电光与控制, 2016, 23 (3): 49, 网络出版: 2016-04-05  

面向SDN的源地址验证方法研究

Source Address Validation Methods Based on SDN
作者单位
中国电子科技集团公司电子科学研究院,北京 100041
摘要
当前互联网上出现越来越多的基于源地址欺骗的网络攻击,这类攻击很难被追查,对网络安全造成巨大威胁。在传统网络条件的限制下,实现源地址验证会遇到很多困难。得益于软件定义网络(SDN)带来的网络革新,网络控制变得更加便捷。面向SDN架构,利用可编程控制器对源地址验证方法进行重新设计和实现,提出两种面向SDN的源地址验证方法:一种是将无状态的IP地址与底层不可变标记如MAC地址、端口号绑定起来,在交换机中形成(MAC地址,端口号,源IP地址)三元组流表的过滤规则;另一种是利用最短路径算法计算路由路径,向路径上交换机下发(源IP地址,目的IP地址,入端口,出端口)四元组流表作为过滤准则。最后进行仿真实验,比较两种方案的实验结果。
Abstract
Nowadays, more and more attacks based on source address spoofing appear on the internet, which is difficult to trace and is a big threat to network security.Under the condition of the existing network environment, it is very difficult to implement source address validation.A significant network innovation brought by Software-Defined Networking (SDN) has made the network control more convenient.This article utilizes programmable controller to redesign and implement source address validation method, and puts forward two kinds of source address validation methods based on SDN.One is binding the stateless IP address and underlying immutable tags like MAC address/Port, forming a triple flow table filtering rules (MAC, Port and IP) in the interchanger;the other is to compute routing path with the shortest path algorithm, sending flow tables like source_IP, destination_IP, in_port and out_port as filtering rules.Simulation experiment was made to compare the effect of the two schemes.
参考文献

[1] MICKEOWN N, ANDERSON T, BALAKRISHNAN H, et al. OpenFlow:enabling innovation in campus networks[J].ACM Sigcomm Computer Communication Review, 2008, 38(2):69-74.

[2] 姚广,毕军.互联网中IP源地址伪造及防护技术[J].电信科学,2008,24(1):26-33.(YAO G, BI J.Source address spoofing and prevention technologies in internet[J].Telecommunications Science, 2008, 24(1):26-33.)

[3] BREMLER B A, LEVY H.Spoofing prevention method [C]//The 24th Annual Joint Conference of the Computer and Communications Societies, Proceedings, IEEE, 2005:536-547.

[4] FERGUSON P, SENIE D.ITEF RFC 2827 network ingress filtering:defeating denial of service attacks which employ IP source address spoofing[S].Washington:ISOC, 2000.

[5] BOLTON C, LOWE G.Analyses of the reverse path forwarding routing algorithm[C]//The 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), Florence, 2004:485-491.

[6] PARK K H, LEE H J.On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets[C]//Proceedings of the Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, New York:ACM, 2001:15-26.

[7] CHENG J, WANG H N, KANG G S.Hop-count filtering:an effective denfense against spoofed DDoS traffic[C]//Proceedings of the 10th ACM Conference on Computer and Communications Security, New York:ACM, 2003:30-41.

[8] WU J P, BI J, LI X.IRTF RFC5210 a Source Address Validation Architecture (SAVA) test bed and deployment experience[S].Washington:ISOC, 2008.

[9] SAVAGE S, WETHERALL D, KARLIN A, et al.Network support for IP traceback[J].IEEE/ACM Transactions on Networking, 2001, 9(3):226-237.

[10] ABRAHAM Y, PERRIG A, SONG D.Pi:a path identification mechanism to defend against DDoS attacks[C]//Symposium on Security and Privacy, Proceedings, IEEE, 2003:93-107.

[11] WU J P, REN G.Building a next generation Internet with source address validation architecture[J].Science in China, 2008, 38(10):1583-1593.

[12] CHUNG S, LIAO L, WAN J.Software defined networks [J].Communications Magazine, IEEE, 2013, 51(2):113-117.

[13] WEN F X, YONG G W, CHUAN H F, et al.A survey on software defined networking[J].IEEE Communications Surveys & Tutorials, 2014, 17(1):27-51.

[14] 左青云,陈鸣,赵广松,等.基于OpenFlow的SDN技术[J].软件学报,2013,24(5):1078-1097.(ZUO Q Y, CHEN M, ZHAO G S, et al.Research on OpenFlow based SDN technologies[J].Journal of Software, 2013, 24(5):1078-1097.)

孙鹏. 面向SDN的源地址验证方法研究[J]. 电光与控制, 2016, 23(3): 49. SUN Peng. Source Address Validation Methods Based on SDN[J]. Electronics Optics & Control, 2016, 23(3): 49.

关于本站 Cookie 的使用提示

中国光学期刊网使用基于 cookie 的技术来更好地为您提供各项服务,点击此处了解我们的隐私策略。 如您需继续使用本网站,请您授权我们使用本地 cookie 来保存部分信息。
全站搜索
您最值得信赖的光电行业旗舰网络服务平台!