异构容错控制平面的安全性分析

吴奇; 陈鸿昶; 陈福才

doi:10.11959/j.issn.2096-109x.2018095

您当前的位置：

首页 >

文章列表页 >

异构容错控制平面的安全性分析

论文 | 更新时间：2024-06-03

- 异构容错控制平面的安全性分析
- Security analysis in heterogeneous fault-tolerant control plane
- 网络与信息安全学报 2018年4卷第11期页码：32-39
- 作者机构：
- 作者简介：
  
  [ "吴奇（1991-），男，江苏徐州人，国家数字交换系统工程技术研究中心博士生，主要研究方向为网络安全。" ]
  [ "陈鸿昶（1964-），男，河南郑州人，国家数字交换系统工程技术研究中心研究员、博士生导师，主要研究方向为网络安全方向、大数据。" ]
  [ "陈福才（1974-），男，江西高安人，国家数字交换系统工程技术研究中心研究员、硕士生导师，主要研究方向为网络安全方向、大数据。" ]
- 基金信息：
  
  国家重点研发计划项目;The National Key R＆D Program of China(2016YFB0800101);国家自然科学基金创新研究群体基金资助项目;The Foundation for Innovative Research Groups of the National Natural Science Foundation of China(61521003)
- DOI：10.11959/j.issn.2096-109x.2018095
  中图分类号： TP393
- 网络首发：2018-11，
  
  纸质出版：2018-11-15
- 稿件说明：
移动端阅览
吴奇, 陈鸿昶, 陈福才. 异构容错控制平面的安全性分析[J]. 网络与信息安全学报, 2018,4(11):32-39.

Qi WU, Hongchang CHEN, Fucai CHEN. Security analysis in heterogeneous fault-tolerant control plane[J]. Chinese Journal of Network and Information Security, 2018, 4(11): 32-39.
吴奇, 陈鸿昶, 陈福才. 异构容错控制平面的安全性分析[J]. 网络与信息安全学报, 2018,4(11):32-39. DOI： 10.11959/j.issn.2096-109x.2018095.

Qi WU, Hongchang CHEN, Fucai CHEN. Security analysis in heterogeneous fault-tolerant control plane[J]. Chinese Journal of Network and Information Security, 2018, 4(11): 32-39. DOI： 10.11959/j.issn.2096-109x.2018095.

摘要

随着软件定义网络的大规模应用，软件定义网络的安全性显得愈发重要。基于异构思想的容错控制平面作为一种重要的防御思路，近年来越来越引起研究者的注意。但是现有容错控制平面的研究中忽视了异构原件中的同构漏洞问题，这大大降低了容错控制架构对软件定义网络的安全收益。从异构原件中的同构漏洞出发，首先分析了同构漏洞对控制平面的安全影响，然后以此为基础对容错控制平面的容忍能力进行量化，构造出一个最大化容忍能力的控制平面布局方法。实验仿真证明了所提方法可以有效降低控制平面的故障概率，攻击者在对基于所提方法构造的控制平面进行攻击时，需要花费更多的攻击成本才可以瘫痪控制平面。

Abstract

With the large-scale application of software-defined networks

the security of software-defined networks becomes more and more important.As an important defense idea

the fault-tolerant control plane based on heterogeneity has attracted more and more researchers' attention in recent years.However

the existing researches ignore the problem of common vulnerability in heterogeneous variants

which greatly reduces the security benefits of the fault-tolerant control architecture for software-defined networks.Addressing this problem

the common vulnerability was taken in heterogeneous variants into considerations.First

the tolerance capability of the fault-tolerant control plane was quantified.Then a control plane deployment method was constructed which was able to maximize the tolerance capability.The simulations show that the proposed method can effectively reduce the failure probability of the control plane.When the attackers attack the control plane constructed based on the proposed method

they pay more attack cost to compromise the control plane.

关键词

Keywords

references

SCOTT-HAYWARD S , NATARAJAN S , SEZER S . A survey of security in software defined networks [J ] . IEEE Communications Surveys ＆ Tutorials , 2016 , 18 ( 1 ): 623 - 654 .

PORRAS P , SHIN S , YEGNESWARAN V , et al . A security enforcement kernel for OpenFlow networks [C ] // International Workshop on Hot Topics in Software Defined Networks . ACM , 2012 : 121 - 126 .

SHIN S , SONG Y , LEE T , et al . Rosemary:a robust,secure,and high-performance network operating system [C ] // Conference on Computer and Communications Security . ACM , 2014 : 78 - 89 .

YEGANEH S H , GANJALI Y . Kandoo:a framework for efficient and scalable offloading of control applications [C ] // The Workshop on Hot Topics in Software Defined Networks . ACM , 2012 : 19 - 24 .

JIN X , GOSSELS J , Rexford J , et al . CoVisor:a compositional hypervisor for software-defined networks [C ] // Usenix Conference on Networked Systems Design and Implementation . USENIX Association , 2015 : 87 - 101 .

LENG J , ZHOU Y , ZHANG J , et al . An inference attack model for flow table capacity and usage:exploiting the vulnerability of flow table overflow in software-defined network [J ] . Water Air ＆ Soil Pollution , 2015 , 85 ( 3 ): 1413 - 1418 .

卢振平 , 陈福才 , 程国振 . 软件定义网络中控制器调度时间机制设计与实现 [J ] . 网络与信息安全学报 , 2018 ( 1 ): 36 - 44 .

LU Z P , CHEN F C , CHENG G Z . Design and implementation of the controller scheduling-time in SDN [J ] . Chinese Journal of Network and Information Security , 2018 ( 1 ): 36 - 44 .

[EB/OL ] . http://cve.mitre.org/ http://cve.mitre.org/

YOON C , LEE S , KANG H , et al . Flow wars:systemizing the attack surface and defenses in software-defined networks [J ] . IEEE/ACM Transactions on Networking , 2017 ,( 99 ): 1 - 17 .

GUDE N , KOPONEN T , PETTIT J , et al . NOX:towards an operating system for networks [J ] . ACM Sigcomm Computer Communication Review , 2008 , 38 ( 3 ): 105 - 110 .

Floodlight documentation [EB/OL ] . http://www.projectfloodlight.org/display/floodlightcon-troller/Floodlight+Documentation http://www.projectfloodlight.org/display/floodlightcon-troller/Floodlight+Documentation

CHEUNG S , FONG M , PORRAS P , et al . Securing the software-defined network control layer [C ] // Proceedings of the Network and Distributed System Security Symposium , 2015 .

FERGUSON A D , GUHA A , LIANG C , et al . Participatory networking:an API for application control of SDNs [C ] // ACM SIGCOMM . 2013 : 327 - 338 .

KOPONEN T , CASADO M , GUDE N , et al . Onix:a distributed control platform for large-scale production networks [C ] // Usenix Conference on Operating Systems Design and Implementation . 2010 : 351 - 364 .

MEDVED J , VARGA R , TKACIK A , et al . OpenDaylight:towards a model-driven SDN controller architecture [C ] // IEEE,International Symposium on a World of Wireless,Mobile and Multimedia Networks . IEEE , 2014 : 1 - 6 .

BERDE P , HART J , HART J , et al . ONOS:towards an open,distributed SDN OS [C ] // The Work-shop on Hot Topics in Software Defined Networking . ACM , 2014 : 1 - 6 .

Castro M , Liskov B . Practical byzantine fault tolerance and proactive recovery [J ] . ACM Transactions on Computer Systems , 2002 , 20 ( 4 ): 398 - 461 .

BOTELHO F , BESSANI A , RAMOS F M V , et al . On the design of practical fault-tolerant SDN controllers [C ] // . European Workshop on Software-Defined Networks , 2014 : 73 - 78 .

Li H , Li P , Guo S , et al . Byzantine-resilient secure software-defined networks with multiple controllers [J ] . IEEE Transactions on Cloud Computing , 2015 , 2 ( 4 ): 436 - 447 .

王禛鹏 , 扈红超 , 程国振 , 等 . 软件定义网络下的拟态防御实现架构 [J ] . 网络与信息安全学报 , 2017 , 3 ( 10 ): 52 - 61 .

WANG Z P , HU H C , CHENG G Z , et al . Implementation architecture of mimic security defense based on SDN [J ] . Chinese Journal of Network and Information Security , 2017 , 3 ( 10 ): 52 - 61 .

KELLER E , et al . Timing-based reconnaissance and defense in software-defined networks [C ] // Conference on Computer Security Applications . ACM , 2016 : 89 - 100 .

浏览量

998

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

轻量级软件定义边缘计算网络拓扑发现方法

面向SDN的移动目标防御技术研究进展