基于SDN/NFV的安全服务链自动编排部署框架
|
摘要
针对云计算等虚拟化环境的安全防护问题,提出了一种基于SDN/NFV技术思想的安全服务链自动编排部署框架.论文通过扩展ABAC策略模型以描述用户的安全需求,采用优先级解决策略冲突以编排虚拟安全设备,依据网络中虚拟安全设备实例负载与实时链路传输时延来调度网络流,最终由SDN控制器生成流表下发到网络中完成流量重定向,实现了根据安全需求自动构建安全服务链的过程.整个框架在基于开源控制器Flood Light和虚拟安全设备的实验环境中实现了自动编排部署,取得了预期效果.
Aiming at the security protection in virtual environments such as cloud computing,an automatic scheduling deployment framework of security service chain based on SDN/NFV is proposed in this paper.The ABAC strategy model is extended to describe the security requirements of users and priorities are used to solve the policy conflicts to arrange virtualized security appliance.The load of each virtualized security appliance instance and the real-time link transmission delay are quantified to dispatch network traffic.Finally,the flow table generated by SDN controller is sent to the network to complete traffic redirection and implement the process of automatically building the security service chain according to the security requirements.The entire framework is implemented in the experimental environment to achieve the automatic scheduling deployment based on floodlight,virtualized security appliance,and it has obtained anticipatory effects.
Aiming at the security protection in virtual environments such as cloud computing,an automatic scheduling deployment framework of security service chain based on SDN/NFV is proposed in this paper.The ABAC strategy model is extended to describe the security requirements of users and priorities are used to solve the policy conflicts to arrange virtualized security appliance.The load of each virtualized security appliance instance and the real-time link transmission delay are quantified to dispatch network traffic.Finally,the flow table generated by SDN controller is sent to the network to complete traffic redirection and implement the process of automatically building the security service chain according to the security requirements.The entire framework is implemented in the experimental environment to achieve the automatic scheduling deployment based on floodlight,virtualized security appliance,and it has obtained anticipatory effects.
引文
1Yuan E,Tong J.Attributed based access control(ABAC)for web services.Proceedings of 2015 IEEE International Conference on Web Services.Orlando,FL,USA.2005.569.
2Lee W,Choi YH,Kim N.Study on virtual service chain for secure software-defined networking.The International Conference on Control and Automation.2013.177–180.
3Gushchin A,Walid A,Tang A.Scalable routing in SDNenabled networks with consolidated middleboxes.Proceedings of the 2015 ACM SIGCOMM Workshop on Hot Topics in Middleboxes and Network Function Virtualization.London,UK.2015.55–60.
4Martini B,Paganelli F,Mohammed AA,et al.SDN controller for context-aware data delivery in dynamic service chaining.Proceedings 1st IEEE Conference on Network Softwarization(Net Soft).London,UK.2015.1–5.
5 Giotis K,Kryftis Y,Maglaris V.Policy-based orchestration of NFV services in software-defined networks.Proceedings of the 1st IEEE Conference on Network Softwarization.London,UK.2015.1–5.
6Qazi ZA,Tu CC,Chiang L,et al.SIMPLE-fying middlebox policy enforcement using SDN.Proceedings of the ACM SIGCOMM 2013.New York,NY,USA.2013.27–38.
7Zhang Y,Beheshti N,Beliveau L,et al.St EERING:A software-defined networking for inline service chaining.Proceedings of the 21st IEEE International Conference on Network Protocols.Goettingen,Germany.2013.1–10.
8 Mc Keown N,Anderson T,Balakrishnan H,et al.Open Flow:Enabling innovation in campus networks.ACM SIGCOMM Computer Communication Review,2014,38(2):69–74.
2Lee W,Choi YH,Kim N.Study on virtual service chain for secure software-defined networking.The International Conference on Control and Automation.2013.177–180.
3Gushchin A,Walid A,Tang A.Scalable routing in SDNenabled networks with consolidated middleboxes.Proceedings of the 2015 ACM SIGCOMM Workshop on Hot Topics in Middleboxes and Network Function Virtualization.London,UK.2015.55–60.
4Martini B,Paganelli F,Mohammed AA,et al.SDN controller for context-aware data delivery in dynamic service chaining.Proceedings 1st IEEE Conference on Network Softwarization(Net Soft).London,UK.2015.1–5.
5 Giotis K,Kryftis Y,Maglaris V.Policy-based orchestration of NFV services in software-defined networks.Proceedings of the 1st IEEE Conference on Network Softwarization.London,UK.2015.1–5.
6Qazi ZA,Tu CC,Chiang L,et al.SIMPLE-fying middlebox policy enforcement using SDN.Proceedings of the ACM SIGCOMM 2013.New York,NY,USA.2013.27–38.
7Zhang Y,Beheshti N,Beliveau L,et al.St EERING:A software-defined networking for inline service chaining.Proceedings of the 21st IEEE International Conference on Network Protocols.Goettingen,Germany.2013.1–10.
8 Mc Keown N,Anderson T,Balakrishnan H,et al.Open Flow:Enabling innovation in campus networks.ACM SIGCOMM Computer Communication Review,2014,38(2):69–74.