Trie与功能组合：SDN/NFV安全体系结构的创新防护策略

82 浏览量更新于2024-08-26 收藏 17.66MB PDF 举报

本文探讨了一种创新的安全保护体系结构，结合Software-Defined Networking (SDN) 和 Network Function Virtualization (NFV) 技术，特别提出了一个功能组合算法，该算法是基于Trie数据结构设计的。Trie，也被称为前缀树，是一种高效的字符串搜索和存储数据结构，特别适合处理大量关键路径相关的查询。 SDN和NFV是现代网络架构的核心组成部分，前者通过集中控制平面与分散的数据平面分离，实现了网络资源的灵活管理和优化；后者将传统的网络功能虚拟化，使得网络服务可以根据需求动态部署和扩展。然而，随着网络服务的复杂性和多样性增加，安全问题变得尤为重要。传统的安全策略可能无法适应这种变化，因此，研究一种能够有效整合和管理网络功能，并提供高效、可扩展的安全保护方案显得至关重要。文章的作者Zheng Hao、Zhaowen Lin和Ran Li来自北京邮电大学的研究团队，他们在网络技术研究所及通信网络科学与技术实验室，以及国家移动网络安全工程实验室，共同致力于解决这一挑战。他们提出的基于Trie的功能组合算法，旨在通过对网络服务功能进行高效的分类和组织，实现对SDN/NFV环境中潜在威胁的快速识别和响应。该算法的主要优势包括： 1. 高效性：Trie数据结构允许对功能进行快速查找，从而在遇到攻击或异常行为时，能迅速定位到相关的安全策略。 2. 灵活性：通过功能组合，可以动态调整安全防护措施，适应不同网络环境和应用需求的变化。 3. 扩展性：由于Trie结构的层次分明，当新功能加入时，只需在其适当位置添加节点，不会影响整个系统的性能。然而，实现这个体系结构也涉及到技术细节，如功能定义的标准化、Trie的构建和维护、安全策略的自动化执行等。此外，可能还需要考虑与其他安全技术的集成，例如入侵检测系统（IDS）和入侵防御系统（IPS），以形成一个全方位的安全防护网。这篇研究论文提供了一个有前景的解决方案，它不仅提升了SDN/NFV环境下的网络安全防护能力，还展示了如何利用Trie数据结构的优势来增强网络功能的动态管理。对于网络技术领域的研究者和实践者来说，这是一个值得深入研究和借鉴的创新思路。

A SDN/NFV Security Protection Architecture with a Function

Composition Algorithm Based on Trie

Zheng Hao

Network and Information Center,

Institute of Network Technology,

Beijing University of Posts and

Telecommunications

Beijing 100876, China

Science and Technology on

Information Transmission and

Dissemination in Communication

Networks Laboratory

Shijiazhuang 050081, China

National Engineering Laboratory for

Mobile Network Security

Beijing 100876, China

haoz@bupt.edu.cn

Zhaowen Lin

Network and Information Center,

Institute of Network Technology,

Beijing University of Posts and

Telecommunications

Beijing 100876, China

Science and Technology on

Information Transmission and

Dissemination in Communication

Networks Laboratory

Shijiazhuang 050081, China

National Engineering Laboratory for

Mobile Network Security

Beijing 100876, China

linzw@bupt.edu.cn

Ran Li

Network and Information Center,

Institute of Network Technology,

Beijing University of Posts and

Telecommunications

Beijing 100876, China

Science and Technology on

Information Transmission and

Dissemination in Communication

Networks Laboratory

Shijiazhuang 050081, China

National Engineering Laboratory for

Mobile Network Security

Beijing 100876, China

liran_@bupt.edu.cn

ABSTRACT

Soware

Dened Network (SDN) is a new type of network

architecture that has advantages over traditional network. For

SDN, security is a basic issue. SDN controller has received

considerable aention in the researches on SDN security.

Researchers assign security tasks to SDN controllers generally,

but it puts a heavy burden on the SDN controller and leads to a

decrease in system stability. On the basis of previous work, we

propose a new security protection architecture based on

SDN/NFV. Meanwhile, a security function virtual machine pool

is designed in infrastructure layer in architecture. It can create

virtual machines and manage the ip addresses of the virtual

machines automatically, which improves the exibility and

expandability of the architecture. Moreover, a function

composition algorithm based on Trie (FCT) has been introduced.

We deploy the security protection architecture on VMware cloud

platform to validate the availability of the architecture and use

experimental data to prove FCT algorithm has good

performance.

Permission to make digital or hard copies of all or part of this work for personal

or classroom use is granted without fee provided that copies are not made or

distributed for profit or commercial advantage and that copies bear this notice and

the full citation on the first page. Copyrights for components of this work owned

by others than ACM must be honored. Abstracting with credit is permitted. To

copy otherwise, or republish, to post on servers or to redistribute to lists, requires

prior specific permission and/or a fee. Request permissions from

Permissions@acm.org.

CSAE '18, October 22–24, 2018, Hohhot, China

ACM ISBN 978-1-4503-6512-3/18/10…$15.00

https://doi.org/10.1145/3207677.3277992

CCS CONCEPTS

• Security and privacy → Network security • Networks →

Network architectures; Network components; Network

algorithms

KEYWORDS

SDN, NFV, security protection architecture, composition

algorithm

1 INTRODUCTION

Software Define Network(SDN) [1] is a new network

architecture based on OpenFlow [2]. Compared with traditional

networks, it has great advantages in flexibility, scalability, etc.

The core of SDN is the separation of the control plane and the

data plane, which makes the configuration and management of

network environment more flexible, effective and dynamic, thus

realizing adaptive control of network traffic and providing users

with a good programmable network.

Network Function Virtualization(NFV) [3] is a network

architecture concept which aims to make the network control

deployment more exible and reduce the cost of the network. By

making use of the universal hardware and virtualization

technology, more functional soware processing can be carried

out to replace the traditional specic hardware devices, which is

helpful to reduce the cost of the network equipment and make

the network equipment no longer depend on the dedicated

hardware.

Network has become increasingly complicated with the

development of new technologies, such as cloud computing,

Internet of things, big data and mobile Internet, especially the

widespread application of virtualization technology. e

下载后可阅读完整内容，剩余7页未读，立即下载

weixin_38651786

粉丝: 7
资源: 915

Trie与功能组合：SDN/NFV安全体系结构的创新防护策略

基于C++实现中文敏感词过滤，支持特殊符号，半角全角，停顿词，重复词等等，基于trie树算法实现

基于双数组树Trie的词典查询算法

基于Trie的算法中具有计数BloomFilter的高效IP地址查找

AhoCorasickDoubleArrayTrie：基于Double Array Trie的Aho Corasick算法的极快实现

一个基于trie树的具有联想功能的文本编辑器.zip

基于 Double Array Trie 的 Aho Corasick算法的 非常快的C# 实现_代码_下载

MemoTrie:基于Trie的备忘录功能

Wayfarer：可组合的基于Trie的路由器

trienet：用于子字符串搜索，自动完成和Intelli-sense的Trie数据结构的.NET实现。 包括：patricia trie，后缀trie和使用Ukkonen算法的trie实现

多分枝trie树路由查找算法研究

最新资源

基于 Double Array Trie 的 Aho Corasick算法的非常快的C# 实现_代码_下载

trienet：用于子字符串搜索，自动完成和Intelli-sense的Trie数据结构的.NET实现。包括：patricia trie，后缀trie和使用Ukkonen算法的trie实现