Method, device and system used for digesting security policy conflicts

Abstract

The invention discloses a method, device and system used for digesting security policy conflicts. When a flow rule control device receives a flow rule policy issued by an application proxy device, semantic analysis is performed on the flow rule policy based on aliases so that an alias rule set of the flow rule policy is formed; the alias rule set of the flow rule policy is compared with the alias rule set of the current rules so as to judge existence of the policy conflicts; and if the policy conflicts do not exist, the flow rule policy is transmitted to corresponding switches so that the corresponding switches perform corresponding routing forwarding according to the flow rule policy. Therefore, a situation of bypassing security rules through other flow rule policies or policy combinations can be effectively prevented, and security of an SDN framework based on OpenFlow can be enhanced.

Description

technical field [0001] The present invention relates to the communication field, in particular to a method, device and system for resolving security policy conflicts. Background technique [0002] SDN (Software Defined Network, Software Defined Network) is a new type of network architecture and technology system. It splits the traditional tightly coupled network architecture into a three-layer architecture that separates application, control, and forwarding. The upper-layer application and the lower-layer forwarding facilities are abstracted into multiple Logical entity, which has the characteristics of open programmability. [0003] Under the SDN architecture, the centralized controller is used to program the distributed switches and define routing rules. The policies of upper-layer applications are delivered to the switches through the controller for execution, and security functions such as firewalls are also implemented in the form of upper-layer applications. As a typi...

AI Technical Summary

Problems solved by technology

[0005] Under the SDN architecture, when multiple applications on the upper layer issue flow rule policies at the same time, conflicts may occur between different policies. This traffic is allowed by policy or otherwise, causing a conflict between policies

Even in the network fragmentation environment of FlowVisor, security applications and other applications may exist in the same network fragmentation at the same time, resulting in policy conflicts

This can be exploited by hackers to bypass security policies and pose a security risk

[0006] For example, although the firewall policy blocks the data flow from 10.0.0.1 to 10.0.0.2, the hacker can choose the path from 10.0.0.1 to 10.0.0.3, and from 10.0.0.3 to 10.0.0.2, and send the data flow from 10.0.0.1 to 10.0.0.2, so that the firewall policy cannot effectively play a role, bringing security risks

Images