CN109039703A - The method and system of business scenario network rapid build under a kind of complex network simulated environment - Google Patents

Abstract

The invention discloses a kind of method and system of business scenario network rapid build under complex network simulated environment.The method include the steps that 1) network topology structure according to needed for target scene network configuration, virtual router, each IP address section and VLAN, generate the configuration file of the target scene network, and send it to route test network and Switch control network；2) Switch control network completes the configurations of node access networks network according to configuration file；3) the virtual flow-line server of route test network creates virtual flow-line according to the configuration file, and according to configuration file subnet division and VLAN；4) physical interface of virtual flow-line server is connected with the Experimental Network core switch in Experimental Network, accesses each node；5) virtual flow-line server creates the virtual link between virtual switch according to configuration file；6) virtual flow-line server is communicated with virtual switch and is established control, and each virtual switch issues flow table.

Description

A method and method for quickly constructing a business scenario network in a complex network simulation environment system

technical field

The invention belongs to the technical field of Internet network security, and relates to a method and system for rapidly and large-scale realization of complex scene networks in a complex network simulation environment.

Background technique

The situation of confrontation in cyberspace is becoming increasingly severe, and cyber attack and defense have become the main content of cyber offensive and defensive confrontation in various countries. The network environment has developed from a simple Internet to a ubiquitous cyberspace, and the attack method has also developed from a single mode to a complex APT attack. The complex network simulation environment is an important infrastructure for network attack and defense drills and network new technology evaluation, and is used to improve the stability, security and performance of networks and information systems. All countries in the world attach great importance to the construction of a complex network simulation environment as an important means to support cyberspace security technology verification, network weapon testing, offensive and defensive confrontation exercises, and network risk assessment.

In the actual application process of the complex network simulation environment, in order to achieve the simulation of the real target network environment, it is often necessary to restore the complex network structure and build a virtual scene network that is exactly the same as the real environment. The network includes routing connections, complex link structures within and between autonomous domains, and real network addresses. The existing traditional complex network simulation environment can only realize the division of different network segments in the construction of the scene network environment, and cannot realize complex network hierarchical relationships. There is a lack of routing between networks, or the network hierarchy relationship built by physical devices cannot be flexibly changed. It is expensive to simulate large-scale and complex network structures. It takes a long time and is expensive to build a physical device network environment manually. The simulation and customization that cannot be carried out for real network addresses has great limitations for the restoration and simulation of real networks.

Contents of the invention

Aiming at the technical problems existing in the prior art, the purpose of the present invention is to provide a method and system for rapidly constructing complex network simulation environment scene networks, so as to solve the problems of real complex network simulation and flexible rapid construction. The present invention introduces SDN (Software Defined Networking) technology to generate a virtual router (vRouter), the SDN controller implements unified policy control on the virtual router through the OpenFlow protocol, realizes the creation of routing nodes in the scene network, and uses the virtual switch (OVS) technology to generate a virtual OVS Bridge (Bridge), to achieve the division of network segments in the scene network. The present invention can create complex, multi-level, and multi-link network scenarios according to actual needs, solving the problem that traditional environments cannot simulate complex multi-level and multi-link network scenarios on a large scale, and because it is a virtual router, adding and deleting is flexible and free , not limited by physical devices, generating virtual devices is time-consuming and cost-effective, and solves the problem that the network structure cannot be flexibly changed. To sum up, the present invention greatly improves the limitations of the traditional complex network simulation environment on the restoration simulation of the real network.

Technical scheme of the present invention is:

A method for quickly constructing a business scenario network under a complex network simulation environment, the steps of which include:

1) The server in the complex network simulation environment is connected to the access switch of the experimental network, each of the access switches is connected to the core switch of the experimental network; the switch of the access network is connected to the core switch of the experimental network;

2) Generate the configuration file of the target scenario network according to the required network topology, virtual router, each IP address segment and VLAN according to the target scenario network configuration, and send the configuration file to the routing control network and the switch control network;

3) The switch control network completes the basic configuration of the node access network according to the configuration file;

4) The virtual routing server of the route control network creates a virtual route according to the configuration file, and divides subnets and VLANs according to the configuration file, and divides each node in the target scene network into corresponding VLANs and subnets;

5) Each virtual routing server creates a virtual network bridge, which is bound to the physical interface of a server and connected to the virtual network bridges created by other virtual routing servers; each virtual network bridge has a channel interface , the channel interface of each virtual network bridge is bound to a physical interface of each virtual routing server, and the physical interface of the virtual routing server is connected to the experimental network core switch in the experimental network, thereby accessing each node;

6) The virtual routing server creates a virtual connection between the virtual switches according to the configuration file, and configures a communication channel between the virtual switch and the SDN controller;

7) The virtual routing server starts the SDN controller, communicates with the corresponding virtual switch and establishes management and control through the configured communication channel; then the virtual routing server sends the virtual routing and port IP address information to the SDN controller, and when the SDN controller According to the received information, the flow table is delivered to each virtual switch, thereby completing the creation of the virtual router.

Further, the method for creating the virtual route is as follows: the virtual route server first extracts the connection relationship between each node from the configuration file, and calculates and generates the shortest path between each node and any other node according to the Dijkstra single-source shortest path algorithm , generate routing table entry information according to the shortest path information.

Further, the method for dividing subnets and VLANs according to the configuration file is: the virtual routing server generates the required virtual network bridge according to the configuration file, and marks all ports on the virtual network bridge with corresponding VLAN tags, that is, divides subnets into subnets. network and VLAN.

Further, in the step 7), the virtual routing server sends the virtual routing and port IP address information to the SDN controller through the northbound API interface, and when the SDN controller receives the information, it transmits the information to each The virtual switch delivers the flow table to complete the creation of the virtual router.

Further, each of the virtual routers is uniformly controlled and managed by an SDN controller.

Further, the configuration file is a JSON configuration file; the configuration file is sent to the routing control network and the switch control network through the SSH protocol.

A rapid network construction system for business scenarios in a complex network simulation environment, characterized in that it includes a routing control network, an experimental network, a switch control network, and an access network; wherein,

The experimental network is a customized network scenario used in each business scenario, and supports custom gateways, routing and IP; each node in the complex network simulation environment is connected to the access switch of the experimental network, and each access switch is connected to the experimental network. The core switch of the network, the experimental network and the routing control network connection; the nodes include real nodes and virtual nodes;

The routing control network includes several virtual routing servers, the virtual routing servers run SDN controllers, and the SDN controllers generate and manage virtual routers through the configuration files of the target scene network, so as to realize the routing between nodes in the target scene network, And according to the configuration file, the subnets are divided and separated; the gateways of each node are provided in the routing control network; the gateways of each node point to a corresponding port of the virtual router; the routing control network includes several virtual bridges, Different user networks are isolated through virtual bridges;

The switch control network is used to configure the switch of the experimental network and the switch of the access network according to the configuration file;

The access network, as an access point network corresponding to the experimental network, provides an access interface so that users can access and use the network and resources in the business scene of the complex network simulation environment.

Further, the configuration file of the target scene network is generated according to the network topology, virtual router, each IP address segment and VLAN required for the target scene network configuration.

Further, each virtual routing server creates a virtual network bridge, which is bound to a physical interface of a server, and is respectively connected to virtual bridges created by other virtual routing servers; each virtual bridge has a channel The channel interface of each virtual network bridge is bound to a physical interface of each virtual routing server, and the physical interface of the virtual routing server is connected to the core switch of the experimental network in the experimental network to access each node.

Further, each of the virtual routers is uniformly controlled and managed by an SDN controller.

The main functions of the system of the present invention are four parts: routing control network (vRouterCtrlNet), experiment network (ExptNet), switch control network (MethCtrlNet), and access network (AccessNet). The specific functions of each network will be clarified in detail in the link of specific implementation.

The user purely graphical interface selects the resources required by the scene network, draws the network topology, fills in the network address information and submits it.

The frontend of the system generates a configuration file in JSON format for the scene network. The content in the configuration file includes the network address information and network topology filled in by the user. The background of the system passes the SDN (software Define the network) technology to generate a virtual router (vRouter), and the SDN controller conducts unified policy control on the virtual router through the OpenFlow protocol, realizes the creation of routing nodes in the scene network, and generates the routing relationship required by the virtual router, that is, the connection between nodes Relationships, including the connection relationship between routers and routers, the connection relationship between terminals and routers, the virtual interface address information of virtual routers, using virtual switch (OVS) technology to generate virtual OVS bridges (Bridge), to realize the The division of the network segment is sent to the virtual routing server.

The virtual routing server monitors in real time whether the specified directory in the virtual routing server receives the new scene network configuration file in JSON format generated by the system foreground, and if so, automatically starts the creation process of the scene network.

The virtual routing server extracts the information of the configuration file sent from the foreground to generate a virtual bridge and a virtual router. According to the needs of the scene network, automatically configure the ports of the virtual bridge and virtual router (vRouter), divide the virtual local area network (VLAN), configure the interface address, and configure the virtual connection line.

The virtual routing server generates a routing table according to the connection relationship between nodes, and writes the automatically generated routing table into the virtual router to realize complex network routing in the scene.

The configuration file contains real nodes (physical servers) and virtual nodes (virtual machines). The experimental network access switches connected to the real nodes and virtual nodes in the scene are configured with VLAN information, and a link between the core switch of the experimental network and the virtual routing server is created. Links, that is, configure the VLANs allowed by the Tunk channel on the port connecting the core switch and the virtual routing server.

The overall network system architecture of the present invention is divided into four types of networks according to functions, namely, routing control network, scene network, switch control network, access network, connection relationship between networks, and functions realized by each network.

In the stage of processing scene network configuration files, the invention automatically analyzes the connection relationship of each node, and generates the connection relationship between nodes through the shortest path algorithm.

In the scene virtual routing generation stage, the present invention uses the SDN controller to control and configure the virtual bridge (Bridge), sends routing table information to the SDN controller through the northbound Restful interface, and the SDN controller sends the routing table information to the SDN controller. The way and method to send to each Bridge through the southbound OpenFlow channel. There are detailed clarifications in the specific implementation mode.

Compared with prior art, the present invention has following obvious points:

1. It can realize the construction of large-scale and complex scene network, which has changed the status quo of single and simple traditional environment structure. Realize the embodiment of the routing connection relationship between autonomous domains, autonomous domains and campus networks in the simulated Internet, realize the simulation of the real environment to the maximum extent, and make up for the deficiency that the existing technology cannot realize the hierarchical network routing relationship.

2. The scene network is quickly and automatically deployed, and complex routing relationships no longer need to rely on physical network equipment and manual configuration, greatly improving efficiency. Through the SDN technology, the network address information can be customized, that is, it can be a private network address or a public network address, which solves the problem that the existing technology can only automatically allocate private network addresses and cannot define real addresses.

3. Through the use of SDN technology and virtual switches, parallel isolation between networks in different scenarios can be realized without interfering with each other, and the problem of address conflicts in the simultaneous use of multiple tenants can be solved.

Description of drawings

Figure 1 is an overall system architecture diagram;

Fig. 2 is a flow chart of the virtual routing service.

Detailed ways

In order to enable relevant professionals to better understand the technical solution of the present invention, the technical solution of the present application will be clearly and completely described below in combination with specific implementation cases of the present application and related drawings.

The invention automatically generates configuration files and routing information according to the scene network topology information customized by the front-end user, and sends them to the routing server to automatically create virtual network devices and links, thereby quickly generating large-scale complex scene networks.

The system of the present invention is applied in a complex network simulation environment, and the system architecture is as shown in Figure 1. In this, the system function of the present invention is mainly divided into four parts: routing control network (vRouterCtrlNet), experimental network (ExptNet), switch Control network (MethCtrlNet), access network (AccessNet).

The core part in the system of the present invention is the virtual routing control network (vRouterCtrlNet). The routing control network includes a virtual routing server, and the SDN controller is running in the server. The virtual routing server can generate several virtual routers (vRouter), which realizes Routing between nodes in the scene network, all vRouters are controlled and managed uniformly through the SDN controller, and the SDN controller generates and manages all virtual routers through the configuration file of the scene network, including the interface IP address information of the virtual router, routing table. At the same time, gateways of each node are provided in the routing control network, and all physical and virtual node gateways point to a certain port of the virtual router. At the same time, through the virtual switch technology in the routing control network, the virtual routing server creates several virtual bridges (Bridge) according to the scene network configuration file, and divides different VLANs in the Bridge to realize the division and isolation of subnets. Between the networks of users (tenants), the isolation between tenants is realized through bridges in different scenarios and the VLANs in them. Tenants do not share VLANs between tenants, and bridges between different tenants are not interconnected, so network isolation is realized.

The experimental network is a customized network scenario used in various business scenarios, and supports custom gateways, routes, and IPs. All business scenarios of the entire system are deployed on the business scenario network, which is the network basis for the operation of the business scenario. The real and virtual nodes (Tnode) in the complex network simulation environment are connected to the experimental network access switch (ExptNetSW), the access switch is connected to the experimental network core switch (Core ExptNetSW), and the experimental network is connected to the routing control network to realize the Tnode Routing between nodes in the scene network. A brief summary of the network path between two different subnet nodes is: node 1—experimental network—routing control network—experimental network—node 2.

The switch control network is used to configure the experimental network switch and access network switch, including operations such as creating VLANs, opening and closing ports, and creating channels.

As the access point network corresponding to the experimental network, the access network (AccessNet) provides an access interface for end users, enabling users to access and use networks and other resources in complex network simulation environment business scenarios.

The technical implementation process of the present invention is specifically described below in conjunction with the example of creating a scene network:

1. Scenario network physical device connection

All complex network simulation environment servers are connected to the experimental network access switches through cables, each access switch is connected to the experimental network core switch through optical fiber lines, and the access network switches are also connected to the experimental network core switch through optical fiber lines.

2. Automatic configuration of the access switch

The user draws a picture through the front-end interface, creates a scene network, configures the required network topology, virtual router, each IP address segment, VLAN, etc., and then the front-end generates a JSON configuration file of the scene network, and sends it to the routing control network through the SSH protocol and switch control network.

When there is one or more VLANs in the scene network, you need to create the required VLANs in the scene network in the experimental network access switch, so that the access of terminal devices (real and virtual nodes) can be added to the corresponding VLAN as required . Through the scene configuration file, after the system in the switch control network parses the configuration file, it communicates with the physical switch through the SSH protocol, and resolves the task information in the configuration file into instructions and sends them to the physical switch. This step includes creating VLANs, configuring switch ports, Configure the trunk channel, open or close the port, etc.

The switch control network completes the basic configuration of the Tnode access network. This step is to cooperate with the routing control network to complete the access of each node. It is the first step for each node access. It belongs to the initial basic work of preparation. After the corresponding ports are divided into VLANs, the initial basic work is completed. All scene network routing and gateways are completed by the routing control network. Real nodes and virtual nodes only access the scene network through the access switches in the experimental network.

3. Scenario network virtual routing configuration

If there is a layer-3 forwarding routing device in the scenario network, you need to create and configure a virtual route. Figure 2 shows the creation process of the scene network virtual route.

●After the virtual routing server receives the configuration file, it will start creating the virtual routing immediately.

●The virtual routing server first parses the received configuration file, and extracts the connection relationship between all servers, switches, and routers. According to the connection relationship between nodes, it includes the connection relationship between routers and between terminals and routers. , according to the Dijkstra (Dijkstra) single-source shortest path algorithm, automatically calculate and generate the shortest path between all nodes and any other nodes, and generate routing table entry information according to the shortest path information.

●The virtual routing server first generates the required virtual bridge (Bridge) according to the configuration file, and marks all the ports on the Bridge with the corresponding VLAN tags, that is, divides subnets and VLANs, and each node in the scene network belongs to different VLANs And subnet, where each interface with VLAN tag will be logically connected to the Layer 2 network between nodes. At the same time, each virtual routing server creates a Bridge that is bound to the physical interface of the server, and is connected to all other Bridges at the same time. The only Trunk interface on the Bridge is bound to a physical interface of each virtual routing server. The physical interface is connected to the core switch of the experimental network in the experimental network, so as to access each Tnode node. In this way, the Tnode node can be connected to the routing control network and access the gateway of its own subnet, so as to realize the routing between nodes of different subnets. Create a virtual connection between Bridges according to the connection relationship between Bridges in the scene network configuration file. Some of the Bridges are used as virtual routers in the subsequent steps, so the virtual routing server configures these Bridges as communication channels with the SDN controller, and the SDN controller controls the Bridges through the OpenFlow protocol.

●In order to convert the Bridge into a virtual router (vRouter) with routing and forwarding functions, the virtual routing server starts the SDN controller at this time, communicates with the related Bridge through the previously configured communication channel and establishes management and control. At this time, the server passes through the northbound The API interface sends the routing table information and port IP address information generated according to the scene configuration file to the SDN controller. After receiving the information, the SDN controller sends the flow table to each Bridge through the southbound OpenFlow channel, thus completing the virtual router. of the creation. The SDN controller and Bridge all run in the virtual routing server, and the communication between them all takes place in the server.

4. Access network configuration

The access network creates a physical access point for users (who can be tenants, or other relevant personnel who actually use the scene network created by the tenant) to access the scene network, so that the user's terminal equipment can be connected to the scene network, Access to real nodes and virtual nodes in the scene network.

Although the illustrative specific embodiments of the present invention have been described above, so that researchers in the technical field can understand the present invention, it should be clear that the present invention is not limited to the scope of the specific embodiments. For those of ordinary skill in the art, Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. A method for rapidly constructing a business scenario network under a complex network simulation environment, the steps comprising: 1) The server in the complex network simulation environment is connected to the access switch of the experimental network, each of the access switches is connected to the core switch of the experimental network; the switch of the access network is connected to the core switch of the experimental network; 2) Generate the configuration file of the target scenario network according to the required network topology, virtual router, each IP address segment and VLAN according to the target scenario network configuration, and send the configuration file to the routing control network and the switch control network; 3) The switch control network completes the basic configuration of the node access network according to the configuration file; 4) The virtual routing server of the route control network creates a virtual route according to the configuration file, and divides subnets and VLANs according to the configuration file, and divides each node in the target scene network into corresponding VLANs and subnets; 5) Each virtual routing server creates a virtual network bridge, which is bound to the physical interface of a server and connected to the virtual network bridges created by other virtual routing servers; each virtual network bridge has a channel interface , the channel interface of each virtual network bridge is bound to a physical interface of each virtual routing server, and the physical interface of the virtual routing server is connected to the experimental network core switch in the experimental network, thereby accessing each node; 6) The virtual routing server creates a virtual connection between the virtual switches according to the configuration file, and configures a communication channel between the virtual switch and the SDN controller; 7) The virtual routing server starts the SDN controller, communicates with the corresponding virtual switch and establishes management and control through the configured communication channel; then the virtual routing server sends the virtual routing and port IP address information to the SDN controller, and when the SDN controller According to the received information, the flow table is delivered to each virtual switch, thereby completing the creation of the virtual router. 2. The method according to claim 1, wherein the method for creating the virtual route is: the virtual route server first extracts the connection relationship between each node from the configuration file, and calculates according to the Dijkstra single-source shortest path algorithm Generate the shortest path between each node and any other node, and generate routing table entry information according to the shortest path information. 3. The method according to claim 1 or 2, wherein the method for dividing subnets and VLANs according to the configuration file is: the virtual routing server generates the required virtual network bridge according to the configuration file, and divides the virtual network All ports on the bridge are marked with corresponding VLAN tags, that is, subnetting and VLANs are divided. 4. The method according to claim 1, characterized in that, in the step 7), the virtual routing server sends the virtual routing and port IP address information to the SDN controller through the northbound API interface, and when the SDN controller receives After receiving the information, send the flow table to each virtual switch through the southbound OpenFlow channel, thereby completing the creation of the virtual router. 5. The method according to claim 1, wherein each virtual router is uniformly controlled and managed by an SDN controller. 6. The method according to claim 1, wherein the configuration file is a JSON configuration file; the configuration file is sent to the routing control network and the switch control network through the SSH protocol. 7. A rapid network construction system for business scenarios in a complex network simulation environment, characterized in that it includes a routing control network, an experimental network, a switch control network, and an access network; wherein, The experimental network is a customized network scenario used in each business scenario, and supports custom gateways, routing and IP; each node in the complex network simulation environment is connected to the access switch of the experimental network, and each access switch is connected to the experimental network. The core switch of the network, the experimental network and the routing control network connection; the nodes include real nodes and virtual nodes; The routing control network includes several virtual routing servers, the virtual routing servers run SDN controllers, and the SDN controllers generate and manage virtual routers through the configuration files of the target scene network, so as to realize the routing between nodes in the target scene network, And according to the configuration file, the subnets are divided and separated; the gateways of each node are provided in the routing control network; the gateways of each node point to a corresponding port of the virtual router; the routing control network includes several virtual bridges, Different user networks are isolated through virtual bridges; The switch control network is used to configure the switch of the experimental network and the switch of the access network according to the configuration file; The access network, as an access point network corresponding to the experimental network, provides an access interface so that users can access and use the network and resources in the business scene of the complex network simulation environment. 8. The system according to claim 7, wherein the configuration file of the target scene network is generated according to the network topology, virtual router, each IP address segment and VLAN required for the target scene network configuration. 9. The system according to claim 7, wherein each virtual routing server creates a virtual network bridge, which is bound to a physical interface of a server, and the virtual network bridge created by other virtual routing servers The bridges are connected separately; each virtual bridge has a channel interface, and the channel interface of each virtual bridge is bound to a physical interface of each virtual routing server, and the physical interface of the virtual routing server is connected to the core switch of the experimental network in the experimental network. connected to each node. 10. The system according to claim 7, wherein each virtual router is uniformly controlled and managed by an SDN controller.