Flow consistency in an intensive SDN security architecture with multiple controllers
As critical components in SDN,controllers are prone to suffer from a series of potential attacks which result in system crashes.To prevent the compromise caused by single failure of controller or flow-tampering attacks,Mcad-SA,an aware decision-making security architecture with multiple controllers...
| Main Author: | |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
POSTS&TELECOM PRESS Co., LTD
2017-12-01
|
| Series: | 网络与信息安全学报 |
| Subjects: | |
| Online Access: | http://www.infocomm-journal.com/cjnis/CN/10.11959/j.issn.2096-109x.2017.00223 |
| _version_ | 1818552249025036288 |
|---|---|
| author | LVYing-ying,GUOYun-fei,QIChao,WUQi,WANGYa-wen |
| author_facet | LVYing-ying,GUOYun-fei,QIChao,WUQi,WANGYa-wen |
| author_sort | LVYing-ying,GUOYun-fei,QIChao,WUQi,WANGYa-wen |
| collection | DOAJ |
| description | As critical components in SDN,controllers are prone to suffer from a series of potential attacks which result in system crashes.To prevent the compromise caused by single failure of controller or flow-tampering attacks,Mcad-SA,an aware decision-making security architecture with multiple controllers was proposed,which coordinates heterogeneous controllers internally as an“associated”controller.This architecture extends existing control plane and takes advantage of various controllers’merits to improve the difficulty and cost of probes and attacks from attackers.In this framework,flow rules distributed to switches are no longer relying on a single controller but according to the vote results from the majority of controllers,which significantly enhances the reliability of flow rules.As to the vote process of flow rules,segmentation and grading is adopted to pick up the most trustful one from multiple flow rules and implement flow consistency.This mechanism avoids comparison between rules via bit by bit which is impractical among several controllers.Theory analysis and simulation results demonstrates the effectiveness,availability and resilience of the proposed methods and their better security gain over general SDN architectures. |
| first_indexed | 2024-12-12T09:10:44Z |
| format | Article |
| id | doaj.art-5afe2a0d81394fd89dd020ad85e3fe24 |
| institution | Directory Open Access Journal |
| issn | 2096-109X |
| language | English |
| last_indexed | 2024-12-12T09:10:44Z |
| publishDate | 2017-12-01 |
| publisher | POSTS&TELECOM PRESS Co., LTD |
| record_format | Article |
| series | 网络与信息安全学报 |
| spelling | doaj.art-5afe2a0d81394fd89dd020ad85e3fe242022-12-22T00:29:31ZengPOSTS&TELECOM PRESS Co., LTD网络与信息安全学报2096-109X2017-12-01312627810.11959/j.issn.2096-109x.2017.00223Flow consistency in an intensive SDN security architecture with multiple controllersLVYing-ying,GUOYun-fei,QIChao,WUQi,WANGYa-wen 0National Digital Switching System Engineering＆Technological R＆D Center,Zhengzhou 450002,ChinaAs critical components in SDN,controllers are prone to suffer from a series of potential attacks which result in system crashes.To prevent the compromise caused by single failure of controller or flow-tampering attacks,Mcad-SA,an aware decision-making security architecture with multiple controllers was proposed,which coordinates heterogeneous controllers internally as an“associated”controller.This architecture extends existing control plane and takes advantage of various controllers’merits to improve the difficulty and cost of probes and attacks from attackers.In this framework,flow rules distributed to switches are no longer relying on a single controller but according to the vote results from the majority of controllers,which significantly enhances the reliability of flow rules.As to the vote process of flow rules,segmentation and grading is adopted to pick up the most trustful one from multiple flow rules and implement flow consistency.This mechanism avoids comparison between rules via bit by bit which is impractical among several controllers.Theory analysis and simulation results demonstrates the effectiveness,availability and resilience of the proposed methods and their better security gain over general SDN architectures.http://www.infocomm-journal.com/cjnis/CN/10.11959/j.issn.2096-109x.2017.00223multi-controllersecuritymcad-saflow consistency |
| spellingShingle | LVYing-ying,GUOYun-fei,QIChao,WUQi,WANGYa-wen Flow consistency in an intensive SDN security architecture with multiple controllers 网络与信息安全学报 multi-controller security mcad-sa flow consistency |
| title | Flow consistency in an intensive SDN security architecture with multiple controllers |
| title_full | Flow consistency in an intensive SDN security architecture with multiple controllers |
| title_fullStr | Flow consistency in an intensive SDN security architecture with multiple controllers |
| title_full_unstemmed | Flow consistency in an intensive SDN security architecture with multiple controllers |
| title_short | Flow consistency in an intensive SDN security architecture with multiple controllers |
| title_sort | flow consistency in an intensive sdn security architecture with multiple controllers |
| topic | multi-controller security mcad-sa flow consistency |
| url | http://www.infocomm-journal.com/cjnis/CN/10.11959/j.issn.2096-109x.2017.00223 |
| work_keys_str_mv | AT lvyingyingguoyunfeiqichaowuqiwangyawen flowconsistencyinanintensivesdnsecurityarchitecturewithmultiplecontrollers |