面向OpenFlow网络的访问控制规则自动实施方案

Automatic implementation scheme of implementing access control rules in OpenFlow network

针对OpenFlow网络数据平面频繁改变导致网络难以实时满足访问控制策略要求的问题,提出了面向OpenFlow网络的访问控制规则自动实施方案。首先,由实时构建的转发路径获得可达空间,并通过规则集动态合成算法消除访问控制规则间的冲突;之后,采用规则空间分割算法将合成后访问控制规则的拒绝空间与可达空间比较,以检测直接和间接违反访问控制规则的非法转发路径;在此基础上,结合网络更新事件与违反检测结果灵活采取自动的违反解决方法,包括规则更新拒绝、规则序列移除、基于线性规划(LP)的近源端规则部署和末端规则部署4种;最后转换访问控制规则形式。理论分析和仿真结果表明,方案可用于控制器上运行多个安全应用程序和交换机内存受限的情况,并且基于LP的近源端规则部署方法可以降低网络中的不期望流量。

Focusing on the issue that OpenFlow network can＇ t meet access control policy constantly resulted from its data plane changing frequently, an automatic implementation scheme of implementing access control rules in OpenFlow network was proposed. Firstly, reachable space was obtained by building real-time forwarding paths, and conflicts among access control rules were resolved by using dynamical synthesis algorithm. Then, denied space was extracted from synthetic set of access control rules by using rule space division algorithm, which was compared with reachable space subsequently to detect direct and indirect violations. According to network update situations and violation detection results, automatic violation resolutions were adopted flexibly, such as rejecting rule update, removing rule sequence, deploying rule near source based on Linear Programming （LP） and deploying rule terminally. Lastly, the format of access control rule was converted. The theoretical analysis and simulation results demonstrate that the proposed scheme is applicable under the condition that multiple security applications are mnning on the controller and memory of switch is limited, and show that deploying rule near source based on LP can minimize unwanted traffic of network.