Flow consistency in an intensive SDN security architecture with multiple controllers

LVYing-ying; GUOYun-fei; QIChao; WUQi; WANGYa-wen

doi:10.11959/j.issn.2096-109x.2017.00223

您当前的位置：

首页 >

文章列表页 >

Flow consistency in an intensive SDN security architecture with multiple controllers

学术论文 | 更新时间：2024-06-03

- Flow consistency in an intensive SDN security architecture with multiple controllers
- Flow consistency in an intensive SDN security architecture with multiple controllers
- 网络与信息安全学报 2017年3卷第12期页码：62-78
- 作者机构：
- 作者简介：
  
  [ "LV Yingying (1993-),born in Jiangxi. He is working on his master degree at National Digital Switching System Engineering Technology Research Center. His research interests include cyber security and software-defined" ]
  [ "GUO Yunfei(1963-),born in Henan. He is a Ph.D supervisor and professor at National Digital Switching System Engineering Technology Research Center. His main research interests include cloud security,telecommunication network security and cyber security." ]
  [ "QI Chao(1991-),born in Jiangxi.He is working on his Ph.D degree at National Digital Switching System Engineering Technology Research Center. His research interests include cyber security and software-defined network." ]
  [ "WU Qi (1991-),born in Jiangsu. He is working on his Ph.D degree at National Digital Switching System Engineering Technology Research Center. His research interests include cyber security and software-defined network." ]
  [ "WANG Yawen (1990-),born in Henan. He is working on his Ph.D degree at National Digital Switching System Engineering Technology Research Center. His research interests include cloud computing and cyber security." ]
- 基金信息：
  
  国家自然科学基金创新研究群体基金资助项目;The Foundation for Innovative Research Groups of the National Natural Science Foundation of China(61521003);国家自然科学基金资助项目;The National Science Foundation for Distinguished Young Scholars of China(61602509);国家重点研发计划项目;The National Key R＆D Program of China(2016YFB0800100);国家重点研发计划项目;The National Key R＆D Program of China(2016YFB0800101);河南省科技攻关计划项目;The Science and Technology Research Project of Henan Province(172102210615)
- DOI：10.11959/j.issn.2096-109x.2017.00223
  中图分类号：
- 网络首发：2017-12，
  
  纸质出版：2017-12-15
- 稿件说明：
移动端阅览
LVYing-ying, GUOYun-fei, QIChao, 等. Flow consistency in an intensive SDN security architecture with multiple controllers[J]. 网络与信息安全学报, 2017,3(12):62-78.

Ying-ying LV, Yun-fei GUO, Chao QI, et al. Flow consistency in an intensive SDN security architecture with multiple controllers[J]. Chinese Journal of Network and Information Security, 2017, 3(12): 62-78.
LVYing-ying, GUOYun-fei, QIChao, 等. Flow consistency in an intensive SDN security architecture with multiple controllers[J]. 网络与信息安全学报, 2017,3(12):62-78. DOI： 10.11959/j.issn.2096-109x.2017.00223.

Ying-ying LV, Yun-fei GUO, Chao QI, et al. Flow consistency in an intensive SDN security architecture with multiple controllers[J]. Chinese Journal of Network and Information Security, 2017, 3(12): 62-78. DOI： 10.11959/j.issn.2096-109x.2017.00223.

摘要

Abstract

As critical components in SDN

controllers are prone to suffer from a series of potential attacks which result in system crashes.To prevent the compromise caused by single failure of controller or flow-tampering attacks

Mcad-SA

an aware decision-making security architecture with multiple controllers was proposed

which coordinates heterogeneous controllers internally as an“associated”controller.This architecture extends existing control plane and takes advantage of various controllers’merits to improve the difficulty and cost of probes and attacks from attackers.In this framework

flow rules distributed to switches are no longer relying on a single controller but according to the vote results from the majority of controllers

which significantly enhances the reliability of flow rules.As to the vote process of flow rules

segmentation and grading is adopted to pick up the most trustful one from multiple flow rules and implement flow consistency.This mechanism avoids comparison between rules via bit by bit which is impractical among several controllers.Theory analysis and simulation results demonstrates the effectiveness

availability and resilience of the proposed methods and their better security gain over general SDN architectures.

关键词

Keywords

references

MCKEOWN N , ANDERSON T , BALAKRISHNAN H , et al . OpenFlow:enabling innovation in campus networks [J ] . ACM Sigcomm Computer Communication Review , 2008 , 38 ( 2 ): 69 - 74 .

MONSANTO C , REICH J , FOSTER N , et al . Composing software-defined networks [C ] // The 10th USENIX Conference on Networked Systems Design and Implementation,USENIX Association . 2013 : 1 - 14 .

KREUTZ D , RAMOS F M V , VERISSIMO P . Towards secure and dependable software-defined networks [C ] // The Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking . 2013 : 55 - 60 .

CABAJ K,WYTRĘBOWICZ J,KUKLIŃSKI S , et al . SDN architecture impact on network security [C ] // Federated Conference on Computer Science and Information Systems . 2014 .

SCOTT-HAYWARD S , NATARAJAN S , SEZER S . A survey of security in software defined networks [J ] . IEEE Communications Surveys＆Tutorials , 2015 , 18 ( 1 ): 623 - 654 .

PORRAS P , SHIN S , YEGNESWARAN V , et al . A security enforcement kernel for OpenFlow networks [C ] //2012:121-126.　　　　　　　 2012 : 121 - 126 .

PORRAS P , CHEUNG S , FONG M , et al . Securing the Software-Defined Network Control Layer [C ] // The 2015 Network and Distributed System Security Symposium (NDSS),San Diego,California . 2015 .

JAIN S , KUMAR A , MANDAL S , et al . B4:experience with a globally-deployed software defined wan [C ] // ACM SIGCOMM 2013 Conference on SIGCOMM . 2013 : 3 - 14 .

BERDE P , HART J , HART J , et al . ONOS:towards an open,distributed SDN OS [C ] // The Workshop on Hot Topics in Software Defined NETWORKING . 2010 : 1 - 6 .

ELDEFRAWY K , KACZMAREK T . Byzantine fault tolerant software-defined networking (SDN) controllers [C ] // Computer Software and Applications Conference . 2016 : 208 - 213 .

CELLO M , XU Y , WALID A , et al . BalCon:a distributed elastic SDN control via efficient switch migration [C ] // IEEE International Conference on Cloud Engineering . 2017 .

GUO Z , XU Y , CELLO M , et al . JumpFlow:reducing flow table usage in software-defined networks [J ] . Computer Networks , 2015 ,( 92 ): 300 - 315 .

MCGEER R , . A safe,efficient update protocol for openflow networks [C ] // The Workshop on Hot Topics in Software Defined Networks . 2012 : 61 - 66 .

SUKAPURAM R , BARUA G . Enhanced algorithms for consistent network updates [C ] // Network Function Virtualization and Software Defined Network . 2016 : 184 - 190 .

HUSSEIN A , ELHAJJ I H , CHEHAB A , et al . SDN verification plane for consistency establishment [C ] // Computers and Communication . IEEE , 2016 : 519 - 524 .

HUA J , GE X , ZHONG S . FOUM:a flow-ordered consistent update mechanism for software-defined networking in adversarial settings [C ] // The International Conference on Computer Communications . 2016 : 1 - 9 .

Reitblatt M , Foster N , Rexford J , et al . Consistent updates for software-defined networks:change you can believe in! [C ] // ACM Workshop on Hot Topics in Networks . 2011 :7.

Ryu SDN Framework [EB/OL ] . http://osrg.github.io/ryu/ http://osrg.github.io/ryu/ .

FloodLight.“Open SDN controller” [EB/OL ] . http://floodlight.openflowhub.org/ http://floodlight.openflowhub.org/ .

QI C , WU J , HU H , et al . Dynamic-scheduling mechanism of controllers based on security policy in software-defined network [J ] . Electronics Letters , 2016 , 52 ( 23 ): 1918 - 1920 .

QI C , WU J , HU H , et al . An intensive security architecture with multi-controller for SDN [C ] // Computer Communications Workshops . 2016 : 401 - 402 .

OpenDaylightConsortium [EB/OL ] . http://www.opendaylight.org http://www.opendaylight.org .

LANTZ B , HELLER B , MCKEOWN N . A network in a laptop:rapid prototyping for software-defined networks [C ] // ACM Workshop on Hot Topics in Networks . 2010 : 1 - 6 .

MACHAT R , BANKS S , CALABRIA F , et al ． ISSU benchmarking methocldogy [DB/OL ] . http://tools.ietf.org/html/draft-banks-bmwgissu-meth-05. http://tools.ietf.org/html/draft-banks-bmwgissu-meth-05. .

浏览量

2906

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据