基于OpenFlow架构的域内源地址验证方法

发布时间：2018-11-15 15:50

【摘要】：源地址验证对网络安全、管理和计量都有重要意义.清华大学提出包括接入子网、域内和域间三个层次的源地址验证体系结构.其中域内用到一种基于集中计算路径的方法,但在传统网络环境限制下,其实现遇到很多问题.本文将利用软件定义网络对网络革新的便捷支持,基于OpenFlow网络对域内源地址验证方法进行重新设计与实现,并提出两种方案.一种是在已有路由表的基础上计算出域内任意两个子前缀间的路径并生成源地址前缀、目的地址前缀和入接口三元组作为过滤规则;另一种方案是重新设计新的路由算法,生成同时具有路由功能和验证源地址功能的四元组(源地址前缀、目的地址前缀、入接口和出接口)流表.并分别对两种方案做出对比,给出实验结果.
[Abstract]:Source address verification is of great significance to network security, management and measurement. Tsinghua University proposes a source address verification architecture with three levels: access subnet, intra-domain and inter-domain. A method based on centralized computing path is used in the domain, but under the limitation of traditional network environment, its implementation meets many problems. This paper uses the software definition network to support the network innovation, redesigns and implements the method of source address verification based on OpenFlow network, and puts forward two schemes. One is to calculate the path between any two sub-prefixes in the domain and generate the source address prefix based on the existing routing table. The destination address prefix and the interface triple are used as filtering rules. Another scheme is to redesign the new routing algorithm to generate a flow table of quaternions (source address prefix, destination address prefix, inbound interface and outbound interface) with both routing function and verifying source address function. The two schemes are compared and the experimental results are given.
【作者单位】：清华大学计算机科学与技术系;
【基金】：国家自然科学基金项目(61073172)资助高等学校博士学科点专项科研基金项目(200800030034)资助
【分类号】：TP393.08

【参考文献】