Research On Topology Security Based On SDN

Software-defined networking(SDN)is a new type of network architecture.Unlike traditional networks,SDN separates the control plane and data plane in the network.The control plane is composed of logically centralized controllers.The data plane consists of forwarding equipment.The controller with network control is one of the core advantages of SDN,but it also expands the attack surface and becomes a key attack target for attackers.Existing research shows that the global topology view in the controller can be easily tampered by an attacker.By launching the topology attack,an attacker can masquerade as a server in the network to obtain the client's traffic,or forge a fake link to create a black hole route or initiate a man-in-the-middle attack.Although researchers have proposed a large number of defense models to prevent topology attacks,these models have limited application scenarios and do not always play a role in protecting the global topology view in the controller.We conducted a security analysis of the existing defense models,analyzed the defense principles of the mainstream defense models,and proposed two new topology attacks on this basis.The attacker can skillfully bypass the attack detection of the existing defense models and disguise into a server or a fake link.In addition,a total of 9 topology attack threat models are established and the attack principles of these threat models are analyzed in depth in this paper.In order to defend against topology attacks,this article starts from the attack principle and adopts different defense strategies for each attack to ensure that the topology view in the controller can be fully and effectively protected.We propose a mathematical model based on information entropy to determine the delay of network links,define port security,and use concepts such as suspicious ports and illegal links to defend against attacks.Based on the above,we propose a method that makes full use of SDN features.Topology attack defense model-Policy Topo.We deployed Policy Topo in the virtual environment and the physical test bench respectively,and conducted offensive and defensive tests on it.The results show that Policy Topo not only effectively protects against topology attacks,but also introduces very low performance overhead.