基于OpenFlow的云计算网络安全研究

发布时间：2018-06-30 09:41

本文选题：云计算 + 网络监控　；参考：《中国科学技术大学》2017年硕士论文

【摘要】：研究云计算网络的安全监控有助于创建安全的云计算网络,有助于云计算发展,能够更有效地保障客户的数据安全和隐私安全。传统的监控模式中,监控器一般部署在网络边界监控外部流量。为了能够同时监控网络外部和内部的流量,出现了基于OpenFlow的监控模式。OpenFlow技术赋予了网络可编程的能力,使得网络能够像软件一样可以灵活编程和修改。借助OpenFlow网络可编程的特点,将所有监控流量路由到监控设备,可以灵活的监控网络流量。现有的基于OpenFlow的云计算网络监控研究存在以下不足:1)之前的研究对于同类安全设备的数量支持不足,均假设每种类型的安全设备有且只有一个,在大规模网络环境下,存在性能瓶颈;2)监视器之间相对独立的工作,无有效协作。针对这些问题,本文基于OpenFlow深入研究了相应的优化改进方法,以进一步提高云计算安全的工作性能,增强实用性。具体研究内容如下:1)首先,基于OpenFlow设计了一种新的云计算网络监控架构。监控架构主要包括云安全设备的管理、监控规则的指定以及路由路径的生成。云安全设备管理方面,使用设备集合表示同类型设备,可以灵活的管理设备。监控规则指定方面,使用流表匹配项表示匹配规则,并指定使用的设备集合;2)然后,研究了三种路由算法。提出的三种路由算法分别是:使用简单路径的算法、修改的Prim算法以及基于TSP的算法;3)最后,为使云计算网络中的监控器能够有效协作,又提出使用协调器实现监控器之间的协作。协调器与监控器和OpenFlow控制器之间使用REST API沟通,监控器得到的局部数据能够被协调器获知,从而使全网的监控器协作,共同防御。为了验证本文提出的方法的可行性与有效性,基于Ryu控制器实现了相应的原型系统,并在Mininet上进行了实验。实验结果表明,本文所提出的监控架构和路由算法,能够很好的支持多台同类型的监控设备同时工作;提出的算法在小规模和大规模网络图中都有较好表现;协调器可以使监控器之间很好的协作,一部分区域受到攻击,可以使其他区域提前预警,或者提前防御;与现有的研究工作对比显示,在本文提出的系统中监控器的任务压力远小于使用单监控器的系统。原型系统可以在不降低云计算网络正常工作效率的前提下,灵活的监控网络数据流量。
[Abstract]:Research on security monitoring of cloud computing network is helpful to create secure cloud computing network, help cloud computing development, and ensure data security and privacy security of customers more effectively. In the traditional monitoring mode, the monitor is usually deployed at the network boundary to monitor the external traffic. In order to monitor the external and internal traffic of the network at the same time, the OpenFlow-based monitoring mode. OpenFlow technology has given the network programmable ability, which makes the network as flexible as software can be programmed and modified. With the programmable feature of OpenFlow network, all the monitored traffic can be routed to the monitoring device, and the network traffic can be monitored flexibly. The existing research on cloud computing network monitoring based on OpenFlow has the following shortcomings: 1) the previous research has insufficient support for the number of security devices of the same kind, assuming that each type of security device has only one, and in a large-scale network environment, There is a performance bottleneck 2) there is relatively independent work between monitors and there is no effective collaboration. Aiming at these problems, this paper studies the corresponding optimization improvement methods based on OpenFlow, in order to further improve the performance of cloud computing security and enhance the practicability. Firstly, a new cloud computing network monitoring architecture based on OpenFlow is designed. The monitoring architecture includes the management of cloud security devices, the specification of monitoring rules and the generation of routing paths. Cloud security equipment management, the use of equipment sets to represent the same type of equipment, can be flexible management of equipment. To specify the monitoring rules, the matching rules are represented by the matching items in the stream table, and the set of devices used is specified. Then, three routing algorithms are studied. The three routing algorithms proposed are simple path algorithm, modified Prim algorithm and tsp based algorithm. Finally, in order to make the monitor in cloud computing network cooperate effectively, It is also proposed to use the coordinator to realize the cooperation between monitors. The coordinator communicates with the monitor and the OpenFlow controller using rest API, and the local data obtained by the monitor can be known by the coordinator, so that the monitor of the whole network can cooperate and defend together. In order to verify the feasibility and effectiveness of the proposed method, the prototype system based on Ryu controller is implemented, and the experiment is carried out on Mininet. Experimental results show that the proposed monitoring architecture and routing algorithm can well support the same type of monitoring equipment working at the same time, and the proposed algorithm has a good performance in both small-scale and large-scale network diagrams. The coordinator allows good coordination between monitors, attacks on some areas, early warning of others, or early defense; a comparison with existing research shows that, In this paper, the task pressure of monitor is much less than that of single monitor. The prototype system can monitor the network data flow flexibly without reducing the normal working efficiency of cloud computing network.
【学位授予单位】：中国科学技术大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】