SDN网络的节点安全控制技术研究

发布时间：2019-01-23 08:30

【摘要】：软件定义网络(SDN)提出数据平面和控制平面分离的思想,解决了传统网络不能解决的高可靠性、扩展性和灵活性等方面的问题,但其在业务方面创新的同时也带来了新的安全方面的挑战。SDN控制器中业务控制与安全控制高度耦合互相影响,通过流表控制整个网络安全的安全控制机制还有待完善,且所有安全控制只能到达数据转发层,并没有与安全设备或者节点直接交互,使得安全控制能力受限。为进一步优化SDN网络安全控制能力,本文通过对解耦SDN控制层的业务控制和安全控制、基于流和基于节点代理相结合的安全控制技术等问题展开研究。设计实现了 SDN网络中的节点安全控制架构,并改良了现有的部分安全控制机制和技术,做到SDN网络中节点安全的深度防护。论文的具体工作如下:1)提出一种新的SDN节点安全控制架构,将SDN控制器中的安全部分完全独立出来成为安全控制器,负责所有SDN网络中的安全相关问题。2)提出一种通过sFlow流采集、sFlow-RT扩展的流检测和SDN控制器北向接口调用改变流表规则的基于流控制的节点安全控制技术。3)提出了在SDN网络节点中部署安全代理监测安全设备和节点的本地状态,安全控制器中的安全服务通过安全代理进行安全防护和安全控制部署。4)部署了实验验证网络,分别验证了系统各模块功能,并模拟了 DOS/DDoS泛洪攻击来验证SDN节点安全控制架构实现方案的合理性和可靠性。
[Abstract]:The idea of separating data plane from control plane is proposed by (SDN), which solves the problems of high reliability, expansibility and flexibility that can not be solved by traditional network. At the same time, it brings new security challenges. The high coupling of service control and security control in SDN controller, the security control mechanism of controlling the whole network security through flow table still needs to be improved. And all the security control can only reach the data forwarding layer, and there is no direct interaction with the security devices or nodes, so the security control ability is limited. In order to optimize the security control capability of SDN network, this paper studies the traffic control and security control of decoupled SDN control layer, and the security control technology based on flow and node agent. The node security control architecture in SDN network is designed and implemented, and the existing partial security control mechanism and technology are improved to achieve the depth protection of node security in SDN network. The specific work of this paper is as follows: 1) A new SDN node security control architecture is proposed. The security part of the SDN controller is completely independent of the security controller. Responsible for all security-related issues in SDN networks. 2) propose a sFlow stream acquisition, The extended flow detection of sFlow-RT and the northward interface of SDN controller call the flow control technology based on flow control. 3) A security agent is proposed in the SDN network node to monitor the security device and the local state of the node. The security services in the security controller deploy the security protection and security control through the security agent. 4) the experimental verification network is deployed to verify the functions of each module of the system. The DOS/DDoS flooding attack is simulated to verify the rationality and reliability of the SDN node security control architecture.
【学位授予单位】：北京邮电大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.0

【相似文献】