基于SDN的云安全应用研究综述

施江勇; 杨岳湘; 李文华; 王森

doi:10.11959/j.issn.2096-109x.2017.00165

您当前的位置：

首页 >

文章列表页 >

基于SDN的云安全应用研究综述

综述 | 更新时间：2024-06-03

- 基于SDN的云安全应用研究综述
- Research on SDN-based cloud security application
- 网络与信息安全学报 2017年3卷第5期页码：10-25
- 作者机构：
- 作者简介：
  
  [ "施江勇（1990-），男，湖南岳阳人，国防科技大学博士生，主要研究方向为虚拟化和SDN安全。" ]
  [ "杨岳湘（1965-），男，湖南岳阳人，国防科技大学研究员、博士生导师，主要研究方向为网络安全、云安全和移动安全。" ]
  [ "李文华（1983-），男，河南周口人，国防科技大学工程师，主要研究方向为云计算和数据中心管理。" ]
  [ "王森（1995-），男，陕西咸阳人，国防科技大学本科生，主要研究方向为信息化建模与处理。" ]
- 基金信息：
  
  国家自然科学基金资助项目;The National Natural Science Foundation of China(61170286)
- DOI：10.11959/j.issn.2096-109x.2017.00165
  中图分类号： TP393
- 网络首发：2017-05，
  
  纸质出版：2017-05-15
- 稿件说明：
移动端阅览
施江勇, 杨岳湘, 李文华, 等. 基于SDN的云安全应用研究综述[J]. 网络与信息安全学报, 2017,3(5):10-25.

Jiang-yong SHI, Yue-xiang YANG, Wen-hua LI, et al. Research on SDN-based cloud security application[J]. Chinese Journal of Network and Information Security, 2017, 3(5): 10-25.
施江勇, 杨岳湘, 李文华, 等. 基于SDN的云安全应用研究综述[J]. 网络与信息安全学报, 2017,3(5):10-25. DOI： 10.11959/j.issn.2096-109x.2017.00165.

Jiang-yong SHI, Yue-xiang YANG, Wen-hua LI, et al. Research on SDN-based cloud security application[J]. Chinese Journal of Network and Information Security, 2017, 3(5): 10-25. DOI： 10.11959/j.issn.2096-109x.2017.00165.

摘要

软件定义网络（SDN，software defined network）技术将传统网络的控制层和数据层进行解耦合，使网络具有可编程性，极大地方便了网络应用的开发。对基于 SDN 的云安全应用进行了全方位的分析，在分类的基础上，对每一类安全应用顺着其发展脉络分析了相关工作的优缺点，并进行了总结。另外，针对当前云安全服务模型不够完善、不能跟计算和网络服务有机整合的问题，提出了一种基于 SDN 的云安全服务模型SDCSec。最后，对基于SDN的云安全应用的未来发展方向做了展望。

Abstract

SDN decoupled the control plane and data plane of traditional network

making the network programmable and simplifying the development of network applications.A comprehensive survey was made to current studies on SDN-based cloud security applications.Based on classification of the applications

the advantages and disadvantages of each application were studied and each category was summarized.What’s more

a service model of cloud security based on SDN was proposed

to overcome the inefficient of current works and integrate security with network service.Lastly

some suggestions about the future development of SDN-based cloud security applications were made.

关键词

Keywords

references

MCKEOWN N , ANDERSON T , BALAKRISHNAN H , et al . OpenFlow:enabling innovation in campus networks [J ] . ACM SIGCOMM Computer Communication Review , 2008 , 38 ( 2 ): 69 - 74 .

KOERNER M , KAO O . Oftables:a distributed packet fil-ter [C ] // 2014 6th International Conference on Communication Systems and Networks (COMSNETS) . 2014 .

JIA X , WANG J K H . Distributed firewall for P2P network in data center [C ] // ICCE-China Workshop (ICCE-China),IEEE . 2013 : 15 - 19 .

SUH M , PARK S H , LEE B , et al . Building firewall over the software-defined network controller [C ] // The 16th International Con-ference on Advanced Communication Technology,IEEE . 2014 : 744 - 748 .

PORRAS P , SHIN S , YEGNESWARAN V , et al . A security enforcement kernel for OpenFlow networks [C ] // The First Workshop on Hot Topics in Software Defined Networks,ACM . 2012 : 121 - 126 .

HU H , HAN W , AHN G J , et al . FlowGuard:building robust firewalls for software-defined networks [C ] // The Third Workshop on Hot Topics in Software Defined Networking . 2014 : 97 - 102 .

王鹃 , 王江 , 焦虹阳 , 等 . 一种基于OpenFlow的SDN访问控制策略实时冲突检测与解决方法 [J ] . 计算机学报 , 2015 , 38 ( 4 ): 872 - 883 .

WANG J , WANG J , JIAO H Y , et al . A method of openflow-based real-time conflict detection and resolution for SDN access control policies [J ] . Chinese Journal of Computers , 2015 , 38 ( 4 ): 872 - 883 .

BRAGA R , MOTA E , PASSITO A . Lightweight DDoS flooding attack detection using NOX/OpenFlow [C ] // 2010 IEEE 35th Conference on Local Computer Networks (LCN) . 2010 : 408 - 415 .

KRISHNAN R , KRISHNASWAMY D , MCDYSAN D . Behavioral security threat detection strategies for data center switches and routers [C ] // 2014 IEEE 34th International Conference on Distributed Computing Systems Workshops (ICDCSW) . 2014 : 82 - 87 .

MOUSAVI S M , ST-HILAIRE M . Early detection of DDoS attacks against SDN controllers [C ] // 2015 International Conference on Computing,Networking and Communications (ICNC) . 2015 : 77 - 81 .

WANG B , ZHENG Y , LOU W , et al . DDoS attack protection in the era of cloud computing and software-defined networking [J ] . Computer Networks , 2015 , 81 : 308 - 319 .

WANG H , XU L , GU G . FloodGuard:a DoS attack prevention extension in software-defined networks [C ] // 2015 45th Annual IEEE/IFIP International Conference on Dependable Systems and Networks . 2015 : 239 - 250 .

FAYAZ S K , TOBIOKA Y , SEKAR V , et al . Bohatei:flexible and elastic DDoS defense [C ] // 24th Usenix Security Symposium (USENIX Security 15) . 2015 : 817 - 832 .

CHUNG C J , KHATKAR P , XING T , et al . NICE:network intrusion detection and countermeasure selection in virtual network systems [J ] . IEEE Transactions on Dependable and Secure Computing , 2013 , 10 ( 4 ): 198 - 211 .

XING T , HUANG D , XU L , et al . Snortflow:a OpenFlow-based intrusion prevention system in cloud environment [C ] // 2013 Second GENI Research and Educational Experiment Workshop (GREE) . 2013 : 89 - 92 .

XING T , XIONG Z , HUANG D , et al . SDNIPS:enabling soft-ware-defined networking based intrusion prevention system in clouds [C ] // The 10th International Conference on Network and Service Management (CNSM) and Workshop . 2014 : 308 - 311 .

YOON C , PARK T , LEE S , et al . Enabling security functions with SDN:a feasibility study [J ] . Computer Networks , 2015 , 85 : 19 - 35 .

JEONG C , HA T , NARANTUYA J , et al . Scalable network intrusion detection on virtual SDN environment [C ] // 2014 IEEE 3rd International Conference on Cloud Networking (CloudNet) . 2014 : 264 - 265 .

HA T , YOON S , RISDIANTO A C , et al . Suspicious flow for warding for multiple intrusion detection systems on software-defined networks [J ] . IEEE Network , 2016 , 30 ( 6 ): 22 - 27 .

HA T , KIM S , AN N , et al . Suspicious traffic sampling for intrusion detection in software-defined networks [J ] . Computer Networks , 2016 .

崔竞松 , 郭迟 , 陈龙 , 等 . 创建软件定义网络中的进程级纵深防御体系结构 [J ] . 软件学报 , 2014 , 25 ( 10 ): 2251 - 2265 .

CUI J S , GUO C , CHEN L , et al . Establishing process-level defense-in-depth framework for software defined networks [J ] . Journal of Software , 2014 , 25 ( 10 ): 2251 - 2265 .

SHIN Y , SON K , PARK H . SDN-based security in virtualized environments for cloud computing [J ] . Life Science Journal , 2014 , 11 ( 7 ): 642 - 647 .

MEHDI S A , KHALID J , KHAYAM S A . Revisiting traffic ano maly detection using software defined networking [C ] // The International Workshop on Recent Advances in Intrusion Detection . 2011 : 161 - 180 .

GIOTIS K , ARGYROPOULOS C , ANDROULIDAKIS G , et al . Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environ-ments [J ] . Computer Networks , 2014 , 62 : 122 - 136 .

JASINSKA E , . sFlow-I can feel your traffic [C ] // 23C3:23rd Chaos Communication Congress . 2006 .

GIOTIS K , ANDROULIDAKIS G , MAGLARIS V . Leveraging SDN for efficient anomaly detection and mitigation on legacy networks [C ] // 2014 Third European Workshop on Software Defined Networks . 2014 : 85 - 90 .

左青云 , 陈鸣 , 王秀磊 , 等 . 一种基于SDN的在线流量异常检测方法 [J ] . 西安电子科技大学学报 , 2015 , 42 ( 1 ): 155 - 160 .

ZUO Q , CHEN M , WANG X L , et al . Online traffic anomaly detection method for SDN [J ] . Journal of Xidian University , 2015 , 42 ( 1 ): 155 - 160 .

ZHANG Y , . An adaptive flow counting method for anomaly detection in SDN [C ] // The 9th ACM Conference on Emerging Networking Experiments and Technologies . 2013 : 25 - 30 .

GARG G , GARG R . Security of networks using efficient adaptive flow counting for anomaly detection in SDN [M ] . Artificial Intelligence and Evolutionary Computations in Engineering Systems . 2016 : 667 - 674 .

SHIN S , GU G . CloudWatcher:network security monitoring using OpenFlow in dynamic cloud networks (or:how to provide security monitoring as a service in clouds?) [C ] // 2012 20th IEEE International Conference on Network Protocols (ICNP) . 2012 : 1 - 6 .

SHIN S , WANG H , GU G . A first step toward network security virtualization:from concept to prototype [J ] . IEEE Transactions on Information Forensics and Security , 2015 , 10 ( 10 ): 2236 - 2249 .

ZHANG Y , SINGH V , WANG Y , et al . FlowSense:light-weight networking sensing with OpenFlow:U.S.Patent 8,918,502 [P ] . 2015 - 12 - 23

CHOWDHURY S R , BARI M F , AHMED R , et al . Payless:a low cost network monitoring framework for software defined net-works [C ] // 2014 IEEE Network Operations and Management Symposium (NOMS) . 2014 : 1 - 9 .

ZAALOUK A , KHONDOKER R , MARX R , et al . Orchsec:an orchestrator-based architecture for enhancing network-security using network monitoring and SDN control functions [C ] // 2014 IEEE Network Operations and Management Symposium (NOMS) . 2014 : 1 - 9 .

TOOTOONCHIAN A , GHOBADI M , GANJALI Y . OpenTM:traffic matrix estimator for OpenFlow networks [C ] // The International Conference on Passive and Active Network Measurement . 2010 : 201 - 210 .

VAN-ADRICHEM N L M , DOERR C , KUIPERS F A . Opennetmon:network monitoring in OpenFlow software-defined networks [C ] // 2014 IEEE Network Operations and Management Symposium (NOMS) . 2014 : 1 - 8 .

PHEMIUS K , BOUET M . Monitoring latency with Open-Flow [C ] // The 9th International Conference on Network and Service Management (CNSM 2013) . 2013 : 122 - 125 .

KEKELY L , KUČERA J , PUŠ V , et al . Software defined monitoring of application protocols [J ] . IEEE Transactions on Computers , 2016 , 65 ( 2 ): 615 - 626 .

KAPOOR R D , CALABRESE A D , DUBEY R K , et al . Sample netflow for network traffic data collection:U.S.Patent 7,193,968 [P ] . 2007 - 3 - 20

HAN W , ZHAO Z,DOUPÉ A , et al . HoneyMix:toward SDNbased Intelligent Honeynet [C ] // The 2016 ACM International Workshop on Security in Software Defined Networks ＆Network Function Virtualization . 2016 : 1 - 6 .

JAFARIAN J H,AL-SHAER E , DUAN Q . OpenFlow random host mutation:transparent moving target defense using software defined networking [C ] // The First Workshop on Hot Topics in Software Defined Networks . 2012 : 127 - 132 .

CABAJ K , MAZURCZYK W . Using software-defined networking for ransom ware mitigation:the case of cryptoWall [J ] . arXiv preprint arXiv:1608.06673 , 2016

MCBRIDE M , COHN M , DESHPANDE S , et al . SDN security considerations in the data center [J ] . Open Networking Foundation ONF Solution Brief , 2013

SHERWOOD R , GIBB G , YAP K K , et al . Flowvisor:a network virtualization layer [J ] . OpenFlow Switch Consortium , 2009 : 1 - 13 .

AL-SHABIBI A , DE-LEENHEER M , GEROLA M , et al . Open-VirteX:make your virtual SDNs programmable [C ] // The 3rd Workshop on Hot Topics in Software Defined Networking . 2014 : 25 - 30 .

SHIN S , PORRAS P A , YEGNESWARAN V , et al . FRESCO:modular composable security services for software-defined networks [C ] // NDSS . 2013 .

FOSTER N , GUHA A , REITBLATT M , et al . Languages for software-defined networks [J ] . IEEE Communications Magazine , 2013 , 51 ( 2 ): 128 - 134 .

REICH J , MONSANTO C , FOSTER N , et al . Modular sdn programming with pyretic [J ] . Technical Reprot of USENIX , 2013 .

MONSANTO C , FOSTER N , HARRISON R , et al . A compiler and run-time system for network programming languages [C ] // ACM SIGPLAN Notices . 2012 : 217 - 230 .

HINRICHS T L , GUDE N S , CASADO M , et al . Practical declarative network management [C ] // The 1st ACM Workshop on Research on Enterprise Networking . 2009 : 1 - 10 .

VOELLMY A , HUDAK P . Nettle:Taking the sting out of pro-gramming network routers [C ] // The International Symposium on Practical Aspects of Declarative Languages . 2011 : 235 - 249 .

VOELLMY A , KIM H , FEAMSTER N . Procera:a language for high-level reactive network control [C ] // The first Workshop on Hot Topics in Software Defined Networks . 2012 : 43 - 48 .

SHIRALI-SHAHREZA S , GANJALI Y . FleXam:flexible sampling extension for monitoring and security applications in Open-Flow [C ] // The second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking . 2013 : 167 - 168 .

WETTE P , KARL H . Which flows are hiding behind my wildcard rule? adding packet sampling to OpenFlow [J ] . ACM SIGCOMM Computer Communication Review , 2013 , 43 ( 4 ): 541 - 542 .

SUH J , KWON T T , DIXON C , et al . OpenSample:a low-latency,sampling-based measurement platform for commodity SDN [C ] // 2014 IEEE 34th International Conference on Distributed Computing Systems (ICDCS) . 2014 : 228 - 237 .

TAESANG C , . Adaptive flow monitoring [C ] // Open Networking Summit . 2016 .

AFEK Y,BREMLER-BARR A , LANDAU F S , et al . Sampling and large flow detection in SDN [C ] // ACM SIGCOMM Computer Communication Review . 2015 : 345 - 346 .

HUSSAIN M , ABDULSALAM H . SECaaS:security as a service for cloud-based applications [C ] // The Second Kuwait Conference on e-Services and e-Systems . 2011 :8.

AL-AYYOUB M , JARARWEH Y , BENKHELIFA E , et al . SDSecurity:a software defined security experimental frame-work [C ] // 2015 IEEE International Conference on Communication Workshop (ICCW) . 2015 : 1871 - 1876 .

AHMAD I , NAMAL S , YLIANTTILA M , et al . Security in software defined networks:a survey [J ] . IEEE Communications Surveys ＆Tutorials , 2015 , 17 ( 4 ): 2317 - 2346 .

王蒙蒙 , 刘建伟 , 陈杰 , 等 . 软件定义网络:安全模型、机制及研究进展 [J ] . 软件学报 , 2016 , 27 ( 4 ): 969 - 992 .

WANG M M , LIU J W , CHEN J , et al . Software defined networking:security model,threats and mechanism [J ] . Journal of Software , 2016 , 27 ( 4 ): 969 - 992 .

COUGHLIN M . A survey of SDN security research [J ] . University of Colorado Boulder , 2014 .

FRANÇOIS J , DOLBERG L , FESTOR O , et al . Network security through software defined networking:a survey [C ] // The Conference on Principles,Systems and Applications of IP Telecommunications . 2014 :6.

SHIN S , XU L , HONG S , et al . Enhancing network security through software defined networking (SDN) [C ] // 2016 25th International Conference on Computer Communication and Networks (ICCCN) . 2016 : 1 - 9 .

浏览量

4705

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

云计算多授权中心CP-ABE代理重加密方案

容器云中基于信号博弈的容器迁移与蜜罐部署策略

基于FANP的云用户行为信任评估优化机制

基于API调用管理的SDN应用层DDoS攻击防御机制

容器云中基于Stackelberg博弈的动态异构调度方法