PERM-GUARD: SDN中细粒度流规则有效性验证

79 浏览量更新于2024-08-29 收藏 831KB PDF 举报

PERM-GUARD是一项针对软件定义网络（Software Defined Networking, SDN）中流规则验证的重要研究。SDN是一种依赖于集中式控制的网络架构，控制器负责定义网络行为，并通过配置众多流规则来管理网络设备。这种架构的核心在于确保流规则的有效性和一致性，这对于网络的正常运行至关重要。在SDN环境中，安全有效地管理并验证从应用层到控制层的流规则变得尤为重要。本文主要关注的问题是设计一种机制来验证SDN中的流规则有效性。首先，作者分析了在SDN中生成和插入流规则的基本流程，这包括理解规则的生成策略和控制平面的操作过程。 PERM-GUARD是一种精细粒度的流规则生产权限验证方案。它引入了一种新颖的权限认证模型，这一模型强调了对操作者的身份验证和授权。具体来说，PERM-GUARD采用了身份为基础的签名技术，确保只有授权的实体才能创建、修改或删除有效的流规则。此外，该方案还可能包括访问控制列表（Access Control List, ACL）或者基于角色的访问控制（Role-Based Access Control, RBAC）等机制，以进一步增强安全性。为了实现PERM-GUARD，系统可能会涉及以下几个关键组件： 1. 权限管理系统：用于分配和管理每个用户或服务的流规则操作权限，确保只有具备相应权限的实体才能执行特定操作。 2. 身份验证模块：对试图操作流规则的用户进行严格的认证，确保其身份真实无误。 3. 签名与加密：使用公钥基础设施（Public Key Infrastructure, PKI）或身份相关密钥对流规则进行签名，确保数据完整性和来源的可靠性。 4. 审计日志：记录所有流规则的创建、修改和删除操作，以便在出现问题时追踪和审计。 5. 冲突检测与解决：设计算法检测并处理可能出现的并发或恶意修改冲突，保持流规则的一致性。 PERM-GUARD的目标是提升SDN网络的安全性和效率，防止未经授权的规则更改，从而维护网络的正常运行和业务连续性。它的实施将显著增强SDN架构的整体安全性，是现代网络管理不可或缺的一部分。随着网络技术的发展，PERM-GUARD这类解决方案的研究和实践将愈发重要。

PERM-GUARD: Authenticating the Validity of Flow Rules in

Software Deﬁned Networking

Mengmeng Wang, Jianwei Liu, Jie Chen, Xiao liu, Jian Mao

School of Electronic and Information Engineering, Beihang University, Beijing, China

Email: jane10603@126.com; liujianwei@buaa.edu.cn; chenjiey@foxmail.com; liuxiaobh@gmail.com; maojian@buaa.edu.cn

Abstract—Software Deﬁned Networking (SDN) is one of the

typical ﬂow-rule-driven networks. In SDN, a centralized con-

troller dictates the network behavior and conﬁgures network

devices with many ﬂow rules, and the validity and consistency

of ﬂow rules could guarantee the normal operations in SDN.

Therefore, SDN requires a secure and efﬁcient mechanism to

manage and authenticate ﬂow rules between the application

layer and the control layer. In this paper, our target problem

is to authenticate the validity of ﬂow rules in SDN. We analyze

the mechanisms to generate and insert ﬂow rules in SDN

respectively, and present PERM-GUARD, a ﬁne-grained ﬂow

rule production-permission authentication scheme. PERM-

GUARD employs a new permission authentication model and

introduces an identity-based signature scheme to ensure that

the controller can verify the validity of ﬂow rules. We conduct

theoretical analysis and evaluate our approach by simulation.

The results demonstrate that PERM-GUARD can efﬁciently

identify and reject fake ﬂow rules generated by unregistered

applications. Meanwhile, our approach can also effectively ﬁlter

unauthorized ﬂow rules created by valid applications.

Keywords-Software Deﬁned Networking, Flow-Rule-

Validity Authentication, Identity-Based Signature, Flow Rule

Production-Permissions Management

I. INTRODUCTION

Software Deﬁned Networking (SDN) is a typical cen-

tralized network architecture for managing and operating

computer networks, and it introduces high programmability

and dynamic orchestration of many enterprise networks by

centralizing network control logic and separating itself from

the underlying routers and switches [1–4]. In SDN, the

controller dictates the network behavior and conﬁgures the

network devices through some simple APIs in the form of

ﬂow rules. Therefore, it is ﬂow rules that determine when

or if the network trafﬁc will go through a network device.

SDN is promised to facilitate network management and

ease the burden of solving networking problems by means of

the logically centralized control offered by a controller. To

date, there are many kinds of controllers, e.g., NOX, POX,

Floodlight, and OpenDaylight. However, at the beginning

of controller design, the main concerns of developers are

network resources control, routing and scheduling. One

example of the design principles that was not included as

one of the main concerns is security of ﬂow rules.

Flow rules in SDN are dynamically generated by a va-

riety of applications (e.g., OpenFlow applications, security

applications) and the network administrator, and then they

will be sent by the controller to network devices in the

infrastructure layer, in response to some special perceived

threats. Network devices in the infrastructure layer have

absolute trust in ﬂow rules sent by the controller, and

take them as important guidelines to perform operations.

However, the current SDN community lacks a secure and

efﬁcient ﬂow rule authorization mechanism to manage and

authenticate the ﬂow rules between the application layer and

the control layer. A ﬂow rule may be tampered or forged in

the process of its generating, sending and executing.

In SDN, adversaries could launch attacks on ﬂow rules

even by writing some remote/local programs, rather than by

buying a lot of expensive network equipment. If an attacker

could generate some malicious ﬂow rules by masquerading

as a valid application, or tamper with the valid ﬂow rules

generated by a valid application, the normal ﬂow rule

production mechanism in SDN would be damaged. Then, a

lot of illegal data packets could bypass many security devices

(e.g., ﬁrewalls, intrusion detection systems) that deployed in

SDN. In the worst case, an adversary may tamper with a set

of ﬂow rules, or generate some fake ﬂow rules, to control

the state of all switches in a SDN network. Therefore,

ensuring the legality and correctness of ﬂow rules in SDN,

and preventing the proliferation of malicious ﬂow rules, are

clearly error-prone and challenging.

Contributions: In this paper, we focus on the question

of how to authenticate the validity of ﬂow rules in SDN.

By analyzing two key issues: (i) the ﬂow-rule-production-

permission mechanism, and (ii) how could ﬂow rules that

generated by a variety of applications be authenticated by

the controller, we propose PERM-GUARD, a new model to

verify and authenticate the validity of ﬂow rules in SDN. To

summarize, this paper’s contributions include the following:

(1) We present PERM-GUARD, a ﬁne-grained ﬂow rule

production-permissions management model, which could

prevent fake ﬂow rules produced by unregistered applica-

tions, and ﬁlter out ﬂow rules beyond the granted permis-

sions of registered applications.

(2) An identity-based signature scheme is introduced into

2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing

DOI 10.1109/CSCloud.2015.89

127

下载后可阅读完整内容，剩余5页未读，立即下载

weixin_38698590

粉丝: 6
资源: 943

PERM-GUARD: SDN中细粒度流规则有效性验证

JVM调优总结 Xms -Xmx -Xmn -Xss

perm-tool:PoC Eclipse插件可帮助程序员在指定Android的应用程序级别权限时使用最小特权

OutOfMemoryError-PermGen-space-的解决方案亲测有效

jvm -Xms -Xmx -XX:PermSize -XX:MaxPermSize 设置比例

find / -perm -4000 -o -perm -2000

php curl error code,PHP中curl错误号对照表

jvm 启动参数

find / -type f -perm -4000 的每个参数都是什么意思？find指令都有哪些参数，如何使用？

MAVEN_OPTS有哪些参数

-xx:maxmetaspacesize

最新资源