Challenges and Preparedness of SDN-based Firewalls
Challenges and Preparedness of SDN-based Firewalls
复制标题
基于SDN的防火墙的挑战和准备
DOI：
10.1145/3180465.3180468
复制
发表时间：
2018
期刊：
影响因子：
--
通讯作者：
Ahn, Gail-Joon
中科院分区：
文献类型：
--
作者：
Dixit, Vaibhav Hemant;Kyung, Sukwha;Zhao, Ziming;Doupé, Adam;Shoshitaishvili, Yan;Ahn, Gail-Joon
软件定义网络（SDN）是一种新的体系结构，旨在解决传统和垂直集成网络的问题。为了提高成本效益和实现逻辑控制，SDN通过将网络流量交付（“数据平面”）与网络配置（“控制平面”）分离，提供了高可编程性和集中的网络视图。SDN控制器和相关协议正在迅速发展，以满足复杂企业网络的扩展需求。由于现代SDN技术的发展，采用SDN的生产网络容易出现一些安全漏洞。SDN框架的发展速度继续超过解决其安全问题的尝试。根据我们的研究，现有的防御机制，特别是基于sdn的防火墙，在成功地在底层网络中执行安全策略时，面临着新的和sdn特有的挑战。在本文中，我们确定了与基于sdn的防火墙相关的问题，例如模糊的流路径计算和大型网络中较差的可扩展性。我们调查了现有的基于sdn的防火墙设计及其在保护动态扩展网络（如数据中心）方面的缺点。我们通过评估一种名为FlowGuard的sdn特定安全解决方案来扩展我们的研究，并识别新的攻击媒介和漏洞。我们还提出了相应的威胁检测技术和相应的缓解策略。
Software-Defined Network (SDN) is a novel architecture created to address the issues of traditional and vertically integrated networks. To increase cost-effectiveness and enable logical control, SDN provides high programmability and centralized view of the network through separation of network traffic delivery (the "data plane") from network configuration (the "control plane"). SDN controllers and related protocols are rapidly evolving to address the demands for scaling in complex enterprise networks. Because of the evolution of modern SDN technologies, production networks employing SDN are prone to several security vulnerabilities. The rate at which SDN frameworks are evolving continues to overtake attempts to address their security issues.According to our study, existing defense mechanisms, particularly SDN-based firewalls, face new and SDN-specific challenges in successfully enforcing security policies in the underlying network. In this paper, we identify problems associated with SDN-based firewalls, such as ambiguous flow path calculations and poor scalability in large networks. We survey existing SDN-based firewall designs and their shortcomings in protecting a dynamically scaling network like a data center. We extend our study by evaluating one such SDN-specific security solution called FlowGuard, and identifying new attack vectors and vulnerabilities. We also present corresponding threat detection techniques and respective mitigation strategies.