SDN网络访问策略冲突的检测和解决方法

发布时间：2018-02-25 07:08

本文关键词： 策略冲突头部空间解析流表标记访问控制列表　出处：《大连海事大学》2017年硕士论文　论文类型：学位论文

【摘要】：SDN是一种新兴的基于软件的网络架构及技术,最大的特点是具有松耦合控制平面与数据平面,使转发平面和控制平面进行分离。由于OpenFlow无状态性,可以对数据包进行自由修改,因此会导致与已知设定的防火墙策略发生冲突,使得数据流可以绕过既定的策略,会使得网络安全性能降低,容易受到外部攻击。本文针对这一问题本提出了利用流表的转发规则和流表的特性同时借助MPLS思想,制定以双标记的方式解决冲突发生。在SDN新型网络中,本文对OpenFlow协议中流表进行深入研究,了解流表的构造以及转发策略和规则。在出现策略冲突时,运用头部空间解析算法进行策略冲突的检测,通过头部空间解析计算出流表项中每条路径整合的起始和结束IP地址,并且与网络中已经设定存在的策略进行对比,判断出是否出现冲突策略,并由控制器下放流表对数据包进行追踪双标记,即对出现敏感源IP地址的数据包进行标记,同时追踪出现敏感目的IP地址的数据包进行标记。如果同时出现双标记,则把数据包进行统一处理。最后将防火墙的安全策略进行部署下移,使用访问控制列表进行优化设置,避免了数据流与控制器交互,减轻控制器负担,在特定环境下,优化了网络设置并且提升控制器使用效率。基于在应用层开发,定义了 4个模块实现策略冲突发现和解决方案。各个模块分别为:拓扑建立模块,冲突检测与发现模块,触发机制模块,以及流表下发模块。并且用仿真工具Mininet和Floodlight控制器进行试验测试,通过对简单网络和复杂网络进行对比,检测是否可以有效的阻止策略冲突的发生并且通过控制器CPU的使用率来直观的判断增加访问控制列表对控制器效率的提升。
[Abstract]:SDN is a new software-based network architecture and technology. The most important feature is that it has loosely coupled control plane and data plane, which separates the forwarding plane from the control plane. Due to the stateless nature of OpenFlow, data packets can be modified freely. This can lead to conflicts with known firewall policies that allow data streams to bypass established policies and reduce network security performance. In order to solve this problem, this paper proposes to use the forwarding rules of stream table and the characteristics of stream table, and with the help of MPLS thought, to solve the conflict in a dual-label way. In the new SDN network, a new type of network is proposed. In this paper, we deeply study the stream table in OpenFlow protocol, understand the structure of the flow table and the forwarding policy and rules. When there is a policy conflict, we use the header space parsing algorithm to detect the policy conflict. The beginning and end IP addresses of each path integration in the stream table are calculated by header space analysis, and compared with the existing policies in the network, the conflict strategy is judged. The data packet is tagged by the flow table under the controller, that is, the packet with the sensitive source IP address is marked, and the packet with the sensitive destination IP address is tagged at the same time. Finally, the security policy of the firewall is deployed downwards, and the access control list is used to optimize the setup, which avoids the interaction between the data flow and the controller, lightens the burden of the controller, and in a specific environment, Based on the development of application layer, four modules are defined to realize policy conflict detection and solution. Each module is: topology building module, conflict detection and discovery module. The trigger mechanism module, and the flow table sending module. The simulation tool Mininet and Floodlight controller are used to test, and the simple network and complex network are compared. Detection can effectively prevent the occurrence of policy conflicts and through the controller CPU usage to directly determine the increase in access control list to improve the efficiency of the controller.
【学位授予单位】：大连海事大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.0

【相似文献】