Research On Access Control On The Northbound Interface Of Heterogeneous SDN Controller Architecture

Software-defined networking(SDN),as a new type of network architecture,has been favored by the industry for its flexible control and programmable features.To reduce the possible infection of attacks between homogeneous controllers,someone has introduced the idea of dynamic heterogeneous redundancy into the SDN control layer and proposes a heterogeneous SDN controller architecture.Recently,heterogeneous SDN controller architectures have been used in scenarios such as cloud data centers,VANET and smart grids.Unlike traditional SDN networks with only local applications,more and more applications are deployed in remote clouds,which places new demands on application access control.The application program calls the Northbound Interface(NBI)to access the network resources on the controller,thereby achieving network programmability.However,northbound interfaces that lack mechanisms such as encryption,authentication,and authorization management can cause security issues,such as resource exposure and configuration tampering.To address these issues,researchers have developed specific access control systems for different controllers.However,this will have the following problems:(1)There are many different kinds of controllers in the heterogeneous SDN controller architecture,and various types of controllers differ greatly in terms of system architecture and programming language.When security requirements change,access control systems on different controllers must be rewritten.(2)Existing systems mostly use API hooking to implement access control to the controller's internal SDN applications,but this method cannot achieve access control for external applications that are more common in architectures.Given these problems,we abstract the access control task and transfer the mutual access control functions to a common platform or module outside the controller to solve the access control problem under the alternative controller architecture.Under the server architecture,two universal northbound interface access control schemes are designed.The main work here is as follows:(1)For the application scenario of single application access,we propose an intermediate proxy access control scheme based on SGX.Firstly,we combined SGX technology to propose a trusted intermediate proxy access control model.In the proposed model,the agent is located between the application layer and the control layer and runs in a trusted execution environment.The controller delegates the access control task to the trusted agent layer to complete,thereby achieving universal access control for heterogeneous controllers.Secondly,to reduce the workload of the controller,and securely transmit sensitive data such as policies and resources,we have designed a lightweight security protocol combining the remote authentication and sealed storage features of SGX,which includes the agent,application and controller.The process of identity authentication,key agreement and message broker forwarding between participants.During the implementation of the protocol,the controller only needs to perform simple AES encryption.Finally,through theoretical analysis and simulation experiments,we show that this solution has lower calculation overhead and network overhead,and at the same time,it has better practicability.(2)Aiming at the application scenario where multiple applications access cooperatively,we propose a broadcast encryption scheme based on trust attributes.Firstly,we use an AND gate structure,combining a mixed-order bilinear group,an elliptic curve encryption algorithm,and a dual system encryption technology to implement an attribute broadcast encryption model.This model only needs to install an encryption and decryption module that is commonly used in heterogeneous controllers,which can implement application access control and encrypt and transmit network resources.Compared with other similar attribute broadcast encryption methods,we introduce middleman attribute-based encryption technology and hash technology into the model to achieve outsourced storage and verifiable outsourced decryption,reducing the user's private key storage overhead and decryption computing overhead.Secondly,to solve the problem that legitimate applications may be invaded and cause unauthorized access or unauthorized access,we introduce a trust evaluation model to dynamically adjust application access permissions.The model evaluates the credibility of the application based on its historical interaction behavior and assigns access permissions accordingly.Finally,through theoretical analysis and comparative experiments,we show that the computational and storage overheads of the scheme are small,the scalability is strong,and the effectiveness of the trust evaluation method is verified by simulation experiments.