计算机科学与探索 ›› 2015, Vol. 9 ›› Issue (1): 63-70.DOI: 10.3778/j.issn.1673-9418.1407061

• 网络与信息安全 • 上一篇    下一篇

面向SDN环境的软件定义安全架构

刘文懋1,2+,裘晓峰3,陈鹏程3,文旭韬3,何新新3,汪东升1,李  军1   

  1. 1. 清华大学 信息技术研究院,北京 100084
    2. 北京神州绿盟科技股份有限公司,北京 100089
    3. 北京邮电大学 移动生活与新媒体实验室,北京 100876
  • 出版日期:2015-01-01 发布日期:2014-12-31

SDN Oriented Software-Defined Security Architecture

LIU Wenmao1,2+, QIU Xiaofeng3, CHEN Pengcheng3, WEN Xutao3, HE Xinxin3, WANG Dongsheng1, LI Jun1   

  1. 1. Research Institute of Information Techonlogy, Tsinghua University, Beijing 100084, China
    2. NSFOCUS Information Technology Co., Ltd., Beijing 100089, China
    3. Mobile Life and New Media Lab, Beijing University of Posts and Telecommunications, Beijing 100876, China
  • Online:2015-01-01 Published:2014-12-31

摘要: OpenFlow协议无深度包检测能力使其在安全应用中受限,同时现有安全解决方案不能适应软件定义网络(software-defined networking,SDN)的发展。提出了一个分布式的软件定义安全架构(software-defined security architecture,SDSA),可将安全功能从SDN控制器解耦到专有的安全控制器和安全APP,提供了全局流和局部数据包层面的检测和防护,以抵御SDN和虚拟化环境中的各类攻击。全局视图和知识库有助于进行快速准确的决策,安全数据和控制分离既极大简化了安全设备的处理逻辑,又使得安全控制器具有灵活的控制平面,并且实时下发策略到设备和动态牵引流量,从而使得整个防护响应大大加快。实验表明SDSA架构可有效防护DoS、端口扫描和异常大流量等各类攻击。

关键词: 软件定义安全, 云计算, 网络虚拟化

Abstract: Current OpenFlow specifications provide limited access to packet details, making it inefficient to deploy security applications. Moreover, current security solutions become less flexible as software defined-networking (SDN) develops. This paper proposes a distributed software-defined security architecture (SDSA), which offloads heavy security processing from SDN controller to a dedicated security controller and security APPs, providing both flow and packet level protections against various attacks in the SDN and virtual environment. This paper gives the global view and knowledge of flows, IaaS assets and devices, which can make accurate decisions and ensures devices to execute security rules instantly. The architecture simplifies security device logic greatly by separating security data and control planes, the detection and protection are automated with standardized control messages, making the security reaction fast. The experiments demonstrate that SDSA can detect DoS attack, port scan and abnormal high traffic with low cost and little overhead.

Key words: software-defined security, cloud computing, network virtualization