Port address overloading based packet forwarding verification in SDN

Ping WU; Chaowen CHANG; Yingying MA

doi:10.11959/j.issn.1000-436x.2021108

您当前的位置：

首页 >

文章列表页 >

Port address overloading based packet forwarding verification in SDN

Papers | 更新时间：2024-06-05

- Port address overloading based packet forwarding verification in SDN
- Journal on Communications Vol. 42, Issue 7, Pages: 70-83(2021)
- 作者机构：
  
  信息工程大学密码工程学院，河南郑州 450004
- 作者简介：
- 基金信息：
  
  The National Natural Science Foundation of China(61572517)
- DOI：10.11959/j.issn.1000-436x.2021108
  CLC： TP393
- Online First：2021-07，
  
  Published：25 July 2021
- 稿件说明：
移动端阅览
Ping WU, Chaowen CHANG, Yingying MA. Port address overloading based packet forwarding verification in SDN[J]. Journal on Communications, 2021, 42(7): 70-83.
DOI：

Ping WU, Chaowen CHANG, Yingying MA. Port address overloading based packet forwarding verification in SDN[J]. Journal on Communications, 2021, 42(7): 70-83. DOI： 10.11959/j.issn.1000-436x.2021108.

摘要

针对软件定义网络（SDN）现有转发验证机制因嵌入额外的分组字段所带来的通信开销大的问题，提出基于端址重载的包转发验证机制。其核心思想是入口交换机重构数据分组端口和地址信息实现端址重载，下游交换机基于重载的端址信息实现数据分组的概率验证，控制器统计路径中节点验证有效和无效的数据分组信息并定位异常；理论分析给出了恶意注入与丢弃攻击异常检测阈值；最后实现了所提机制并对其进行了评估。实验结果表明，所提机制以引入不超过10%的转发时延、低于8%的吞吐率损失实现高效转发及有效的异常定位。

Abstract

Aiming at the problem that the existing forwarding verification mechanisms in software-defined networking (SDN) incur significant communication overhead caused by embedding additional packet fields

a packet forwarding verification mechanism based on port address overloading was proposed

which key idea was the ingress switch implemented port address overloading by reconstructing port and address of packet

downstream switches executed packet probabilistic verification based on overloading port address

and the controller acquired valid and invalid packet statistics of node verification in the path and localized anomaly.Anomaly detection threshold of malicious injecting and dropping packets was presented by theoretical analysis.Finally

the proposed scheme was implemented and evaluated.Experiments demonstrate the proposed scheme achieves efficient forwarding and effective anomaly localization with less than 10% of additional forwarding delays and less than 8% of throughput degradation.

关键词

Keywords

references

MCKEOWN N , ANDERSON T , BALAKRISHNA H , et al . OpenFlow:enabling innovation in campus networks [J ] . Computer Communication Review , 2008 , 38 ( 2 ): 69 - 74 .

NUNES B A A , MENDONCA M , NGUYEN X N , et al . A survey of software-defined networking:past,present,and future of programmable networks [J ] . IEEE Communications Surveys ＆ Tutorials , 2014 , 16 ( 3 ): 1617 - 1634 .

王蒙蒙 , 刘建伟 , 陈杰 , 等 . 软件定义网络:安全模型、机制及研究进展 [J ] . 软件学报 , 2016 , 27 ( 4 ): 969 - 992 .

WANG M M , LIU J W , CHEN J , et al . Software defined networking:security model,threats and mechanism [J ] . Journal of Software , 2016 , 27 ( 4 ): 969 - 992 .

SINGH D , SHIV A , CHAMOLI S K . Software defined networking (SDN) challenges,issues and solution [J ] . International Journal of Engineering and Computer Science , 2019 , 7 ( 1 ): 884 - 889 .

GUDE N , KOPONEN T , PETTIT J , et al . Nox [J ] . ACM SIGCOMM Computer Communication Review , 2008 , 38 ( 3 ): 105 - 110 .

PORRAS P , CHEUNG S , FONG M , et al . Securing the software-defined network control layer [C ] // Network and Distributed System Security Symposium . Piscataway:IEEE Press , 2015 : 1 - 15 .

SHIN S , SONG Y , LEE T , et al . Rosemary:a robust,secure,and high-performance network operating system [C ] // Proceedings of the 2014 ACM SIGSAC Conference on Computer and Communications Security . New York:ACM Press , 2014 : 78 - 89 .

HONG S , XU L , WANG H , et al . Poisoning network visibility in software-defined networks:new attacks and countermeasures [C ] // Network and Distributed System Security Symposium . Piscataway:IEEE Press , 2015 : 1 - 15 .

ANDERSEN D G , BALAKRISHNAN H , FEAMSTER N , et al . Accountable Internet protocol (AIP) [C ] // Proceedings of the ACM SIGCOMM 2008 conference on Data communication . New York:ACM Press , 2008 : 1 - 8 .

PAPPAS C , REISCHUK R M , PERRIG A . FAIR:forwarding accountability for Internet reputability [C ] // 2015 IEEE 23rd International Conference on Network Protocols . Piscataway:IEEE Press , 2015 : 189 - 200 .

ZHANG X , ZHOU Z , HSIAO H C , et al . ShortMac:efficient data-plane fault localization [C ] // Network and Distributed System Security Symposium . Piscataway:IEEE Press , 2012 : 2 - 12 .

MIZRAK A T , CHENG Y C , MARZULLO K , et al . Fatih:detecting and isolating malicious routers [C ] // 2005 International Conference on Dependable Systems and Networks . Piscataway:IEEE Press , 2005 : 538 - 547 .

LIU K J , DENG J , VARSHNEY P K , et al . An acknowledgment-based approach for the detection of routing misbehavior in MANETs [J ] . IEEE Transactions on Mobile Computing , 2007 , 6 ( 5 ): 536 - 550 .

ZHANG X , JAIN A , PERRIG A . Packet-dropping adversary identification for data plane security [C ] // Proceedings of the 2008 ACM CoNEXT Conference . New York:ACM Press , 2008 :24.

PADMANABHAN V N , SIMON D R . Secure traceroute to detect faulty or malicious routing [J ] . ACM SIGCOMM Computer Communication Review , 2003 , 33 ( 1 ): 77 - 82 .

BOSSHART P , DALY D , GIBB G , et al . P4:programming protocol-independent packet processors [J ] . ACM SIGCOMM Computer Communication Review , 2014 , 44 ( 3 ): 87 - 95 .

YAO G , BI J , XIAO P Y . Source address validation solution with OpenFlow/NOX architecture [C ] // 2011 19th IEEE International Conference on Network Protocols . Piscataway:IEEE Press , 2011 : 7 - 12 .

CASADO M , FREEDMAN M J , PETTIT J , et al . Ethane [J ] . ACM SIGCOMM Computer Communication Review , 2007 , 37 ( 4 ): 1 - 12 .

BALLARD J R , RAE I , AKELLA A . Extensible and scalable network monitoring using OpenSAFE [C ] // Internet Network Management Conference on Research on Enterprise Networking . Berkeley:USENIX Association , 2010 : 1 - 5 .

WUNDSAM A , LEVIN D , SEETHARAMAN S , et al . OFRewind:enabling record and replay troubleshooting for networks [C ] // Usenix Conference on Usenix Technical Conference . Berkeley:USENIX Association , 2011 : 1 - 6 .

KIM T H J , BASESCU C , JIA L M , et al . Lightweight source authentication and path validation [J ] . ACM SIGCOMM Computer Communication Review , 2015 , 44 ( 4 ): 271 - 282 .

周启钊 , 于俊清 , 李冬 . SDN环境下SAVI动态配置技术研究 [J ] . 通信学报 , 2018 , 39 ( S1 ): 235 - 243 .

ZHOU Q Z , YU J Q , LI D . Dynamic source address validation in software defined network [J ] . Journal on Communications , 2018 , 39 ( S1 ): 235 - 243 .

王首一 , 李琦 , 张云 . 轻量级的软件定义网络数据分组转发验证 [J ] . 计算机学报 , 2019 , 42 ( 1 ): 176 - 189 .

WANG S Y , LI Q , ZHANG Y . LPV:lightweight packet forwarding verification in SDN [J ] . Chinese Journal of Computers , 2019 , 42 ( 1 ): 176 - 189 .

DHAWAN M , PODDAR R , MAHAJAN K , et al . SPHINX:detecting security attacks in software-defined networks [C ] // Proceedings 2015 Network and Distributed System Security Symposium . Piscataway:IEEE Press , 2015 : 1 - 15 .

SASAKI T , PAPPAS C , LEE T , et al . SDNsec:forwarding accountability for the SDN data plane [C ] // 2016 25th International Conference on Computer Communication and Networks . Piscataway:IEEE Press , 2016 : 1 - 10 .

祝现威 , 常朝稳 , 朱智强 , 等 . 基于身份属性的SDN 控制转发方法 [J ] . 通信学报 , 2019 , 40 ( 11 ): 1 - 18 .

ZHU X W , CHANG C W , ZHU Z Q , et al . SDN control and forwarding method based on identity attribute [J ] . Journal on Communications , 2019 , 40 ( 11 ): 1 - 18 .

HESS F , . Efficient identity based signature schemes based on pairings [C ] // Selected Areas in Cryptography . 2003 : 310 - 324 .

HAGERUP T , RÜB C , . A guided tour of chernoff bounds [J ] . Information Processing Letters , 1990 , 33 ( 6 ): 305 - 308 .

LYNN B . On the implementation of pairing-based cryptosystems [D ] . Stanford:Stanford University , 2007 .

Views

895

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Software-defined time-sensitive networking for hybrid multi-domain networking

Address overloading-based packet forwarding verification in SDN

Adaptive SDN switch migration mechanism based on coalitional game

Software-defined networking QoS optimization based on deep reinforcement learning

Traffic scheduling method based on segment routing in software-defined networking

Related Author

HU Yihong

LIU Yaqiong

SHOU Guochu

GUO Mengjie

Zhibin ZUO

Julong LAN

Lan YAO

Yuxiang HU

Related Institution

School of Information and Communication Engineering, Beijing University of Posts and Telecommunications

College of Information Science and Engineering, Henan University of Technology

National Digital Switching System Engineering ＆Research Center

Computer Network information Center, Chinese Academy of Sciences

University of Chinese Academy of Sciences

AI问答

⁰