• 文献检索
  • 文档翻译
  • 深度研究
  • 学术资讯
  • Suppr Zotero 插件Zotero 插件
  • 邀请有礼
  • 套餐&价格
  • 历史记录
应用&插件
Suppr Zotero 插件Zotero 插件浏览器插件Mac 客户端Windows 客户端微信小程序
定价
高级版会员购买积分包购买API积分包
服务
文献检索文档翻译深度研究API 文档MCP 服务
关于我们
关于 Suppr公司介绍联系我们用户协议隐私条款
关注我们

Suppr 超能文献

核心技术专利：CN118964589B侵权必究
粤ICP备2023148730 号-1Suppr @ 2026

文献检索

告别复杂PubMed语法，用中文像聊天一样搜索，搜遍4000万医学文献。AI智能推荐，让科研检索更轻松。

立即免费搜索

文件翻译

保留排版，准确专业，支持PDF/Word/PPT等文件格式，支持 12+语言互译。

免费翻译文档

深度研究

AI帮你快速写综述，25分钟生成高质量综述，智能提取关键信息，辅助科研写作。

立即免费体验

防止 OpenFlow 网络中 IPv6 分片滥用的机制。

Mechanism to prevent the abuse of IPv6 fragmentation in OpenFlow networks.

机构信息

National Advanced IPv6 Center, Universiti Sains Malaysia, Gelugor, Penang, Malaysia.

出版信息

PLoS One. 2020 May 11;15(5):e0232574. doi: 10.1371/journal.pone.0232574. eCollection 2020.

DOI:10.1371/journal.pone.0232574
PMID:32392261
原文链接:https://pmc.ncbi.nlm.nih.gov/articles/PMC7213737/
Abstract

OpenFlow makes a network highly flexible and fast-evolving by separating control and data planes. The control plane thus becomes responsive to changes in topology and load balancing requirements. OpenFlow also offers a new approach to handle security threats accurately and responsively. Therefore, it is used as an innovative firewall that acts as a first-hop security to protect networks against malicious users. However, the firewall provided by OpenFlow suffers from Internet protocol version 6 (IPv6) fragmentation, which can be used to bypass the OpenFlow firewall. The OpenFlow firewall cannot identify the message payload unless the switch implements IPv6 fragment reassembly. This study tests the IPv6 fragmented packets that can evade the OpenFlow firewall, and proposes a new mechanism to guard against attacks carried out by malicious users to exploit IPv6 fragmentation loophole in OpenFlow networks. The proposed mechanism is evaluated in a simulated environment by using six scenarios, and results exhibit that the proposed mechanism effectively fixes the loophole and successfully prevents the abuse of IPv6 fragmentation in OpenFlow networks.

摘要

OpenFlow 通过分离控制平面和数据平面，使网络变得高度灵活和快速发展。控制平面因此能够响应拓扑和负载均衡要求的变化。OpenFlow 还提供了一种新的方法来准确和快速地处理安全威胁。因此，它被用作一种创新的防火墙，作为第一道安全防线来保护网络免受恶意用户的攻击。

然而，OpenFlow 提供的防火墙存在 Internet 协议第 6 版 (IPv6) 分片问题，这可能被用来绕过 OpenFlow 防火墙。除非交换机实现 IPv6 分片重组，否则 OpenFlow 防火墙无法识别消息有效负载。本研究测试了可以逃避 OpenFlow 防火墙的 IPv6 分片数据包，并提出了一种新的机制来防范恶意用户利用 IPv6 分片漏洞在 OpenFlow 网络中发起的攻击。该机制在模拟环境中使用六个场景进行了评估，结果表明该机制有效地修复了漏洞，并成功防止了 IPv6 分片在 OpenFlow 网络中的滥用。

https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/f5712746b167/pone.0232574.g020.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/9f1e7de896c4/pone.0232574.g001.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/04148adf0fc0/pone.0232574.g002.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/ef7a8ade6dc6/pone.0232574.g003.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/719131353b86/pone.0232574.g004.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/b9a8ed040563/pone.0232574.g005.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/6a70f03b0d9a/pone.0232574.g006.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/9725064a6203/pone.0232574.g007.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/783493f3efbe/pone.0232574.g008.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/e1332ae6f800/pone.0232574.g009.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/2fb6cd1c1d85/pone.0232574.g010.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/14541809773f/pone.0232574.g011.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/1dac0dbf7995/pone.0232574.g012.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/4e00414b2bd4/pone.0232574.g013.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/1389646be8d5/pone.0232574.g014.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/45bcf363db5a/pone.0232574.g015.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/1a8cac4855f8/pone.0232574.g016.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/3c29696447fa/pone.0232574.g017.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/9a9b6e3f974e/pone.0232574.g018.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/a6dc366ea5b6/pone.0232574.g019.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/f5712746b167/pone.0232574.g020.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/9f1e7de896c4/pone.0232574.g001.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/04148adf0fc0/pone.0232574.g002.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/ef7a8ade6dc6/pone.0232574.g003.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/719131353b86/pone.0232574.g004.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/b9a8ed040563/pone.0232574.g005.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/6a70f03b0d9a/pone.0232574.g006.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/9725064a6203/pone.0232574.g007.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/783493f3efbe/pone.0232574.g008.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/e1332ae6f800/pone.0232574.g009.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/2fb6cd1c1d85/pone.0232574.g010.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/14541809773f/pone.0232574.g011.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/1dac0dbf7995/pone.0232574.g012.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/4e00414b2bd4/pone.0232574.g013.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/1389646be8d5/pone.0232574.g014.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/45bcf363db5a/pone.0232574.g015.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/1a8cac4855f8/pone.0232574.g016.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/3c29696447fa/pone.0232574.g017.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/9a9b6e3f974e/pone.0232574.g018.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/a6dc366ea5b6/pone.0232574.g019.jpg
https://cdn.ncbi.nlm.nih.gov/pmc/blobs/03aa/7213737/f5712746b167/pone.0232574.g020.jpg

相似文献

1
Mechanism to prevent the abuse of IPv6 fragmentation in OpenFlow networks.防止 OpenFlow 网络中 IPv6 分片滥用的机制。
PLoS One. 2020 May 11;15(5):e0232574. doi: 10.1371/journal.pone.0232574. eCollection 2020.
2
DAD-match; Security technique to prevent denial of service attack on duplicate address detection process in IPv6 link-local network.DAD 匹配；防止 IPv6 链路本地网络中重复地址检测过程中拒绝服务攻击的安全技术。
PLoS One. 2019 Apr 2;14(4):e0214518. doi: 10.1371/journal.pone.0214518. eCollection 2019.
3
DICOM image secure communications with Internet protocols IPv6 and IPv4.使用互联网协议IPv6和IPv4进行DICOM图像安全通信。
IEEE Trans Inf Technol Biomed. 2007 Jan;11(1):70-80. doi: 10.1109/titb.2006.879606.
4
Adaptive Suspicious Prevention for Defending DoS Attacks in SDN-Based Convergent Networks.基于软件定义网络的融合网络中用于防御拒绝服务攻击的自适应可疑预防
PLoS One. 2016 Aug 5;11(8):e0160375. doi: 10.1371/journal.pone.0160375. eCollection 2016.
5
Addressless: A new internet server model to prevent network scanning.无址化：一种新的互联网服务器模型，用于防止网络扫描。
PLoS One. 2021 Feb 2;16(2):e0246293. doi: 10.1371/journal.pone.0246293. eCollection 2021.
6
Intelligent Approach to Network Device Migration Planning towards Software-Defined IPv6 Networks.面向软件定义 IPv6 网络的网络设备迁移规划智能方法。
Sensors (Basel). 2021 Dec 26;22(1):143. doi: 10.3390/s22010143.
7
Experimental validation and performance evaluation of OpenFlow-based wavelength path control in transparent optical networks.透明光网络中基于OpenFlow的波长路径控制的实验验证与性能评估
Opt Express. 2011 Dec 19;19(27):26578-93. doi: 10.1364/OE.19.026578.
8
Cryptanalysis and Improvement of "A Secure Password Authentication Mechanism for Seamless Handover in Proxy Mobile IPv6 Networks".《代理移动IPv6网络中无缝切换的安全密码认证机制》的密码分析与改进
PLoS One. 2015 Nov 18;10(11):e0142716. doi: 10.1371/journal.pone.0142716. eCollection 2015.
9
Performance Evaluation Model for Application Layer Firewalls.应用层防火墙性能评估模型
PLoS One. 2016 Nov 28;11(11):e0167280. doi: 10.1371/journal.pone.0167280. eCollection 2016.
10
Design and Evaluation of a Proxy-Based Monitoring System for OpenFlow Networks.基于代理的OpenFlow网络监测系统的设计与评估
ScientificWorldJournal. 2016;2016:6513649. doi: 10.1155/2016/6513649. Epub 2016 Feb 23.

引用本文的文献

1
An adaptive detection model for IPv6 extension header threats based on deterministic decision automaton.一种基于确定性决策自动机的IPv6扩展报头威胁自适应检测模型。
Sci Rep. 2024 Apr 25;14(1):9534. doi: 10.1038/s41598-024-59913-8.
2
A Systematic Literature Review on Machine Learning and Deep Learning Approaches for Detecting DDoS Attacks in Software-Defined Networking.软件定义网络中基于机器学习和深度学习的 DDoS 攻击检测方法的系统文献综述
Sensors (Basel). 2023 May 1;23(9):4441. doi: 10.3390/s23094441.

本文引用的文献

1
Distributed controller clustering in software defined networks.软件定义网络中的分布式控制器集群
PLoS One. 2017 Apr 6;12(4):e0174715. doi: 10.1371/journal.pone.0174715. eCollection 2017.
2
Global patterns and controls of soil organic carbon dynamics as simulated by multiple terrestrial biosphere models: Current status and future directions.多种陆地生物圈模型模拟的土壤有机碳动态的全球模式与控制：现状与未来方向
Global Biogeochem Cycles. 2015 Jun;29(6):775-792. doi: 10.1002/2014GB005021. Epub 2015 Jun 5.