.png){kind=icon}
返回
ANCHOR: Logically Centralized Security for Software-Defined Networks
.png){kind=icon}
PRE
AI
DOI：10.1145/3301305.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Software-defined networking (SDN) decouples the control and data planes of traditional networks, logically centralizing the functional properties of the network in the SDN controller. While this centralization brought advantages such as a faster pace of innovation, it also disrupted some of the natural defenses of traditional architectures against different threats. The literature on SDN has mostly been concerned with the functional side, despite some specific works concerning non-functional properties such as security or dependability. Though addressing the latter in an ad-hoc, piecemeal way may work, it will most likely lead to efficiency and effectiveness problems. We claim that the enforcement of non-functional properties as a pillar of SDN robustness calls for a systemic approach. We further advocate, for its materialization, the reiteration of the successful formula behind SDN: 'logical centralization'. As a general concept, we propose anchor, a subsystem architecture that promotes the logical centralization of non-functional properties. To show the effectiveness of the concept, we focus on security in this article: we identify the current security gaps in SDNs and we populate the architecture middleware with the appropriate security mechanisms in a global and consistent manner. Essential security mechanisms provided by anchor include reliable entropy and resilient pseudo-random generators, and protocols for secure registration and association of SDN devices. We claim and justify in the article that centralizing such mechanisms is key for their effectiveness by allowing us to define and enforce global policies for those properties; reduce the complexity of controllers and forwarding devices; ensure higher levels of robustness for critical services; foster interoperability of the non-functional property enforcement mechanisms; and promote the security and resilience of the architecture itself. We discuss design and implementation aspects, and we prove and evaluate our algorithms and mechanisms, including the formalisation of the main protocols and the verification of their core security properties using the Tamarin prover.
Keyword:
Software-defined networking
SDN
non-functional properties
control plane
security
perfect forward secrecy
post-compromise security
post-compromise recovery
post-quantum secure
robust pseudo-random generator
PRG
source of strong entropy
iDVV
network device registration and association
advanced security properties
communications overhead
Ryu
Mininet
Open vSwitch (OVS)
OpenFlow
attack prevention
AI总结
对已上传原文的论文进行重点信息的提取，主要内容包括：简要概述、研究摘要、背景介绍、关键亮点、图文解析、展望与总结。
期刊
A
IF:
2.8
论文数:
293
被引数:
770
机构
引用论文
分享收藏Comparison of Caffeine Metabolism by Slices, Microsomes and Hepatocyte Cultures from Adult Human Liver.png)
Xenobiotica
XenobioticaIF0
PREAI
分享收藏Involvement of hypothalamic neuropeptide Y in pentazocine induced suppression of food intake in rats下丘脑神经肽Y在喷他佐辛诱导的大鼠摄食抑制中的作用
PREAI
分享收藏
Vinyl polymers containing amido and carboxylic groups as side substituents: I. Synthesis of N-acryloyl-glycine and N-acryloyl-6-caproic acid and their grafting on cellulose membranesPolymer
PolymerIF0
PREAI
分享收藏
查看更多内容