SDN中基于用户信任度的资源访问控制方案  

Resource Access Control Scheme Based on User Credit in SDN

作　　者：魏占祯[1] 彭星源 赵洪 WEI Zhanzhen;PENG Xingyuan;ZHAO Hong(Beijing Electronic Science and Technology Institute,Beijing 100070,China)

机构地区：[1]北京电子科技学院,北京100070

出　　处：《信息网络安全》2021年第10期33-40,共8页Netinfo Security

基　　金：国家重点研发计划[2017YFB0801803]。

摘　　要：现有的资源访问控制方案用户访问权限不能动态变化、访问控制策略制定存在安全隐患,针对这些问题,文章提出SDN中基于用户信任度的资源访问控制方案。该方案引入用户信任度概念,利用SDN管控分离和流驱动特性,设计了基于用户信任度的资源访问控制系统。控制器根据用户属性评估用户信任度,据此对用户进行分类,通过下发流表的方式为不同类型的用户授予不同权限,用户信任度区间发生变化时,其访问权限也随之变化,实现了动态授予权限的功能。同时,文章通过Mininet对方案进行仿真,与普通SDN网络和传统网络进行对比,结果表明,该方案在资源的访问控制上具有一定的动态性和安全性。Existing resource access control schemes have problems such as the inability to dynamically change user access permissions,and the security risks in the formulation of access control policies.In view of these problems,this paper proposes a resource access control scheme based on user credit in SDN.This scheme introduces the concept of user credit and uses the characteristics of SDN that management and control separation and flow-driven to design a resource access control system based on user credit.The controller evaluates the user’s credit based on the user’s attributes,and classifies users accordingly.By issuing flow tables,different types of users are granted different permissions.When the user’s trust level changes,their access permissions will also change,realizing the function of dynamically granting permissions.And the program is simulated through Mininet and compares it with ordinary SDN networks and traditional networks,the results show that the program has a certain degree of dynamics and security in resource access control.

关 键 词：SDN 访问控制 用户信任度 动态授权 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]