Security analysis in heterogeneous fault-tolerant control plane

Qi WU; Hongchang CHEN; Fucai CHEN

doi:10.11959/j.issn.2096-109x.2018095

您当前的位置：

首页 >

文章列表页 >

Security analysis in heterogeneous fault-tolerant control plane

Papers | 更新时间：2024-06-03

- Security analysis in heterogeneous fault-tolerant control plane
- Chinese Journal of Network and Information Security Vol. 4, Issue 11, Pages: 32-39(2018)
- 作者机构：
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2018095
  CLC： TP393
- Online First：2018-11，
  
  Published：15 November 2018
- 稿件说明：
移动端阅览
Qi WU, Hongchang CHEN, Fucai CHEN. Security analysis in heterogeneous fault-tolerant control plane[J]. Chinese Journal of Network and Information Security, 2018, 4(11): 32-39.
DOI：

Qi WU, Hongchang CHEN, Fucai CHEN. Security analysis in heterogeneous fault-tolerant control plane[J]. Chinese Journal of Network and Information Security, 2018, 4(11): 32-39. DOI： 10.11959/j.issn.2096-109x.2018095.

摘要

随着软件定义网络的大规模应用，软件定义网络的安全性显得愈发重要。基于异构思想的容错控制平面作为一种重要的防御思路，近年来越来越引起研究者的注意。但是现有容错控制平面的研究中忽视了异构原件中的同构漏洞问题，这大大降低了容错控制架构对软件定义网络的安全收益。从异构原件中的同构漏洞出发，首先分析了同构漏洞对控制平面的安全影响，然后以此为基础对容错控制平面的容忍能力进行量化，构造出一个最大化容忍能力的控制平面布局方法。实验仿真证明了所提方法可以有效降低控制平面的故障概率，攻击者在对基于所提方法构造的控制平面进行攻击时，需要花费更多的攻击成本才可以瘫痪控制平面。

Abstract

With the large-scale application of software-defined networks

the security of software-defined networks becomes more and more important.As an important defense idea

the fault-tolerant control plane based on heterogeneity has attracted more and more researchers' attention in recent years.However

the existing researches ignore the problem of common vulnerability in heterogeneous variants

which greatly reduces the security benefits of the fault-tolerant control architecture for software-defined networks.Addressing this problem

the common vulnerability was taken in heterogeneous variants into considerations.First

the tolerance capability of the fault-tolerant control plane was quantified.Then a control plane deployment method was constructed which was able to maximize the tolerance capability.The simulations show that the proposed method can effectively reduce the failure probability of the control plane.When the attackers attack the control plane constructed based on the proposed method

they pay more attack cost to compromise the control plane.

关键词

Keywords

references

SCOTT-HAYWARD S , NATARAJAN S , SEZER S . A survey of security in software defined networks [J ] . IEEE Communications Surveys ＆ Tutorials , 2016 , 18 ( 1 ): 623 - 654 .

PORRAS P , SHIN S , YEGNESWARAN V , et al . A security enforcement kernel for OpenFlow networks [C ] // International Workshop on Hot Topics in Software Defined Networks . ACM , 2012 : 121 - 126 .

SHIN S , SONG Y , LEE T , et al . Rosemary:a robust,secure,and high-performance network operating system [C ] // Conference on Computer and Communications Security . ACM , 2014 : 78 - 89 .

YEGANEH S H , GANJALI Y . Kandoo:a framework for efficient and scalable offloading of control applications [C ] // The Workshop on Hot Topics in Software Defined Networks . ACM , 2012 : 19 - 24 .

JIN X , GOSSELS J , Rexford J , et al . CoVisor:a compositional hypervisor for software-defined networks [C ] // Usenix Conference on Networked Systems Design and Implementation . USENIX Association , 2015 : 87 - 101 .

LENG J , ZHOU Y , ZHANG J , et al . An inference attack model for flow table capacity and usage:exploiting the vulnerability of flow table overflow in software-defined network [J ] . Water Air ＆ Soil Pollution , 2015 , 85 ( 3 ): 1413 - 1418 .

卢振平 , 陈福才 , 程国振 . 软件定义网络中控制器调度时间机制设计与实现 [J ] . 网络与信息安全学报 , 2018 ( 1 ): 36 - 44 .

LU Z P , CHEN F C , CHENG G Z . Design and implementation of the controller scheduling-time in SDN [J ] . Chinese Journal of Network and Information Security , 2018 ( 1 ): 36 - 44 .

[EB/OL ] . http://cve.mitre.org/ http://cve.mitre.org/

YOON C , LEE S , KANG H , et al . Flow wars:systemizing the attack surface and defenses in software-defined networks [J ] . IEEE/ACM Transactions on Networking , 2017 ,( 99 ): 1 - 17 .

GUDE N , KOPONEN T , PETTIT J , et al . NOX:towards an operating system for networks [J ] . ACM Sigcomm Computer Communication Review , 2008 , 38 ( 3 ): 105 - 110 .

Floodlight documentation [EB/OL ] . http://www.projectfloodlight.org/display/floodlightcon-troller/Floodlight+Documentation http://www.projectfloodlight.org/display/floodlightcon-troller/Floodlight+Documentation

CHEUNG S , FONG M , PORRAS P , et al . Securing the software-defined network control layer [C ] // Proceedings of the Network and Distributed System Security Symposium , 2015 .

FERGUSON A D , GUHA A , LIANG C , et al . Participatory networking:an API for application control of SDNs [C ] // ACM SIGCOMM . 2013 : 327 - 338 .

KOPONEN T , CASADO M , GUDE N , et al . Onix:a distributed control platform for large-scale production networks [C ] // Usenix Conference on Operating Systems Design and Implementation . 2010 : 351 - 364 .

MEDVED J , VARGA R , TKACIK A , et al . OpenDaylight:towards a model-driven SDN controller architecture [C ] // IEEE,International Symposium on a World of Wireless,Mobile and Multimedia Networks . IEEE , 2014 : 1 - 6 .

BERDE P , HART J , HART J , et al . ONOS:towards an open,distributed SDN OS [C ] // The Work-shop on Hot Topics in Software Defined Networking . ACM , 2014 : 1 - 6 .

Castro M , Liskov B . Practical byzantine fault tolerance and proactive recovery [J ] . ACM Transactions on Computer Systems , 2002 , 20 ( 4 ): 398 - 461 .

BOTELHO F , BESSANI A , RAMOS F M V , et al . On the design of practical fault-tolerant SDN controllers [C ] // . European Workshop on Software-Defined Networks , 2014 : 73 - 78 .

Li H , Li P , Guo S , et al . Byzantine-resilient secure software-defined networks with multiple controllers [J ] . IEEE Transactions on Cloud Computing , 2015 , 2 ( 4 ): 436 - 447 .

王禛鹏 , 扈红超 , 程国振 , 等 . 软件定义网络下的拟态防御实现架构 [J ] . 网络与信息安全学报 , 2017 , 3 ( 10 ): 52 - 61 .

WANG Z P , HU H C , CHENG G Z , et al . Implementation architecture of mimic security defense based on SDN [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 10 ): 52 - 61 .

KELLER E , et al . Timing-based reconnaissance and defense in software-defined networks [C ] // Conference on Computer Security Applications . ACM , 2016 : 89 - 100 .

Views

998

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Lightweight software-defined edge computing network topology discovery method

Research progress on moving target defense for SDN

Related Author

ZHOU Qizhao

SHI Zhongyu

Jinglei TAN

Hongqi ZHANG

Cheng LEI

Xiaohu LIU

Shuo WANG

Related Institution

College of Computer Science and Technology, Chengdu University of Information Technology

Chengdu Polytechnic

School of Cryptography Engineering,Information Engineering University

Henan Provincial Key Laboratory of Information Security

⁰