WO2014177097A1

WO2014177097A1 - Flow table entry generation method and corresponding device

Info

Publication number: WO2014177097A1
Application number: PCT/CN2014/078406
Authority: WO
Inventors: 梁乾灯; 范亮; 尤建洁; 韩杰
Original assignee: 中兴通讯股份有限公司
Priority date: 2013-08-16
Filing date: 2014-05-26
Publication date: 2014-11-06
Also published as: CN104378298A

Abstract

A flow table entry generation method and corresponding device, the method being used for an openflow forwarding device and comprising: receiving a guide flow table entry and a flow table template transmitted by an openflow controller, the action information of the guide flow table entry comprising a preset flow table template ID; after receiving a data packet, if the data packet matches the guide flow table entry, then searching for a corresponding flow table template according to the preset flow table template ID in the action information of the guide flow table entry, and generating a flow table entry according to a flow table entry generation rule defined by the corresponding flow table template and the key field information of the data packet. The technical solution enhances the security of an openflow protocol, and expands the application scenario and usability of an openflow/SDN network.

Description

Flow table entry generation method and corresponding device

Technical field

The present invention relates to the field of flow table entry generation technology, and in particular to a flow table entry generation method and corresponding device.

Background technique

Today's Internet based on Transmission Control Protocol (TCP)

(Internet) After more than 40 years of development, it has achieved great success and is closely related to people. It has become one of the essential infrastructures for work, study and life. The TCP/IP-style Internet has formed the current status of the Internet architecture due to the division of labor and organization principles of "network/network equipment for simple processing and complex processing for the host/side" at the beginning of design: Host-side The application layer protocol can be easily and flexibly modified and deployed. The application layer software has been developed by leaps and bounds, and the functions of the application layer have been greatly enriched. In sharp contrast, the network layer and the network layer protocol Although the design is simple, the scalability is not strong and it is not easy to modify. On the one hand, many fatal flaws exposed at the Internet network level are difficult to be repaired and improved in the long run, such as network management is difficult to deploy, network security problems are becoming more and more serious, and efforts are being made. The forwarding policy cannot meet the user's service quality requirements, and the multicast is difficult to deploy and apply. On the other hand, the new protocols and new applications are difficult to implement due to the requirements for changes to the network layer. For example, the transition from IPv4 to IPv6 is difficult. Into the device is increasingly showing ubiquitous mobility and heterogeneity Network reliability and differentiated service capabilities present challenges, routing scalability issues in large-scale networks, cloud computing and content distribution applications have new demands for network forwarding efficiency. The father of TCP/IP, Vinton G. Cerf, also pointed out that the Internet should Do a better job in network security and network reliability ("Security and reliability are the two most basic thresholds for the future of the Internet, otherwise this architecture will not survive"). Therefore, the Internet has now formed an embarrassing situation in which the application layer is flexible and changeable, the network layer is rigid and difficult to change, and the loopholes are numerous. To solve the current problems and embarrassing situations, the Internet needs to be deeply explored, researched and reformed from the perspectives of network architecture and control, so as to fully meet the new opportunities and enormous challenges of the 21st century.

How to solve the problems and challenges facing the Internet today, domestic and foreign research institutions from the Internet A lot of active exploration and research has been carried out at the level of the network architecture. Mainly through two stages of development, improvements to the Internet can be divided into two types: evolutionary improvements and revolutionary improvements.

Over the years, in view of the many problems exposed by traditional IP networks in terms of service quality assurance, mobile support, high efficiency and reliability, and security assurance, the research field generally uses design-specific patching methods to solve these problems separately. Once the running network is discovered. The weaknesses or errors are immediately improved, such as adding new protocols and functional components to the traditional Internet architecture. This "repair->discovery->re-modification" approach is based on the relevant Internet TCP/IP architecture, which gradually evolves and develops related networks to add new functions and features to solve the current problems. The way, is an improvement of Evolution. The advantage of this improvement is that it is easy to deploy and implement, and it helps to protect the existing investment in the construction of related Internet. However, its shortcomings are: (1) a patching only solves local problems in a small scope; (2) related improvements may introduce short-term gains, while in the long run it is destructive such as NAT (Network Address Translation) Conversion), or local gains are destructive to the whole; (3) A patch may not be easily "compatible" with future modifications; (4) After many fixes, the Internet becomes more "thick", complex, not Flexibility, beyond the ability to withstand the simple architecture of the original Internet; (5) Some inherent problems in the traditional Internet architecture are difficult to fundamentally solve. Since 2005, the research field has gradually formed another point of view. Only by redesigning the network architecture can we fundamentally solve the problems faced by IP networks. Currently, the Internet architecture "Clean-Slate" (from scratch) A good time to make a complete and radical change, completely abandon the relevant Internet architecture, and design a new generation of Internet architecture that integrates multiple design goals. This kind of program aims to fundamentally solve various problems related to the Internet architecture, and is a revolutionary improvement. The advantages of this scheme are: (1) It can get rid of the constraints of the TPC/IP architecture and jump out of its constraints and framework to solve the legacy problems caused by the architecture of the Internet for many years;

(2) The Internet can be redesigned and comprehensively designed to solve many problems of the Internet and to coordinate the realization of many new Internet requirements. However, the shortcomings of this scheme are: (1) Since the new network may not be compatible with the relevant Internet and need to completely replace the original network infrastructure, there is a problem of network deployment and smooth transition; (2) How to establish a new architecture There is also a significant risk of establishing a new architecture that addresses the problems faced by current and future networks;

(3) The need to rebuild a trial network suitable for a new architecture is costly to evolve. In order to solve the problems existing in the current Internet and realize the rapid and flexible deployment of new network protocols, open programmable networks have been proposed. Open programmable network refers to allowing network researchers, not just device vendors, to program and manage their network architecture or network protocols on network devices. The open programmable thinking is one of the representative achievements of the revolutionary improvement program. It can be summarized as follows: The original multi-function network coexists, the overall, complex MAN (Metropolitan Area Network) / WAN (Wide Area) Network, WAN) Network or network equipment is divided into functions, such as data forwarding and logic control, or system core and user function. The interface between the parts is open and standard. Based on this open and standardized interface, each part can evolve and improve without notice or influence other parts, so that the entire network or network equipment will also achieve independent, smooth evolution and improvement. The challenges of the open programmable approach are: (1) Network tiering needs to be reasonable, scientific, and scalable; (2) Define a scientific, scalable inter-layered interface; (3) Control plane If you take centralized management, you need to consider inter-domain connectivity, scalability (such as expanding to the global).

In the field of open programmable networks, technologies such as Software Defined Networking (SDN) from Scott Shenker et al. at Berkeley University and OpenFlow (Stanford) at Open University are open. Representative results of sex research. Figure 1 is a schematic diagram of the hierarchical model of SDN/OpenFlow technology, including: three levels: infrastructure layer, network control layer and application layer. The infrastructure layer in the SDN/OpenFlow network consists of more than one forwarding device. The forwarding device is simpler and has no complicated control plane (Control Plane) than the routers, switches and various gateways in the current network. Work is the forwarding of data streams. The main device in the network control layer is the network operating system (or SDN/OpenFlow controller). The network operating system controls multiple forwarding devices at the same time through a standardized interface, instead of the control plane that is independent of each forwarding device. And even the current network management system can implement network management and end-to-end data flow rules delivery (that is, sending flow rules to multiple forwarding devices on the forwarding path), and the network operating system passes the application programming interface (API, Application Programming Interface ) interacts with the application layer. The application layer is composed of different applications, and the application can directly call the network management and control functions of the network control layer through the API interface.

As with the deployment of other revolutionary improvements, the carrier network is moving to SDN/OpenFlow In the process of architecture evolution, it is bound to encounter various problems, such as security is one of the most important issues. In addition, the adaptability to various live network technologies is also an important indicator to measure whether a new technology is in line with the trend of the network. As shown in FIG. 2, in an actual SDN/OpenFlow network, a network control layer device (such as an SDN/OpenFlow controller) and an infrastructure layer device (ie, a forwarding device) communicate through an IP address-based communication protocol message ( For example, the OpenFlow protocol, the data traffic between the network terminals, between the network terminal and the application server, between the application server and the application server is forwarded by the flow table between the forwarding devices, and the flow table of each flow is controlled by SDN/OpenFlow. The device generates and delivers the data packet to the forwarding device. The forwarding device sends the data packet to the SDN/OpenFlow controller for query and generation. The forwarding device needs to wait for SDN/OpenFlow. The controller sends a new flow table to forward the data packet. This forwarding mode of data packets brings the following problems:

I. Security problem: The forwarding device sends all attack packets to SDN/ before sending the flow table to the SDN/OpenFlow controller or the attacking application server. The OpenFlow controller, if the attack packet is sent frequently, may cause congestion between the forwarding device and the SDN/OpenFlow controller, affecting other control messages between the forwarding device and the control device (such as flow table query and configuration). The delivery efficiency of the delivery, etc., and the current flow table delivery mechanism cannot protect the application server before the attack packet arrives at the application server, that is, the application server finds the attack and passes between the application layer and the SDN/OpenFlow controller. Before the interface sends the security policy and the SDN/OpenFlow controller forms a new flow table and sends it to the forwarding device, all attack packets from the attack source for the application server are sent to the application server.

Second, the compatibility problem: For the service scenarios such as NAT, the current traffic flow, flow table entry generation, and flow table entry delivery mode have a longer control process, which has a greater impact on forwarding delay and efficiency. For example, in the NAT scenario, after receiving the data packet sent by the user's private network terminal, the forwarding device needs to first send the packet to the SDN/OpenFlow controller, which is not logged to the SDN/OpenFlow controller. The controller completes the designation of the public network address and port number, the address matching relationship, the generation of the corresponding flow table entries, and the delivery of the flow table entries. Currently, each user has a large number of scenes that are frequently generated and released (such as P2P ( Peer). To Peer (peer-to-peer network) application), the forwarding efficiency is low, and in the future, IPv4/IPv6 will coexist for a long time, and the private network IPv4 address will exist for a long time. In the network, this forwarding mode needs further optimization.

Summary of the invention

The technical problem to be solved by the embodiment of the present invention is to provide a method for generating a flow table entry and a corresponding device, so as to improve the timeliness and adaptability of the packet forwarding mode on the premise of improving the security of the SDN/Openflow network.

In order to solve the above problems, the following technical solutions are used:

A flow table entry generation method is applied to an OpenFlow forwarding device, including: receiving a boot flow table entry and a flow table template sent by an Openflow controller; wherein, the action information of the boot flow table entry The preset flow table template ID is included;

After receiving the data packet, if the data packet matches the boot flow table entry, searching and the flow table according to the flow table template ID preset in the action information of the boot flow table entry a flow table template corresponding to the template ID, and generating a flow table entry according to the flow table entry generation rule defined by the corresponding flow table template and the key segment information of the data packet.

Optionally, the method further includes:

The generated flow table entry is sent to the Openflow controller through an extended flow entry add message.

Optionally, the step of sending the generated flow table entry to the Openflow controller by using the flow entry adding message includes:

The Openflow forwarding device sends the information of the flow table entry in real time or in batch through the flow entry adding message.

Optionally, the method further includes:

The data packet is processed and forwarded according to the generated flow table entry.

Optionally, the matching rule of the bootstrap flow entry includes: the destination address is an IP address of the protected device;

The step of matching the data packet to hit the boot flow table entry includes:

The destination address of the data packet is an IP address of the protected device. Optionally, the flow table entry generation rule defined by the flow table template is to limit the rate of the packets sent by the source IP address to the protected device.

The step of generating a flow table entry according to the flow table entry generation rule defined by the flow table template and the key field information of the data packet includes:

The flow table entry is generated. The matching rule of the flow table entry includes: the source IP address is the source IP address of the data, the destination IP address is the IP address of the protected device, and the action information is A data message matching the matching rule is sent to the protected device and the transmission rate is restricted by the meter entry.

Optionally, the matching rule of the guiding flow table entry includes a private network address segment whose source address is a type of user;

The step of matching the data packet to hit the boot flow table entry includes:

The source address of the data is one of the private network address segments.

Optionally, the flow table entry generation rule defined by the flow table template is an address translation rule of a packet sent by the user side to the network side;

The flow table entry is generated. The matching rule of the flow table entry includes: a private network address of the data packet, and the action includes converting the private network address into an allocated public network address, and passing the corresponding outbound interface. Send the converted message.

Optionally, the method further includes:

Receiving a second flow table template sent by the OpenFlow controller; where the second flow table template is concatenated with the flow table template, and the flow table entry generation rule defined by the second flow table template is a network The address translation rule of the packet sent to the user side.

Optionally, the method further includes:

Generating the second flow table η · according to the generated flow table entry in combination with the second flow table template,

The matching rule of the second flow table entry includes: the allocated public network address, Action The information is that the public network address is translated into a corresponding private network address, and the converted message is sent through the corresponding outbound interface.

Optionally, the private network address includes: a private network IP address;

The public network address includes: a public network IP address, or a public network IP address and port information. Optionally, the method further includes:

The generated second flow table entry is sent to the Openflow controller through a flow entry add message.

A method for generating a flow table entry, which is applied to an OpenFlow controller, includes: sending a boot flow table entry and a flow table template to an Openflow forwarding device; wherein the action information of the boot flow table entry includes The flow table template ID set.

Optionally, the matching rule of the bootstrap flow entry includes: the destination address is an IP address of the protected device; and/or,

The flow table entry generation rule defined by the flow table template is to limit the rate of the packets sent by the source IP address to the protected device.

Optionally, the method further includes:

After receiving the flow table entry sent by the Openflow forwarding device through the flow entry adding message,

The Openflow controller does not reply to the flow entry adding message, and indicates that the local flow table entry generated by the Openflow forwarding device according to the flow table template is accepted; or

The OpenFlow controller sends a reject message to the OpenFlow forwarding device, and the Openflow forwarding device is required to delete the flow table entry generated according to the flow table template. Alternatively, the Openflow controller sends the OpenFlow controller to the Openflow forwarding device. A higher priority flow table entry.

Optionally, the matching rule of the guiding flow table entry includes: the source address is a private network address segment of the user; and/or,

The flow table entry generation rule defined by the flow table template is a packet sent by the user side to the network side. Address translation rules.

Optionally, the private network address network segment includes: a private network IP address.

Optionally, the method further includes:

Sending a second flow table template to the OpenFlow forwarding device, where the second flow table template is concatenated with the flow table template, and the flow table entry generation rule defined by the second flow table template is sent by the network side The address translation rule for the message to the user side.

An OpenFlow forwarding device, comprising: a receiving module and a generating module, wherein: the receiving module is configured to: receive a boot flow table entry and a flow table template sent by the Openflow controller; wherein, the boot flow table entry The Action information includes the preset flow table template ID; and is further configured to receive a data message;

The generating module is configured to: after the receiving, by the receiving module, the data packet matches the boot flow table entry received by the receiving module, according to the boot flow table Searching, by using the flow table template ID that is preset in the action information of the entry, a flow table template corresponding to the flow table template ID, and generating a rule and the data message according to the flow table entry defined by the corresponding flow table template. The key field information generates a flow table entry.

Optionally, the method further includes a sending module, where:

The sending module is configured to: send the flow table entry generated by the generating module to the Openflow controller by using an extended flow entry adding message.

Optionally, the sending module is further configured to: process and forward the data packet according to the flow table entry generated by the generating module.

The generating module is configured to determine that the data packet match hits the boot flow table entry as follows:

The destination address of the data packet is an IP address of the protected device.

Optionally, the flow table entry generation rule defined by the flow table template is to any source IP address. Determining the rate of the packets sent by the protected device;

The generating module is configured to generate a flow table entry according to the flow table entry generation rule defined by the flow table template and the key segment information of the data packet as follows:

The source address of the data is one of the private network address segments.

Optionally, the receiving module is further configured to: receive a second flow table template sent by the Openflow controller;

The second flow table template is cascaded with the flow table template, and the second flow table template is defined. The generating module is further configured to: combine the generated according to the generated flow table entry. Generating, by the second flow table template, the second flow table entry;

The matching rule of the second flow table entry includes: the allocated public network address, and the action information is to convert the public network address into a corresponding private network address, and send the converted message through the corresponding outbound interface. . Optionally, the private network address includes: a private network IP address;

The public network address includes: a public network IP address, or a public network IP address and port information. Optionally, the sending module is further configured to: send the generated second flow table entry to the Openflow controller by using a flow entry adding message.

An OpenFlow controller includes a storage module and a sending module, where: the storage module is configured to: save a pre-configured boot flow table entry and a flow table template; wherein, the action of guiding the flow table entry ( The Action information includes the preset flow table template ID;

The sending module is configured to: send the boot flow table entry and the flow table template saved by the storage module to the Openflow forwarding device.

Optionally, the matching rule of the boot flow table entry includes: the destination address is a protected device

IP address; and / or,

Optionally, the method further includes a receiving module, where:

The receiving module is configured to: receive a flow table entry sent by the Openflow forwarding device by using a flow entry adding message;

The sending module is further configured to: after the receiving module receives the flow table entry, send a reject message to the Openflow forwarding device, requesting the Openflow forwarding device to delete the flow generated according to the flow table template a table entry; or, after the receiving module receives the flow table entry, sending a higher priority flow table entry to the Openflow forwarding device.

The flow table entry generation rule defined by the flow table template is an address translation rule of a message sent by the user side to the network side.

Optionally, the sending module is further configured to: send the second stream to the Openflow forwarding device a table template; wherein the second flow table template is cascaded with the flow table template, and the second flow table template is. ' , ^ '

The foregoing technical solution implements the function of generating a flow table entry according to the flow table entry template on the Openflow forwarding device, enhances the security of the Openflow protocol, and extends the application scenario and practicability of the Openflow/SDN network. BRIEF abstract

1 is a schematic diagram of a topology of an SDN/OpenFlow network in the related art;

2 is a schematic diagram of a network topology in the related art;

3 is a schematic flowchart of a method for generating a flow table entry in an embodiment of the present invention;

Figure 4 is a schematic top view of a first embodiment of the present invention;

Figure 5 is a flow chart of the first embodiment of the present invention;

Figure 6 is a schematic top view of a second embodiment of the present invention;

Figure 7 is a flow chart of a second embodiment of the present invention;

Figure 8 is a schematic top view of a third embodiment of the present invention;

Figure 9 is a flow chart of a third embodiment of the present invention;

FIG. 10 is a schematic structural diagram of an Openflow forwarding device according to an embodiment of the present invention;

FIG. 11 is a schematic structural diagram of an Openflow controller according to an embodiment of the present invention. Preferred embodiment of the invention

Embodiments of the present invention will be described in detail below with reference to the accompanying drawings. It should be noted that, in the case of no conflict, the features in the embodiments and the embodiments in the present application may be arbitrarily combined with each other.

In this embodiment, a flow table entry generation method is applied to an Openflow forwarding device, as shown in FIG. 3, including: Receiving the boot flow table entry and the flow table template sent by the OpenFlow controller; wherein, the Action information of the boot flow table entry includes the preset flow table template ID;

After the data packet is received, if the data packet matches the boot flow table entry, the corresponding flow table template is searched according to the flow table template ID preset in the action information of the boot flow table entry. And generating a flow table entry according to the flow table entry generation rule defined by the corresponding flow table template and the key segment information of the data message.

Optionally, the method further includes:

Optionally,

The matching rule of the boot flow table entry includes: the destination address is an IP address of the protected device; and the data packet matching hits the boot flow table entry, specifically:

Optionally,

The flow table entry generation rule defined by the flow table template is to limit the rate of the packets sent by the source IP address to the protected device;

And generating, by the flow table entry generation rule and the key field information of the data packet, the flow table entry, specifically:

The flow table entry is generated. The matching rule of the flow table entry includes: the source IP address is the source IP address of the data, the destination IP address is the IP address of the protected device, and the action information is Sending a data message matching the matching rule to the protected device and using the measurement table The entry limits the sending rate.

Optionally,

The matching rule of the boot flow table entry includes a private network address network segment whose source address is a type of user; the data packet matching hits the boot flow table entry, specifically including:

The source address of the data is one of the private network address segments.

Optionally,

The flow table entry generation rule defined by the flow table template is an address translation rule of a packet sent by the user side to the network side;

Optionally, the method further includes:

And generating, according to the generated flow table entry, the second flow table entry in combination with the second flow table template;

The matching rule of the second flow table entry includes: the allocated public network address, and the action information is to convert the public network address into a corresponding private network address, and send the converted message through the corresponding outbound interface. .

Optionally,

The private network address includes: a private network IP address;

The public network address includes: a public network IP address, or a public network IP address and port information. Optionally, the method further includes: The generated second flow table entry is sent to the Openflow controller through a flow entry add message.

In addition, an embodiment of the present invention further provides a method for generating a flow table entry, which is applied to an OpenFlow controller, and includes:

Sending a boot flow table entry and a flow table template to the Openflow forwarding device; wherein the action information of the boot flow table entry includes the preset flow table template ID.

Optionally,

The matching rule of the boot flow table entry includes: the destination address is an IP address of the protected device; and/or,

Optionally, the method further includes:

Optionally,

The matching rule of the boot flow table entry includes a source address being a private network address segment of the user; and/or,

Optionally, the method further includes:

The method in this embodiment can prevent the gateway fraudulent behavior caused by the maliciously transmitting RA message of the IPv6 host, if the Layer 2 network device does not support the IPv6 security RA (Random Access) feature.

Three embodiments of the embodiments of the present invention in different application scenarios are respectively described below.

Embodiment 1

For the attack defense of the Openflow controller and the hardware architecture of the Openflow forwarding device, the combination of the ASIC forwarding plane and the CPU control plane is used as an example. The networking diagram is shown in Figure 4. The detailed process is shown in Figure 5.

Step 101: The Openflow controller configures a local security policy to prevent the TCP semi-connected attack. Step 102: The Openflow controller sends the boot flow table entry XI and the flow table template Y1 to each Openflow forwarding device according to the local security policy.

Optionally, the matching rule of the boot flow table entry XI is that the destination address is an IP address of the Openflow controller, the packet type is TCP or TCP SYN (synchronous), and the action of the boot flow table entry is a query flow table. The flow table entry generation rule defined by the template Y1 and the flow table template Y1 is a rate for limiting the TCP or TCP SYN packet sent by any source IP address to the Openflow controller.

Optionally, after receiving the boot flow table entry XI and the flow table template Y1, the Openflow forwarding device sends the boot flow table entry XI to the ASIC forwarding plane, and saves the flow table template Y1 on the CPU control plane.

Step 103: The attack source A1 sends a TCP SYN packet to the Openflow controller at a certain rate to form a TCP semi-connection type network attack. Step 104: After receiving the first TCP SYN packet sent by the attack source A1, the Openflow forwarding device matches the flow table to the navigation table entry XI, and then queries the flow table template Y1 according to the action action of the XI, and defines the flow table according to Y1. The entry generation rule and the source IP address of the attack packet generate a flow table entry Z1;

Optionally, after the ASIC forwarding plane of the Openflow forwarding device hits the boot flow table entry XI, sending the packet and the ID of the flow table template Y1 to the CPU control plane, and the CPU control plane queries the flow table according to the information. The template generates a flow table entry Z1 according to the rules defined by the flow table template and sends the flow table entry Z1 to the ASIC forwarding plane.

Optionally, the matching rule of the flow table entry Z1 includes: the source IP address is the source IP address of the foregoing TCP SYN packet, the destination IP address is the IP address of the Openflow controller, and the type of the message is TCP or TCP SYN, and the action action To send a message matching the matching rule to the Openflow controller and limit the sending rate of the message.

Step 105: The Openflow forwarding device sends the TCP SYN packet sent by the attack source A1 to the OpenFlow controller according to the flow table entry Z1, and limits the sending rate of the packet, and sends a flow entry adding message to the Openflow controller, and the Z1 is sent. The defined flow table entry generation rule is notified to the Openflow controller.

Optionally, if the sending rate of the attack source is higher than the rate limit of the flow table entry Z1, the Openflow forwarding device caches or discards the packets exceeding the rate.

Optionally, after receiving the TCP SYN packet, the OpenFlow controller sends a higher priority flow table entry to the Openflow forwarding device, and the matching rule of the flow table entry includes: The source IP address is the source IP address of the TCP SYN text, the destination IP address is the IP address of the OpenFlow controller, and the packet type is TCP. The action is to discard the packet matching the matching rule. The Openflow forwarding device receives the packet. The flow table entry matches the higher priority flow table entry for subsequent received packets.

In addition, after receiving the above-mentioned flow entry addition message, the Openflow controller saves the flow table entry generation rule defined by Z1, and may send it to other Openflow forwarding devices.

Optionally, the format of the flow table template is slightly different according to the version of the Openflow protocol. The reference instance format is as shown in Table 1. Table 1 Basic format of the flow table template

The Flow Template Identifier indicates the ID of the flow table template, and its value is unique. The Flow Template Description is a flow table entry generation rule defined by the flow table template. Counters is a counter. Each flow table entry is generated according to the flow table template. The current count value of this counter is incremented by one.

Embodiment 2

Attack defense of the application server. The hardware architecture of the Openflow forwarding device is exemplified by a multi-core CPU architecture (control core and forwarding core coexist). See Figure 6 for the networking diagram. The detailed process is shown in Figure 7, including:

Step 201: The application server sends a security requirement to the Openflow controller through an NBI (North Bound Interface) of the Openflow controller. The security requirement may include, but is not limited to, the following types of information: For example, a TCP link-building packet, a packet with a TTL (Time To Live) of 0; a feature that needs to be set for such a stream, such as a base rate limit value;

Step 202: The Openflow controller according to the security requirements sent by the application server

The Openflow forwarding device sends a boot flow table entry X2 and a flow table template Y2;

Optionally, the matching rule of the boot flow table entry X2 is that the destination address is the application server address, the packet type is TCP or TCP SYN, the action action of the boot flow table entry is the query flow table template, and the flow table template Y2 defines the flow table. The entry generation rule is a rate that limits the TCP or TCP SYN 4 message sent by any source IP address to the application server.

Optionally, after receiving the boot flow table entry X2 and the flow table template Y2, the Openflow forwarding device sends the boot flow table entry X2 to the forwarding core, and saves the flow table template Y2 in the control core. .

Step 203: The terminal user A2 sends a TCP packet to the application server at a certain rate. Step 204: After receiving the first TCP packet sent by A2, the Openflow forwarding device matches the flow table to hit the boot flow table entry X2, according to X2. Action action query flow table template Y2, Generating a flow table entry Z2 according to the flow table entry generation rule defined by Y2 and the source IP address of the TCP packet;

Optionally, after the forwarding core of the Openflow forwarding device hits the boot flow table entry X2, sending a query message to the control core, and carrying the packet and the ID of the flow table template Y2, the control core The flow table template Y2 is queried according to the above information, and the flow table entry Ζ2 is generated and sent to the forwarding core.

Optionally, the matching rule of the flow table entry Ζ2 includes: the source IP address is the source IP address of the TCP packet, the destination IP address is the IP address of the application server, and the packet type is TCP or TCP SYN, and the action is Sending a packet matching the matching rule and limiting the sending rate of the packet by using the corresponding outbound interface;

Step 205: The Openflow forwarding device sends the TCP packet sent by the terminal user to the corresponding outbound interface according to the flow table entry Z2, and limits the sending rate of the packet, and sends a flow entry adding message to the Openflow controller, where The information carrying the flow table entry Z2 is carried.

Optionally, if the sending rate of the attack source is higher than the limit sending rate of the flow table entry Z2, the Openflow forwarding device caches or discards the packets exceeding the rate.

Optionally, if there are multiple Openflow forwarding devices between the terminal user and the application server, the forwarding process of the TCP text by other Openflow forwarding devices is the same as steps 201-205 or the Openflow controller predicts the attack source. Send a higher priority precision flow table entry to limit the speed.

Step 206: After receiving the TCP packet sent by the terminal user, the application server determines that the terminal user sends a normal TCP file or attacks "3" and/or determines the identity information of the terminal user.

Optionally, in the process of performing packet authentication between the application server and the terminal user, the data packet sent by the application server to the terminal user is forwarded according to the flow table information of the Openflow pipeline, and is forwarded by the Openflow controller to the Openflow along the path. The device sends the corresponding flow table entry.

Step 207: The application server sends the authorization information to the Openflow controller according to the TCP packet type and/or the authentication result of the terminal user. If the application server determines that the TCP packet is a normal TCP packet and/or determines that the terminal user is a legitimate user, the application is required to be The OpenFlow controller cancels or relaxes the rate limit on the TCP packet; if it is determined that the TCP packet is a TCP semi-connected attack packet, the OpenFlow controller is required to send a flow entry to the Openflow forwarding device. Discarding the TCP packet sent by the terminal user to the application server;

Step 208: The Openflow controller sends the information according to the authorization information of the application server.

The Openflow forwarding device sends a control message, and the Openflow forwarding device is required to delete the generated flow table entry Z2 or send a higher priority flow table entry to the Openflow forwarding device. Step 209: The Openflow forwarding device according to the Openflow The control message sent by the controller performs flow table entry operations and traffic forwarding.

Optionally, the higher priority flow table entry includes, according to different authorization information of the application server, a rate limit that does not limit the sending rate of the TCP packet and the rate of sending the TCP packet on demand. parameter.

Embodiment 3

Rapid generation of the network address translation session table, the hardware architecture of the Openflow forwarding device is OF

(Short for Openflow) The combination of the forwarding plane and the OF-Agent (agent) is an example. The networking diagram is shown in Figure 8. The detailed process is shown in Figure 9, including:

Step 301: The OpenFlow controller configures the user's NAT public address pool, port number segment, and matching rule according to local configuration rules or application requirements.

Optionally, the application requirements include: a public network address translation requirement and/or a matching rule requirement of the user private network host, where the user can send the requirement to the northbound interface of the Openflow controller through a specific NAT application;

Step 302: The Openflow controller sends the boot flow table entry X3 and the flow table templates Y3-0 and Y3-1 (where Y3-0 and Y3-1 are cascaded) to the corresponding Openflow forwarding device according to the security requirement of the application server;

Optionally, the matching rule of the boot flow table entry X3 includes the source address being the private network address or the network segment and the user side interface information of the user, and the action action of the boot flow table entry is the query flow table template, and the flow table template Y3-0 is defined. The flow table entry generation rule includes: a user's NAT public address pool and the The user allocates a flow table (the address translation rule indicating the message sent by the user to the network side address), and the flow table entry generation rule defined by the flow table template Y3-1 includes: assigning another flow table entry to the user (representing The address translation rule for sending packets to the user by the network side address);

Optionally, after receiving the boot flow table entry X3 and the flow table template Y3-0, Y3-1, the Openflow forwarding device sends the boot flow table entry Χ3 to the OF forwarding plane, where the flow is performed. Table templates Y3-0 and Y3-1 are saved in the OF-Agent;

Step 303: The private network host A3 sends a UDP (User Datagram Protocol) packet to the network side device at a certain rate;

Step 304: After receiving the first UDP packet sent by A3, the matching flow forwarding device hits the navigation flow table entry X3, and then queries the flow table template Y3-0 according to the action action of X3, according to the flow defined by Y3-0. The table entry generation rule and the message information allocate a public network IP address or a public network IP address and a port number to the private network host A3, and generate a flow table entry Z31 (corresponding to the packet sent by the user to the network side address). Address translation rules). Because Y3-0 cascades the flow table templates Y3-1 and Y3-0, the Z3 is filled with the metadata of the Y3-0 and Y3-1 convention formats. After generating Z31, the message will continue to be delivered. Processed by Y3-1. According to the flow table entry generation rule defined by Y3-1 and the information and the metadata generation Z32 (corresponding to the packet address conversion rule of the network side address sending user).

Optionally, after the OF forwarding plane of the Openflow forwarding device hits the boot flow table entry X3, sending an inquiry message to the OF-Agent and carrying the packet and the ID of the flow table template Y3-0, The OF-Agent queries the flow table template and/or the cascaded flow table template, allocates a public network IP address, or assigns a public network IP address and a port number according to the foregoing information, and generates the flow table entries Z31 and Z32 to send. Give the OF forwarding face.

Optionally, the matching rule of the flow table entry Z31 includes: a source IP address, a source port number, and a packet type, and the action action is to convert the source IP address into an allocated public network IP address, and may also convert the source port. It is the assigned port number and sends the converted packet through the corresponding outbound interface.

Optionally, the matching rule of the flow table entry Z32 includes: a destination IP address, a destination port number, a genre type, and an action action is to convert the destination IP address into an assigned public network IP address, and may also aim The port is translated to the assigned port number, and the converted packet is sent through the corresponding outbound interface. Step 305: The Openflow forwarding device performs a NAT action on the TCP/UDP packet between the A3 and the network side device according to the flow table entries Z31 and Z32, and forwards the packet through the corresponding outbound interface, and sends the message to the Openflow control device through the flow entry adding message. Information on Z31 and Z32.

Optionally, after the flow table entries Z31 and Z32 are aged, the Openflow forwarding device reclaims the corresponding public network address and/or port number.

Optionally, in the case that two or more flow table entries are generated at the same time, the flow table template is cascaded, and the flow table entries are generated, and the meta data between the cascaded flow table templates is generated, and is mainly used for the flow. Processing when table templates are cascaded.

Optionally, the description manner of the flow table template is different according to the description method. Taking the XML application scenario as an example, if the implementation is extended in the OpenFlow protocol, it needs to be converted into a corresponding data structure.

<flow-template-entry>

<table-id>5</table-id>

<cascade-template-id>2</ cascade-template-id>

<out-meta>

<field>

<desc>public-ip</desc>

</field>

<field>

<desc>"private-ip</desc>

</field> o pyowteateet flmlnFv-- /act〇sin <v

/setwscnr <v-- toetaedd/toetaeddmfili 1mfili <> <>------ ,vaue · · · · · · · · · vauel 10011 T 100211100213l Av<v

Yypypteacated/tell <v<>

Setwscnr <v-- act〇sin <v

/stuct〇sInrin <v

/GotoabeTl <>- vaue/vauel3l <v<v

Yypypeded/tefix <v<>

GOtoabeTl Av- Wtectos/riAin <>- stuct〇sInrin <v

/atcmh <>

/wscnr <v- toetaedd/toetaeddmfili2mfili <v<>------ vauewsc/vauelnrl <v<v- yppypteacet/tek <v<v

Wscnr <v- atcmh <> outetam <v- /H0SSD/:l£ /-60// O./-ΪΗ0ΖAV J/inch J <V <V3SZ3SZ

ρ J 〈>ι <value>3</value>

</Goto-Table>

</Instructions>

<set-nw-dst>

<type>metadata</type>

<from-meta-field-id>2</from-meta-field-id>

</set-nw-dst>

</actions>

</ flow-template-entry>

In the above example, the id of the flow-template-entry is the ID of the flow table template; the table-id indicates that the flow table template generates an entry for the flow table identified by the table ID; the cascade-template-id indicates the flow table template level. A flow table template with a specified ID; Out-meta/In-mate indicates the format definition of the intermediate data passed by the cascaded two flow table templates

The hardware architecture of the Openflow forwarding device and the application scenarios of the embodiments of the present invention can be freely combined according to the needs of the actual environment. The hardware architecture is preserved, but not limited to several types in the foregoing embodiments.

Correspondingly, an embodiment of the present invention further discloses an OpenFlow forwarding device, as shown in FIG. 10, including:

The receiving module 1001 is configured to: receive a boot flow table entry and a flow table template sent by the OpenFlow controller; where the action information of the boot flow table entry includes the preset flow table template ID; Receiving data packets;

The generating module 1002 is configured to: after the receiving module receives the data packet, if the data packet matches the boot flow table entry that is received by the receiving module, according to the boot flow table entry The flow table template ID that is preset in the action information is used to search the corresponding flow table template, and generates a rule and the data packet according to the flow table entry defined by the corresponding flow table template. The key field information generates a flow table entry.

Optionally, the device further includes a sending module:

The sending module 1003 is configured to: send the flow table entry generated by the generating module to the Openflow controller by using an extended flow entry adding message.

Optionally, the device further includes:

The sending module 1003 is configured to process and forward the data packet according to the flow table entry generated by the generated module.

Optionally,

The generating module 1002 is configured to generate a flow table entry according to the flow table entry generation rule defined by the flow table template and the key segment information of the data packet, which specifically includes:

The generating module 1002 is configured to: generate the flow table entry; where the matching rule of the flow table entry includes: the source IP address is the source IP address of the data, and the destination IP address is the protected The IP address of the device, the Action information is to send a data message matching the matching rule to the protected device and use a measurement table entry to limit the sending rate.

Optionally,

The source address of the data is one of the private network address segments.

Optionally,

The flow table entry generation rule defined by the flow table template is a packet sent by the user side to the network side. Address translation rules;

The generating module 1002 is configured to: generate the flow table entry; where the matching rule of the flow table entry includes: a private network address of the data packet, and the Actions include converting the private network address into an allocated public address. The network address is sent and the translated packet is sent through the corresponding outbound interface.

Optionally,

The receiving module 1001 is further configured to: receive a second flow table template sent by the Openflow controller;

The second flow table template is cascaded with the flow table template, and the second flow table template is defined, optionally

The generating module 1002 is further configured to: generate the second flow table entry according to the generated flow table entry, in combination with the second flow table template;

Optionally,

The private network address includes: a private network IP address;

The public network address includes: a public network IP address, or a public network IP address and port information. Optionally,

The sending module 1003 is further configured to: send the generated second flow table entry to the Openflow controller by using a flow entry add message.

Correspondingly, an OpenFlow controller, as shown in FIG. 11, includes: a storage module 1101 configured to: save a pre-configured boot flow table entry and a flow table template; wherein, the action of the boot flow table entry The (Action) information includes the preset flow table template ID; The sending module 1102 is configured to: send the boot flow table entry and the flow table template saved by the storage module to the Openflow forwarding device.

Optionally,

Optionally, the controller further includes:

The receiving module 1103 is configured to: receive a flow table entry sent by the Openflow forwarding device by using a flow entry to add a message;

The sending module 1102 is further configured to: after receiving the flow table entry, the receiving module sends a reject message to the Openflow forwarding device, requesting the Openflow forwarding device to delete the flow table generated according to the flow table template. Or an entry; or, after the receiving module receives the flow table entry, sending a higher priority flow table entry to the Openflow forwarding device.

Optionally,

The private network address network segment includes: a private network IP address.

Optionally,

The sending module 1102 is further configured to: send a second flow table template to the Openflow forwarding device, where the second flow table template is cascaded with the flow table template, and the second flow table template is configured

One of ordinary skill in the art will appreciate that all or part of the steps in the above methods may be passed through the program. The instructions are related to hardware completion, and the program can be stored in a computer readable storage medium such as a read only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the foregoing embodiment may be implemented in the form of hardware, or may be implemented in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

The above description is only a preferred embodiment of the present invention and is not intended to limit the scope of protection of the present invention. In view of the present invention, various other modifications, equivalents, improvements, etc., should be made without departing from the spirit and scope of the invention. It is included in the scope of protection of the present invention.

Industrial applicability

The foregoing technical solution implements the function of generating a flow table entry according to the flow table entry template on the Openflow forwarding device, enhances the security of the Openflow protocol, and extends the application scenario and practicability of the Openflow/SDN network. Therefore, the present invention has strong industrial applicability.

Claims

Claim

A method for generating a flow table entry, which is applied to an OpenFlow forwarding device, comprising: receiving a boot flow table entry and a flow table template sent by an Openflow controller; wherein, the action of the flow table entry is The information includes the preset flow table template ID;

2. The method for generating a flow table entry according to claim 1, further comprising:

The flow table entry generating method according to claim 2, wherein the step of transmitting the generated flow table entry to the Openflow controller by using the flow entry adding message comprises: the Openflow forwarding device The information of the flow table entry is sent in real time or in batch by the flow entry adding message.

The method for generating a flow table entry according to any one of claims 1 to 3, further comprising: processing and forwarding the data packet according to the generated flow table entry.

The method for generating a flow table entry according to any one of claims 1 to 3, wherein: the matching rule of the boot flow table entry includes: the destination address is an IP address of the protected device; and the data packet matches The steps to hit the boot flow table entry include:

6. The flow table entry generating method according to claim 5, wherein:

The step of generating a flow table entry according to the flow table entry generation rule defined by the flow table template and the key segment information of the data packet includes: The flow table entry is generated. The matching rule of the flow table entry includes: the source IP address is the source IP address of the data, the destination IP address is the IP address of the protected device, and the action information is A data message matching the matching rule is sent to the protected device and the transmission rate is restricted by the meter entry.

The method for generating a flow table entry according to any one of claims 1 to 3, wherein: the matching rule of the boot flow table entry includes a private network address network segment whose source address is a type of user; The steps of the text match hitting the boot flow table entry include:

The source address of the data is one of the private network address segments.

8. The flow table entry generating method according to claim 7, wherein:

9. The method for generating a flow table entry according to claim 8, further comprising:

Receiving a second flow table template sent by the OpenFlow controller; where the second flow table template is concatenated with the flow table template, and the flow table entry generation rule defined by the second flow table template is a network The address translation rule sent to the user side by the side.

The method for generating a flow table entry according to claim 9, further comprising:

Generating, according to the generated flow table entry, the second flow table template, the matching rule of the second flow table entry includes: the allocated public network address, and the action information is The public network address is translated into a corresponding private network address, and the converted message is sent through the corresponding outbound interface.

11. The method for generating a flow table entry according to claim 7, 8 or 10, wherein: The private network address includes: a private network IP address;

The public network address includes: a public network IP address, or a public network IP address and port information.

The method for generating a flow table entry according to claim 10, further comprising:

13. A flow table entry generation method, applied to an OpenFlow controller, comprising: sending a boot flow table entry and a flow table template to an Openflow forwarding device; wherein, the action information of the boot flow table entry The preset flow table template ID is included.

14. The flow table entry generating method according to claim 13, wherein:

The method for generating a flow table entry according to claim 13, further comprising:

16. The flow table entry generating method according to claim 13, wherein:

17. The method of generating a flow table entry according to claim 16, wherein:

The method for generating a flow table entry according to claim 16, further comprising:

19. An OpenFlow forwarding device, comprising a receiving module and a generating module, wherein:

The receiving module is configured to receive a boot flow table entry and a flow table template sent by the OpenFlow controller, where the action information of the boot flow table entry includes the preset flow table template ID; Receiving a data message;

The forwarding device of claim 19, further comprising a sending module, wherein: the sending module is configured to: send the flow table entry generated by the generating module to the Openflow by using an extended flow entry adding message Controller.

21. The forwarding device of claim 20, wherein:

The sending module is further configured to: process and forward the data packet according to the flow table entry generated by the generating module.

22. The forwarding device of claim 19 or 20, wherein:

The matching rule of the boot flow table entry includes: the destination address is an IP address of the protected device; and the generating module is configured to determine that the data packet match hits the boot flow table entry as follows:

23. The forwarding device of claim 22, wherein:

24. The forwarding device of claim 19 or 20, wherein:

The matching rule of the boot flow table entry includes a private network address network segment whose source address is a type of user; the generating module is configured to determine that the data packet match hits the boot flow table entry as follows:

The source address of the data is one of the private network address segments.

25. The forwarding device of claim 24, wherein:

26. The forwarding device of claim 25, wherein:

The receiving module is further configured to: receive a second flow table template sent by the Openflow controller;

The second flow table template is cascaded with the flow table template, and the second flow table template is defined.

27. The forwarding device of claim 26, wherein:

The generating module is further configured to: generate the second flow table entry according to the generated flow table entry, in combination with the second flow table template;

28. The forwarding device of claim 24, 25 or 27, wherein:

The private network address includes: a private network IP address;

29. The forwarding device of claim 28, wherein:

The sending module is further configured to: send the generated second flow table entry to the Openflow controller by using a flow entry add message.

30. An OpenFlow controller, comprising: a storage module and a sending module, wherein: the storage module is configured to: save a pre-configured boot flow table entry and a flow table template; wherein, the boot flow table entry The action information includes the preset flow table template ID. The sending module is configured to: send the boot flow table entry and the flow table template saved by the storage module to the Openflow forwarding device.

31. The controller of claim 30, wherein:

The controller of claim 30, further comprising a receiving module, wherein: the receiving module is configured to: receive a flow table entry sent by the Openflow forwarding device by using a flow entry adding message;

The sending module is further configured to: after the receiving module receives the flow table entry, send a reject message to the Openflow forwarding device, requesting the Openflow forwarding device to delete the The flow table entry generated by the flow table template; or, after the receiving module receives the flow table entry, sending a flow table entry with a higher priority to the Openflow forwarding device.

33. The controller of claim 30, wherein:

34. The controller of claim 33, wherein:

35. The controller of claim 33, wherein:

The sending module is further configured to: send a second flow table template to the OpenFlow forwarding device, where the second flow table template is cascaded with the flow table template, and the flow defined by the second flow table template