面向SDN/NFV环境的网络功能策略验证

陈浩宇; 邹德清; 金海

doi:10.11959/j.issn.2096-109x.2021035

您当前的位置：

首页 >

文章列表页 >

面向SDN/NFV环境的网络功能策略验证

专栏Ⅱ：SDN与云计算安全 | 更新时间：2024-06-03

- 面向SDN/NFV环境的网络功能策略验证
- Verification on policies for network functions in SDN/NFV-based environment
- 网络与信息安全学报 2021年7卷第3期页码：59-71
- 作者机构：
  
  1. 大数据技术与系统国家地方联合工程研究中心，华中科技大学计算机学院，湖北武汉 430074
  2. 服务计算技术与系统教育部重点实验室，华中科技大学计算机学院，湖北武汉 430074
  3. 集群与网格计算湖北省重点实验室，华中科技大学计算机学院，湖北武汉 430074
  4. 大数据安全湖北省工程研究中心，华中科技大学网络空间安全学院，湖北武汉 430074
- 作者简介：
  
  [ "陈浩宇（1992- ），男，江苏扬州人，华中科技大学博士生，主要研究方向为网络安全测试、网络模糊测试、软件定义网络、网络功能虚拟化、软件定义网络安全" ]
  [ "邹德清（1975- )，男，湖南长沙人，华中科技大学教授、博士生导师，主要研究方向为虚拟化安全与云安全、网络攻防与漏洞检测、大数据安全、容错计算" ]
  [ "金海（1966- ）男，上海人，华中科技大学教授、博士生导师，主要研究方向为计算机体系结构、虚拟化技术、集群计算与云计算、P2P 计算、网络存储以及网络安全" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2019YFB2101700);广州市未来产业关键技术研发专题项目;The Science and Technology Program of Guangzhou(201902020016)
- DOI：10.11959/j.issn.2096-109x.2021035
  中图分类号： TP393
- 网络首发：2021-06，
  
  纸质出版：2021-06-15
- 稿件说明：
移动端阅览
陈浩宇, 邹德清, 金海. 面向SDN/NFV环境的网络功能策略验证[J]. 网络与信息安全学报, 2021,7(3):59-71.

Haoyu CHEN, Deqing ZOU, Hai JIN. Verification on policies for network functions in SDN/NFV-based environment[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 59-71.
陈浩宇, 邹德清, 金海. 面向SDN/NFV环境的网络功能策略验证[J]. 网络与信息安全学报, 2021,7(3):59-71. DOI： 10.11959/j.issn.2096-109x.2021035.

Haoyu CHEN, Deqing ZOU, Hai JIN. Verification on policies for network functions in SDN/NFV-based environment[J]. Chinese Journal of Network and Information Security, 2021, 7(3): 59-71. DOI： 10.11959/j.issn.2096-109x.2021035.

摘要

SDN与NFV技术带来了网络管理的灵活性与便捷性，但SDN的动态转发策略可能导致网络功能策略失效，同时不同网络功能的策略可能互相影响，引起冲突问题。为了在基于SDN/NFV的云网络中对网络功能的策略进行验证，分析了网络功能与 SDN 设备之间、跨网络功能之间的策略冲突，建立了统一策略表达进行策略解析，设计策略验证方案、框架并进行原型实现，检验不同场景下的虚拟网络功能策略的正确性，并与现有策略冲突验证方案对比，用实验进行了有效性与性能分析。

Abstract

Although the newly introduced SDN and NFV technologies bring flexibility and convenience in network management

the dynamic forwarding policies introduced by SDN may cause invalidation in the network function policies

and the policies in different network functions may also cause conflicts due to their own behaviors.In order to verify the policies in SDN/NFV-based cloud network

the verification on policies between the network function and the SDN device

as well as across the network functions were considered.A unified policy expression for analysis was summarized

and policy verification scheme

framework and prototype implementation were proposed to verify the correctness of polices in different scenarios

then experiments were conducted to justify the effectiveness and performance

关键词

Keywords

references

MANAR J , TARANPREET S , ABDALLAH S , et al . Software defined networking:state of the art and research challenges [J ] . Computer Networks , 2014 , 72 : 74 - 98 .

Software-defined network [J ] .

RASHID M , JOAN S , JUAN-LUIS G , et al . Network function virtualization:state-of-the-art and research challenges [J ] . IEEE Communications Surveys ＆ Tutorials , 2016 , 18 ( 1 ): 236 - 262 .

饶少阳 , 陈运清 , 冯明 . 基于 SDN 的云数据中心网络 [J ] . 电信科学 , 2014 ( 8 ): 33 - 41 .

RAO S Y , CHEN Y Q , FENG M . cloud data center based on SDN [J ] . Telecommunications Science , 2014 ( 8 ): 33 - 41 .

安琪 , 刘艳萍 , 孙茜 , 等 . 基于SDN与NFV的网络切片架构 [J ] . 电信科学 , 2016 ( 11 ): 119 - 126 .

ANQ , LIU Y P , SUN Q , et al . Network slicing architecture based on SDN and NFV [J ] . Telecommunications Science . 2016 ( 11 ): 119 - 126 .

SDN ＆ NFV use cases defined [EB ] .

WANG Y , LI Z , XIE G , KAVE S . Enabling automatic composition and verification of service function chain [C ] // IEEE/ACM International Symposium on Quality of Service (IWQoS’17) . 2017 : 1 - 5 .

PANDA A , ARGYRAKI K , SAGIV M , et al . New directions for network verification [C ] // LIPIcs-Leibniz International Proceedings in Informatics , 2015 : 209 - 220

STOENESCU R , POPOVICI M , NEGREANU L , et al . Symnet:scalable symbolic execution for modern networks [C ] // Proceedings of the 2016 ACM SIGCOMM Conference (SIGCOMM’16) . 2016 : 314 - 327 .

HORN A , KHERADMAND A , PRASAD M R . Delta-net:real-time network verification using atoms [C ] // Proceedings of the 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI’17) . 2017 : 735 - 749

KHURSHID A , ZHOU W , CAESAR M , et al . Veriflow:verifying network-wide invariants in real time [C ] // Proceedings of the 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI’13) . 2013 : 15 - 27 .

SHERRY J , HASAN S , SCOTT C , et al . Making middleboxes someone else's problem:network processing as a cloud service [J ] . ACM SIGCOMM Computer Communication Review , 2012 , 42 ( 4 ): 13 - 24 .

PANDA A , LAHAV O , ARGYRAKI K , et al . Verifying isolation properties in the presence of middleboxes [J ] . arXiv preprint,2014,arXiv:1409 . 7687 .

HU H , AHN G J , KULKARNI K . Detecting and resolving firewall policy anomalies [J ] . IEEE Transactions on Dependable ＆ Secure Computing(TDSC’12) , 2012 , 9 ( 3 ): 318 - 331 .

DENG J , LI H . On the safety and efficiency of virtual firewall elasticity control [C ] // 24th Network and Distributed System Security Symposium (NDSS’17) . 2017 .

MALDONADO-LOPEZ F A , CALLE E , DONOSO Y . Detection and prevention of firewall-rule conflicts on software-defined networking [C ] // 7th IEEE international Workshop on Reliable Networks Design and Modeling (RNDM’15) . 2015 : 259 - 265 .

邱松 , 焦健 , 张东阳 . 面向防火墙和IDS/IPS协同防御的策略冲突检测算法 [J ] . 系统仿真学报 , 2015 , 27 ( 11 ): 2770 - 2777 .

QIU S , JIAO J , ZHANG D Y . Policy conflicts verification algorithm towards collaborative defense with firewalls and IDS/IPS [J ] . Journal of System Simulation , 2015 , 27 ( 11 ): 2770 - 2777 .

PANDA A , LAHAV O , ARGYRAKI K , et al . Verifying reachability in networks with mutable datapaths [C ] // Proceedings of the 14th USENIX Symposium on Networked Systems Design and Implementation (NSDI’17) . 2017 : 699 - 718 .

WU W , ZHANG Y , BANERJEE S . Automatic synthesis of NF models by program analysis [C ] // ACM Workshop on Hot Topics in Networks (HotNets’16) . 2016 : 29 - 35 .

FAYAZ S K , YU T , TOBIOKA Y , CHAKI S , SEKAR V . BUZZ:testing context-dependent policies in stateful networks [C ] // 13th USENIX Conference on Networked Systems Design and Implementation (NSDI’16) . 2016 : 275 - 289 .

PRABHU S , CHOU K Y , KHERADMAND A , et al . Plankton:Scalable network configuration verification through model checking [C ] // Proceedings of the 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI’20) . 2020 : 953 - 967 .

YUAN Y , MOON S J , UPPAL S , et al . NetSMC:a custom symbolic model checker for stateful network verification [C ] // Proceedings of the 17th USENIX Symposium on Networked Systems Design and Implementation (NSDI’20) . 2020 : 181 - 200 .

浏览量

419

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

面向网络安全资源池的智能服务链系统设计与分析

基于免疫算法的网络功能异构冗余部署方法

网络功能虚拟化环境中大规模资源状态监测策略

基于NFV的新的协作式DDoS防御技术