مقاله انگلیسی رایگان در مورد اجرای امنیت مبتنی بر ریسک در شبکه نرم افزارمحور – الزویر 2018

Software Defined Network (SDN) paradigm provides intelligent and efficient management of different network control functions (NF) depending on changes in traffic behavior, service providers’ requirements and application context. However, the logical centralization of controllers’ functions opens up challenges towards enforcing security perimeter over the underlying network and the assets involved. In this paper, we propose a risk assessment model for pro-active secure flow control and routing of traffic in SDN. The proposed model determines threat value of different SDN entities by analyzing vulnerability and exposure with respect to Common Vulnerability Scoring System (CVSS). The risk of a given traffic is calculated as cumulative threat values of the SDN entities that guides the flow and routing control functions in generating secure flow rules for the forwarding switches. The efficacy of the proposed model is demonstrated through extensive case studies of an enterprise network.

Introduction

Software Defined Networking (SDN) is an emerging networking paradigm that allows intelligent and efficient management of network control functions. It allows execution of different network control functions as a logically centralized controller by decoupling them from the underlying forwarding network [1] consisting of various network devices, e.g., switches, routers, access points, etc. The controller provides better flexibility and configuration control to the users with easy and on-demand dynamic configuration of the network and its resources [2]. The SDN model shown in Figure 1 provides several benefits over the traditional network such as (i) Simple and reliable network, (ii) Programmability feature, (iii) Flexible device configuration and troubleshooting, and (iv) Virtualization of the network. Due to these extensive features, Software Defined Networking has attained significant attention to research community starting from academics to industries and has several applications in ranging from data centers to wide area networking, cloud computing, Internet of Things, Mobile Ad hoc Networking, cellular networking, etc. [3]. Software Defined Networking (SDN) enables efficient service provisioning to end users from various enterprise applications based on Service Level Agreements (SLAs) and dynamic requirements in terms of policies by maintaining the global view of the network. Among various SDN enabled communication protocol, the majority of the SDN applications implement OpenFlow protocol [48] to support necessary interaction between the controllers and the switches as OpenFlow is a vendor-independent standard and hence allows for interoperability between heterogeneous networking devices. Despite the advantages provided by SDN, various performance and security challenges have been major concerns since its evolution. The performance and security issues those need to be addressed for efficient deployment of SDN are the management of complex policies in a simple interface, networking delay, lack of standardized interfaces between SDN layers, load balancing, packet scheduling, etc. In addition, there exist various open problems to utilize the benefits of SDN [5]. The most important problems lie in: (i) usable, reliable and efficient network service offerings [6]; (ii) extensible control function execution platform with the change in network size and requirements [7]; and (iii) end-to-end security enforcement to network services. The thrust of this paper is to provide a seamless solution for enforcing end-to-end security in SDN.