SDN中IP欺骗数据分组网络溯源方法研究  

Tracing IP-spoofed packets in software defined network

作　　者：魏松杰 孙鑫 赵茹东 吴超 WEI Songjie;SUN Xin;ZHAO Rudong;WU Chao(School of Computer Science and Engineering,Nanjing University of Science and Technology,Nanjing 210094,China)

机构地区：[1]南京理工大学计算机科学与工程学院,江苏南京210094

出　　处：《通信学报》2018年第11期181-189,共9页Journal on Communications

基　　金：国家自然科学基金资助项目(No.61472189);赛尔网络下一代互联网技术创新项目(No.NGII20160105;No.NGII20170119)~~

摘　　要：IP数据分组溯源方法是指从目的地址出发,逐跳找到源主机。该方法在软件定义网络(SDN,software defined network)框架下,通过控制器向网络中相关SDN交换机添加探测流表项,并根据目标数据分组触发的有效溯源Packet-in消息,找到目标数据分组的转发路径及源主机。所提方案可以为调试网络故障提供方便,使网络管理员可以得到任意一个数据分组的转发路径,应对IP地址欺骗等网络安全问题。实验证明,该溯源方法能够及时、准确地找到目标数据分组的转发路径,不影响网络中其他数据流转发,且无明显的系统开销。IP packets back tracing is to find the source host hop by hop from the destination. The method found the forwarding path of target packets and source host by adding probe entry into flow tables on SDN switches and analyzing the effective back tracing Packet-in messages sent by related switches. The proposed scheme can provide convenience for debugging network problems , so that the network administrator can obtain the forwarding paths of any data packets. Furthermore, it can help to solve the problem of IP spoofing. Experimental results prove that the traceability method can find the forwarding paths of target packets in a timely and accurate manner without affecting other traffic or significant system overhead.

关 键 词：SDN IP地址欺骗 IP溯源 探测流表项 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]