基于安全分级的网络切片备份与重映射方法研究

doi:10.11959/j.issn.2096-109x.2018088

网络与信息安全学报 ›› 2018, Vol. 4 ›› Issue (11): 49-57.doi: 10.11959/j.issn.2096-109x.2018088

基于安全分级的网络切片备份与重映射方法研究

孙志勇,季新生,游伟,袁泉

国家数字交换系统工程技术研究中心，河南郑州 450002

修回日期:2018-10-15 出版日期:2018-11-01 发布日期:2019-01-03
作者简介:孙志勇（1994-），男，河南濮阳人，国家数字交换系统工程技术研究中心硕士生，主要研究方向为新一代移动通信网络技术、移动通信网络安全。|季新生（1968-），男，江苏南通人，国家数字交换系统工程技术中心教授、博士生导师，主要研究方向为网络空间安全、拟态安全。|游伟（1984-），男，江西丰城人，国家数字交换系统工程技术中心讲师，主要研究方向为新一代移动通信网络技术、移动通信网络安全。|袁泉（1991-），男，山东青岛人，国家数字交换系统工程技术博士生，主要研究方向为新一代移动通信网络技术、网络功能虚拟化。
基金资助:
国家自然科学创新研究群体基金资助项目(61521003);国家重点研发计划基金资助项目(2016YFB0801605)

Research on backup and remapping of network slice based on security classification

Zhiyong SUN,Xinsheng JI,Wei YOU,Quan YUAN

National Digital Switching System Engineering ＆Technological Research Center,Zhengzhou 450002,China

Revised:2018-10-15 Online:2018-11-01 Published:2019-01-03
Supported by:
The Foundation for Innovative Research Groups of the National Natural Science Foundation of China(61521003);The National Key R＆D Program of China(2016YFB0801605)

摘要/Abstract

摘要：

在未来5G核心网虚拟化环境中通用的X86服务器使攻击者容易发掘漏洞，底层网络也更易感染和传播病毒，进而造成单个物理节点失效问题，严重影响网络切片的服务性能。首先在现有节点备份和重映射应对方案基础上，考虑节点间的安全约束关系对网络安全性能的影响，提出网络切片中虚拟节点与物理节点的安全参数评估模型，建立虚拟节点与物理节点之间的安全约束关系；然后基于安全参数评估模型选出备份虚拟节点并设计备份映射方法；最后在满足网络时延要求下设计节点重映射机制。实验结果表明，所提方法能够在满足网络切片的服务性能要求下，显著提升网络的入侵容忍能力。

关键词: 网络切片, 服务功能链映射, 备份, 重映射, 可靠性

Abstract:

In the future virtual environment of 5G core network,the general X86 servers make the attackers exploit vulnerabilities more easily,the substrate network is infected with and spreads the virus more easily,and the problem of single physical node failed will affect the service performance of the network slice seriously.Based on the existing node backup and remapping solutions,considering the impact of security constraints among nodes on network security performance,a security parameter evaluation model of virtual nodes and physical nodes were proposed in the network slicing,and the security constraint relationship was established between the virtual nodes and the physical nodes.Then backup virtual nodes were selected based on the security parameters evaluation model,and backup mapping methods were designed.Finally,the node remapping mechanism was designed with satisfying the requirement of network delay.Experiments show that the proposed method can significantly improve network intrusion tolerance with satisfying the requirements of network slicing service performance.

Key words: network slice, service function chain mapping, backup,remapping, reliability

中图分类号:

TN918.91

孙志勇,季新生,游伟,袁泉. 基于安全分级的网络切片备份与重映射方法研究[J]. 网络与信息安全学报, 2018, 4(11): 49-57.

Zhiyong SUN,Xinsheng JI,Wei YOU,Quan YUAN. Research on backup and remapping of network slice based on security classification[J]. Chinese Journal of Network and Information Security, 2018, 4(11): 49-57.

图/表 6

参考文献 20

[1]	3GPP SA. 3rd generation partnership project service and system aspects[EB/OL]. . 2017.9
[2]	ORDONEZ-LUCENA J , AMEIGEIRAS P , LOPEZ D ,et al. Network slicing for 5G with SDN/NFV:concepts,architectures,and challenges[J]. IEEE Communications Magazine, 2017,55(5): 80-87.
[3]	CHOYI V K , ABDEL-HAMID A , SHAH Y ,et al. Network slice selection,assignment and routing within 5G networks[C]// Standards for Communications and NETWORKING. 2016: 1-7.
[4]	CHATRAS B , KWONG U S T , BIHANNIC N . NFV enabling network slicing for 5G[C]// Innovations in Clouds,Internet and Networks. 2017.
[5]	ORDONEZ-LUCENA J , AMEIGEIRAS P , LOPEZ D ,et al. Network slicing for 5G with SDN/NFV:concepts,architectures,and challenges[J]. IEEE Communications Magazine, 2017,55(5): 80-87.
[6]	HAN B , GOPALAKRISHNAN V , JI L ,et al. Network function virtualization:challenges and opportunities for innovations[J]. IEEE Communications Magazine, 2015,53(2): 90-97.
[7]	HERRERA J G , BOTERO J F . Resource allocation in NFV:a comprehensive survey[M]. IEEE Press, 2016,13(3): 518-532.
[8]	BASTA A , KELLERER W , HOFFMANN M ,et al. A virtual SDN-enabled LTE EPC architecture:a case study for S/P gateways functions[C]// IEEE Future Networks and Services. 2013: 1-7.
[9]	SEXTON J , STORLIE C , NEIL J . Attack chain detection statistical analysis and data mining[J]. The ASA Data Science Journal, 2015,8(5-6): 353-363.
[10]	龚水清, 陈靖, 黄聪会 ,等. 信任感知的安全虚拟网络映射算法[J]. 通信学报, 2015,36(11): 180-189.
	GONG S Q , JING J , HUANG C H ,et al. Trust-aware secure virtual network embedding algorithm[J]. Journal on Communications, 2015,36(11): 180-189.
[11]	HERKER S , KHAN A , AN X . Survey on survivable virtual network embedding problem and solutions[C]// International Conference on Networking and Services (ICNS). 2013: 99-104.
[12]	RAHMAN M R , BOUTABA R . SVNE:survivable virtual network embedding algorithms for network virtualization[J]. IEEE Transactions on Network ＆ Service Management, 2013,10(2): 105-118.
[13]	CHOWDHURY S R , AHMED R , KHAN M A ,et al. Protecting virtual networks with drone[C]// Network Operations and Management Symposium (NOMS),IEEE/IFIP. 2016: 78-86.
[14]	CHOWDHURY S R , AHMED R , KHAN M M A ,et al. Dedicated protection for survivable virtual network embedding[J]. IEEE Transactions on Network and Service Management, 2016,13(4): 913-926.
[15]	ZHANG Q , ZHANI M F , JABRI M ,et al. Venice:reliable virtual data center embedding in clouds[C]// INFOCOM,Proceedings IEEE. 2014: 289-297.
[16]	JARRAY A , KARMOUCH A . Cost-efficient mapping for fault-tolerant virtual networks[J]. IEEE Transactions on Computers, 2015,64(3): 668-681.
[17]	SHAHRIAR N , AHMED R , KHAN A ,et al. ReNoVatE:recovery from node failure in virtual network embedding[C]. Network and Service Management (CNSM). 2016: 19-27.
[18]	SHAHRIAR N , AHMED R , CHOWDHURY S ,et al. Generalized recovery from node failure in virtual network embedding[J]. IEEE Transactions on Network ＆ Service Management, 2017,(99): 1-1.
[19]	YU H , ANAND V , QIAO C ,et al. Migration based protection for virtual infrastructure survivability for link failure[C]// 2011 and the National Fiber Optic Engineers Conference on Optical Fiber Communication Conference and Exposition (OFC/NFOEC). 2011: 1-3.
[20]	季新生, 赵硕, 艾健健 ,等. 异构备份式的虚拟网映射方法研究[J]. 电子与信息学报, 2018,40(5): 1087-1093.
	JI X S , ZHAO S , AI J J ,et al. Research on heterogeneous-backup virtual network embedding[J]. JEIT, 2018,40(5): 1087-1093.

基于安全分级的网络切片备份与重映射方法研究

Research on backup and remapping of network slice based on security classification

在线阅读

pdf下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 6

参考文献 20

相关文章 9

Metrics

推荐阅读 0

[1]	徐子钧, 刘建伟, 李耕. 面向5G mMTC的网络切片安全研究[J]. 网络与信息安全学报, 2022, 8(1): 95-105.
[2]	潘启润,黄开枝,游伟. 基于隔离等级的网络切片部署方法[J]. 网络与信息安全学报, 2020, 6(2): 96-105.
[3]	林素青. 支持访问更新的可验证外包属性加密方案[J]. 网络与信息安全学报, 2019, 5(1): 37-49.
[4]	陈强,刘彩霞,李凌书. 基于粒子群优化算法的5G网络切片功能迁移机制[J]. 网络与信息安全学报, 2018, 4(8): 47-55.
[5]	陈强,刘彩霞,李凌书. 基于改进式贪婪算法的5G网络切片动态资源调度策略[J]. 网络与信息安全学报, 2018, 4(7): 60-68.
[6]	谢记超,伊鹏,张震,张传浩,谷允捷. 基于异构备份与重映射的服务功能链部署方案[J]. 网络与信息安全学报, 2018, 4(6): 23-35.
[7]	苗笛,黄斌,李杰. 基于智慧协同网络的传感网络安全备份方法[J]. 网络与信息安全学报, 2017, 3(3): 28-33.
[8]	梁蛟,刘武,韩伟力,王晓阳,甘似禹,沈烁. 安卓云备份模块的代码安全问题分析[J]. 网络与信息安全学报, 2017, 3(1): 68-78.
[9]	慈云飞,史国振,谢绒娜,潘耀明,杨凤,叶思水. 面向移动云的基于时间的增量备份方案[J]. 网络与信息安全学报, 2016, 2(8): 48-53.