基于SDN的安全管理体系架构  

The Security Management Architecture basing on SDN

作　　者：赵桦筝 徐萱 乔俊博 孙岭新 ZHAO Hua-zheng;XU Xuan;QIAO Jun-bo;SUN Ling-xin(Software and Applied Science and Technology Institute,Zhengzhou University,Zhengzhou 450003,China)

机构地区：[1]郑州大学软件与应用科技学院,河南郑州450003

出　　处：《电脑知识与技术》2019年第4X期51-54,共4页Computer Knowledge and Technology

基　　金：河南省高等学校大学生创新训练计划项目(No.S201810459070)

摘　　要：在网络多样化的趋势下,网络受众范围不断扩大,网络安全问题越来越突出。传统的安全架构已经难以应对复杂的网络安全现状,软件定义网络(Software Defined Network, SDN)为解决安全问题提供了一种新思路。基于SDN,提出了新型安全管理体系架构SDSM(Software Defined Security Management)。该架构能够为用户提供全面且可自定义的网络安全服务,以双控制器作为关键组件,可通过北向API接口提供多种多样的原子服务。针对防治DoS和DDoS攻击做出了详细介绍,并提出了解决SDN本身可能受到DDoS攻击的方法。相比于传统网络安全架构,SDN集中控制的特性使得SDSM简化了管理,增强了安全性,提升了网络安全服务能力。In the trend of network’s diversification, the scope of the network users is expanding and the network security issues are becoming more and more prominent. Nowadays, it's difficult for the traditional security architecture to deal with the complex network security issues. Software Defined Network (SDN) proposes a new way to solve these security problems. This paper presents a new security management system based on the architecture of SDN named SDSM (Software Defined Security Management), which can provide users with comprehensive and customizable network security services. With dual controllers as key components, SDSM can provide a large variety of atomic services through northbound API interface. This paper gives a detailed introduction to the prevention and control of DoS and DDoS attacks, and puts forward the solution to the possibility that DDoS attacks on SDN itself. Compared with traditional network security architectures, the centralized control of SDN helps SDSM simplify management, enhance se? curity performance and improve network security service capability.

关 键 词：网络安全 软件定义网络 双控制器 分布式拒绝服务攻击 拒绝服务 

分 类 号：TN915.08[电子电信—通信与信息系统]