基于SDN架构的攻击防护策略

发布时间：2018-07-20 20:21

【摘要】：软件定义网络是一种新型的网络架构,它将网络的控制功能和转发功能进行解耦,实现了网络控制的直接可编程。在这种架构下,网络是进行集中管理的,管理员可以通过控制器来快速的配置网络资源和动态调整网络流量以应对需求的变化。这几种软件定义网络的优势在学术和工程中已经得到了验证。但是软件定义网络作为发展起步没多久的网络架构还面临着诸多挑战,本论文主要探讨数据层面的安全问题。在软件定义网络架构下,传统的网络存在的ARP欺骗等地址伪造报文威胁依然存在,只是这些攻击可能在形式上发生了变化。而且软件定义网络架构还面临新的安全挑战,即应用可以通过重写流表项来避开需要强制执行的安全应用规则,同时流表项之间也可能存在冲突。本文针对上面两种安全问题,提出了一种软件定义网络架构下数据层的攻击防护策略。针对南向设备的潜在威胁,利用网络中控制器对于全网状态的感知能力,维护一个设备信息映射表,进行伪造报文的检测,这样保证后续模块收到的数据包地址都是正确的,同时论文在主机信用评估方面的设计使得本模块能够更容易的与其它安全模块进行耦合。针对高安全等级应用规则被避开或覆盖的情况,借鉴了头部空间分析技术的思想,将流表项规则和安全规则分别生成规则空间,在应用下发新规则时检测其与两个空间存不存在重叠。如果存在重叠,表示规则出现冲突,调用冲突解决模块丢弃数据包或者进行额外流表项的插入。
[Abstract]:The software defined network is a new type of network architecture, which decouples the control function and forwarding function of the network, and realizes the direct programmable of network control. Under this architecture, the network is centralized management. The administrator can quickly configure the network resources and dynamically adjust the network traffic to respond to the demand through the controller. Changes. The advantages of these software defined networks have been verified in academic and engineering. However, the software definition network is facing many challenges as a network architecture that has not been developed for long. This paper mainly discusses the security problems of the data level. Under the software definition network architecture, the existing ARP deception and other addresses exist in the traditional network. The threat of forged message still exists, but these attacks may change in form. And the software definition network architecture also faces new security challenges, that is, applications can avoid security application rules that need to be enforced by rewriting the flow table items, and there may be conflicts between the flow table items. This article aims at the above two kinds of security. This paper proposes an attack protection strategy for data layer under the software definition network architecture. In view of the potential threat to the southern device, using the network controller's perception of the whole network state, maintaining a device information mapping table and detecting the forged message, so that the data packet address received by the follow-up module is correct. At the same time, the design of the thesis in the host credit evaluation makes this module more easy to be coupled with other security modules. In view of the situation that the high security level application rules are avoided or covered, the idea of the head spatial analysis technology is used for reference, the rules of flow table and the safety rules are generated in the rule space respectively, and the new rules are issued under the application. If there is no overlap between two spaces, if there is an overlap, the representation rule conflicts, the call conflict resolution module discards the packet or inserts the extra flow table item.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】