可编程软件定义网络的新架构与安全技术：综述

王珅; 伍军; 杨武; 郭龙华

doi:10.1631/FITEE.1800575

Your Location：

Home >

Browse articles >

可编程软件定义网络的新架构与安全技术：综述

网络空间安全专辑 | Updated：2022-05-19

- 可编程软件定义网络的新架构与安全技术：综述
- Novel architectures and security solutions of programmable software-defined networking: a comprehensive survey
- 信息与电子工程前沿（英文） 2018年19卷第12期页码：1500-1521
- Affiliations：
  
  Research Center for Modern Governance, Zhejiang University of Science and Technology, Hangzhou 310023, China
  School of Electronic Information and Electrical Engineering, Shanghai Jiao Tong University, Shanghai 200240, China
  Information Security Research Center, Harbin Engineering University, Harbin 150001, China
  Huawei Technologies Co., Ltd., Shanghai 201206, China
- Author bio：
  
  [ "Jun WU, E-mail: junwuhn@sjtu.edu.cn" ]
- Funds：
  
  Project supported by the National Natural Science Foundation of China (No. 61831007)
- DOI：10.1631/FITEE.1800575
  中图分类号： TP393
- 收稿：2018-09-17，
  
  修回：2018-12-17，
  
  纸质出版：2018-12
- Accepted：
Scan QR Code
王珅, 伍军, 杨武, 等. 可编程软件定义网络的新架构与安全技术：综述[J]. 信息与电子工程前沿（英文）, 2018,19(12):1500-1521.

Shen WANG, Jun WU, Wu YANG, et al. Novel architectures and security solutions of programmable software-defined networking: a comprehensive survey[J]. Frontiers of Information Technology & Electronic Engineering, 2018, 19(12): 1500-1521.
王珅, 伍军, 杨武, 等. 可编程软件定义网络的新架构与安全技术：综述[J]. 信息与电子工程前沿（英文）, 2018,19(12):1500-1521. DOI： 10.1631/FITEE.1800575.

Shen WANG, Jun WU, Wu YANG, et al. Novel architectures and security solutions of programmable software-defined networking: a comprehensive survey[J]. Frontiers of Information Technology & Electronic Engineering, 2018, 19(12): 1500-1521. DOI： 10.1631/FITEE.1800575.

摘要

当前，网络空间已经成为社会基础设施的一个重要组成部分。随着网络规模快速发展，应用程序和服务日益丰富，底层网络设备（如交换机和路由器）承载功能被不断扩展。为提升网络动态架构、安全性和服务质量，网络控制平面与数据平面的解耦是网络技术发展趋势。目前，软件定义网络（SDN）是新兴网络领域最热门、最具前景的技术之一。在SDN中，通过在专有设备部署高级别策略指导网络设备数据转发，减少网络设备复杂功能。SDN有利于实现网络新技术、新协议，提升部署功能灵活性和可操作性。然而，该新型网络技术面临架构和安全方面的新挑战。本文为可编程SDN最新进展相关研究提供一个全面综述，分析已被研究和有待解决的问题，并分析在框架架构和安全领域的发展趋势。

Abstract

Nowadays

cyberspace has become a vital part of social infrastructure. With the rapid development of the scale of networks

applications and services have become enriched

and the bearing function of the underlying network devices (such as switches and routers) has also been extended. To promote the dynamics architecture

high-level security

and high quality of service of the network

control network architecture forward separation is a development trend of the networking technology. Currently

software-defined networking (SDN) is one of the most popular and promising technologies. In SDN

high-level strategies are deployed by the proprietary equipment

which is used to guide the data forwarding of the network equipment. This can reduce many complicated functions of the network equipment and improve the flexibility and operability of the implementation and deployment of new network technologies and protocols. However

this novel networking technology faces novel challenges in term of architecture and security. The aim of this study is to offer a comprehensive review of the state-of-the-art research on novel advances of programmable SDN

and to highlight what has been investigated and what remains to be addressed

particularly

in terms of architecture and security.

关键词

Keywords

references

ST Ali , , , V Sivaraman , , , A Radford , , , 等 . . A survey of securing networks using software defined networking . . IEEE Trans Reliab , , 2015 . . 64 ( ( 3 ): ): 1086 - - 1097 . . DOI: 10.1109/TR.2015.2421391 http://doi.org/10.1109/TR.2015.2421391 . .

K Benton , , , LJ Camp , , , C Small . . OpenFlow vulnerability assessment . . 2 nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking , , 2013 . . p.151 - - 152 . . DOI: 10.1145/2491185.2491222 http://doi.org/10.1145/2491185.2491222 . .

F Botelho , , , A Bessani , , , FMV Ramos , , , 等 . . On the design of practical fault-tolerant SDN controllers . . 3 rd European Workshop on Software Defined Networks , , 2014 . . p.73 - - 78 . . DOI: 10.1109/EWSDN.2014.25 http://doi.org/10.1109/EWSDN.2014.25 . .

R Braga , , , E Mota , , , A Passito . . Lightweight DDoS flooding attack detection using NOX/OpenFlow . . IEEE Local Computer Network Conf , , 2010 . . p.408 - - 415 . . DOI: 10.1109/LCN.2010.5735752 http://doi.org/10.1109/LCN.2010.5735752 . .

M Casado , , , MJ Freedman , , , J Pettit , , , 等 . . Ethane: taking control of the enterprise . . Conf on Applications, Technologies, Architectures, and Protocols for Computer Communications , , 2007 . . p.1 - - 12 . . DOI: 10.1145/1282380.1282382 http://doi.org/10.1145/1282380.1282382 . .

YN Cheng , , , C Dong , , , LW Chu , , , 等 . . Design and implementation of software-defined networking based firewall system . . Comput Appl Softw , , 2015 . . 32 ( ( 1 ): ): 286 - - 288, 312 . . DOI: 10.3969/j.issn.1000-386x.2015.01.072 http://doi.org/10.3969/j.issn.1000-386x.2015.01.072 . .

K David , , , H Berndt . . 6G vision and requirements: is there any need for beyond 5G . . IEEE Veh Technol Mag , , 2018 . . 13 ( ( 3 ): ): 72 - - 80 . . DOI: 10.1109/MVT.2018.2848498 http://doi.org/10.1109/MVT.2018.2848498 . .

European Telecommunications Standards Institute . . Network Functions Virtualisation . . 2012 . . https://portal.etsi.org/nfv/nfv_white_paper.pdf https://portal.etsi.org/nfv/nfv_white_paper.pdf , , . .

SK Fayazbakhsh , , , V Sekar , , , ML Yu , , , 等 . . FlowTags: enforcing network-wide policies in the presence of dynamic middlebox actions . . 2 nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking , , 2013 . . p.19 - - 24 . . DOI: 10.1145/2491185.2491203 http://doi.org/10.1145/2491185.2491203 . .

MJ Feng , , , SW Mao , , , T Jiang . . Enhancing the performance of future wireless networks with software-defined networking . . Front Inform Technol Electron Eng , , 2016 . . 17 ( ( 7 ): ): 606 - - 619 . . DOI: 10.1631/FITEE.1500336 http://doi.org/10.1631/FITEE.1500336 . .

A Gelberger , , , N Yemini , , , R Giladi . . Performance analysis of software-defined networking (SDN) . . IEEE 21 st Int Symp on Modelling, Analysis and Simulation of Computer and Telecommunication Systems , , 2013 . . p.389 - - 393 . . DOI: 10.1109/MASCOTS.2013.58 http://doi.org/10.1109/MASCOTS.2013.58 . .

A Greenberg , , , G Hjalmtysson , , , DA Maltz , , , 等 . . A clean slate 4D approach to network control and management . . ACM SIGCOMM Comput Commun Rev , , 2005 . . 35 ( ( 5 ): ): 41 - - 54 . . DOI: 10.1145/1096536.1096541 http://doi.org/10.1145/1096536.1096541 . .

ZT Guan , , , Y Zhang , , , LF Wu , , , 等 . . APPA: an anonymous and privacy preserving data aggregation scheme for fog-enhanced IoT . . J Netw Comput Appl , , 2019 . . 125 82 - - 92 . . DOI: 10.1016/j.jnca.2018.09.019 http://doi.org/10.1016/j.jnca.2018.09.019 . .

N Gude , , , T Koponen , , , J Pettit , , , 等 . . NOX: towards an operating system for networks . . ACM SIGCOMM Comput Commun Rev , , 2008 . . 38 ( ( 3 ): ): 105 - - 110 . . DOI: 10.1145/1384609.1384625 http://doi.org/10.1145/1384609.1384625 . .

N Handigol , , , B Heller , , , V Jeyakumar , , , 等 . . Where is the debugger for my software-defined network? . . 1 st Workshop on Hot Topics in Software Defined Networks , , 2012 . . p.55 - - 60 . . DOI: 10.1145/2342441.2342453 http://doi.org/10.1145/2342441.2342453 . .

H Hata . . A study of requirements for SDN switch platform . . Int Symp on Intelligent Signal Processing and Communication Systems , , 2013 . . p.79 - - 84 . . DOI: 10.1109/ISPACS.2013.6704525 http://doi.org/10.1109/ISPACS.2013.6704525 . .

B Heller , , , R Sherwood , , , N McKeown . . The controller placement problem . . 1 st Workshop on Hot Topics in Software Defined Networks , , 2012 . . p.7 - - 12 . . DOI: 10.1145/2342441.2342444 http://doi.org/10.1145/2342441.2342444 . .

ZY Hu , , , MW Wang , , , XQ Yan , , , 等 . . A comprehensive security architecture for SDN . . 18 th Int Conf on Intelligence in Next Generation Networks , , 2015 . . 30 - - 37 . . DOI: 10.1109/ICIN.2015.7073803 http://doi.org/10.1109/ICIN.2015.7073803 . .

JH Jafarian , , , E Al-Shaer , , , Q Duan . . OpenFlow random host mutation: transparent moving target defense using software defined networking . . 1 st Workshop on Hot Topics in Software Defined Networks , , 2012 . . p.127 - - 132 . . DOI: 10.1145/2342441.2342467 http://doi.org/10.1145/2342441.2342467 . .

E Keller , , , S Ghorbani , , , M Caesar , , , 等 . . Live migration of an entire network (and its hosts) . . 11 th ACM Workshop on Hot Topics in Networks , , 2012 . . p.109 - - 114 . . DOI: 10.1145/2390231.2390250 http://doi.org/10.1145/2390231.2390250 . .

H Kim , , , N Feamster . . Improving network management with software defined networking . . IEEE Commun Mag , , 2013 . . 51 ( ( 2 ): ): 114 - - 119 . . DOI: 10.1109/MCOM.2013.6461195 http://doi.org/10.1109/MCOM.2013.6461195 . .

D Kreutz , , , FMV Ramos , , , P Verissimo . . Towards secure and dependable software-defined networks . . 2 nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking , , 2013 . . p.55 - - 60 . . DOI: 10.1145/2491185.2491199 http://doi.org/10.1145/2491185.2491199 . .

GL Li , , , J Wu , , , JH Li , , , 等 . . Battery status sensing software-defined multicast for V2G regulation in smart grid . . IEEE Sens J , , 2017 . . 17 ( ( 23 ): ): 7838 - - 7848 . . DOI: 10.1109/JSEN.2017.2731971 http://doi.org/10.1109/JSEN.2017.2731971 . .

Foundation Linux . . OpenDaylight . . http://www.opendaylight.org http://www.opendaylight.org , , 2015 . . .

B Liu , , , M Chen , , , B Xu , , , 等 . . An OpenFlow-based performance-oriented multipath forwarding scheme in datacenters . . Front Inform Technol Electron Eng , , 2016 . . 17 ( ( 7 ): ): 647 - - 660 . . DOI: 10.1631/FITEE.1601059 http://doi.org/10.1631/FITEE.1601059 . .

CF Liu , , , S Samarakoon , , , M Bennis , , , 等 . . Fronthaul-aware software-defined wireless networks: resource allocation and user scheduling . . IEEE Trans Wirel Commun , , 2018 . . 17 ( ( 1 ): ): 533 - - 547 . . DOI: 10.1109/TWC.2017.2768358 http://doi.org/10.1109/TWC.2017.2768358 . .

ZJ Liu , , , Y Li , , , L Su , , , 等 . . TCAM-efficient flow table mapping scheme for OpenFlow multiple-table pipelines . . J Tsinghua Univ (Sci Technol) , , 2014 . . 54 ( ( 4 ): ): 437 - - 442 . . DOI: 10.16511/j.cnki.qhdxxb.2014.04.009 http://doi.org/10.16511/j.cnki.qhdxxb.2014.04.009 . .

N McKeown , , , T Anderson , , , H Balakrishnan , , , 等 . . OpenFlow: enabling innovation in campus networks . . ACM SIGCOMM Comput Commun Rev , , 2008 . . 38 ( ( 2 ): ): 69 - - 74 . . DOI: 10.1145/1355734.1355746 http://doi.org/10.1145/1355734.1355746 . .

S Narayana , , , J Rexford , , , D Walker . . Compiling path queries in software-defined networks . . 3 rd Workshop on Hot Topics in Software Defined Networking , , 2014 . . p.181 - - 186 . . DOI: 10.1145/2620728.2620736 http://doi.org/10.1145/2620728.2620736 . .

AK Nayak , , , A Reimers , , , N Feamster , , , 等 . . Resonance: dynamic access control for enterprise networks . . 1 st ACM Workshop on Research on Enterprise Networking , , 2009 . . p.11 - - 18 . . DOI: 10.1145/1592681.1592684 http://doi.org/10.1145/1592681.1592684 . .

BBA Nunes , , , M Mendonca , , , XN Nguyen , , , 等 . . A survey of software-defined networking: past, present, and future of programmable networks . . IEEE Commun Surv Tutor , , 2014 . . 16 ( ( 3 ): ): 1617 - - 1634 . . DOI: 10.1109/SURV.2014.012214.00180 http://doi.org/10.1109/SURV.2014.012214.00180 . .

Open Networking Foundation . . Software-Defined Networking: the New Norm for Networks . . http://www.valleytalk.org/wp-content/uploads/2012/05/wp-sdn-newnorm.pdf http://www.valleytalk.org/wp-content/uploads/2012/05/wp-sdn-newnorm.pdf , , 2012 . . .

H Pan , , , HT Guan , , , JJ Liu , , , 等 . . The FlowAdapter: enable flexible multi-table processing on legacy hardware . . 2 nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking , , 2013 . . p.85 - - 90 . . DOI: 10.1145/2491185.2491209 http://doi.org/10.1145/2491185.2491209 . .

P Porras , , , S Shin , , , V Yegneswaran , , , 等 . . A security enforcement kernel for OpenFlow networks . . 1 st Workshop on Hot Topics in Software Defined Networks , , 2012 . . p.121 - - 126 . . DOI: 10.1145/2342441.2342466 http://doi.org/10.1145/2342441.2342466 . .

ZA Qazi , , , CC Tu , , , L Chiang , , , 等 . . SIMPLE-fying middlebox policy enforcement using SDN . . ACM SIGCOMM Comput Commun Rev , , 2013 . . 43 ( ( 4 ): ): 27 - - 38 . . DOI: 10.1145/2486001.2486022 http://doi.org/10.1145/2486001.2486022 . .

M Reitblatt , , , N Foster , , , J Rexford , , , 等 . . Consistent updates for software-defined networks: change you can believe in . . 10 th ACM Workshop on Hot Topics in Networks , , 2011 . . Article 7 DOI: 10.1145/2070562.2070569 http://doi.org/10.1145/2070562.2070569 . .

M Reitblatt , , , N Foster , , , J Rexford , , , 等 . . Abstractions for network update . . ACM SIGCOMM Comput Commun Rev , , 2012 . . 42 ( ( 4 ): ): 323 - - 334 . . DOI: 10.1145/2377677.2377748 http://doi.org/10.1145/2377677.2377748 . .

S Scott-Hayward . . Design and deployment of secure, robust, and resilient SDN controllers . . 1 st IEEE Conf on Network Softwarization , , 2015 . . p.1 - - 5 . . DOI: 10.1109/NETSOFT.2015.7258233 http://doi.org/10.1109/NETSOFT.2015.7258233 . .

S Scott-Hayward , , , G OoCallaghan , , , S Sezer . . SDN security: a survey . . IEEE SDN for Future Networks and Services , , 2013 . . p.1 - - 7 . . DOI: 10.1109/SDN4FNS.2013.6702553 http://doi.org/10.1109/SDN4FNS.2013.6702553 . .

S Sezer , , , S Scott-Hayward , , , PK Chouhan , , , 等 . . Are we ready for SDN . . Implementation challenges for software-defined networks. IEEE Commun Mag , , 2013 . . 51 ( ( 7 ): ): 36 - - 43 . . DOI: 10.1109/MCOM.2013.6553676 http://doi.org/10.1109/MCOM.2013.6553676 . .

S Shin , , , GF Gu . . CloudWatcher: network security monitoring using OpenFlow in dynamic cloud networks . . 20 th IEEE Int Conf on Network Protocols , , 2012 . . p.1 - - 6 . . DOI: 10.1109/ICNP.2012.6459946 http://doi.org/10.1109/ICNP.2012.6459946 . .

S Shin , , , P Porras , , , V Yegneswaran , , , 等 . . FRESCO: modular composable security services for software-defined networks . . ISOC Network and Distributed Security Symp , , 2013 . . p.1 - - 16 . . . .

A Tavakoli , , , M Casado , , , T Koponen , , , 等 . . Applying NOX to the datacenter . . 8 th ACM Workshop on Hot Topics in Networks , , 2009 . . p.1 - - 6 . . . .

A Voellmy , , , H Kim , , , N Feamster . . Procera: a language for high-level reactive network control . . 1 st Workshop on Hot Topics in Software Defined Networks , , 2012 . . p. 43 - - 48 . . DOI: 10.1109/10.1145/2342441.2342451 http://doi.org/10.1109/10.1145/2342441.2342451 . .

K Wang , , , JH Li , , , J Wu , , , 等 . . QoS-predicted energy efficient routing for information-centric smart grid: a network calculus approach . . IEEE Access , , 2018 . . 6 52867 - - 52876 . . DOI: 10.1109/ACCESS.2018.2870929 http://doi.org/10.1109/ACCESS.2018.2870929 . .

X Wang , , , Z Liu , , , YX Qi , , , 等 . . LiveCloud: a lucid orchestrator for cloud datacenters . . 4 th IEEE Int Conf on Cloud Computing Technology and Science , , 2012 . . p.341 - - 348 . . DOI: 10.1109/CloudCom.2012.6427544 http://doi.org/10.1109/CloudCom.2012.6427544 . .

XT Wen , , , Y Chen , , , CC Hu , , , 等 . . Towards a secure controller platform for openflow applications . . 2 nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking , , 2013 . . p.171 - - 172 . . DOI: 10.1145/2491185.2491212 http://doi.org/10.1145/2491185.2491212 . .

J Wu , , , MX Dong , , , K Ota , , , 等 . . FCSS: fog computing based content-aware filtering for security services in information centric social networks . . IEEE Trans Emerg Top Comput, in press , , 2017 . . DOI: 10.1109/TETC.2017.2747158 http://doi.org/10.1109/TETC.2017.2747158 . .

J Wu , , , MX Dong , , , K Ota , , , 等 . . Big data analysis-based secure cluster management for optimized control plane in software-defined networks . . IEEE Trans Netw Serv Manag , , 2018a . . 15 ( ( 1 ): ): 27 - - 38 . . DOI: 10.1109/TNSM.2018.2799000 http://doi.org/10.1109/TNSM.2018.2799000 . .

J Wu , , , SB Luo , , , S Wang , , , 等 . . NLES: a novel lifetime extension scheme for safety-critical cyber-physical systems using SDN and NFV . . IEEE Internet Things J, in press , , 2018b . . DOI: 10.1109/JIOT.2018.2870294 http://doi.org/10.1109/JIOT.2018.2870294 . .

EZ Yang , , , LK Zhang , , , Z Yao , , , 等 . . A video conferencing system based on SDN-enabled SVC multicast . . Front Inform Technol Electron Eng , , 2016 . . 17 ( ( 7 ): ): 672 - - 681 . . DOI: 10.1631/FITEE.1601087 http://doi.org/10.1631/FITEE.1601087 . .

SH Yeganeh , , , Y Ganjali . . Kandoo: a framework for efficient and scalable offloading of control applications . . 1 st Workshop on Hot Topics in Software Defined Networks , , 2012 . . p.19 - - 24 . . DOI: 10.1145/2342441.2342446 http://doi.org/10.1145/2342441.2342446 . .

SH Yeganeh , , , A Tootoonchian , , , Y Ganjali . . On scalability of software-defined networking . . IEEE Commun Mag , , 2013 . . 51 ( ( 2 ): ): 136 - - 141 . . DOI: 10.1109/MCOM.2013.6461198 http://doi.org/10.1109/MCOM.2013.6461198 . .

D Zhang , , , Z Chang , , , FR Yu , , , 等 . . A double auction mechanism for virtual resource allocation in SDN-based cellular network . . IEEE 27 th Annual Int Symp on Personal, Indoor, and Mobile Radio Communications , , 2016a . . p.1 - - 6 . . DOI: 10.1109/PIMRC.2016.7794896 http://doi.org/10.1109/PIMRC.2016.7794896 . .

D Zhang , , , Z Chang , , , T Hmlinen . . Reverse combinatorial auction based resource allocation in heterogeneous software defined network with infrastructure sharing . . IEEE 83 rd Vehicular Technology Conf , , 2016b . . p.1 - - 6 . . DOI: 10.1109/VTCSpring.2016.7504455 http://doi.org/10.1109/VTCSpring.2016.7504455 . .

D Zhang , , , Z Chang , , , T Hmlinen , , , 等 . . Double auction based multi-flow transmission in software-defined and virtualized wireless networks . . IEEE Trans Wirel Commun , , 2017 . . 16 ( ( 12 ): ): 8390 - - 8404 . . DOI: 10.1109/TWC.2017.2762300 http://doi.org/10.1109/TWC.2017.2762300 . .

浏览量

Downloads

CSCD

文章被引用时，请邮件提醒。

Submit

工具集

关联资源

Microwave metamaterials: from exotic physics to novel information systems

Stochastic stability analysis of networked control systems with random cryptographic protection under random zero-measurement attacks

A secure and high-performance multi-controller architecture for software-defined networking

A lightweight authentication scheme with user untraceability*