李兆斌 刘泽一 魏占祯 韩禹

摘 要：针对软件定义网络中，控制器无法保证下发的网络策略能够在转发设备上得到正确执行的安全问题，提出一种新的转发路径监控安全方案。首先以控制器的全局视图能力为基础，设计了基于OpenFlow协议的路徑凭据交互处理机制;然后采用哈希链和消息验证码作为生成和处理转发路径凭据信息的关键技术;最后在此基础上，对Ryu控制器和Open vSwitch开源交换机进行深度优化，添加相应处理流程，建立轻量级的路径安全机制。测试结果表明，该机制能够有效保证数据转发路径安全，吞吐量消耗比SDN数据层可信转发方案（SDNsec）降低20%以上，更适用于路径复杂的网络环境，但时延和CPU使用率的浮动超过15%，有待进一步优化。

关键词：软件定义网络;哈希链;消息验证码;路径校验;数据完整性

中图分类号：TP393.08

文献标志码：A

Abstract： For the security problem that the SDN （Software Defined Network） controller can not guarantee the network strategy issued by itself to be correctly executed on the forwarding devices， a new forwarding path monitoring security solution was proposed. Firstly， based on the overall view capability of the controller， a path credential interaction processing mechanism based on OpenFlow was designed. Secondly， Hash chain and message authentication code were introduced as the key technologies for generating and processing the forwarding path credential information. Thirdly， on this basis， Ryu controller and Open vSwitch opensource switch were deeply optimized，with credential processing flow added， constructing a lightweight path security mechanism. The test results show that the proposed mechanism can effectively guarantee the security of data forwarding path， and its throughput consumption is reduced by more than 20% compared with SDNsec， which means it is more suitable for the network environment with complex routes， but its fluctuates of latency and CPU usage are more than 15%， which needs further optimization.

英文关键词Key words： Software Defined Network （SDN）; Hash chain; message authentication code; path validation; data integrity

0 引言

软件定义网络（Software Defined Network， SDN）通过分离控制层与转发层大幅提升其网络部署的灵活性、网络管理的动态性以及网络传输的高效性。随着SDN架构的应用场景不断丰富，其安全问题也逐渐凸显，成为影响该技术进一步发展的巨大障碍， 特别是受限于转发层的分布式环境以及设备认证机制的缺失，SDN的数据转发过程存在较大的问题，由于控制器缺乏针对流表实际执行情况的有效监测机制，且在数据转发过程中交换机并不关注上一跳设备的身份合法性，攻击者通过控制一个恶意节点即可以偏离流表规定路径的方式来隐蔽地篡改或丢弃数据包。……