【作者】 杨宁；

【导师】 彭扬；

【作者基本信息】 北京邮电大学 ， 信息与通信工程， 2017， 硕士

【摘要】 软件定义网络是一种新型的网络架构,它将网络的控制功能和转发功能进行解耦,实现了网络控制的直接可编程。在这种架构下,网络是进行集中管理的,管理员可以通过控制器来快速的配置网络资源和动态调整网络流量以应对需求的变化。这几种软件定义网络的优势在学术和工程中已经得到了验证。但是软件定义网络作为发展起步没多久的网络架构还面临着诸多挑战,本论文主要探讨数据层面的安全问题。在软件定义网络架构下,传统的网络存在的ARP欺骗等地址伪造报文威胁依然存在,只是这些攻击可能在形式上发生了变化。而且软件定义网络架构还面临新的安全挑战,即应用可以通过重写流表项来避开需要强制执行的安全应用规则,同时流表项之间也可能存在冲突。本文针对上面两种安全问题,提出了一种软件定义网络架构下数据层的攻击防护策略。针对南向设备的潜在威胁,利用网络中控制器对于全网状态的感知能力,维护一个设备信息映射表,进行伪造报文的检测,这样保证后续模块收到的数据包地址都是正确的,同时论文在主机信用评估方面的设计使得本模块能够更容易的与其它安全模块进行耦合。针对高安全等级应用规则被避开或覆盖的情况,借鉴了头部空间分析技术的思想,将流表项规则和安全规则分别生成规则空间,在应用下发新规则时检测其与两个空间存不存在重叠。如果存在重叠,表示规则出现冲突,调用冲突解决模块丢弃数据包或者进行额外流表项的插入。更多还原

【Abstract】 Software Defined Network is a network architecture that decouples the network control from underlying network forwarding infrastructure so as to enable the network control to become directly programmable.Through software-based SDN controllers, the network is centrally managed so that administrators could configure network resources very quickly and dynamically adjust network-wide traffic flow to meet changing needs. These advantages of SDN have already been proven in academia and industry.However, software defined network are facing some challenges for the short development period, this paper mainly discusses the security issues about data level. With new SDN architecture, some security threats are common to traditional network, including ARP fraud or other forged packets, but the profile of these threats changes. Moreover, there are some new security challenges such as bypassing predefined mandatory policies by overwriting flow entries. Meanwhile, there may be a conflict between the rules of the flow table.Aiming at the above two kinds of security challenges, this paper presents an attack protection strategy for the data layer of software defined network. To resolve the potential threat of the southbound device,we detect forged packets, in use of ability of the controller to perceive the state of the whole network, to ensure that the data packets received by the subsequent modules have correct addresses and, at the same time, the design of the host credit evaluation makes the module can be more easily coupled with other security modules. For the case that the application rules of high security level are bypassed or get overwritten, the flow table rules and the security rules are respectively used to generate the rule space. When new rules are sent to the controller by applications, detect whether there is an overlap between the two spaces, borrowing the idea of header space analysis. Once there is an overlap, which means there are conflicts between rules, we call the conflict resolution module to discard the packet or insert additional flow entries.更多还原