一种基于OpenFlow的SDN访问控制策略实时冲突检测与解决方法

发布时间：2018-04-11 09:55

本文选题：软件定义网络 + OpenFlow　；参考：《计算机学报》2015年04期

【摘要】：软件定义网络SDN(Software-Defined Networking)是由美国斯坦福大学Clean Slate研究组提出的一种新型网络创新架构,可通过软件编程的形式定义和控制网络,其控制平面和转发平面分离及开放性可编程的特点,为新型互联网体系结构研究提供了新的实验途径,也极大地推动了下一代互联网的发展.OpenFlow是SDN的主要协议,定义了SDN控制器与交换机之间的通信标准.目前,很多基于OpenFlow的SDN设备已经在实际中得到了部署.但是,基于OpenFlow的SDN却面临很多安全挑战.其中一个重要的挑战是如何建立一个安全可靠的SDN防火墙应用.由于OpenFlow协议的无状态性,现有的SDN防火墙可以被通过改写交换机中的流表项轻松绕过.针对这一安全威胁,作者提出了基于Flowpath的实时动态策略冲突检测与解决方法.通过获取实时的SDN网络状态,能够准确地检测防火墙策略的直接和间接违反,并且一旦发现冲突,可以基于Flowpath进行自动化和细粒度的冲突解决.最后,作者在开源控制器Floodlight上实现了一个安全增强的防火墙应用FlowVerifier,并基于Mininet对FlowVerifier的性能进行了评估.结果表明FlowVerifier能够检测和自动化地解决SDN网络中由于流表改写而引入的策略冲突及其带来的安全威胁.
[Abstract]:SDN(Software-Defined networking is a new network innovation framework proposed by Clean Slate team of Stanford University, USA. It can define and control network by software programming, and its control plane and forwarding plane are separated and open programmable.It provides a new experimental approach for the study of new Internet architecture and greatly promotes the development of next generation Internet. OpenFlow is the main protocol of SDN and defines the communication standard between SDN controller and switch.At present, many SDN devices based on OpenFlow have been deployed in practice.However, SDN based on OpenFlow faces many security challenges.One of the important challenges is how to build a secure and reliable SDN firewall application.Due to the stateless nature of the OpenFlow protocol, existing SDN firewalls can be easily bypassed by overwriting stream table entries in the switch.Aiming at this security threat, the author proposes a real-time dynamic policy conflict detection and resolution method based on Flowpath.By acquiring real-time SDN network state, the direct and indirect violations of firewall policies can be detected accurately, and once conflicts are detected, automatic and fine-grained conflict resolution can be carried out based on Flowpath.Finally, the author implements a secure enhanced firewall application named flow Verifier on the open source controller Floodlight, and evaluates the performance of FlowVerifier based on Mininet.The results show that FlowVerifier can detect and automatically resolve the policy conflicts and the security threats caused by the rewriting of stream tables in SDN networks.
【作者单位】：武汉大学计算机学院;教育部空天信息安全与可信计算重点实验室;克莱姆森大学;
【基金】：国家“九七三”重点基础研究发展规划项目基金(2014CB340600) 国家自然科学基金(61173138,61402342,61003628)资助~~
【分类号】：TP393.08

【相似文献】