Secure Interaction Scheme between SDN Application Plane and Control Plane

doi:10.3969/j.issn.1671-1122.2021.06.009

Abstract

Abstract:

Software defined networking (SDN) brings new challenges to network security while promoting network innovation. This paper studies the secure interaction scheme between SDN application plane and control plane to ensure that SDN can provide reliable network services. Firstly, this paper proposes the overall architecture of the secure interaction scheme between SDN application plane and control plane. Secondly, the TLS protocol is used to complete the two-way authentication and secure communication between the application and the controller agent. At the same time, application authority management and application identity information management are designed to ensure that applications can access the controller securely and reasonably. Then, flow rule conflict detection and reconciliation algorithms are proposed to ensure the correct implementation of network policies. Finally, the system is implemented based on Floodlight and Mininet and compared with the existing SDN application identity authentication mechanisms and authority management mechanisms. The experimental results show that the delay introduced by the secure interaction scheme between SDN application plane and control plane proposed in this paper is acceptable.

Key words: software defined networking, application plane, control plane, secure interaction

CLC Number:

TP309

FAN Guangyu, WANG Xingwei, JIA Jie, HUANG Min. Secure Interaction Scheme between SDN Application Plane and Control Plane[J]. Netinfo Security, 2021, 21(6): 70-79.

Figures/Tables 7

References 22

[1]	ONF. Software-defined Networking(SDN) Definition[EB/OL]. , 2020-12-20.
[2]	DABBAGH M, HAMDAOUI B, GUIZANI M, et al. Software-defined Networking Security: Pros and Cons[J]. Communications Magazine IEEE, 2015,53(6):73-79. doi: 10.1109/MCOM.2015.7120048 URL
[3]	RAWAT D B, REDDY S R. Software Defined Networking Architecture, Security and Energy Efficiency: A Survey[J]. IEEE Communications Surveys & Tutorials, 2016,19(1):325-346.
[4]	Project Floodlight. Floodlight Controller[EB/OL]. https://floodlight.atlassian.net/wiki/spaces/floodlightcontroller/overview, 2020-12-20.
[5]	OpenDaylight. Platform Overview[EB/OL]. , 2020-12-22.
[6]	ONF. ONOS[EB/OL]. https://onosproject.org/, 2020 -12-22.
[7]	IETF. Software-defined Networking: A Perspective from within a Service Provider Environment[EB/OL].https://www.rfc-editor.org/info/rfc7149 , 2020 -12-22.
[8]	KREUTZ D, RAMOS F M V, VERISSIMO P. Towards Secure and Dependable Software-defined Networks[C]// ACM. ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, August 22, 2014, Chicago, IL, USA. New York: ACM, 2014: 55-60.
[9]	AHMAD I, NAMAL S, YLIANTTILA M, et al. Security in Software Defined Networks: A Survey[J]. IEEE Communications Surveys & Tutorials, 2015,17(4):2317-2346.
[10]	SHU Zhaogang, WAN Jiafu, LI Di, et al. Security in Software-defined Networking: Threats and Countermeasures[J]. Mobile Networks and Applications, 2016,21(5):764-776. doi: 10.1007/s11036-016-0676-x URL
[11]	SCOTT-HAYWARD S, NATARAJAN S, SEZER S. A Survey of Security in Software Defined Networks[J]. IEEE Communications Surveys & Tutorials, 2016,18(1):623-654.
[12]	ONF. Principles and Practices for Securing Software-defined Networks[EB/OL]. https://opennetworking.org/wp-content/uploads/2014/10/Principles_and_Practices_for_Securing_Software-Defined_Networks_applied_to_OFv1.3.4_V1.0.pdf, 2020-12-25.
[13]	SMELIANSKY R L. SDN for Network Security [C]//IEEE. 2014 International Science and Technology Conference (Modern Networking Technologies), October 28-29, 2014, Moscow, Russia. NJ: IEEE, 2014: 1-5.
[14]	CHAUDHARY R, AUJLA G S, GARG S, et al. SDN-enabled Multi-attribute-based Secure Communication for Smart Grid in IIoT Environment[J]. IEEE Transactions on Industrial Informatics, 2018,14(6):2629-2640. doi: 10.1109/TII.9424 URL
[15]	LEE S, YOON C, SHIN S. The Smaller, the Shrewder: A Simple Malicious Application Can Kill an Entire SDN Environment[C]// ACM. 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization, March 11, 2016, New Orleans, LA, USA. New York: ACM, 2016: 23-28.
[16]	LEE C, SHIN S. SHIELD: An Automated Framework for Static Analysis of SDN Applications[C]// ACM. 2016 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization, March 11, 2016, New Orleans, LA, USA. New York: ACM, 2016: 29-34.
[17]	WANG Pengzhan, HUANG Liusheng, XU Hongli, et al. Rule Anomalies Detecting and Resolving for Software Defined Networks[C]// IEEE. GLOBECOM 2015-2015 IEEE Global Communications Conference, December 6-10, 2015, San Diego, CA, USA. NJ: IEEE, 2016: 1-6.
[18]	PISHARODY S, CHOWDHARY A, HUANG Dijiang. Security Policy Checking in Distributed SDN-based Clouds[C]// IEEE. 2016 IEEE Conference on Communications and Network Security (CNS), October 17-19, 2016, Philadelphia, PA, USA. NJ: IEEE, 2017: 19-27.
[19]	PISHARODY S, NATARAJAN J, CHOWDHARY A, et al. Brew: A Security Policy Analysis Framework for Distributed SDN-based Cloud Environments[J]. IEEE Transactions on Dependable & Secure Computing, 2017,16(6):1011-1025.
[20]	WANG Mengmeng, LIU Jianwei, CHEN Jie, et al. PERM-GUARD: Authenticating the Validity of Flow Rules in Software Defined Networking[C]// IEEE. 2015 IEEE 2nd International Conference on Cyber Security and Cloud Computing, November 3-5, 2015, New York, NY, USA. NJ: IEEE, 2015: 127-132.
[21]	PORRAS P, SHIN S, YEGNESWARAN V, et al. A Security Enforcement Kernel for OpenFlow Networks[EB/OL]. , 2020-12-25.
[22]	PORRAS P A, CHEUNG S, FONG M W, et al. Securing the Software Defined Network Control Layer[EB/OL]. http://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.703.7607&rep=rep1&type=pdf, 2020-12-25.

	Write	Read	Event Remind
Packet In/Out	15	10	5
Controller	12	8	4
Switch	9	6	3
Host	6	4	2
Error	3	2	1

方法	认证机制	权限管理粒度	每个应用权限个数/个
SE-Floodlight	基于角色（默认3个角色）	粗粒度	无
OperationCheckpoint	无	细粒度	15
PermOF	无	细粒度	18
SDNShield	无	细粒度	无
PERM-GUARD	基于身份信息	细粒度	16
本文方法	基于身份信息	细粒度	45