异构容错控制平面的安全性分析

doi:10.11959/j.issn.2096-109x.2018095

Abstract

Abstract:

With the large-scale application of software-defined networks,the security of software-defined networks becomes more and more important.As an important defense idea,the fault-tolerant control plane based on heterogeneity has attracted more and more researchers' attention in recent years.However,the existing researches ignore the problem of common vulnerability in heterogeneous variants,which greatly reduces the security benefits of the fault-tolerant control architecture for software-defined networks.Addressing this problem,the common vulnerability was taken in heterogeneous variants into considerations.First,the tolerance capability of the fault-tolerant control plane was quantified.Then a control plane deployment method was constructed which was able to maximize the tolerance capability.The simulations show that the proposed method can effectively reduce the failure probability of the control plane.When the attackers attack the control plane constructed based on the proposed method,they pay more attack cost to compromise the control plane.

Key words: software-defined network, common vulnerability, heterogeneous variant, tolerance capability

CLC Number:

TP393

Qi WU,Hongchang CHEN,Fucai CHEN. Security analysis in heterogeneous fault-tolerant control plane[J]. Chinese Journal of Network and Information Security, 2018, 4(11): 32-39.

Figures/Tables 5

References 21

[1]	SCOTT-HAYWARD S , NATARAJAN S , SEZER S . A survey of security in software defined networks[J]. IEEE Communications Surveys ＆ Tutorials, 2016,18(1): 623-654.
[2]	PORRAS P , SHIN S , YEGNESWARAN V ,et al. A security enforcement kernel for OpenFlow networks[C]// International Workshop on Hot Topics in Software Defined Networks. ACM, 2012: 121-126.
[3]	SHIN S , SONG Y , LEE T ,et al. Rosemary:a robust,secure,and high-performance network operating system[C]// Conference on Computer and Communications Security. ACM, 2014: 78-89.
[4]	YEGANEH S H , GANJALI Y . Kandoo:a framework for efficient and scalable offloading of control applications[C]// The Workshop on Hot Topics in Software Defined Networks. ACM, 2012: 19-24.
[5]	JIN X , GOSSELS J , Rexford J ,et al. CoVisor:a compositional hypervisor for software-defined networks[C]// Usenix Conference on Networked Systems Design and Implementation. USENIX Association, 2015: 87-101.
[6]	LENG J , ZHOU Y , ZHANG J ,et al. An inference attack model for flow table capacity and usage:exploiting the vulnerability of flow table overflow in software-defined network[J]. Water Air ＆ Soil Pollution, 2015,85(3): 1413-1418.
[7]	卢振平, 陈福才, 程国振 . 软件定义网络中控制器调度时间机制设计与实现[J]. 网络与信息安全学报, 2018(1): 36-44.
	LU Z P , CHEN F C , CHENG G Z . Design and implementation of the controller scheduling-time in SDN[J]. Chinese Journal of Network and Information Security, 2018(1): 36-44.
[8]	[EB/OL].
[9]	YOON C , LEE S , KANG H ,et al. Flow wars:systemizing the attack surface and defenses in software-defined networks[J]. IEEE/ACM Transactions on Networking, 2017,(99): 1-17.
[10]	GUDE N , KOPONEN T , PETTIT J ,et al. NOX:towards an operating system for networks[J]. ACM Sigcomm Computer Communication Review, 2008,38(3): 105-110.
[11]	Floodlight documentation[EB/OL].
[12]	CHEUNG S , FONG M , PORRAS P ,et al. Securing the software-defined network control layer[C]// Proceedings of the Network and Distributed System Security Symposium, 2015.
[13]	FERGUSON A D , GUHA A , LIANG C ,et al. Participatory networking:an API for application control of SDNs[C]// ACM SIGCOMM. 2013: 327-338.
[14]	KOPONEN T , CASADO M , GUDE N ,et al. Onix:a distributed control platform for large-scale production networks[C]// Usenix Conference on Operating Systems Design and Implementation. 2010: 351-364.
[15]	MEDVED J , VARGA R , TKACIK A ,et al. OpenDaylight:towards a model-driven SDN controller architecture[C]// IEEE,International Symposium on a World of Wireless,Mobile and Multimedia Networks. IEEE, 2014: 1-6.
[16]	BERDE P , HART J , HART J ,et al. ONOS:towards an open,distributed SDN OS[C]// The Work-shop on Hot Topics in Software Defined Networking. ACM, 2014: 1-6.
[17]	Castro M , Liskov B . Practical byzantine fault tolerance and proactive recovery[J]. ACM Transactions on Computer Systems, 2002,20(4): 398-461.
[18]	BOTELHO F , BESSANI A , RAMOS F M V ,et al. On the design of practical fault-tolerant SDN controllers[C]// . European Workshop on Software-Defined Networks, 2014: 73-78.
[19]	Li H , Li P , Guo S ,et al. Byzantine-resilient secure software-defined networks with multiple controllers[J]. IEEE Transactions on Cloud Computing, 2015,2(4): 436-447.
[20]	王禛鹏, 扈红超, 程国振 ,等. 软件定义网络下的拟态防御实现架构[J]. 网络与信息安全学报, 2017,3(10): 52-61.
	WANG Z P , HU H C , CHENG G Z ,et al. Implementation architecture of mimic security defense based on SDN[J]. Chinese Journal of Network and Information Security, 2017,3(10): 52-61.
[21]	KELLER E ,et al. Timing-based reconnaissance and defense in software-defined networks[C]// Conference on Computer Security Applications. ACM, 2016: 89-100.

Metrics

Recommended 0

No Suggested Reading articles found!

	OB	NB	FB	W03	W08	W12	UB	DE	RE	SO	OS
OB	149	45	58	2	1	0	3	2	10	13	1
NB	45	139	56	1	1	0	0	4	8	16	0
FB	58	56	254	3	2	0	6	9	22	22	0
W03	2	1	3	412	344	85	0	0	1	7	0
W08	1	1	2	344	846	385	0	0	0	0	0
W12	0	0	0	85	385	467	0	0	0	0	0
UB	3	0	6	0	0	0	840	909	176	86	1
DE	2	4	9	0	0	0	303	995	220	76	1
RE	10	8	22	1	0	0	179	220	1518	69	1
SO	13	16	22	7	0	0	86	73	69	365	27
OS	1	0	0	0	0	0	1	1	1	57	100

Security analysis in heterogeneous fault-tolerant control plane

RichHTML

PDF下载

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 5

References 21

Related Articles 4

Metrics

Recommended 0

[1]	Haoyu CHEN, Deqing ZOU, Hai JIN. Verification on policies for network functions in SDN/NFV-based environment [J]. Chinese Journal of Network and Information Security, 2021, 7(3): 59-71.
[2]	Jinglei TAN, Hongqi ZHANG, Cheng LEI, Xiaohu LIU, Shuo WANG. Research progress on moving target defense for SDN [J]. Chinese Journal of Network and Information Security, 2018, 4(7): 1-12.
[3]	Zhongfu GUO, Xingming ZHANG, Bo ZHAO, Sunan WANG. Survey of software-defined networking data plane security [J]. Chinese Journal of Network and Information Security, 2018, 4(11): 1-12.
[4]	Fei CHEN,Xiao-hong BI,Jing-jing WANG,Yuan LIU. Survey of DDoS defense:challenges and directions [J]. Chinese Journal of Network and Information Security, 2017, 3(10): 16-24.