A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/12—Protocols specially adapted for proprietary or special-purpose networking environments, e.g. medical networks, sensor networks, networks in vehicles or remote metering networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
    • H04L41/08—Configuration management of networks or network elements
    • H04L41/0893—Assignment of logical groups to network elements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1458—Denial of Service
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved

Definitions

  • the present invention relates to the field of communication technology, specifically, to an SDN-based smart ship network system.
  • Smart ships refer to the use of sensors, communications, Internet and other technical means to automatically sense and obtain all aspects of ship information. and data, and based on analysis technologies such as computer technology to make ships safer and more reliable.
  • analysis technologies such as computer technology to make ships safer and more reliable.
  • smart ships compared with traditional ship networks, smart ships have higher requirements for flexibility, security, reliability and real-time performance.
  • the communication network system of traditional ships cannot meet the network division needs of smart ships in a timely manner due to its fixed configuration mode.
  • this application discloses an SDN-based smart ship network system, which divides network communications into different network sections in real time according to working status and needs, and regulates the access equipment and communication methods between each section. Different designs are made based on different security levels to meet the flexibility, security, reliability and real-time requirements of smart ship networks.
  • An SDN-based smart ship network system including an internal communication network and an external communication network;
  • the internal communication network includes a data plane, a control plane and an application plane that are communicated in sequence.
  • the control plane includes a smart ship SDN network controller.
  • the control plane interacts with the application plane through the northbound interface of the smart ship SDN network controller. , and perform data interaction with the data plane through the southbound interface of the smart ship SDN network controller,
  • the data plane includes an intelligent ship owner switch, a first-level security network, a second-level security network and a third-level security network.
  • the intelligent ship-owner switch is connected and communicates with each node in the first-level security network, the second-level security network and the third-level security network.
  • the first-level safety network includes engine room equipment network nodes and bridge equipment network nodes, which are used for information communication between ship driving-related equipment.
  • the secondary security network includes key ship equipment testing and verification equipment nodes and scientific experiment workstation nodes, which are used to implement testing of key equipment of smart ships and communication of scientific research nodes.
  • the three-level security network includes entertainment nodes and non-navigation service-related equipment nodes, which are used for non-operational service communications.
  • the security priorities of the first-level security network, the second-level security network and the third-level security network are reduced in order;
  • the external communication network includes SDN gateway/router, 4G/5G network communication equipment, AIS/VDES communication equipment, NAVDAT communication equipment, Beidou communication equipment and satellite communication equipment;
  • the internal communication network interacts with 4G/5G network communication equipment, AIS/VDES communication equipment, NAVDAT communication equipment, Beidou communication equipment and satellite communication equipment through SDN gateway/router.
  • the data plane also includes a smart ship backup switch.
  • the smart ship backup switch is connected to the first-level safety network, the second-level safety network and the third-level safety network. When the smart ship owner switch fails, the system can immediately start the smart ship. Ship backup switch working.
  • the internal network nodes of the first-level security network are not directly connected to external communication devices. Communication data packets interacting with the first-level security network must pass the SDN gateway security verification and audit before they can be exchanged with external communication devices.
  • communication data packets interacting with the first-level security network must pass the SDN gateway security verification review before they can be exchanged with external communication devices, including:
  • a digital signature will be dynamically set. Data from communication nodes without digital signatures cannot enter the first-level security network. .
  • the communication data packets interacting with the first-level security network must pass the SDN gateway security verification review before they can be exchanged with external communication devices, including:
  • Private business data packets that are transmitted between external communication equipment nodes and the first-level secure network must be encrypted before data transmission after passing the SDN gateway security verification review.
  • dynamic digital signatures are set through the SDN gateway. Node data without digital signatures cannot enter the secondary security network.
  • the third-level security network does not transmit data with the first-level security network and the second-level security network.
  • the application plane is used to configure the management strategy of the smart ship network system.
  • the smart ship SDN controller calls the corresponding management strategy according to the communication content to build a complete smart ship network system management system.
  • the management strategy includes a network switching strategy, Network defense strategy, network monitoring strategy, Cyber threat hunting strategies and network data collection strategies;
  • the network switching strategy is defined as: the smart ship communication network contains two core switches, namely the smart ship owner switch and the smart ship backup switch.
  • the smart ship SDN controller sends control information to the smart ship owner switch.
  • the ship owner switch forwards the flow table information in the first-level security network, the second-level security network and the third-level security network according to the rules issued by the controller.
  • the smart ship backup switch synchronously updates the forwarding rules of the smart ship owner switch.
  • the smart ship owner switch appears When a fault occurs, the unmanned ship/smart ship backup switch comes online, and the unmanned ship/smart ship SDN controller sends control information to the unmanned ship/smart ship backup switch.
  • the smart ship backup switch takes over the work of the smart ship owner switch. Ensure normal communication with other nodes in the network, thus ensuring the flexibility of the network;
  • the network defense strategy is defined as follows: after the smart ship detects a DDoS attack, it gives priority to hiding the IP address of the attacked node to prevent it from continuing to suffer malicious attacks; at the same time, it orders the smart ship SDN controller to issue new data to the smart ship owner and backup switch. Forwarding rules, modify the hidden IP address, and finally use the network threat tracking strategy to find the attacker IP, clean up the malicious data packets sent by the IP address in the smart ship network system, release the storage space of the network system, and ensure the normal operation of the smart ship network nodes Communication reflects the characteristics of smart ship network system that can be flexibly organized after being attacked;
  • the network monitoring strategy is defined as: real-time extraction of smart ship network information from the network information collection database, feature fusion of network traffic information, switch flow table information and control information, establishing a network security status assessment model, and using this model to evaluate the intelligent
  • the ship network performs real-time monitoring, analysis and early warning, sends analysis reports and early warning reports to the network management equipment of the smart ship's secondary safety network, and displays the reports to network managers or scientific researchers for network system maintenance or research to ensure network security;
  • the network threat tracking strategy is defined as: when a smart ship suffers a DDoS attack, every data packet passing by the smart ship owner and backup switch will be marked in the IP packet header with a certain probability through a probabilistic packet marking algorithm, so that The victim host of the smart ship can reconstruct the attack path, find the attacker, and blacklist the attacker's IP, and is not allowed to enter the smart ship network system to improve the reliability of the network;
  • the network data collection strategy is defined as: the smart ship network system collects network information in the network environment and stores it in the network information collection database.
  • the network information in the network environment includes a primary security network and a secondary security network. and network traffic information for Level 3 security networks, smart ships
  • the flow table information of the main and backup switches and the control information issued by the smart ship SDN controller are conducive to network status monitoring and scientific research data collection to ensure the real-time nature of network data exchange.
  • the present invention has the following advantages:
  • the present invention proposes an SDN-based smart ship network system, which breaks the fixed model of the traditional ship network and divides the smart ship network as needed, such as dividing the smart ship related navigation and operation business equipment nodes into a first-level security network; intelligent ship network
  • the testing and scientific research nodes of the ship's key equipment are divided into Level 2 security networks; the nodes related to non-navigation business and other daily office/entertainment nodes are divided into Level 3 security networks.
  • management strategies such as network switching strategy, network defense strategy, network monitoring strategy, network threat tracking strategy, and network data collection strategy are applied to ensure the flexibility, security, reliability, and real-time nature of the smart ship deployment network.
  • Figure 1 is an architecture diagram of an SDN-based smart ship network system of the present invention.
  • Figure 2 is a flow chart of internal network communication of the smart ship of the present invention.
  • Figure 3 is the communication process between the first-level security network and the second-level security network node of the present invention.
  • the invention discloses an SDN-based smart ship network system, as shown in Figure 1, including an internal communication network and an external communication network.
  • the internal communication network includes a data plane, a control plane and an application plane that are connected in sequence.
  • the control plane includes a smart ship SDN network controller.
  • the control plane interacts with the application plane through the northbound interface of the smart ship SDN network controller, and interacts with the data plane through the southbound interface of the smart ship SDN network controller.
  • the data plane includes smart ship owner SDN switches, backup SDN switches and level one security network, level two security network and level three security network. Normally, smart ship owner SDN switches are connected to level one security network, level two security network and level three security network. Each node connects and communicates.
  • the smart ship backup switch in the data plane is also connected to the first-level security network, the second-level security network and the third-level security network respectively.
  • the system can immediately start the smart ship backup SDN switch. .
  • the first-level safety network includes network nodes of engine room equipment such as main thrusters and steering gears, as well as network nodes of bridge equipment such as radar and INS, which are used for communication connections of smart ship-related navigation and operation business equipment nodes.
  • the secondary security network includes key ship test and verification equipment nodes, scientific experiment workstation nodes, and other scientific research equipment network nodes, etc., and is used for testing of key equipment of smart ships and communication of scientific research nodes.
  • the third-level security network includes network communications of ship staff and passengers’ smartphones, notebooks and other entertainment nodes, ship work and teaching and other non-navigation business-related equipment nodes, and other daily office/entertainment nodes.
  • the security priorities of the first-level security network, the second-level security network and the third-level security network decrease in order. Usually the second-level security network is optional and deployed as needed.
  • the external communication network includes SDN gateways/routers, and a series of external communication equipment such as 4G/5G network communication equipment, AIS/VDES communication equipment, NAVDAT communication equipment, Beidou, and satellite communication equipment.
  • the internal nodes of the internal communication network can interact with 4G/5G network communication equipment, AIS/VDES communication equipment, NAVDAT communication equipment, Beidou communication equipment and satellite communication equipment through SDN gateways/routers.
  • the internal network nodes of the first-level security network are not directly connected to external communication devices. All communication data packets must pass the SDN gateway security verification and audit before they can be exchanged with external communication devices. .
  • SDN gateway security verification and audit For open standard format data packets transmitted by external communication equipment nodes that are allowed to enter the first-level security network, such as AIS data packets generated by AIS communication equipment, after passing the SDN gateway security verification review, digital signatures will be dynamically set, and communications without digital signatures will Node data cannot enter the first-level security network.
  • Private business data packets exchanged between external communication equipment nodes and the first-level security network transmission such as VDE data packets generated by VDES communication equipment, need to be encrypted such as AES algorithm before data transmission after passing the SDN gateway security verification review.
  • DDoS attack detection based on machine learning.
  • communication will be normal.
  • DDoS traffic the system will implement network defense strategies.
  • each node of the first-level security network can use the above mechanism to exchange data with nodes in the second-level security network, but cannot exchange data with the third-level security network.
  • external communication device nodes that are allowed to enter the secondary security network also need to set digital signatures through the SDN gateway. Node data without digital signatures cannot enter the secondary security network; however, the secondary security network is open to the outside world. The data transferred may not be subject to the above restrictions.
  • the third-level security network does not transmit data with the first-level security network and the second-level security network, and does not perform data verification processing.
  • the northbound interface is used to communicate with the smart ship SDN controller of the control plane through the application plane.
  • the application plane includes network switching strategy, network defense strategy, network monitoring strategy, network threat tracking strategy and network data collection strategy.
  • the smart ship SDN controller issues control information corresponding to different strategies based on the communication content to build a complete smart ship network. System management system.
  • the smart ship communication network contains two core switches, namely the smart ship owner switch and the smart ship backup switch.
  • the smart ship SDN controller sends control information to the smart ship owner switch, and the smart ship owner switch responds according to the controller The issued rules forward flow table information in the first-level security network, the second-level security network, and the third-level security network.
  • the smart ship backup switch synchronously updates the forwarding rules of the smart ship owner switch.
  • the smart ship backup switch comes online.
  • the smart ship SDN controller sends control information to the smart ship backup switch.
  • the smart ship backup switch takes over the work of the smart ship owner switch to ensure normal communication with other nodes in the network. This ensures the flexibility of the network;
  • Network defense strategy After the smart ship detects a DDoS attack, it prioritizes hiding the IP address of the attacked node to prevent it from continuing to suffer malicious attacks; at the same time, it orders the smart ship SDN controller to issue new forwarding rules to the smart ship owner and backup switch, and modify the IP address of the attacked node. Hidden IP address, and finally use the network threat tracking strategy to find the attacker IP, clean up the malicious data packets sent by the IP address in the smart ship network system, release the storage space of the network system, and ensure the rapid recovery of the smart ship network nodes under DDoS attacks. Communication reflects the characteristics of smart ship network systems that can be flexibly organized after being attacked.
  • Network monitoring strategy Real-time extraction of smart ship network information from the network information collection database, and Feature fusion of network traffic information, switch flow table information and control information is used to establish a network security status assessment model. Through this model, real-time monitoring, analysis and early warning of the smart ship network are carried out, and the analysis report and early warning report are sent to the second level security of the smart ship.
  • the network management equipment of the network also displays reports to network managers or scientific researchers for network system maintenance or research to ensure network security.
  • Network threat tracking strategy When a smart ship suffers a DDoS attack, on the basis of the above DDoS attack detection algorithm to resist network threats, through the probabilistic packet marking algorithm, each data packet passing by the smart ship owner and backup switch will be included in the IP data with a certain probability. The packet header is marked, so that the victim host of the smart ship can reconstruct the attack path, find the attacker, and blacklist the attacker's IP, and is not allowed to enter the smart ship network system to improve the reliability of the network.
  • Network data collection strategy The smart ship network system needs to collect network information in the network environment, such as: network traffic information of the first-level security network, second-level security network and third-level security network; flow table information of smart ship owners and backup switches; intelligent
  • the control information issued by the ship's SDN controller is stored in the network information collection database, which is conducive to network status monitoring and collection of scientific research data to ensure the real-time nature of network data exchange.
  • Figure 1 shows the network architecture diagram of the unmanned ship system based on SDN in this embodiment.
  • the simulation system is constructed through the Mininet simulation software according to the following steps:
  • S101 Create network switches and nodes according to the topology shown in Figure 1; specifically including a main switch, a backup switch, a first-level security network, a second-level security network and a third-level security network.
  • the first-level safety network includes 15 nodes such as engine room equipment and bridge equipment
  • the second-level safety network includes 10 nodes such as key ship testing and verification equipment
  • the third-level safety network includes 10 nodes such as mobile phones and laptops.
  • S104 Add an SDN controller; the default ip127.0.0.1 is set to TCP protocol and the type is RemoteController.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Health & Medical Sciences (AREA)
  • General Health & Medical Sciences (AREA)
  • Medical Informatics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本发明提供一种基于SDN的智能船网络系统，包括内部通信网络和外部通信网络；所述内部通信网络包括依次通信连接的数据平面、控制平面和应用平面，其中控制平面包括智能船SDN网络控制器，所述控制平面通过智能船SDN网络控制器的北向接口与应用平面进行数据交互、且通过智能船SDN网络控制器的南向接口与数据平面进行数据交互；所述数据平面包括智能船主、备份交换机、一级安全网络、二级安全网络和三级安全网络；所述外部通信网络包括SDN网关/路由器、4G/5G网络通信设备、AIS/VDES通信设备、NAVDAT通信设备、北斗通信设备以及卫星通信设备。本发明基于SDN网络架构设计了智能船通信网络系统，以保障智能船网络的灵活性、安全性、可靠性和实时性。

Description

一种基于SDN的智能船网络系统 技术领域
本发明涉通信技术领域，具体而言，尤其涉及一种基于SDN的智能船网络系统。
背景技术
近些年来，世界各国关于智能船的研究和开发已经逐步展开，船级社已发布智能船相关规范，智能船舶系指利用传感器、通信、互联网等技术手段，自动感知和获取船舶各方面的信息和数据，并基于计算机技术等分析技术使船舶更加安全、可靠。其中，智能船与传统船舶网络相比，其灵活性、安全性、可靠性和实时性要求更高。传统船舶的通信网络系统因其固定配置模式，无法及时满足智能船的网络划分需求。
具体来说，传统船舶的网络系统在智能船通信系统中使用将面临以下问题：
1)网络中的数据传输路径单一，当网络出现故障时会导致数据丢失；
2)传统船舶网络存在广播风暴的危险；
3)传统网络拓扑的复杂伴随着配置复杂度高的问题，没有一定能力的网络工程师无法完成对复杂网络中协议保护的配置。此外，当网络配置达到一定的复杂程度时，船舶网络的保护协议能力达到了瓶颈；
4)传统船舶网络安全性较低等。
目前，国内外诸多学者提出了智能船内部通信的网络架构，如船舶传感器收集的数据通过连接设备与附近的网关节点组成局域网；通过以太网或CANopen技术集成传感器和船舶执行器的网络等技术；部分学者针对自主航行船舶设计了内部通信的网络架构，包括自主船舶控制器、导航系统和机械系统等。但是，上述方法无法解决上述问题。
发明内容
鉴于现有技术的不足，本申请公开了一种基于SDN的智能船网络系统，按照工作状态和需求将网络通信实时划分到不同网络区段，并对各区段之间的接入设备、通信方式和安全等级进行区分设计，从而满足智能船网络灵活性、安全性、可靠性和实时性的要求。
本发明采用的技术手段如下：
一种基于SDN的智能船网络系统，包括内部通信网络和外部通信网络；
所述内部通信网络包括依次通信连接的数据平面、控制平面和应用平面，其中控制平面包括智能船SDN网络控制器，所述控制平面通过智能船SDN网络控制器的北向接口与应用平面进行数据交互、且通过智能船SDN网络控制器的南向接口与数据平面进行数据交互，
所述数据平面包括智能船主交换机、一级安全网络、二级安全网络和三级安全网络，智能船主交换机与一级安全网络、二级安全网络和三级安全网络中各节点连接通信，
所述一级安全网络包括机舱设备网络节点以及船桥设备网络节点，用于进行船舶驾驶相关设备间的信息通信，
所述二级安全网络包括船舶关键装备测试验证设备节点以及科学实验工作站节点，用于实现智能船关键装备的测试和科学研究节点的通信，
所述三级安全网络包括娱乐节点以及非航行业务相关设备节点，用于进行非运营业务通信，
所述一级安全网络、二级安全网络和三级安全网络的安全优先级依次降低；
所述外部通信网络包括SDN网关/路由器、4G/5G网络通信设备、AIS/VDES通信设备、NAVDAT通信设备、北斗通信设备以及卫星通信设备；
所述内部通信网络通过SDN网关/路由器与4G/5G网络通信设备、AIS/VDES通信设备、NAVDAT通信设备、北斗通信设备以及卫星通信设备进行数据交互。
进一步地，所述数据平面还包括智能船备份交换机，所述智能船备份交换机分别与一级安全网络、二级安全网络和三级安全网络通信连接，当智能船主交换机故障时系统可立即启动智能船备份交换机工作。
进一步地，所述一级安全网络内部网络节点不与外部通信设备直接相连，与所述一级安全网络交互的通信数据包需通过SDN网关安全验证审核后才能与外部通信设备进行交换。
进一步地，与所述一级安全网络交互的通信数据包需通过SDN网关安全验证审核后才能与外部通信设备进行交换，包括：
对于允许进入一级安全网络的外部通信设备节点传输的公开标准格式的数据包，通过SDN网关安全验证审核后，将会动态设置数字签名，没有数字签名的通信节点的数据不能进入一级安全网络。
进一步地，与所述一级安全网络交互的通信数据包需通过SDN网关安全验证审核后才能与外部通信设备进行交换，还包括：
外部通信设备节点与一级安全网络传输交互的私有业务数据包，通过SDN网关安全验证审核后，需先进行加密处理，再进行数据传输。
进一步地，所有数据平面的数据交换，都需要进行基于机器学习的DDoS攻击检测，当判断当前流量为正常流量时则正常通信，当判断当前流量为DDoS流量，则进行网络防御，具体包括：
优先隐藏被攻击节点的IP地址，防止其继续遭受恶意攻击；同时命令智能船SDN控制器向智能船主交换机下发新的转发规则，修改被隐藏的IP地址，最后进行网络威胁追踪找到攻击者IP，清理智能船网络系统中该IP地址发送的恶意数据包，释放网络系统的存储空间。
进一步地，对于允许进入二级安全网络的外部通信设备节点通过SDN网关设置动态数字签名，没有数字签名的节点数据不可以进入二级安全网络。
进一步地，所述三级安全网络不与所述一级安全网络和二级安全网络进行数据传输。
进一步地，所述应用平面用于配置智能船网络系统的管理策略，智能船SDN控制器根据通信内容调用相应的管理策略构建完整的智能船网络系统管理体系，所述管理策略包括网络切换策略、网络防御策略、网络监控策略、 网络威胁追踪策略和网络数据采集策略；
所述网络切换策略被定义为：智能船通信网络中包含两个核心交换机，分别为智能船主交换机和智能船备份交换机，正常情况下智能船SDN控制器将控制信息下发至智能船主交换机，智能船主交换机根据控制器下发的规则转发一级安全网络、二级安全网络和三级安全网络中的流表信息，此时智能船备份交换机同步更新智能船主交换机的转发规则，当智能船主交换机出现故障时，无人船/智能船备份交换机上线，无人船/智能船SDN控制器将控制信息下发至无人船/智能船备份交换机，同时智能船备份交换机接替了智能船主交换机的工作，保证网络其他节点正常通信，进而保障了网络的灵活性；
所述网络防御策略被定义为：智能船检测到DDoS攻击后，优先隐藏被攻击节点的IP地址，防止其继续遭受恶意攻击；同时命令智能船SDN控制器向智能船主、备份交换机下发新的转发规则，修改被隐藏的IP地址，最后利用网络威胁追踪策略找到攻击者IP，清理智能船网络系统中该IP地址发送的恶意数据包，释放网络系统的存储空间，保证智能船网络节点的正常通信，体现了智能船网络系统遭受攻击后能够灵活组网的特性；
所述网络监控策略被定义为：实时提取网络信息采集数据库中的智能船网络信息，将网络流量信息、交换机流表信息和控制信息进行特征融合，建立网络安全状态评估模型，通过该模型对智能船网络进行实时监控、分析和预警，将分析报告和预警报告发送给智能船二级安全网络的网络管理设备，同时将报告展示给网络管理人员或科研人员进行网络系统的维护或研究，以保障网络的安全性；
所述网络威胁追踪策略被定义为：当智能船遭受DDoS攻击时，通过概率包标记算法，将智能船主、备份交换机经过的每一个数据包以一定概率在IP数据包首部中进行标记，从而让智能船的受害主机能够重构攻击路径，找到攻击者，并将攻击者IP列入黑名单中，不允许进入智能船网络系统，以提高网络的可靠性；
所述网络数据采集策略被定义为：智能船网络系统对网络环境中的网络信息进行采集并存储在网络信息采集数据库中，所述网络环境中的网络信息包括一级安全网络、二级安全网络和三级安全网络的网络流量信息，智能船 主、备份交换机的流表信息以及智能船SDN控制器下发的控制信息，有利于网络状态监控和科研数据的收集，以保障网络数据交换的实时性。
较现有技术相比，本发明具有以下优点：
本发明提出了一种基于SDN的智能船网络系统，打破了传统船舶网络的固定模式，将智能船网络按需划分，如将智能船相关航行与运营业务设备节点划分为一级安全网络；智能船关键装备的测试和科学研究节点划分为二级安全网络；非航行业务相关设备节点、及其他日常办公/娱乐等节点划分为三级安全网络。同时在应用平面设计网络切换策略、网络防御策略、网络监控策略、网络威胁追踪策略和网络数据采集策略等管理策略，以保障智能船布设网络的灵活性、安全性、可靠性和实时性。
附图说明
为了更清楚地说明本发明实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图做以简单地介绍，显而易见地，下面描述中的附图是本发明的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动性的前提下，还可以根据这些附图获得其他的附图。
图1为本发明一种基于SDN的智能船网络系统架构图。
图2为本发明智能船内部网络通信流程图。
图3为本发明一级安全网络与二级安全网络节点通信流程。
具体实施方式
为了使本技术领域的人员更好地理解本发明方案，下面将结合本发明实施例中的附图，对本发明实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅仅是本发明一部分的实施例，而不是全部的实施例。基于本发明中的实施例，本领域普通技术人员在没有做出创造性劳动前提下所获得的所有其他实施例，都应当属于本发明保护的范围。
本发明公开了一种基于SDN的智能船网络系统，如图1所示，包括内部通信网络和外部通信网络。内部通信网络包括依次通信连接的数据平面、控制平面和应用平面，其中控制平面包括智能船SDN网络控制器，所述控制 平面通过智能船SDN网络控制器的北向接口与应用平面进行数据交互、且通过智能船SDN网络控制器的南向接口与数据平面进行数据交互。数据平面包括智能船主SDN交换机、备份SDN交换机与一级安全网络、二级安全网络和三级安全网络，通常情况下，智能船主SDN交换机与一级安全网络、二级安全网络和三级安全网络中各节点连接通信。数据平面中的智能船备份交换机与主交换机一样，也分别与一级安全网络、二级安全网络和三级安全网络通信连接，当智能船主SDN交换机故障时系统可立即启动智能船备份SDN交换机工作。
进一步地，一级安全网络包括主推进器、舵机等机舱设备网络节点，以及雷达、INS等船桥设备网络节点，用于智能船相关航行与运营业务设备节点的通信连接。二级安全网络包括船舶关键测试验证设备节点、科学实验工作站节点、以及其他科研设备网络节点等，用于智能船关键装备的测试和科学研究节点的通信。三级安全网络包括船舶工作人员和乘客的智能手机、笔记本等娱乐节点、船舶工作教学等非航行业务相关设备节点、及其他日常办公/娱乐等节点的网络通信。一级安全网络、二级安全网络和三级安全网络的安全优先级依次降低，通常二级安全网络可选，根据需要布设。
外部通信网络包括SDN网关/路由器、以及4G/5G网络通信设备、AIS/VDES通信设备、NAVDAT通信设备、北斗、卫星通信设备等系列外部通信设备。内部通信网络的内部节点能够通过SDN网关/路由器与4G/5G网络通信设备、AIS/VDES通信设备、NAVDAT通信设备、北斗通信设备以及卫星通信设备进行数据交互。
作为本发明优选的实施方式，如图2-3所示，一级安全网络内部网络节点不与外部通信设备直接相连，所有通信数据包需通过SDN网关安全验证审核后才能与外部通信设备进行交换。对于允许进入一级安全网络的外部通信设备节点传输的公开标准格式的数据包如AIS通信设备产生的AIS数据包，通过SDN网关安全验证审核后，将会动态设置数字签名，没有数字签名的通信节点的数据不可以进入一级安全网络。外部通信设备节点与一级安全网络传输交换的私有业务数据包如VDES通信设备产生的VDE数据包，通过SDN网关安全验证审核后，需先进行诸如AES算法的加密处理，再进行数据传输。
更进一步地，数据平面的数据交换，都需要进行基于机器学习的DDoS攻击检测，当判断当前流量为正常流量时则正常通信，当判断当前流量为DDoS流量，系统执行网络防御策略。
需要注意的是，一级安全网络的各节点可采用上述机制与二级安全网络内节点进行数据交换，但不可以与三级安全网络间进行数据交换。
作为本发明优选的实施方式，对于允许进入二级安全网络的外部通信设备节点也需要通过SDN网关设置数字签名，没有数字签名的节点数据不可以进入二级安全网络；但二级安全网络向外传输的数据可不受上述限制。
作为本发明优选的实施方式，三级安全网络不与所述一级安全网络和二级安全网络进行数据传输，且不进行数据验证处理。
作为本发明优选的实施方式，通过所述应用平面利用北向接口与控制平面的智能船SDN控制器通信。应用平面包括网络切换策略、网络防御策略、网络监控策略、网络威胁追踪策略和网络数据采集策略，智能船SDN控制器根据通信内容，下发不同策略对应的控制信息进而构建了完整的智能船网络系统管理体系。
网络切换策略：智能船通信网络中包含两个核心交换机，分别为智能船主交换机和智能船备份交换机，正常情况下智能船SDN控制器将控制信息下发至智能船主交换机，智能船主交换机根据控制器下发的规则转发一级安全网络、二级安全网络和三级安全网络中的流表信息。此时，智能船备份交换机同步更新智能船主交换机的转发规则。当智能船主交换机出现故障时，智能船备份交换机上线，智能船SDN控制器将控制信息下发至智能船备份交换机，同时智能船备份交换机接替了智能船主交换机的工作，保证网络其他节点正常通信，进而保障了网络的灵活性；
网络防御策略：智能船检测到DDoS攻击后，优先隐藏被攻击节点的IP地址，防止其继续遭受恶意攻击；同时命令智能船SDN控制器向智能船主、备份交换机下发新的转发规则，修改被隐藏的IP地址，最后利用网络威胁追踪策略找到攻击者IP，清理智能船网络系统中该IP地址发送的恶意数据包，释放网络系统的存储空间，保证DDoS攻击下快速恢复智能船网络节点的正常通信，体现了智能船网络系统遭受攻击后能够灵活组网的特性。
网络监控策略：实时提取网络信息采集数据库中的智能船网络信息，将 网络流量信息、交换机流表信息和控制信息进行特征融合，建立网络安全状态评估模型，通过该模型对智能船网络进行实时监控、分析和预警，将分析报告和预警报告发送给智能船二级安全网络的网络管理设备，同时将报告展示给网络管理人员或科研人员进行网络系统的维护或研究，以保障网络的安全性。
网络威胁追踪策略：当智能船遭受DDoS攻击时，在上述DDoS攻击检测算法抵御网络威胁的基础上，通过概率包标记算法，将智能船主、备交换机经过的每一个数据包以一定概率在IP数据包首部中进行标记，从而让智能船的受害主机能够重构攻击路径，找到攻击者，并将攻击者IP列入黑名单中，不允许进入智能船网络系统以提高网络的可靠性。
网络数据采集策略：智能船网络系统需要采集网络环境中的网络信息，如：一级安全网络、二级安全网络和三级安全网络的网络流量信息；智能船主、备份交换机的流表信息；智能船SDN控制器下发的控制信息等存储在网络信息采集数据库中，有利于网络状态监控和科研数据的收集，以保障网络数据交换的实时性。
下面通过具体的应用实例，对本发明的方案和效果做进一步说明。
如图1所示为本实施例中基于SDN的无人船系统网络架构图，根据此架构通过Mininet仿真软件，根据以下步骤构建仿真系统：
S101、根据图1所示拓扑结构创建网络的交换机和节点；具体包括主交换机、备份交换机、一级安全网络、二级安全网和三级安全网络。一级安全网络包括机舱设备和船桥设备等15个节点，二级安全网络包括船舶关键测试验证设备等10个节点，三级安全网络包括手机、笔记本等10个节点。
S102、添加交换机和节点间的链路；一级安全网络的10.0.0.13-10.0.0.15与二级安全网络的20.0.0.8-20.0.0.10进行通信，其他节点仅与同一网段的节点通信。
S103、设置节点IP地址，MAC地址和默认路由。将一级安全网络设备的默认路由设置为空，IP地址依次设置为10.0.0.1、10.0.0.2、10.0.0.3、...、10.0.0.15，mac地址设置为00:00:00:00:01、00:00:00:00:02、...、00:00:00:00:15。将二级安全网络设备默认路由设置为空，IP地址依次设置为 20.0.0.1、20.0.0.2、20.0.0.3、...、20.0.0.10，mac地址设置为00:00:00:00:16、00:00:00:00:17、...、00:00:00:00:25。将三级安全网络设备的默认路由设置为空，IP地址依次设置为30.0.0.1、30.0.0.2、30.0.0.3、...、30.0.0.10，mac地址设置为00:00:00:00:26、00:00:00:00:27、...、00:00:00:00:35。
S104、添加SDN控制器；默认ip127.0.0.1，设定为TCP协议，类型为RemoteController。
S105、启动网络。
最后应说明的是：以上各实施例仅用以说明本发明的技术方案，而非对其限制；尽管参照前述各实施例对本发明进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分或者全部技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本发明各实施例技术方案的范围。

Claims (9)

  1. 一种基于SDN的智能船网络系统，其特征在于，包括内部通信网络和外部通信网络；
    所述内部通信网络包括依次通信连接的数据平面、控制平面和应用平面，其中控制平面包括智能船SDN网络控制器，所述控制平面通过智能船SDN网络控制器的北向接口与应用平面进行数据交互、且通过智能船SDN网络控制器的南向接口与数据平面进行数据交互，
    所述数据平面包括智能船主交换机、一级安全网络、二级安全网络和三级安全网络，智能船主交换机与一级安全网络、二级安全网络和三级安全网络中各节点连接通信，
    所述一级安全网络包括机舱设备网络节点以及船桥设备网络节点，用于进行船舶驾驶相关设备间的信息通信，
    所述二级安全网络包括船舶关键装备测试验证设备节点以及科学实验工作站节点，用于实现智能船关键装备的测试和科学研究节点的通信，
    所述三级安全网络包括娱乐节点以及非航行业务相关设备节点，用于进行非运营业务通信，
    所述一级安全网络、二级安全网络和三级安全网络的安全优先级依次降低；
    所述外部通信网络包括SDN网关/路由器、4G/5G网络通信设备、AIS/VDES通信设备、NAVDAT通信设备、北斗通信设备以及卫星通信设备；
    所述内部通信网络通过SDN网关/路由器与4G/5G网络通信设备、AIS/VDES通信设备、NAVDAT通信设备、北斗通信设备以及卫星通信设备进行数据交互。
  2. 根据权利要求1所述的一种基于SDN的智能船网络系统，其特征在于，所述数据平面还包括智能船备份交换机，所述智能船备份交换机分别与一级安全网络、二级安全网络和三级安全网络通信连接，当智能船主交换机故障时系统可立即启动智能船备份交换机工作。
  3. 根据权利要求1所述的一种基于SDN的智能船网络系统，其特征在 于，所述一级安全网络内部网络节点不与外部通信设备直接相连，与所述一级安全网络交互的通信数据包需通过SDN网关安全验证审核后才能与外部通信设备进行交换。
  4. 根据权利要求3所述的一种基于SDN的智能船网络系统，其特征在于，与所述一级安全网络交互的通信数据包需通过SDN网关安全验证审核后才能与外部通信设备进行交换，包括：
    对于允许进入一级安全网络的外部通信设备节点传输的公开标准格式的数据包，通过SDN网关安全验证审核后，将会动态设置数字签名，没有数字签名的通信节点的数据不能进入一级安全网络。
  5. 根据权利要求3所述的一种基于SDN的智能船网络系统，其特征在于，与所述一级安全网络交互的通信数据包需通过SDN网关安全验证审核后才能与外部通信设备进行交换，还包括：
    外部通信设备节点与一级安全网络传输交互的私有业务数据包，通过SDN网关安全验证审核后，需先进行加密处理，再进行数据传输。
  6. 根据权利要求1所述的一种基于SDN的智能船网络系统，其特征在于，所有数据平面的数据交换，都需要进行基于机器学习的DDoS攻击检测，当判断当前流量为正常流量时则正常通信，当判断当前流量为DDoS流量，则进行网络防御，具体包括：
    优先隐藏被攻击节点的IP地址，防止其继续遭受恶意攻击；同时命令智能船SDN控制器向智能船主交换机下发新的转发规则，修改被隐藏的IP地址，最后进行网络威胁追踪找到攻击者IP，清理智能船网络系统中该IP地址发送的恶意数据包，释放网络系统的存储空间。
  7. 根据权利要求1所述的一种基于SDN的智能船网络系统，其特征在于，对于允许进入二级安全网络的外部通信设备节点通过SDN网关设置动态数字签名，没有数字签名的节点数据不可以进入二级安全网络。
  8. 根据权利要求1所述的一种基于SDN的智能船网络系统，其特征在于，所述三级安全网络不与所述一级安全网络和二级安全网络进行数据传输。
  9. 根据权利要求1所述的一种基于SDN的智能船网络系统，其特征在 于，所述应用平面用于配置智能船网络系统的管理策略，智能船SDN控制器根据通信内容调用相应的管理策略构建完整的智能船网络系统管理体系，所述管理策略包括网络切换策略、网络防御策略、网络监控策略、网络威胁追踪策略和网络数据采集策略；
    所述网络切换策略被定义为：智能船通信网络中包含两个核心交换机，分别为智能船主交换机和智能船备份交换机，正常情况下智能船SDN控制器将控制信息下发至智能船主交换机，智能船主交换机根据控制器下发的规则转发一级安全网络、二级安全网络和三级安全网络中的流表信息，此时智能船备份交换机同步更新智能船主交换机的转发规则，当智能船主交换机出现故障时，无人船/智能船备份交换机上线，无人船/智能船SDN控制器将控制信息下发至无人船/智能船备份交换机，同时智能船备份交换机接替了智能船主交换机的工作，保证网络其他节点正常通信，进而保障了网络的灵活性；
    所述网络防御策略被定义为：智能船检测到DDoS攻击后，优先隐藏被攻击节点的IP地址，防止其继续遭受恶意攻击；同时命令智能船SDN控制器向智能船主、备份交换机下发新的转发规则，修改被隐藏的IP地址，最后利用网络威胁追踪策略找到攻击者IP，清理智能船网络系统中该IP地址发送的恶意数据包，释放网络系统的存储空间，保证智能船网络节点的正常通信，体现了智能船网络系统遭受攻击后能够灵活组网的特性；
    所述网络监控策略被定义为：实时提取网络信息采集数据库中的智能船网络信息，将网络流量信息、交换机流表信息和控制信息进行特征融合，建立网络安全状态评估模型，通过该模型对智能船网络进行实时监控、分析和预警，将分析报告和预警报告发送给智能船二级安全网络的网络管理设备，同时将报告展示给网络管理人员或科研人员进行网络系统的维护或研究，以保障网络的安全性；
    所述网络威胁追踪策略被定义为：当智能船遭受DDoS攻击时，通过概率包标记算法，将智能船主、备份交换机经过的每一个数据包以一定概率在IP数据包首部中进行标记，从而让智能船的受害主机能够重构攻击路径，找到攻击者，并将攻击者IP列入黑名单中，不允许进入智能船网络系统，以提高网络的可靠性；
    所述网络数据采集策略被定义为：智能船网络系统对网络环境中的网络信息进行采集并存储在网络信息采集数据库中，所述网络环境中的网络信息包括一级安全网络、二级安全网络和三级安全网络的网络流量信息，智能船主、备份交换机的流表信息以及智能船SDN控制器下发的控制信息，有利于网络状态监控和科研数据的收集，以保障网络数据交换的实时性。
PCT/CN2023/075805 2022-07-20 2023-02-14 一种基于sdn的智能船网络系统 WO2024016642A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
ZA2023/08261A ZA202308261B (en) 2022-07-20 2023-08-28 A software-defined networking (sdn)-based intelligent ship network system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210863231.X 2022-07-20
CN202210863231.XA CN115396465B (zh) 2022-07-20 2022-07-20 一种基于sdn的智能船网络系统

Publications (1)

Publication Number Publication Date
WO2024016642A1 true WO2024016642A1 (zh) 2024-01-25

Family

ID=84116601

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/075805 WO2024016642A1 (zh) 2022-07-20 2023-02-14 一种基于sdn的智能船网络系统

Country Status (3)

Country Link
CN (1) CN115396465B (zh)
WO (1) WO2024016642A1 (zh)
ZA (1) ZA202308261B (zh)

Families Citing this family (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115396465B (zh) * 2022-07-20 2024-09-20 大连海事大学 一种基于sdn的智能船网络系统
KR102684483B1 (ko) * 2022-12-30 2024-07-12 한화오션 주식회사 선박의 라디오 주파수 통신 네트워크 사이버 보안체계 구축 시스템
CN117082651A (zh) * 2023-07-10 2023-11-17 武汉船舶通信研究所(中国船舶集团有限公司第七二二研究所) 一种适用于船载环境的5g分级分布式网络

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170291670A1 (en) * 2016-04-08 2017-10-12 Texas Marine & Offshore Projects LLC Autonomous workboats and methods of using same
CN111211977A (zh) * 2019-12-12 2020-05-29 鹏城实验室 一种支持外界多异构信道连接的舰船通信方法及系统
CN213521957U (zh) * 2020-12-14 2021-06-22 震兑工业智能科技有限公司 一种基于数字船舶网络安全的网络接入系统
CN115396465A (zh) * 2022-07-20 2022-11-25 大连海事大学 一种基于sdn的智能船网络系统

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106411910B (zh) * 2016-10-18 2019-04-05 优刻得科技股份有限公司 一种分布式拒绝服务攻击的防御方法与系统
CN109889476A (zh) * 2018-12-05 2019-06-14 国网冀北电力有限公司信息通信分公司 一种网络安全防护方法和网络安全防护系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20170291670A1 (en) * 2016-04-08 2017-10-12 Texas Marine & Offshore Projects LLC Autonomous workboats and methods of using same
CN111211977A (zh) * 2019-12-12 2020-05-29 鹏城实验室 一种支持外界多异构信道连接的舰船通信方法及系统
CN213521957U (zh) * 2020-12-14 2021-06-22 震兑工业智能科技有限公司 一种基于数字船舶网络安全的网络接入系统
CN115396465A (zh) * 2022-07-20 2022-11-25 大连海事大学 一种基于sdn的智能船网络系统

Also Published As

Publication number Publication date
CN115396465B (zh) 2024-09-20
ZA202308261B (en) 2024-03-27
CN115396465A (zh) 2022-11-25

Similar Documents

Publication Publication Date Title
WO2024016642A1 (zh) 一种基于sdn的智能船网络系统
EP3206356B1 (en) Controlling transmission security of industrial communications flow in a sdn architecture
CN106612225B (zh) 一种基于openstack的代理部署系统及方法
CN102984057B (zh) 一种多业务一体化双冗余网络系统
CN101771619B (zh) 实现一体化安全服务的网络系统
Maziku et al. Software Defined Networking enabled resilience for IEC 61850-based substation communication systems
CN105471907A (zh) 一种基于Openflow的虚拟防火墙传输控制方法及系统
TW201703473A (zh) 混合型網路生成樹建立方法、備援方法與其控制系統
EP3200399B1 (en) Automated mirroring and remote switch port analyzer (rspan)/encapsulated remote switch port analyzer (erspan) functions using fabric attach (fa) signaling
CN105515998B (zh) 一种sptn域三层域和二层域互通的方法与系统
WO2014202026A1 (zh) 虚拟网络映射保护方法、系统及计算机存储介质
CN104579839A (zh) 一种变电站通信网络状态在线监测系统及方法
CN102571738A (zh) 基于虚拟局域网交换的入侵防御方法与系统
CN213521957U (zh) 一种基于数字船舶网络安全的网络接入系统
CN101277303B (zh) 一种可信可控网络体系结构的控制方法
CN110213233A (zh) 防御电网分布式拒绝服务攻击的仿真平台及建立方法
CN112929200A (zh) 一种面向sdn多控制器的异常检测方法
CN108965013A (zh) Ip和光网络业务快速开通系统及方法
CN106341296A (zh) 一种变电站内通信网络中避免数据报文碰撞的方法
Wang et al. Deep reinforcement learning for securing software-defined industrial networks with distributed control plane
Wang et al. Topology poisoning attacks and countermeasures in SDN-enabled vehicular networks
CN106059930A (zh) 一种电力通信网络系统
CN115580432A (zh) 一种工业控制网络与信息化网络安全连接方法
Ciancamerla et al. An electrical grid and its SCADA under cyber attacks: Modelling versus a Hybrid Test Bed
CN114389991A (zh) 一种智能网络流量调度管理方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23841720

Country of ref document: EP

Kind code of ref document: A1