Lin Zhaowen, Tao Dan, Wang Zhenji
Network and Information Center, Institute of Network Technology, Beijing University of Posts and Telecommunications, Beijing 100876, China.
Science and Technology on Information Transmission and Dissemination in Communication Networks Laboratory, Beijing University of Posts and Telecommunications, Beijing 100876, China.
Sensors (Basel). 2017 Apr 21;17(4):920. doi: 10.3390/s17040920.
For a Software Defined Network (SDN), security is an important factor affecting its large-scale deployment. The existing security solutions for SDN mainly focus on the controller itself, which has to handle all the security protection tasks by using the programmability of the network. This will undoubtedly involve a heavy burden for the controller. More devastatingly, once the controller itself is attacked, the entire network will be paralyzed. Motivated by this, this paper proposes a novel security protection architecture for SDN. We design a security service orchestration center in the control plane of SDN, and this center physically decouples from the SDN controller and constructs SDN security services. We adopt virtualization technology to construct a security meta-function library, and propose a dynamic security service composition construction algorithm based on web service composition technology. The rule-combining method is used to combine security meta-functions to construct security services which meet the requirements of users. Moreover, the RETE algorithm is introduced to improve the efficiency of the rule-combining method. We evaluate our solutions in a realistic scenario based on OpenStack. Substantial experimental results demonstrate the effectiveness of our solutions that contribute to achieve the effective security protection with a small burden of the SDN controller.
对于软件定义网络（SDN）而言，安全性是影响其大规模部署的一个重要因素。现有的SDN安全解决方案主要集中在控制器本身，该控制器必须利用网络的可编程性来处理所有的安全保护任务。这无疑会给控制器带来沉重负担。更具破坏性的是，一旦控制器本身受到攻击，整个网络将陷入瘫痪。受此启发，本文提出了一种新颖的SDN安全保护架构。我们在SDN的控制平面中设计了一个安全服务编排中心，该中心与SDN控制器进行物理解耦并构建SDN安全服务。我们采用虚拟化技术构建一个安全元功能库，并基于Web服务组合技术提出一种动态安全服务组合构建算法。使用规则组合方法来组合安全元功能，以构建满足用户需求的安全服务。此外，引入RETE算法来提高规则组合方法的效率。我们在基于OpenStack的实际场景中评估我们的解决方案。大量实验结果证明了我们的解决方案的有效性，这些解决方案有助于在SDN控制器负担较小的情况下实现有效的安全保护。
