一种基于零信任的SDN网络访问控制方法

doi:10.3969/j.issn.1671-1122.2020.08.005

信息网络安全 ›› 2020, Vol. 20 ›› Issue (8): 37-46.doi: 10.3969/j.issn.1671-1122.2020.08.005

一种基于零信任的SDN网络访问控制方法

吴云坤¹(), 姜博², 潘瑞萱³, 刘玉岭⁴

1.中国科学院大学,北京100049
2.中国信息通信研究院,北京 100191
3.信息工程大学,郑州 450004
4.中国科学院信息工程研究所,北京 100190

收稿日期:2020-06-08 出版日期:2020-08-10 发布日期:2020-10-20
通讯作者: 吴云坤 E-mail:wuyunkun@qianxin.com
作者简介:吴云坤（1975—）,男,江苏,高级工程师,硕士,主要研究方向为大数据安全、态势感知、身份安全、工业互联网安全等|姜博（1987—）,男,北京,工程师,硕士,主要研究方向为软件定义网络、数据分析、无线电管理信息化|潘瑞萱（1995—）,女,陕西,硕士研究生,主要研究方向为网络访问控制|刘玉岭（1982—）,男,山东,副教授,博士,主要研究方向为网络安全测评和等级保护。
基金资助:
国家自然科学基金(61902427)

A SDN Access Control Mechanism Based on Zero Trust

WU Yunkun¹(), JIANG Bo², PAN Ruixuan³, LIU Yuling⁴

1. University of Chinese Academy of Sciences, Beijing 100049, China
2. China Academy of Information and Communications Technology, Beijing, 100191, China
3. Information Engineering University, Zhengzhou 450004, China
4. Institute of Information Engineering, Chinese Academy of Sciences, Beijing 100190, China

Received:2020-06-08 Online:2020-08-10 Published:2020-10-20
Contact: WU Yunkun E-mail:wuyunkun@qianxin.com

摘要/Abstract

摘要：

软件定义网络（Software-defined Networking,SDN）是一种逻辑控制与数据转发分离的新型网络体系结构,它能够为互联网提供满足当前及未来需求的平滑演进能力,已成为未来互联网的发展方向,为解决网络安全问题提供了新思路。目前SDN网络缺乏有效的网络动态访问控制机制,为此文章提出了一种基于零信任的SDN网络访问控制方法：首先引入“零信任”的安全概念构建SDN网络下的网络访问控制框架,该框架对用户入网后的行为实现了实时监测与信任度量,并能够根据度量结果动态调整用户资源访问权限;然后设计了一套面向SDN网络的用户行为信任分级度量指标,选取SDN网络中南向协议Openflow支持计量的行为度量指标,使指标结果易于测度;接着设计了基于云理论的用户行为信任度量算法,并提出基于行为的用户信任度动态度量机制和基于流表的SDN网络资源访问控制方法,通过采取“从不信任并始终验证”的立场对用户在网络中的行为进行周期性持续监测,并根据其行为数据度量用户的信任值,当用户的信任等级降到不可信时,通过SDN控制器迅速下发流表以阻止其继续访问网络;最后通过仿真实验验证了文章模型及方法的有效性,结果表明文章方法能实现更细粒度和动态的访问控制。

关键词: SDN网络, 访问控制, 零信任, 云理论, 信任度量

Abstract:

Software defined network (SDN) is a new network architecture which separates logic control and data forwarding. It can provide the Internet with smooth evolution ability to meet the current and future needs.SDN not only becomes a new development direction of future internet, but also gives a new way to solve the problem of network security. At present, SDN network lacks effective network dynamic access control mechanism. Therefore, this paper proposes a zero-trust based access control method for SDN network. Firstly, the security concept of "zero trust" is introduced to construct the network access control framework under SDN network. The proposed framework achieves the real-time monitoring and trust measurement of insider user behaviors. Moreover, it can adjust user resource access privilege according to the measurement results dynamically. Then, the set of user behavior trust metrics for SDN network is designed, and the behavior metrics supported by Openflow in SDN network are selected to make the index results easy to measure. The dynamic measurement mechanism of user trust based on behavior as well as the SDN network resource access control using flow table is proposed. From the viewpoint of "never trust and always verify", the behavior of users in the network is monitored periodically, and the trust value of users is measured according to their behavior data. When the user trust degree drops to an untrusted degree, the flow table is quickly issued to prevent the user from continuing to access the network. Finally, the effectiveness of the proposed model and method is verified by simulations. The experiments show that our method can achieve more fine-grained and dynamic access control.

Key words: SDN network, access control, zero trust, cloud theory, credible measurement

中图分类号:

TP309

吴云坤, 姜博, 潘瑞萱, 刘玉岭. 一种基于零信任的SDN网络访问控制方法[J]. 信息网络安全, 2020, 20(8): 37-46.

WU Yunkun, JIANG Bo, PAN Ruixuan, LIU Yuling. A SDN Access Control Mechanism Based on Zero Trust[J]. Netinfo Security, 2020, 20(8): 37-46.

图/表 10

图1

图2

图3

图4

图5

表1

图6

图7

表2

表3

参考文献 15

[1]	CERRONI W, BURATTI C, CERBONI S, et al. Intent-based Management and Orchestration of Heterogeneous Openflow/IoT SDN Domains[C]// IEEE. 2017 IEEE Conference on Network Softwarization, July 3-7, 2017, Bologna, Italy. NJ: IEEE, 2017: 1-9.
[2]	WU Qingbiao. Research on Web Authentication and Access Control in Software-defined Networking[M]. Chengdu, Southwest Jiaotong University, 2015.
	吴庆彪. 软件定义网络Web认证与访问控制技术研究[M]. 成都:西南交通大学, 2015.
[3]	ZHANG Runhuan. Research and Implementation of Resilient Control Mechanism for Network Resources Based on SDN[M]. Nanjing, Southeast University, 2018.
	张润环. 基于SDN的网络资源弹性控制机制的研究与实现[M]. 南京:东南大学, 2018.
[4]	ZAHEER Z, CHANG H, MUKHERJEE S, et al. EZTrust: Network-Independent Zero-Trust Perimeterization for Microservices[C]// ACM. 2019 ACM SOSR Symposium on SDN Research, April 3-4, 2019, San Jose, Canada. NY: ACM, 2019: 49-61.
[5]	XIE Dejun, WANG Liming, SONG Chen, et al. Design and Implementation of an Adaptive Network Access Control System Based on SDN[J]. Network New Media Technology, 2017,6(5):20-28.
	谢德俊, 王利明, 宋晨, 等. SDN自适应网络访问控制系统的设计与实现[J]. 网络新媒体技术, 2017,6(5):20-28.
[6]	WU Zenan, TIAN Liqin, WANG Zhigang. Behavior Authentication of Web Users Based on Machine Learning[J]. Chinese Journal of Network and Information Security, 2018,4(1):45-51.
	毋泽南, 田立勤, 王志刚. 基于机器学习的Web用户行为认证[J]. 网络与信息安全学报, 2018,4(1):45-51.
[7]	JI Tieguo, TIAN Liqin, HU Zhixing, et al. AHP-based User Behavior Evaluation Method in Trustworthy Network[J]. Chinese Computer Engineering and Applications, 2007,43(19):123-126.
	冀铁果, 田立勤, 胡志兴, 等. 可信网络中一种基于AHP的用户行为评估方法[J]. 计算机工程与应用, 2007,43(19):123-126.
[8]	TIAN Liqian, LIN Chuang. A Kind of Game-theoretic Control Mechanism of User Behavior Trust Based on Prediction in Trustworthy Network[J]. Chinese Journal of Computer, 2007,30(11):1930-1938.
	田立勤, 林闯. 可信网络中一种基于行为信任预测的博弈控制机制[J]. 计算机学报, 2007,30(11):1930-1938.
[9]	TIAN Guohui, YIN Jianqin, YAN Yunzhang, et al. Gaussian Mixture Models and Principal Component Analysis-based Human Trajectory Behavior Recognition[J]. Acta Electronica Sinica, 2016,44(1):143-149.
	田国会, 尹建芹, 闫云章, 等. 基于混合高斯模型和主成分分析的轨迹分析行为识别方法[J]. 电子学报, 2016,44(1):143-149.
[10]	WARD R, BEYER B. BeyondCorp: A New Approach to Enterprise Security[J]. The Magazine of Usenixand Sage, 2014,39(6):6-11.
[11]	RIZVI S, RYOO J, LIU Y, et al. A Centralized Trust Model Approach for Cloud Computing[C]// IEEE. 23rd IEEE Wireless and Optical Communication Conference, May 9-10, 2014, Newark, New Jersey, USA. NJ: IEEE, 2014: 1-6.
[12]	DECUSATIS C, LIENGTIRAPHAN P, SAGER A, et al. Implementing Zero Trust Cloud Networks with Transport Access Control and First Packet Authentication[C]// IEEE. 2016 IEEE International Conference on Smart Cloud, November 18-20, 2016, New York, USA. NJ: IEEE, 2016: 5-10.
[13]	EIDLE D, NI S, DECUSATIS C, et al. Autonomic Security for Zero Trust Networks[C]// IEEE. 8rd IEEE Annual Ubiquitous Computing, Electronics and Mobile Communication Conference, October 19-21, 2017, New York, USA. NJ: IEEE, 2017: 288-293.
[14]	SAMANIEGO M, DETERS R. Zero-Trust Hierarchical Management in IoT[C]// IEEE. 2018 IEEE International Congress on Internet of Things, July 2-7, 2018, San Francisco, CA, USA. NJ: IEEE, 2018: 88-95.
[15]	JOHN M. Testing Intrusion Detection Systems: A Critique of the 1998 and 1999 DARPA Intrusion Detection System Evaluations as Performed by Lincoln Laboratory[J]. ACM Transactions on Information and System Security, 2000,3(4):262-294.

名称	含义
ADD	用来添加一条新的流表项
DELETE	用来删除所有符合一定条件的流表项
DELETE-STRICT	用来删除某一条指定的流表项
MODIFY	用来修改所有符合一定条件的流表项
MODIFY-STRICT	修改某一条指定的流表项

标准正态信任云	与实际正态信任云的相似度
低信任	0.0001
一般信任	0.6732
高信任	0.0021

指标文献	信任度量方法	具体度量指标	持续度量机制	动态调整用户权限	考虑用户误操作行为
文献[6]	支持向量机	√	×	×	×
文献[7]	AHP	√	×	×	×
文献[8]	贝叶斯	×	×	√	×
文献[9]	混合高斯模型	×	×	×	√
本文	零信任+云理论	√	√	√	√

一种基于零信任的SDN网络访问控制方法

A SDN Access Control Mechanism Based on Zero Trust

RichHTML

PDF (PC)

可视化

摘要/Abstract

引用本文

使用本文

图/表 10

参考文献 15

相关文章 15

编辑推荐

Metrics

本文评价

[1]	汪金苗, 谢永恒, 王国威, 李易庭. 基于属性基加密的区块链隐私保护与访问控制方法[J]. 信息网络安全, 2020, 20(9): 47-51.
[2]	杜义峰, 郭渊博. 一种基于信任值的雾计算动态访问控制方法[J]. 信息网络安全, 2020, 20(4): 65-72.
[3]	刘鹏, 何倩, 刘汪洋, 程序. 支持撤销属性和外包解密的CP-ABE方案[J]. 信息网络安全, 2020, 20(3): 90-97.
[4]	喻露, 罗森林. RBAC模式下数据库内部入侵检测方法研究[J]. 信息网络安全, 2020, 20(2): 83-90.
[5]	许盛伟, 王飞杰. 多机构授权下可追踪可隐藏的属性基加密方案[J]. 信息网络安全, 2020, 20(1): 33-39.
[6]	汪金苗, 王国威, 王梅, 朱瑞瑾. 面向雾计算的隐私保护与访问控制方法[J]. 信息网络安全, 2019, 19(9): 41-45.
[7]	叶阿勇, 金俊林, 孟玲玉, 赵子文. 面向移动终端隐私保护的访问控制研究[J]. 信息网络安全, 2019, 19(8): 51-60.
[8]	秦中元, 韩尹, 张群芳, 朱雪金. 一种改进的多私钥生成中心云存储访问控制方案[J]. 信息网络安全, 2019, 19(6): 11-18.
[9]	蔡方博, 何泾沙, 朱娜斐, 韩松. 分布式访问控制模型中节点级联失效研究[J]. 信息网络安全, 2019, 19(12): 47-52.
[10]	时向泉, 陶静, 赵宝康. 面向虚拟化环境的网络访问控制系统[J]. 信息网络安全, 2019, 19(10): 1-9.
[11]	石悦, 李相龙, 戴方芳. 一种基于属性基加密的增强型软件定义网络安全框架[J]. 信息网络安全, 2018, 18(1): 15-22.
[12]	郁湧, 刘永刚, 顾捷. 网构软件系统中构件之间信任关系分析与度量[J]. 信息网络安全, 2018, 18(1): 31-37.
[13]	马国峻, 李凯, 裴庆祺, 詹阳. 一种社交网络中细粒度人脸隐私保护方案[J]. 信息网络安全, 2017, 17(8): 26-32.
[14]	卿勇, 孙伟, 熊虎, 赵洋. 云计算中可撤销存储的外包加解密CP-ABE方案[J]. 信息网络安全, 2017, 17(6): 6-8.
[15]	顾春华, 高远, 田秀霞. 安全性优化的RBAC访问控制模型[J]. 信息网络安全, 2017, 17(5): 74-79.