CN115941721B

CN115941721B - Network data packet transmission method based on SDN and blockchain

Info

Publication number: CN115941721B
Application number: CN202211312125.9A
Authority: CN
Inventors: 李振宇; 丁勇; 梁海; 杨炳年
Original assignee: Guilin University of Electronic Technology
Current assignee: Guilin University of Electronic Technology
Priority date: 2022-10-25
Filing date: 2022-10-25
Publication date: 2025-07-18
Anticipated expiration: 2042-10-25
Also published as: CN115941721A

Abstract

The invention relates to the technical field of network space safety, in particular to a network data packet transmission method based on SDN and blockchain, which is characterized in that an SDN processor is added on the basis that original industrial Internet equipment is directly connected with the Internet, and the traditional network transmission method is combined with the blockchain technology to assist in transmission, so that key data packets transmitted by the industrial Internet equipment can be prevented from being lost under the condition that normal speed transmission is ensured, meanwhile, record is sent by using blockchain recorded data and key data packets recorded on the SDN equipment, effective detection of abnormal occurrence data packets is realized, and an administrator can be assisted in timely treatment of potential safety hazards.

Description

Network data packet transmission method based on SDN and blockchain

Technical Field

The invention relates to the technical field of network space security, in particular to a network data packet transmission method based on SDN and blockchain.

Background

With the development of industrial Internet and 5G technology, more and more industrial control equipment is gradually accessed into the Internet for convenient use, and the scene relates to important industries and fields of steel, energy, traffic, water conservancy and the like. Due to the fact that a part of scenes, such as vehicle-mounted industrial equipment, are used in a large number of moving mode, the problems that data key data transmission is lost due to unstable receiving exist.

In addition, china suffers from a large amount of network attacks throughout the year, and the industrial Internet contains a large amount of key facilities, so that the industrial Internet is also one of the targets of the important attack of the advanced persistent threat attack organization. The advanced persistent threat attack organization can realize malicious control of equipment by forging key instructions of industrial Internet equipment, so that Internet safety and industrial construction are seriously endangered, and the influence is great.

There are data transmission stability problems in complex environments in the current industrial internet due to device movement or insufficient network coverage. At the same time, there is also a problem of abnormal instruction execution by industrial internet devices due to customized network attacks initiated by advanced persistent threat attack organizations. These problems create a great potential for the safe and stable operation of industrial internet equipment.

Disclosure of Invention

The invention aims to provide a network data packet transmission method based on SDN and blockchain, which combines a software defined network technology and a blockchain technology, separates key data packets by using SDN, and assists transmission and confirmation by a blockchain system so as to solve the technical problems that data may be lost and attack data packets are difficult to detect and trace.

In order to achieve the above object, the present invention provides a network data packet transmission method based on SDN and blockchain, including the following steps:

Step 1, a first SDN processor receives a network data packet;

Step 2, the first SDN processor checks whether the current network data packet is a critical data packet,

If not, directly transmitting through the existing network;

if yes, entering an additional processing stage;

Step 3, the additional processing stages comprise a flow 1, a flow 2 and a flow 3, wherein the flow 1 and the flow 2 are developed simultaneously;

In flow 1, a first SDN processor communicates with a second SDN processor and prepares data for flow 3;

in the process 2, the block chain system is used for assisting transmission and confirmation to finish the transmission of the key data packet;

The detection and tracing process is completed using flow 3.

The network data packet transmission method based on SDN and blockchain adds SDN processors on the basis that original industrial Internet equipment is directly connected with Internet, wherein a first SDN processor is an SDN processor of a current network outlet, and a second SDN processor is an SDN processor of an opposite-end network inlet.

The network data packet is sent by industrial Internet equipment, and the key data packet is an instruction data packet for operating the state of the industrial Internet equipment and comprises equipment state change and upper limit value modification functions.

The specific process of the process 1 comprises the following steps:

The first SDN processor directly sends the key data packet through a network port connected with a normal network;

after receiving the key data packet, the second SDN processor forwards the key data packet to the target device;

after the second SDN processor finishes sending, the sent key data packet is recorded, so that the network attack data flow is found in time in the process 3 and used.

The specific flow of the flow 2 comprises the following steps:

the first SDN processor adds a destination network tag to the key data packet and transmits the key data packet to the blockchain system;

Synchronizing and processing data by a block chain system;

The second SDN processor checks the sending condition of the key data packet and informs the completion of the sending flow of the network data packet by using the block chain system.

In the process of synchronizing and processing data by the blockchain system, the blockchain link points in the blockchain system need to pack the data packets of the same target network label which are not processed currently so as to combine the data packet transmission of the same target network.

The process of checking the sending condition of the key data packet by the second SDN processor comprises the following steps:

The second SDN processor checks if a critical data packet has been sent by step 2,

If the key data packet is not transmitted in the step 2, transmitting the current data packet, and recording a transmission record;

if the critical data packet is already sent in step 2, the sending is skipped.

The specific process of the process 3 includes the following steps:

the transmitted data packet is comprehensively compared with the data packet required to be transmitted on the blockchain at fixed time;

if the situation that the transmitted data packet is not matched with the data packet to be transmitted on the blockchain is not found, cleaning the matched data cache, and continuing to carry out comprehensive comparison;

If the transmitted data packet is not matched with the data packet to be transmitted on the blockchain, marking the data packet which is transmitted and not recorded on the blockchain;

Reporting the abnormal key data packet to an administrator;

tracking and tracing are carried out according to key data packet information of abnormal occurrence;

And the processed transmission key data packet buffer memory is cleaned in time.

The invention provides a network data packet transmission method based on SDN and blockchain, which is characterized in that an SDN processor is added on the basis that original industrial Internet equipment is directly connected with the Internet, and the traditional network transmission method is used, and is combined with the blockchain technology to assist in transmission, so that key data packets transmitted by the industrial Internet equipment can be prevented from being lost under the condition of ensuring normal speed transmission, meanwhile, the record is sent by using blockchain recorded data and key data packets recorded on the SDN equipment, so that effective detection of abnormal data packets is realized, and an administrator can be assisted in timely treatment of potential safety hazards.

Drawings

In order to more clearly illustrate the embodiments of the invention or the technical solutions in the prior art, the drawings that are required in the embodiments or the description of the prior art will be briefly described, it being obvious that the drawings in the following description are only some embodiments of the invention, and that other drawings may be obtained according to these drawings without inventive effort for a person skilled in the art.

Fig. 1 is a flow chart of a network data packet transmission method based on SDN and blockchain of the present invention.

Fig. 2 is a schematic diagram of the security problem faced by the industrial internet and the overall architecture of the industrial internet.

Fig. 3 is a flow chart of the overall network packet transmission process of the present invention.

FIG. 4 is a flow chart of a variation of the transmission of data packets via a blockchain in the present invention.

Detailed Description

Embodiments of the present invention are described in detail below, examples of which are illustrated in the accompanying drawings, wherein like or similar reference numerals refer to like or similar elements or elements having like or similar functions throughout. The embodiments described below by referring to the drawings are illustrative and intended to explain the present invention and should not be construed as limiting the invention.

Referring to fig. 1, the invention provides a network data packet transmission method based on SDN and blockchain, comprising the following steps:

s1, a first SDN processor receives a network data packet;

S2 the first SDN processor checks if the current network packet is a critical packet,

If not, directly transmitting through the existing network;

if yes, entering an additional processing stage;

s3, the additional processing stage comprises a flow 1, a flow 2 and a flow 3, wherein the flow 1 and the flow 2 are developed simultaneously;

The detection and tracing process is completed using flow 3.

Further, the present invention provides a specific embodiment, which is described below with reference to the accompanying drawings and specific implementation steps:

referring to fig. 2 to 4, fig. 2 is a schematic diagram illustrating a security problem and an overall architecture of an industrial internet according to the present invention. The manner in which the industrial internet devices connect and communicate, and the manner in which data is exchanged through the SDN and blockchain is shown in fig. 2.

Specifically, the invention adds the SDN processor on the basis that the original industrial Internet equipment is directly connected with the Internet. An SDN processor (processing device) is a network device, and in a tandem mode, an SDN program may directly read, add, delete and modify data transmitted in a network cable. Compared with traditional network equipment, such as routers and switches, the SDN processing mode is more flexible, and data processing can be performed without paying attention to a network topology structure. Therefore, the invention is based on the characteristic of SDN, combines with the blockchain technology to realize the guarantee of the reliability of key data transmission, the formation of traceable operation logs and the timely discovery of network problems.

After the existing industrial internet communication architecture is modified, a processing flow and a data conversion mode performed by the blockchain processor and the SDN processor need to be designed. The whole data transmission flow chart is shown in fig. 3, and there are 3 flow processing branches in the transmission flow. The following will describe in detail the packet flow process:

0.1 first, after the network data packet is sent by the industrial internet device, the network data packet reaches the SDN processor of the current network outlet.

The 0.2SDN processor may first check whether the data packet currently required to be processed is a critical data packet used by the industrial internet device (the industrial internet critical data packet is an instruction data packet for operating the state of the industrial internet device, and its functions such as device state change, upper limit value modification, etc.).

0.3 If the SDN processor determines that the current packet is not a critical packet according to the set rule, directly skipping an additional processing stage and directly transmitting the current packet through the existing network.

0.4 If the SDN processor determines that the current packet is a critical packet, it starts to enter an additional processing phase.

In the additional processing stage, the block chain system has the problems of huge time consumption for data synchronization and the like, so that unnecessary time delay is generated for original data transmission of industrial internet equipment. In order to solve this problem, the method of the flow 1 is used, and data in the industrial internet is transmitted in advance.

1.1 In flow 1, SDN sends the data packets directly through a network port connected to a normal network.

1.2 After receiving the key data packet, the SDN processor of the opposite end will first forward the key data packet to the target device.

1.3 After the end SDN processor finishes transmitting, recording the transmitted data packet so as to find out the network attack data flow in time in the process 3 for use.

2. While the process 1 proceeds, the process 2 proceeds simultaneously.

2.1 In the process 2, the program on the SDN processor analyzes the key network data packet currently required to be processed, and extracts the target network address information of the network data packet.

And 2.2, inquiring network tag information corresponding to the target network address on the SDN processor according to the extracted target network address information.

2.3 After the network tag information corresponding to the target network address is acquired, generating a target network tag and network data packet storage pair in the temporary data structure body (the structure of the target network tag and network data packet storage pair is shown as a data packet structure between the SDN device 1 and the blockchain node 1 in fig. 4).

2.4, The SDN device transmits the data packet storage pair to which the destination network label has been currently added to the blockchain node.

2.5 To solve the problem of lower blockchain throughput (TPS, number of transactions per second), blockchain link points need to pack packets of the same target network tag that are not currently being processed to merge packet transmissions of the same destination network, thereby reducing the consumption of throughput.

2.6 The blockchain node then transmits the packed data that is not uploaded to the blockchain into the blockchain upon reaching a time that is synchronized with the blockchain.

2.7 Waiting for blockchain system synchronization data.

2.8 Each block link point timing checks if there is data in the blockchain system that is not processed by its own policed network.

2.9 End-of-block chain nodes (since a data packet is distributed to each blockchain node before reaching the peer network, but only the receiver blockchain node conforming to the jurisdiction will perform subsequent processing, the receiver blockchain node is simply referred to as the end-of-block chain node, e.g. blockchain node 2 of fig. 4), after finding that there is data unprocessed by the network under jurisdiction, the unprocessed data is separated into a storage pair with a target network tag and a network data packet.

2.10 Pairs of end-of-pair link points send the storage pairs of the target network label and the network data packet to the end-of-pair SDN device.

The 2.11SDN device needs to check if the data packet has been sent by the [ 1.2 ] step.

2.12 If the data packet is not sent by the step [ 1.2 ], the current data packet is sent, and a sending record is recorded.

2.13 If the data packet has been sent in step [ 1.2 ], the sending is skipped.

After the 2.14SDN process completes data transmission, the blockchain node needs to be notified, and the currently transmitted critical data packet is marked as transmitted.

2.15 When the block chain node marks the data packet as transmitted, the network data packet transmission flow is completed.

3. In order to effectively detect and trace the source of the attack data packet in time, the related detection work needs to be carried out by additionally using the flow 3.

3.1 First, the SDN device needs to make a comprehensive decision by combining the data packets recorded on the blockchain on the basis of the transmitted data packet records at regular time.

3.2 If no record of the transmitted data packet is found to be not matched with the data packet to be transmitted on the blockchain, the matched data cache is cleaned up and execution continues [ 3.1 ].

3.3 If a record of transmitted packets and a packet to be transmitted on the blockchain are found to be mismatched, the packets that have been transmitted and are not recorded on the blockchain are marked.

3.4 Because the critical data packet with abnormal occurrence is very likely to be the data packet sent by the attacker, the critical data packet needs to be reported to the administrator so as to repair the security defect in time.

And 3.5, carrying out tracking and tracing according to the key data packet information of the abnormal occurrence, and solving the potential safety hazard of the network boundary.

And 3.6, timely cleaning the processed transmission key data packet cache on the SDN equipment, and improving the processing efficiency of the SDN equipment on the abnormal data packet.

Through the above three processes of classification, the network data packet initially sent can be classified and identified according to different categories.

The invention solves the potential safety hazard in the industrial Internet by combining the software-defined network technology with the blockchain technology, and has the following advantages:

1. the invention utilizes the normal transmission method and combines the blockchain technology to ensure that the key data packet transmitted by the industrial Internet equipment is not lost under the condition of ensuring normal speed transmission.

2. The invention utilizes the blockchain recorded data and the key data packet recorded on SDN equipment to send records, realizes the effective detection of the data packet with abnormal occurrence, and can assist an administrator in timely processing potential safety hazards.

3. The invention can effectively help the industrial Internet equipment to normally work in the delay tolerant network (Delay Tolerant Networks, DTN).

The above disclosure is only a preferred embodiment of the present invention, and it should be understood that the scope of the invention is not limited thereto, and those skilled in the art will appreciate that all or part of the procedures described above can be performed according to the equivalent changes of the claims, and still fall within the scope of the present invention.

Claims

1. A network data packet transmission method based on SDN and blockchain, characterized in that it includes the following steps:

Step 1: The first SDN processor receives a network data packet;

Step 2: The first SDN processor checks whether the current network data packet is a critical data packet.

Otherwise, send directly through the existing network;

If so, it enters the additional processing stage;

Step 3: The additional processing stage includes process 1, process 2 and process 3, wherein process 1 and process 2 are carried out simultaneously;

The specific process of process 1 includes the following steps:

The first SDN processor directly sends the critical data packet through the network port connected to the normal network;

After receiving the critical data packet, the second SDN processor will first forward it to the target device;

After the second SDN processor completes the transmission, it records the key data packets that have been sent, so as to be used in the process 3 to timely discover the network attack data flow;

The specific process of process 2 includes the following steps:

The first SDN processor adds a destination network tag to the key data packet and transmits it to the blockchain system;

The blockchain system synchronizes and processes data;

The second SDN processor checks the sending status of the key data packets and uses the blockchain system to notify the completion of the network data packet sending process;

The specific process of process 3 includes the following steps:

Regularly and comprehensively compare the sent data packets with the data packets required to be sent on the blockchain;

If no mismatch is found between the sent data packet and the data packet required to be sent on the blockchain, the matched data cache is cleared and the comprehensive comparison continues;

If it is found that the sent data packet does not match the data packet required to be sent on the blockchain, the data packet that has been sent and is not recorded on the blockchain will be marked;

Abnormal key data packets are reported to the administrator;

Conduct tracing based on abnormal key data packet information;

Clean up the processed key data packet cache in time;

In process 1, the first SDN processor communicates with the second SDN processor and prepares data for process 3;

In process 2, the blockchain system is used to assist transmission and confirmation to complete the sending of key data packets;

Use process 3 to complete the detection and traceability process.

2. The network data packet transmission method based on SDN and blockchain as claimed in claim 1 is characterized in that:

The network data packet transmission method based on SDN and blockchain adds an SDN processor on the basis of the original industrial Internet device directly connecting to the Internet, wherein the first SDN processor is the SDN processor of the current network exit, and the second SDN processor is the SDN processor of the opposite network entrance.

3. The network data packet transmission method based on SDN and blockchain as claimed in claim 1, characterized in that:

The network data packet is sent by an industrial Internet device, and the key data packet is an instruction data packet for operating the status of the industrial Internet device, including device status change and upper limit value modification functions.

4. The network data packet transmission method based on SDN and blockchain as claimed in claim 1, characterized in that:

During the process of synchronizing and processing data in the blockchain system, the blockchain nodes in the blockchain system need to package the currently unprocessed data packets with the same target network label to merge the data packet transmissions of the same destination network.

5. The network data packet transmission method based on SDN and blockchain as claimed in claim 1, characterized in that:

The process of the second SDN processor checking the sending status of the key data packet includes the following steps:

The second SDN processor checks whether the critical data packet has been sent by step 2,

If the key data packet has not been sent in step 2, the current data packet is sent and the sending record is recorded;

If the critical data packet has been sent in step 2, skip sending it.