PERM-GUARD: Authenticating the Validity of Flow Rules in Software Defined Networking
PERM-GUARD: Authenticating the Validity of Flow Rules in Software Defined Networking
复制标题
PERM-GUARD：验证软件定义网络中流规则的有效性
DOI：
10.1007/s11265-016-1115-8
复制
发表时间：
2017
影响因子：
1.8
通讯作者：
Jian Mao
中科院分区：
文献类型：
--
作者：
Mengmeng Wang;Jianwei Liu;Jie Chen;Xiao Liu;Jian Mao
软件定义网络（SDN）是流规则驱动网络的一种。在SDN中，一个集中的控制器指示网络行为并通过流规则配置网络设备。因此，流规则的有效性和一致性对SDN网络的安全运行至关重要，需要一种安全高效的机制来管理和认证控制器与网络设备之间的流规则。在本文中，我们的目标是开发保证SDN中流规则有效性的解决方案。我们分析了SDN中流规则的生成和管理机制，并提出了PERM-GUARD，一种针对SDN中流规则的细粒度权限管理和认证方案。PERM-GUARD采用了一种新的权限认证模型，为控制器引入了基于身份的签名方案来验证流规则的有效性。我们对PERM-GUARD进行了理论分析和仿真评估。结果表明，PERM-GUARD可以有效地识别和拒绝由未注册应用生成的假流规则。同时，它还可以有效地过滤掉合法应用创建的未经授权的流规则，并及时准确地跟踪其创建者。
Software Defined Networking (SDN) is one type of the flow-rule-driven networks. In SDN, a centralized controller dictates the network behavior and configures network devices via flow rules. Therefore, the validity and consistency of flow rules are the critical for the security of operations in SDN, requiring a secure and efficient mechanism to manage and authenticate flow rules between the controller and network devices. In this paper, we aim to develop solutions to guarantee the validity of flow rules in SDN. We analyze the mechanisms that generate and manage flow rules in SDN, and present PERM-GUARD, a fine-grained permission management and authentication scheme for flow rules in SDN. PERM-GUARD employs a new permission authentication model and introduces an identity-based signature scheme for the controller to verify the validity of flow rules. We conduct theoretical analysis and simulation-based evaluation of PERM-GUARD. The results demonstrate that PERM-GUARD can efficiently identify and reject fake flow rules generated by unregistered applications. Meanwhile, it can also effectively filter out unauthorized flow rules created by valid applications, and trace their creator timely and accurately.