高效安全的软件定义网络拓扑发现协议

李冬; 于俊清; 谷永普; 赵鹏程

doi:10.11959/j.issn.2096-109x.2023080

您当前的位置：

首页 >

文章列表页 >

高效安全的软件定义网络拓扑发现协议

学术论文 | 更新时间：2024-06-03

- 高效安全的软件定义网络拓扑发现协议
- Efficient and safe software defined network topology discovery protocol
- 网络与信息安全学报 2023年9卷第6期页码：20-33
- 作者机构：
  
  1. 华中科技大学网络与计算中心，湖北武汉 430074
  2. 华中科技大学网络空间安全学院，湖北武汉 430074
- 作者简介：
  
  [ "李冬（1979- ），男，博士，湖北枣阳人，华中科技大学高级工程师，主要研究方向为计算机网络、软件定义网络、网络安全" ]
  [ "于俊清（1975- ），男，博士，内蒙古赤峰人，华中科技大学教授、博士生导师，主要研究方向为数字媒体处理与检索、网络安全、多核计算与流编译" ]
  [ "谷永普（1995- ），男，湖南永州人，华中科技大学硕士生，主要研究方向为网络安全、软件定义网络" ]
  [ "赵鹏程（1996- ），男，湖北武穴人，华中科技大学硕士生，主要研究方向为网络安全、软件定义网络" ]
- 基金信息：
  
  国家重点研发计划;The National Key R＆D Program of China(2020YFB1805601);中国高校产学研创新基金;China University IUR Innovation Fund(2021FNA02005)
- DOI：10.11959/j.issn.2096-109x.2023080
  中图分类号： TP309
- 网络首发：2023-12，
  
  纸质出版：2023-12-25
- 稿件说明：
移动端阅览
李冬, 于俊清, 谷永普, 等. 高效安全的软件定义网络拓扑发现协议[J]. 网络与信息安全学报, 2023,9(6):20-33.

Dong LI, Junqing YU, Yongpu GU, et al. Efficient and safe software defined network topology discovery protocol[J]. Chinese Journal of Network and Information Security, 2023, 9(6): 20-33.
李冬, 于俊清, 谷永普, 等. 高效安全的软件定义网络拓扑发现协议[J]. 网络与信息安全学报, 2023,9(6):20-33. DOI： 10.11959/j.issn.2096-109x.2023080.

Dong LI, Junqing YU, Yongpu GU, et al. Efficient and safe software defined network topology discovery protocol[J]. Chinese Journal of Network and Information Security, 2023, 9(6): 20-33. DOI： 10.11959/j.issn.2096-109x.2023080.

摘要

基于OpenFlow的软件定义网络（SDN，software defined network）控制器主要采用OFDP（OpenFlow discovery protocol）发现网络拓扑，现有研究表明，OFDP存在网络拓扑信息更新效率低、容易遭受网络拓扑污染攻击等问题，为了提高网络拓扑发现协议的效率和安全性，对OFDP的网络拓扑发现机理和安全问题进行了深入研究，详细分析了软件定义网络拓扑建立和更新阶段的特点，基于图论的最小顶点覆盖问题提出了一种改进的OpenFlow网络拓扑发现协议——Im-OFDP（improved OpenFlow discovery protocol）。Im-OFDP基于OFDP网络拓扑发现的先验信息构建端口信息表和链路信息表，然后建立网络拓扑图模型，基于最小顶点覆盖算法筛选支撑网络拓扑的交换机，再根据网络拓扑结构设计网络拓扑发现的多级流表，由控制器下发至相应交换机。控制器发出的网络拓扑发现报文经多级流表转发处理后上报给控制器，进而获取网络拓扑信息。针对安全问题，Im-OFDP一方面基于拓扑发现获取的信息在LLDP（link layer discovery protocol）报文中采用动态检验码检测链路的真实性，另一方面基于主机和交换机等网络设备的拓扑信息建立验证机制，确保网络设备可信。实验结果表明，部署Im-OFDP后，控制器在网络拓扑发现的消息数量、带宽开销、CPU资源负载显著降低，节点失效响应时间、节点失效后链路恢复时间明显较短，能够防御链路伪造、交换机伪造等多种形式的网络拓扑污染攻击。Im-OFDP能够显著提高SDN拓扑发现的效率和安全性。

Abstract

The network topology discovery in OpenFlow-based software-defined networks is mainly achieved by utilizing the OpenFlow discovery protocol (OFDP).However

it has been observed in existing research that OFDP exhibits low updating efficiency and is susceptible to network topology pollution attacks.To address the efficiency and safety concerns of the network topology discovery protocol

an in-depth investigation was conducted on the mechanism and safety of OFDP network topology discovery.The characteristics of network topology establishment and updating in OFDP were analyzed

and an improved protocol named Im-OFDP (improved OpenFlow discovery protocol) based on the minimum vertex covering problem in graph theory was proposed.In Im-OFDP

the switch port table and network link table were initially established using prior information obtained from OFDP network topology discovery.Subsequently

a graph model of the network topology was constructed

and the minimum vertex covering algorithm in graph theory was employed to select specific switches for the reception and forwarding of topology discovery link layer discovery protocol (LLDP) packets.Multi-level flow tables were designed based on the network topology structure

and these flow entries were installed on the selected switches by the controller to process LLDP packets.To address security issues

dynamic check code verification in LLDP packets was employed to ensure the safety of network links.Additionally

a network equipment information maintenance mechanism was established based on known network topologies to ensure the safety of the network equipment.Experimental results demonstrate a significant reduction in the number of network topology discovery messages

bandwidth overhead

and CPU overhead through the deployment of Im-OFDP.Moreover

the response time for node failures and link recovery time after mode failure is substantially reduced.Im-OFDP also effectively mitigates various network topology pollution attacks

such as link fabrication and switch forgery attacks.Overall

Im-OFDP has the capability to enhance the efficiency and safety of SDN topology discovery.

关键词

Keywords

references

MCKEOWN N . OpenFlow:enabling innovation in campus networks [J ] . ACM SIGCOMM Computer Communication Review , 2008 , 38 ( 2 ): 69 - 74 .

NUNES B A A , MENDONCA M , NGUYEN X N , et al . A survey of software-defined networking:past,present,and future of programmable networks [J ] . IEEE Communications Surveys ＆ Tutorials , 2014 , 16 ( 3 ): 1617 - 1634 .

QIN Z , DENKER G , GIANNELLI C , et al . A software defined networking architecture for the internet-of-things [C ] // Proceedings of IEEE Network Operations and Management Symposium . 2014 : 1 - 9 .

AHMED N , ROY A , MONDAL A , et al . SDN-based link recovery scheme for large-scale internet of things [C ] // Proceedings of IEEE 22nd International Conference on High Performance Switching and Routing (HPSR) . 2021 : 1 - 6 .

KU I , LU Y , GERLA M , et al . Towards software-defined VANET:architecture and services [C ] // Proceedings of 13th Annual Mediterranean Ad Hoc Networking Workshop . 2014 : 103 - 110 .

GUO J M , YANG L , RINCÓN D , et al . SDN controller placement in LEO satellite networks based on dynamic topology [C ] // Proceedings of IEEE/CIC International Conference on Communications in China (ICCC) . 2021 : 1083 - 1088 .

MONTERO R , AGRAZ F , PAGES A , et al . Dynamic topology discovery in SDN-enabled transparent optical networks [C ] // Proceedings of International Conference on Optical Network Design ＆Modeling . 2017 : 1 - 6 .

TARNARAS G , HALEPLIDIS E , DENAZIS S . SDN and ForCES based optimal network topology discovery [C ] // Proceedings of IEEE Conference on Network Software . 2015 : 1 - 6 .

KIPONGO J , OLWAL T O , ABU-MAHFOUZ A M . Topology discovery protocol for software defined wireless sensor network:Solutions and open issues [C ] // Proceedings of 27th Internaional Symposium.Industrial Electronics . 2018 : 1282 - 1287 .

SHIN S , XU L , HONG S , et al . Enhancing network security through software defined networking [C ] // Proceedings of 25th International Conference on Computer Communication and Networks , 2016 : 1 - 9 .

ZHU K , YAO Z , HE N , et al . Toward full virtualization of the network Topology [J ] . IEEE Systems Journal , 2019 , 13 ( 2 ): 1640 - 1649 .

OpenFlow discovery protocol and link layer discovery protocol [EB ] .

DACIER M C , KÖNIG H , CWALINSKI R , et al . Security challenges and opportunities of software-defined networking [J ] . IEEE Security ＆ Privacy , 2017 , 15 ( 2 ): 96 - 100 .

AZZOUNI A , TRANG N T M , BOUTABA R , et al . Limitations of OpenFlow topology discovery protocol [C ] // Proceedings of 16th Annual Mediterranean Ad Hoc Network Workshop . 2017 : 1 - 3 .

KHAN S , GANI A , WAHAB A W A , et al . Topology discovery in software defined networks:threats,taxonomy,and state-ofthe-art [J ] . IEEE Communications Surveys ＆ Tutorials , 2017 , 19 ( 1 ): 303 - 324 .

TOUFGA S , ABDELLATIF S , OWEZARSKI P , et al . OpenFlow based topology discovery service in software defined vehicular networks:limitations and future approaches [C ] // Proceedings of IEEE Vehicular Network Conference . 2018 : 1 - 4 .

SMYTH D , MCSWEENEY S , O'SHEA D , et al . Detecting link fabrication attacks in software-defined networks [C ] // Proceedings of 26th International Conference on Computer Communication and Networks . 2017 : 1 - 8 .

GHANNAM R , CHUNG A . Handling malicious switches in software defined networks [C ] // Proceedings of Network Operations ＆Management Symposium . 2016 : 1245 - 1248 .

OIKONOMOU N V , MARGARITI S V , STERGIOU E , et al . Performance evaluation of software-defined networking implemented on various network topologies [C ] // Proceedings of 6th South-East Europe Design Automation,Computer Engineering,Computer Networks and Social Media Conference . 2021 : 1 - 6 .

KAUR N , SINGH A K , KUMAR N , et al . Performance impact of topology poisoning attack in SDN and its countermeasure [C ] // Proceedings of the 10th International Conference on Security of Information and Networks . 2017 : 179 - 184 .

PAKZAD F , PORTMANN M , TAN W L , et al . Efficient topology discovery in OpenFlow-based software defined networks [C ] // Proceedings of 8th International Conference on Signal Processing and Communication Systems . 2014 .

AZZOUNI A , BOUTABA R , TRANG N , et al . sOFTDP:secure and efficient topology discovery protocol for SDN [C ] // Proceedings of IEEE/IFIP Network Operations and Management Symposium . 2018 : 1 - 7 .

NEHRA A , TRIPATHI M , GAUR M S , et al . SLDP:a secure and lightweight link discovery protocol for software defined networking [J ] . Computer Networks , 2018 , 150 ( 2 ): 102 - 116 .

ZHAO X , YAO L , WU G . ESLD:an efficient and secure link discovery scheme for software-defined networking [J ] . International Journal of Communication Systems , 2018 , 31 ( 10 ): 18 .

HAO D . Research and implementation of OFDP based on multi-purpose address broadcast algorithm [D ] . Kunming：University of Yun Nan , 2018 .

JIA Y , XU L , YANG Y , et al . Lightweight automatic discovery protocol for OpenFlow-based software defined networking [J ] . IEEE Communications Letters , 2020 , 24 ( 2 ): 312 - 315 .

DONG S , ZHANG A L , HUANG D Y , et al . Optimization of link layer topology discovery in SDN based on OpenFlow [J ] . Fire Control ＆ Command Control . 2020 , 45 ( 305 ): 150 - 155 .

WANG Z Q . Research on topology discovery and link delay measurement of SDN network [D ] . Huhehaote:University of Inner Moncolia , 2020 .

CHANG Y C , LIN H T , CHU H M , et al . Efficient topology discovery for software-defined networks [J ] . IEEE Transactions on Network and Service Management , 2020 ,( 99 ): 1375 - 1388 .

OCHOA-ADAY L , CERVELLÓ-PASTOR C , FERNNDEZ-FERNÁNDEZ A . eTDP:enhanced topology discovery protocol for software-defined networks [J ] . IEEE Access , 2019 , 7 : 23471 - 23487 .

TARNARAS G , ATHANASIOU F , DENAZIS S . An efficient topology discovery algorithm for software-defined networks [J ] . IET Networks , 2017 , 6 ( 6 ): 157 - 161 .

OCHOA-ADAY L , CERVELLÓ-PASTOR C , FERNÁNDEZFERNÁNDEZ A . Self-healing topology discovery protocol for software defined networks [J ] . IEEE Communications Letters , 2018 , 3 ( 3 ): 1 - 4 .

ROJAS E , ALVAREZ-HORCAJO J , MARTINEZ-YELMO I > , et al . TEDP:an enhanced topology discovery service for software-defined networking [J ] . IEEE Commun Lett , 2018 , 22 ( 8 ): 1540 - 1543 .

ALJERI N , BOUKERCHE A . EDiPSo:an efficient scalable topology discovery protocol for software-defined vehicular network [J ] . Computer Networks , 2021 :108342.

HONG S , XU L , WANG H , et al . Poisoning network visibility in software-defined networks:new attacks and countermeasures [C ] // The Network and Distributed System Security Symposium(NDSS) . 2015 : 8 - 11 .

XIANG S , ZHU H , WU X , et al . Modeling and verifying the topology discovery mechanism of OpenFlow controllers in software-defined networks using process algebra [J ] . Science of Computer Programming , 2019 ,187:102343.

SKOWYRA R , XU L , GU G et al . Effective topology tampering attacks and defenses in software-defined networks [C ] // International Conference on Dependable Systems and Networks(DSN) . 2018 : 374 - 385 .

ALIMOHAMMADIFAR A , MAJUMDAR S , MADI T , et al . Stealthy probing-based verification (SPV):an active approach to defending software defined networks against topology poisoning attacks [C ] // Proceedings of European Symposium on Research in Computer Security (ESORICS) . 2018 : 463 - 484 .

MARIN E , BUCCIOL N , CONTI M . An in-depth look into SDN topology discovery mechanisms:novel attacks and practical countermeasures [C ] // ACM Conference on Computer and Communications Security(CCS) . 2019 : 1101 - 1114 .

DHAWAN M , PODDAR R , MAHAJAN K . SPHINX:detecting security attacks in software-defined networks [C ] // Proceedings of the Network and Distributed System Security Symposium(NDSS) . 2015 : 1 - 15 .

SMYTH D , MCSWEENEY S , O'SHEA D , et al . Detecting link fabrication attacks in software-defined networks [C ] // Proceedings of IEEE 26th International Conference on Computer Communication and Networks (ICCCN) . 2017 : 1 - 8 .

KAMISIŃSKI A , FUNG C . FlowMon:detecting malicious switches in software-defined networks [C ] // Proceedings of ACM CCS workshop on Automated Decision Making for Active Cyber Defense . 2015 : 39 - 45 .

HUANG X , SHI P , LIU Y , et al . Towards trusted and efficient SDN topology discovery:a lightweight topology verification scheme [J ] . Computer Networks , 2020 ,170:107119.

WANG J , TAN Y , LIU J . Topology poisoning attacks and countermeasures in SDN-enabled vehicular networks [C ] // Proceedings of IEEE Global Communications Conference(GLOBECOM) . 2020 : 1 - 6 .

ZHENG Z , XU M W , LI Q , et al . Defending against SDN network topology poisoning attacks [J ] . Computer Research and Development . 2018 , 55 ( 1 ): 207 - 215 .

GU Y P , LI D , YU J Q . Im-OFDP:an improved openflow-based topology discovery protocol for software defined network [C ] // Proceedings of IFIP International Conferences on Networking . 2020 : 628 - 630 .

SOLTANI S , SHOJAFAR M , MOSTAFAEI H , et al . Real-time link verification in software-defined networks [J ] . IEEE Transactions on Network and Service Management , 2023 , 20 ( 3 ): 3596 - 3611 .

KONG D . Combination attacks and defenses on SDN topology discovery [J ] . IEEE/ACM Transactions on Networking , 2023 , 31 ( 2 ): 904 - 919 .

GAO Y , XU M . Defense against software-defined network topology poisoning attacks [J ] . Tsinghua Science and Technology , 2023 , 28 ( 1 ): 39 - 46 .

ZHANG H L , XIE Q M , LI W . Research on minimum convex covering problem [J ] . China New Telecommunications , 2014 ,( 13 ): 51 - 52 .

浏览量

198

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

软件定义网络中控制器调度时间机制设计与实现

面向时延敏感的TRDP安全防护机制

面向软件定义晶上系统的安全多维互连网络

工业互联网蜜网技术综述

目标网络场景自适应的IP定位框架