WhiteRabbit: Scalable Software-Defined Network Data-Plane Verification Method Through Time Scheduling
WhiteRabbit: Scalable Software-Defined Network Data-Plane Verification Method Through Time Scheduling
复制标题
DOI：
10.1109/access.2019.2929958
复制
发表时间：
2019
期刊：
影响因子：
3.9
通讯作者：
Takahiro Shimizu;Naoya Kitagawa;Kohta Ohshima;N. Yamai
中科院分区：
文献类型：
--
作者：
Takahiro Shimizu;Naoya Kitagawa;Kohta Ohshima;N. Yamai
软件定义网络很容易受到受损交换机的攻击，因为常用的可编程软件交换机比传统硬件交换机更有风险。虽然已经提出了几种对策来解决受损的交换机，检测恶意行为的准确性取决于控制器收集网络统计信息的性能。在本文中，我们提出了WhiteRabbit是一种方法来验证转发状态的一致性，通过收集实时网络统计数据收集交换机与准确的时间调度。WhiteRabbit可以检测到被破坏的交换机的攻击，而不受控制器的统计收集性能的影响。鉴于所提出的利用移动平均，它减轻了对验证精度的影响，从开关性能的影响，如调度错误。在我们之前的工作中，我们使用原型系统证明了WhiteRabbit的可行性。然而，我们无法评估在我们以前的工作中计划和实际执行时间之间的差异的影响，因为我们使用Mininet在最小设置中执行了实验。因此，我们测量了在大规模环境中收集统计数据所需的调度错误和时间。我们还证实，调度误差低于收集统计数据所需的时间。此外，考虑到WhiteRabbit仅依赖于调度误差，我们验证了WhiteRabbit在由15个交换机构造的树形拓扑上的准确性高于现有技术。
Software-defined networks are vulnerable to attacks by compromised switches because commonly used programmable software switches are risky than traditional hardware ones. Although several countermeasures have been proposed to address compromised switches, the accuracy of detecting a malicious behavior depends on the performance of network statistics gathering by a controller. In this paper, we propose that WhiteRabbit is an approach to verify the consistency of the forwarding state by gathering real-time network statistics gathering from switches with accurate time scheduling. WhiteRabbit can detect attacks by compromised switches without being influenced by the performance of statistics gathering of a controller. Given that the proposed utilizes moving average, it mitigates the effect on the verification accuracy from the impact of the switch performance, such as scheduling error. In our previous work, we demonstrated the feasibility of WhiteRabbit using a prototype system. However, we could not evaluate the impact of the difference between the scheduled and actual execution times in our previous work, because we performed the experiment in a minimal setup using Mininet. Thus, we measured the scheduling error and time required to gather statistics in a large-scale environment. We also confirmed that the scheduling error is lower than the time required to gather statistics. Additionally, considering that WhiteRabbit only depends on the scheduling error, we verified that the accuracy of WhiteRabbit is higher than prior arts on the tree topology constructed with 15 switches.