CN108600167A - A kind of communication device and method of the network watermark based on OpenFlow - Google Patents

Abstract

The invention relates to network flow watermarking technology, in particular to a communication device and method for network watermarking based on OpenFlow. In the present invention, the watermark embedding end arranged at the sending end is used to add a flow table item to the communication data packet of the sending end, and select relevant data that needs to be embedded with the watermark; then, after embedding the watermark, send the relevant data embedded with the watermark to the receiving end through the network; The watermark detecting end arranged at the receiving end is used for receiving the relevant data embedded with the watermark, performing watermark detection, and determining the data relationship between the sending end and the receiving end. Described embedding end switch extracts the related data of matching according to the key field in the OpenFlow flow entry and then sends to embedded controller to carry out watermark embedding; After embedding watermark then, after sending back the relevant data of embedding watermark to embedded controller, Then it is sent to the receiving end through the network; wherein the embedded end controller sends the OpenFlow flow entry to the embedded end switch.

Description

A communication device and method for network watermarking based on OpenFlow

technical field

The invention relates to network flow watermarking technology, in particular to a communication device and method for network watermarking based on OpenFlow.

Background technique

First the abbreviations used in the present invention are defined:

SDN (Software Defined Network): software defined network;

The emergence of anonymous networks provides an effective means for network attackers to hide their identities and avoid detection and supervision. Most cyber attackers will choose to log in to intermediate springboards or use anonymous networks to hide their identities, which makes network monitoring and management more difficult. Active network flow watermarking technology combines active network traffic analysis with digital watermarking ideas. It has the advantages of high accuracy, short monitoring time, and strong real-time performance, which has attracted widespread attention from scholars.

Active network watermarking technology is an active network traffic modulation and analysis technology. Its main idea is borrowed from digital watermarking, which embeds watermarks by actively modulating certain flow characteristics at the suspicious sender, such as the time interval of data packets, traffic rate, and payload of data packets. After transmission through a complex communication network, if the corresponding watermark can be detected from the data stream detected by the receiving end, it is considered that the traffic at both ends is related, so that it can be further determined that there is a communication relationship between the two ends.

Although network flow watermarking technology is constantly developing and improving, it has not been integrated with the entire network security system, and the deployment methods of embedding points and detection points are not yet flexible.

Contents of the invention

The technical problem to be solved by the present invention is to provide an OpenFlow-based network watermark communication device and method for the problems existing in the prior art. The invention discloses an OpenFlow-based network flow watermarking device and method, aiming at improving the flexibility of the network flow watermarking system, and proposing a new implementation method of the network flow watermarking technology under the SDN network framework.

The technical scheme that the present invention adopts is as follows:

A communication device based on OpenFlow network watermarking comprises:

The watermark embedding end set at the sending end is used to add flow entries to the communication data packets at the sending end, and select the relevant data to be embedded with the watermark; after embedding the watermark, send the relevant data embedded with the watermark to the receiving end through the network;

The watermark detecting end arranged at the receiving end is used for receiving the relevant data embedded with the watermark, performing watermark detection, and determining the data relationship between the sending end and the receiving end.

Further, the embedded-end switch extracts matching related data according to the key fields in the OpenFlow flow entry and then sends it to the embedded controller for watermark embedding; then after embedding the watermark, sends back the relevant data embedded in the watermark to the embedded controller After the controller, it is sent to the receiving end through the network; the embedded end controller sends the OpenFlow flow entry to the embedded end switch; the embedded switch is a commercial OpenFlow switch.

Further, the specific process of extracting and matching related data according to the key fields in the OpenFlow flow entry is: the embedded switch matches the received data through the packet matching field of the OpenFlow flow entry, and extracts the data that can be embedded in the watermark. data; then when the matching data processing command of the data is output to the controller, the data is sent to the embedded controller through the embedded switch for watermark embedding.

Further, the switch at the detection end extracts the relevant data embedded in the matched watermark according to the key field in the OpenFlow flow entry, and then sends it to the controller at the detection end for watermark demodulation; Watermark detection is performed on the data to determine the data relationship between the sending end and the receiving end; the detection end switch is a commercial OpenFlow switch.

Further, the determination of the data relationship between the sending end and the receiving end means that when the watermark embedded in the embedded controller can be detected, it is considered that there is a relationship between the communication flow between the sending end and the receiving end, and it is determined that there is a communication between the sending end and the receiving end. relation.

Further, the commercial OpenFlow switch needs to recompile OpenWRT, add OpenFlow source code; modify the network configuration file to complete the peripheral port configuration of the commercial OpenFlow switch; modify the OpenFlow file to complete the data channel configuration of the commercial OpenFlow switch; modify the firewall file to configure the port forwarding function of the commercial OpenFlow switch .

Further, the embedded switch and the detection-end switch are dedicated OpenFlow switches, wherein the dedicated OpenFlow switch allows creating a network bridge and configuring ports in the OVS mode, and then connects the corresponding embedded controller and the detection-end controller through commands.

The communication method based on the communication device includes:

The watermark embedding end set at the sending end adds a flow entry to the communication data packet of the sending end, selects the relevant data to be embedded with the watermark; then after embedding the watermark, sends the relevant data embedded with the watermark to the receiving end through the network;

The watermark detecting end arranged at the receiving end receives the relevant data embedded with the watermark, performs watermark detection, and determines the data relationship between the sending end and the receiving end.

Further, the embedded-end switch extracts matching related data according to the key fields in the OpenFlow flow entry and then sends it to the embedded controller for watermark embedding; then after embedding the watermark, sends back the relevant data embedded in the watermark to the embedded controller After the controller, it is sent to the receiving end through the network; the embedded end controller sends the OpenFlow flow entry to the embedded end switch.

Further, the switch at the detection end extracts the relevant data embedded in the matched watermark according to the key field in the OpenFlow flow entry, and then sends it to the controller at the detection end for watermark demodulation; then the controller at the detection end demodulates the watermark Watermark detection is performed on relevant data to determine the data relationship between the sending end and the receiving end.

In summary, owing to adopting above-mentioned technical scheme, the beneficial effect of the present invention is:

An OpenFlow switch and a controller can be deployed in a network node, and the controller controls the OpenFlow switch by issuing rules, so that the data flow passing through the network node can be uniformly processed. This provides a more flexible implementation for the watermarking technology.

(1) The present invention uses the new network framework of SDN to deploy watermark embedding points and detection points in the SDN architecture

In the network nodes below, the control of the system on watermark embedding and detection is more flexible.

(2) The present invention uses the OpenFlow protocol, and most switches under the SDN network support this protocol, which has a good

applicability.

(3) The present invention realizes the function of watermark embedding and detection in the Floodlight controller, without the need for OpenFlow

The software and hardware of the switch are modified to make the system easy to expand and manage.

Description of drawings

The invention will be illustrated by way of example with reference to the accompanying drawings, in which:

Fig. 1 is the arrangement diagram of the device of the present invention.

Fig. 2 is a schematic diagram of a connection structure between a common commercial switch and a control host.

Fig. 3 is a schematic diagram of a connection structure between a dedicated OpenFlow switch and a controller.

Fig. 4 is a flow chart of the device of the present invention.

Fig. 5 is a schematic diagram of OpenFlow flow entries.

Detailed ways

All features disclosed in this specification, or steps in all methods or processes disclosed, may be combined in any manner, except for mutually exclusive features and/or steps.

Any feature disclosed in this specification, unless specifically stated, can be replaced by other alternative features that are equivalent or have similar purposes. That is, unless expressly stated otherwise, each feature is one example only of a series of equivalent or similar features.

Relevant description of the present invention:

1. Both the embedded switch and the detection switch are dedicated OpenFlow switches

2. The key fields in the OpenFlow flow entry include at least a data packet matching field and a matching data processing command.

3. SDN is a new type of network architecture based on software programmable ideas. It has a centralized control plane and a distributed forwarding plane. The two planes are separated from each other, so the implementation of SDN does not need to rely on switches and other underlying network devices. . At the same time, the framework improves the user's management rights to the network, so developers can customize any required transmission rules and network routing policies, which makes network control more flexible and intelligent. An OpenFlow switch and a controller can be deployed in a network node, and the controller controls the OpenFlow switch by issuing rules, so that the data flow passing through the network node can be uniformly processed. This provides a more flexible implementation for the watermarking technology.

Two, the concrete realization process of this invention is as follows:

1) Deploy OpenFlow switches and controllers in actual network nodes, and build network environments for watermark embedding and detection. The experimental deployment of this system requires two OpenFlow switches and four PCs. The system deployment is shown in Figure 1.

There are two types of OpenFlow switches: one is a dedicated OpenFlow switch, which uses hardware to implement the three basic components of an OpenFlow switch. The other is a commercial switch, which does not have the three basic components of an OpenFlow switch at the time of production. Users need to implement the functions of an OpenFlow switch through software-defined flow tables, secure channels, and protocol specifications. Using different OpenFlow switches requires different steps to complete system environment deployment.

For a dedicated OpenFlow switch, it can be directly connected to the controller to detect the communication status at both ends to complete the environment configuration. In the experiment, the Pica8 switch is used to complete the environment deployment, which supports the OVS mode of the OpenFlow switch. When entering OVS mode, there is no functional difference from OpenVSwitch. Let the switch run in OVS mode, create a bridge and configure the port, and then connect to the controller through commands. The connection structure is shown in Figure 2.

For commercial switches, software must be installed in the system to support OpenFlow before the environment is deployed. After the configuration is completed, connect the controller to detect the communication between the two ends. The connection structure is shown in Figure 3. In the experiment, a TP-LINK switch is used to complete the environment deployment. The operating system of the router is OpenWRT. Openwork is recompiled on the PC, the configuration file is modified, and the generated system image is uploaded to the switch to complete the upgrade of the operating system.

The specific operation is:

1. Recompile OpenWRT and add OpenFlow source code.

2. Modify the network configuration file to complete the port configuration: divide different VLANs for different ports according to the requirements of the OpenFlow protocol. Reserve a common port for connecting to the controller, and divide the remaining ports into different vlans as standard OpenFlow ports.

3. Modify the openflow file to complete the data channel configuration: set the data channel id, set the configured port as the OpenFlow standard port, and set the controller ip and port.

4. Modify the firewall file to configure the port forwarding function.

2) Issue corresponding rules at both ends

The OpenFlow switch determines the processing mode of the data packet according to the flow table, and the structure of the flow table item is shown in Figure 5. Among them, the Match Fields field represents a data packet matching field, and the matching field includes a data packet header, ingress port information, metadata, and the like. Instructions are used to set up packet operation sets or pipeline processing. After the data packet arrives at the switch, it interacts with the flow table in the pipeline, matches the flow table item through the Match fields field, the data packet matching field is extracted from the arriving data packet, and then matches the content of the Instructions field according to the matching data processing command. The data packets are processed accordingly. When the Instructions field of the matching data processing command is defined as "output=controller", the switch encapsulates the matched data packet into a Packet-in message and sends it to the Floodlight controller.

The system defines different fields in the flow entry through the Floodlight controllers at both ends (the controller refers to the embedded controller or the detection end controller), sends the flow entry to the OpenFlow switch, and generates rules. The OpenFlow switch at both ends (the The switch refers to the embedded switch or the detection switch) by executing the rules of the controller, and sending the data packets conforming to the characteristics to the controller for further processing.

3) Realize network flow watermark embedding and detection functions, embed watermark at the sending end, and detect watermark at the receiving end Digital watermarking technology includes two aspects: the determination of the watermark carrier, the watermark embedding, and the design of the watermark demodulation method. Watermark embedding is to modify some attributes of the watermark carrier appropriately to complete the watermark embedding, and watermark demodulation is to detect and extract the watermark signal bits from the watermark carrier. This system regards the data packet interval time as the watermark carrier of network stream watermarking technology. Watermark embedded detection functions are implemented on the Floodlight controller side. The basic idea of using data packet interval time as watermark carrier is to select a certain number of data packets in the data stream at the sending end, and embed watermark information by adjusting the sending time interval of the selected data packets. The key of this method is to ensure that there are enough data packets in the watermarked network stream, and only embed the watermark between the selected data packets, so that the receiver can detect the watermark information by extracting the receiving time interval of the corresponding data packets. The design diagram of the processing flow of the network flow watermarking device is shown in Fig. 4 .

The present invention is not limited to the foregoing specific embodiments. The present invention extends to any new feature or any new combination disclosed in this specification, and any new method or process step or any new combination disclosed.

Claims (10)

1. a kind of communication device of the network watermark based on OpenFlow, it is characterised in that including：

It is set to the watermark built-in end of transmitting terminal, for adding flow table item to the communication data packet of transmitting terminal, selection needs to be embedded in The related data of watermark；After being then inserted into watermark, the related data of embedded watermark is sent to receiving terminal by network；

It is set to the watermark detection end of receiving terminal, the related data for receiving the embedded watermark carries out watermark detection, determines The data communications context of transmitting terminal and receiving terminal.

2. communication device according to claim 1, it is characterised in that the embedded end switch is according to OpenFlow flow table Critical field extracts matched related data and is then sent to embedded controller progress watermark insertion in；It is then inserted into watermark Afterwards, after by the related data of embedded watermark back to embedded controller, receiving terminal is then sent to by network；It is wherein embedded Side controller issues OpenFlow flow list item to embedded end switch；Embedded interchanger is commercial OpenFlow interchangers.

3. communication device according to claim 2, it is characterised in that critical field in the list item according to OpenFlow flow Extracting matched related data detailed process is：The data received are passed through the number of OpenFlow flow list item by embedded interchanger It is matched according to packet matching domain, extraction can carry out the data of watermark insertion；Then order is handled in the matched data when the data When to export to controller, then the data are sent to embedded controller by embedded interchanger and carry out watermark insertion.

4. communication device according to claim 1, it is characterised in that the detection end switch is according to OpenFlow flow table Critical field extracts the related data of matched watermark day insertion in, is then sent to detection side controller and carries out watermark solution It adjusts；Then the related data after watermarking demodulation is carried out watermark detection by detection side controller, determines the number of transmitting terminal and receiving terminal According to relationship；It is commercial OpenFlow interchangers to detect end switch.

5. communication device according to claim 5, it is characterised in that the determining transmitting terminal is communicated with the data of receiving terminal When relationship refers to the watermark that can detect embedded controller insertion, then it is assumed that transmitting terminal and receiving terminal communication flows exist Correlation determines that there are correspondences for transmitting terminal and receiving terminal section.

6. the communication device according to one of claim 1 to 5, it is characterised in that the commercialization OpenFlow interchangers need OpenWRT is recompilated, OpenFlow source codes are added；Network configuration files are changed to complete outside commercialization OpenFlow interchangers Enclose port configuration；It changes OpenFlow files and completes the configuration of commercialization OpenFlow exchange datas channel；Change firewall texts Part configures commercialization OpenFlow switch port forwarding capabilities.

7. the communication device according to one of claim 1 to 5, it is characterised in that the embedded interchanger is handed over test side It is special OpenFlow interchangers to change planes, wherein special OpenFlow interchangers allow, in OVS patterns, to create bridge and configure end Mouthful, then corresponding embedded controller and detection side controller are connected by ordering.

8. the communication means based on the communication device of claim 1,2,3,4 or 5, it is characterised in that including：

The watermark built-in end for being set to transmitting terminal adds flow table item to the communication data packet of transmitting terminal, chooses and needs embedded watermark Related data；After being then inserted into watermark, the related data of embedded watermark is sent to receiving terminal by network；

The watermark detection end for being set to receiving terminal receives the related data of the embedded watermark, carries out watermark detection, determines and sends The data relationship at end and receiving terminal.

9. communication means according to claim 8, it is characterised in that the embedded end switch is according to OpenFlow flow table Critical field extracts matched related data and is then sent to embedded controller progress watermark insertion in；It is then inserted into watermark Afterwards, after by the related data of embedded watermark back to embedded controller, receiving terminal is then sent to by network；It is wherein embedded Side controller issues OpenFlow flow list item to embedded end switch.

10. communication means according to claim 8, it is characterised in that the detection end switch is according to OpenFlow flow table Critical field extracts the related data of matched watermark day insertion in, is then sent to detection side controller and carries out watermark solution It adjusts；Then the related data after watermarking demodulation is carried out watermark detection by detection side controller, determines the number of transmitting terminal and receiving terminal According to correspondence.