Route Guardian: Constructing Secure Routing Paths in Software-Defined Networking  

作　　者：Mengmeng Wang Jianwei Liu Jian Mao Haosu Cheng Jie Chen Chan Qi 

机构地区：[1]School of Electronic and Information Engineering, Beihang University

出　　处：《Tsinghua Science and Technology》2017年第4期400-412,共13页清华大学学报（自然科学版（英文版）

基　　金：supported in part by the National Natural Science Foundation of China (Nos. 61402029, 61370190, and 61379002);the National Key Basic Research Program (973) of China (No. 2012CB315905)

摘　　要：Software-Defined Networking（SDN） decouples the control plane and the data plane in network switches and routers, which enables the rapid innovation and optimization of routing and switching configurations. However,traditional routing mechanisms in SDN, based on the Dijkstra shortest path, do not take the capacity of nodes into account, which may lead to network congestion. Moreover, security resource utilization in SDN is inefficient and is not addressed by existing routing algorithms. In this paper, we propose Route Guardian, a reliable securityoriented SDN routing mechanism, which considers the capabilities of SDN switch nodes combined with a Network Security Virtualization framework. Our scheme employs the distributed network security devices effectively to ensure analysis of abnormal traffic and malicious node isolation. Furthermore, Route Guardian supports dynamic routing reconfiguration according to the latest network status. We prototyped Route Guardian and conducted theoretical analysis and performance evaluation. Our results demonstrate that this approach can effectively use the existing security devices and mechanisms in SDN.Software-Defined Networking（SDN） decouples the control plane and the data plane in network switches and routers, which enables the rapid innovation and optimization of routing and switching configurations. However,traditional routing mechanisms in SDN, based on the Dijkstra shortest path, do not take the capacity of nodes into account, which may lead to network congestion. Moreover, security resource utilization in SDN is inefficient and is not addressed by existing routing algorithms. In this paper, we propose Route Guardian, a reliable securityoriented SDN routing mechanism, which considers the capabilities of SDN switch nodes combined with a Network Security Virtualization framework. Our scheme employs the distributed network security devices effectively to ensure analysis of abnormal traffic and malicious node isolation. Furthermore, Route Guardian supports dynamic routing reconfiguration according to the latest network status. We prototyped Route Guardian and conducted theoretical analysis and performance evaluation. Our results demonstrate that this approach can effectively use the existing security devices and mechanisms in SDN.

关 键 词：Software-Defined Networking（SDN） network security virtualization capacity-based routing security oriented routing dynamic routing reconfiguration 

分 类 号：TP393.02[自动化与计算机技术—计算机应用技术]