欢迎您！东篱公司
退出
-
申报数据库
-
立项数据库
-
成果数据库
-
项目获奖数据库
中文摘要：
软件定义网络SDN（Software-Defined Networking）是由美国斯坦福大学Clean Slate研究组提出的一种新型网络创新架构,可通过软件编程的形式定义和控制网络,其控制平面和转发平面分离及开放性可编程的特点,为新型互联网体系结构研究提供了新的实验途径,也极大地推动了下一代互联网的发展.OpenFlow是SDN的主要协议,定义了SDN控制器与交换机之间的通信标准.目前,很多基于OpenFlow的SDN设备已经在实际中得到了部署.但是,基于OpenFlow的SDN却面临很多安全挑战.其中一个重要的挑战是如何建立一个安全可靠的SDN防火墙应用.由于OpenFlow协议的无状态性,现有的SDN防火墙可以被通过改写交换机中的流表项轻松绕过.针对这一安全威胁,作者提出了基于Flowpath的实时动态策略冲突检测与解决方法.通过获取实时的SDN网络状态,能够准确地检测防火墙策略的直接和间接违反,并且一旦发现冲突,可以基于Flowpath进行自动化和细粒度的冲突解决.最后,作者在开源控制器Floodlight上实现了一个安全增强的防火墙应用FlowVerifier,并基于Mininet对FlowVerifier的性能进行了评估.结果表明FlowVerifier能够检测和自动化地解决SDN网络中由于流表改写而引入的策略冲突及其带来的安全威胁.
英文摘要：
Software-Defined Networking （SDN） is an innovational network framework introduced by Clean Slate at Stanford University. It enables programmers to control and define the networks by software programming. Additionally, SDN separates data plane and control plane in the networks, and it provides open API and programmability. All of these features provide a new way for the study of new Internet architecture, and have greatly promoted the development of Internet. OpenFlow is a standard protocol of SDN, which defines the communication protocol between SDN controllers and switches. Nowadays, many SDN devices based on OpenFlow have been deployed. However, it is faced with many security challenges and one of the most critical challenges is how to implement a secure and reliable SDN firewall application. Due to the statelessness of OpenFlow protocol, the existing firewall security policy for SDN could be easily bypassed by rewriting the flow entries in the switches. To address such a threat, we present a novel approach for real-time policy conflict detection and resolution based on Flowpath. Our approach can accurately detect and effectively resolve policy conflicts through acquiring the network state of SDN in real time. In addition, we present FlowVerifier architecture and implement the SDN firewall application based on our proposed approach in Floodlight. We also evaluate the performance and effectiveness of FlowVerifier in Mininet. Our evaluation results demonstrate that FlowVerifier can automatically detect and resolve the threats of policy conflicts induced by rewriting flow entries.
同期刊论文项目
同项目期刊论文
期刊信息
位置：