面向软件定义网络的入侵容忍控制器架构及实现

Software-defined networking-oriented intrusion tolerance controller architecture and its implementation

针对软件定义网络(SDN)这一集中式网络控制环境中控制平面存在单点失效问题,提出一种基于入侵容忍思想的控制器架构,通过冗余、多样的中央控制器平台来提高网络可用性与可靠性。该架构利用一种控制器消息的比对方法来检测被入侵的控制器。首先,规定了需比对的关键消息类型和字段;其次,运用一致性裁决算法对不同控制器消息进行比对;最后,将消息异常的控制器进行网络隔离并重启恢复。基于Mininet的入侵容忍可靠性测试表明,该入侵容忍控制器架构可检测并过滤异常控制器消息。基于Mininet的控制器响应延迟测试表明,当容忍度设置为1和3时,下层网络请求延时分别增加16%和42%。基于Cbench的控制器响应延迟和吞吐量测试表明,该入侵容忍控制器性能处在各个子控制器(Ryu,Floodlight)性能水平之间,且向性能高的子控制器趋近。在实际应用中,可根据应用场景的安全级别配置子控制器的数量和类型,以满足对响应速度和入侵容忍度的要求。

In the centralized network control environment of Software-Defined Network（ SDN）, the problem of a single point of failure exists in the controlling plane. In order to solve the problem, a kind of controller architecture was proposed based on intrusion tolerance ideology to improve the availability and reliability of network by using the redundant and diverse central controller platform. In the proposed architecture, the intruded controllers were detected by comparing their messages.Firstly, the key message types and fields needing to be compared were defined. Then, different controller messages were compared using a consistency judgement algorithm. Finally, the controllers with abnormal messages would be isolated and restored. The Mininet-based intrusion tolerance reliability test demonstrated that the controller architecture based on intrusion tolerance could detect and filter the abnormal controller messages. The Mininet-based response-delay test showed that the requirement-delay of underlying network increased by 16% and 42% while the tolerance degree was 1 and 3 respectively. In addition, the Cbench-based response-delay and throughput tests showed that the performance of the intrusion tolerance controller lay among the subsidiary controllers, such as Ryu and Floodlight, and approached the advanced one. In practical application, the quantity and type of the subsidiary controllers can be configured according to the security level of application scenarios, and the proposed intrusion tolerance controller can satisfy the application requirements of response rate and intrusion tolerance degree.