Verification on policies for network functions in SDN/NFV-based environment

Haoyu CHEN; Deqing ZOU; Hai JIN

doi:10.11959/j.issn.2096-109x.2021035

您当前的位置：

首页 >

文章列表页 >

Verification on policies for network functions in SDN/NFV-based environment

TopicⅡ: SDN and cloud computing security | 更新时间：2024-06-03

- Verification on policies for network functions in SDN/NFV-based environment
- Chinese Journal of Network and Information Security Vol. 7, Issue 3, Pages: 59-71(2021)
- 作者机构：
  
  1. 大数据技术与系统国家地方联合工程研究中心，华中科技大学计算机学院，湖北武汉 430074
  2. 服务计算技术与系统教育部重点实验室，华中科技大学计算机学院，湖北武汉 430074
  3. 集群与网格计算湖北省重点实验室，华中科技大学计算机学院，湖北武汉 430074
  4. 大数据安全湖北省工程研究中心，华中科技大学网络空间安全学院，湖北武汉 430074
- 作者简介：
- 基金信息：
- DOI：10.11959/j.issn.2096-109x.2021035
  CLC： TP393
- Online First：2021-06，
  
  Published：15 June 2021
- 稿件说明：
移动端阅览
Haoyu CHEN, Deqing ZOU, Hai JIN. Verification on policies for network functions in SDN/NFV-based environment[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 59-71.
DOI：

Haoyu CHEN, Deqing ZOU, Hai JIN. Verification on policies for network functions in SDN/NFV-based environment[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 59-71. DOI： 10.11959/j.issn.2096-109x.2021035.

摘要

SDN与NFV技术带来了网络管理的灵活性与便捷性，但SDN的动态转发策略可能导致网络功能策略失效，同时不同网络功能的策略可能互相影响，引起冲突问题。为了在基于SDN/NFV的云网络中对网络功能的策略进行验证，分析了网络功能与 SDN 设备之间、跨网络功能之间的策略冲突，建立了统一策略表达进行策略解析，设计策略验证方案、框架并进行原型实现，检验不同场景下的虚拟网络功能策略的正确性，并与现有策略冲突验证方案对比，用实验进行了有效性与性能分析。

Abstract

Although the newly introduced SDN and NFV technologies bring flexibility and convenience in network management

the dynamic forwarding policies introduced by SDN may cause invalidation in the network function policies

and the policies in different network functions may also cause conflicts due to their own behaviors.In order to verify the policies in SDN/NFV-based cloud network

the verification on policies between the network function and the SDN device

as well as across the network functions were considered.A unified policy expression for analysis was summarized

and policy verification scheme

framework and prototype implementation were proposed to verify the correctness of polices in different scenarios

then experiments were conducted to justify the effectiveness and performance

关键词

Keywords

references

MANAR J , TARANPREET S , ABDALLAH S , et al . Software defined networking:state of the art and research challenges [J ] . Computer Networks , 2014 , 72 : 74 - 98 .

Software-defined network [J ] .

RASHID M , JOAN S , JUAN-LUIS G , et al . Network function virtualization:state-of-the-art and research challenges [J ] . IEEE Communications Surveys ＆ Tutorials , 2016 , 18 ( 1 ): 236 - 262 .

饶少阳 , 陈运清 , 冯明 . 基于 SDN 的云数据中心网络 [J ] . 电信科学 , 2014 ( 8 ): 33 - 41 .

RAO S Y , CHEN Y Q , FENG M . cloud data center based on SDN [J ] . Telecommunications Science , 2014 ( 8 ): 33 - 41 .

安琪 , 刘艳萍 , 孙茜 , 等 . 基于SDN与NFV的网络切片架构 [J ] . 电信科学 , 2016 ( 11 ): 119 - 126 .

ANQ , LIU Y P , SUN Q , et al . Network slicing architecture based on SDN and NFV [J ] . Telecommunications Science . 2016 ( 11 ): 119 - 126 .

SDN ＆ NFV use cases defined [EB ] .

WANG Y , LI Z , XIE G , KAVE S . Enabling automatic composition and verification of service function chain [C ] // IEEE/ACM International Symposium on Quality of Service (IWQoS’17) . 2017 : 1 - 5 .

PANDA A , ARGYRAKI K , SAGIV M , et al . New directions for network verification [C ] // LIPIcs-Leibniz International Proceedings in Informatics , 2015 : 209 - 220

STOENESCU R , POPOVICI M , NEGREANU L , et al . Symnet:scalable symbolic execution for modern networks [C ] // Proceedings of the 2016 ACM SIGCOMM Conference (SIGCOMM’16) . 2016 : 314 - 327 .

HORN A , KHERADMAND A , PRASAD M R . Delta-net:real-time network verification using atoms [C ] // Proceedings of the 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI’17) . 2017 : 735 - 749

KHURSHID A , ZHOU W , CAESAR M , et al . Veriflow:verifying network-wide invariants in real time [C ] // Proceedings of the 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI’13) . 2013 : 15 - 27 .

SHERRY J , HASAN S , SCOTT C , et al . Making middleboxes someone else's problem:network processing as a cloud service [J ] . ACM SIGCOMM Computer Communication Review , 2012 , 42 ( 4 ): 13 - 24 .

PANDA A , LAHAV O , ARGYRAKI K , et al . Verifying isolation properties in the presence of middleboxes [J ] . arXiv preprint,2014,arXiv:1409 . 7687 .

HU H , AHN G J , KULKARNI K . Detecting and resolving firewall policy anomalies [J ] . IEEE Transactions on Dependable ＆ Secure Computing(TDSC’12) , 2012 , 9 ( 3 ): 318 - 331 .

DENG J , LI H . On the safety and efficiency of virtual firewall elasticity control [C ] // 24th Network and Distributed System Security Symposium (NDSS’17) . 2017 .

MALDONADO-LOPEZ F A , CALLE E , DONOSO Y . Detection and prevention of firewall-rule conflicts on software-defined networking [C ] // 7th IEEE international Workshop on Reliable Networks Design and Modeling (RNDM’15) . 2015 : 259 - 265 .

邱松 , 焦健 , 张东阳 . 面向防火墙和IDS/IPS协同防御的策略冲突检测算法 [J ] . 系统仿真学报 , 2015 , 27 ( 11 ): 2770 - 2777 .

QIU S , JIAO J , ZHANG D Y . Policy conflicts verification algorithm towards collaborative defense with firewalls and IDS/IPS [J ] . Journal of System Simulation , 2015 , 27 ( 11 ): 2770 - 2777 .

PANDA A , LAHAV O , ARGYRAKI K , et al . Verifying reachability in networks with mutable datapaths [C ] // Proceedings of the 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI’17) . 2017 : 699 - 718 .

WU W , ZHANG Y , BANERJEE S . Automatic synthesis of NF models by program analysis [C ] // ACM Workshop on Hot Topics in Networks (HotNets’16) . 2016 : 29 - 35 .

FAYAZ S K , YU T , TOBIOKA Y , CHAKI S , SEKAR V . BUZZ:testing context-dependent policies in stateful networks [C ] // 13th USENIX Conference on Networked Systems Design and Implementation (NSDI’16) . 2016 : 275 - 289 .

PRABHU S , CHOU K Y , KHERADMAND A , et al . Plankton:Scalable network configuration verification through model checking [C ] // Proceedings of the 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI’20) . 2020 : 953 - 967 .

YUAN Y , MOON S J , UPPAL S , et al . NetSMC:a custom symbolic model checker for stateful network verification [C ] // Proceedings of the 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI’20) . 2020 : 181 - 200 .

Views

419

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Design and analysis of intelligent service chain system for network security resource pool

Network function heterogeneous redundancy deployment method based on immune algorithm

Large-scale resource state monitoring strategy in network function virtualization environment

New collaborative DDoS defense technology based on NFV

Related Author

Zenan WANG

Jiahao LI

Chaohong TAN

Dechang PI

Qingqing ZHANG

Hongbo TANG

Wei YOU

Yingle LI

Related Institution

Purple Mountain Laboratories

Nanjing University of Aeronautics and Astronautics

Jiangsu Future Networks Innovation Institute

School of Mathematics and Computer Science,Fujian Normal University

Fujian Provincial Key Laboratory of Network Security and Cryptology,Fujian Nomal University

⁰