| With the continuous development of network applications,a variety of new network technologies have emerged one after another,greatly enriching the needs of users with the network.For diverse network applications,different new network protocols have different application scenarios and security requirements.For heterogeneous networks with different security forwarding needs,scenario-oriented personalized security forwarding mechanisms can often maximize the protection of data confidentiality and integrity.However,the demand for secure forwarding varies greatly among different network protocols,and traditional encryption mechanisms cannot be applied to all new network protocols.So how to implement flexible and definable secure forwarding techniques has become a current research hotspot.The programmable data plane manages the network in a fully programmable manner,enabling users to quickly develop new custom network features and implement specific network behaviors that best suit their own needs.This feature provides the technical support for flexible and definable secure forwarding mechanisms and facilitates the deployment and application of heterogeneous networks running different new network protocols.However,there are still many challenges in personalized encryption and heterogeneous network interconnection based on programmable data planes to achieve flexible and definable secure forwarding,as shown in(1)The fixed data plane behavior of traditional network devices cannot meet the needs of new network protocols for personalized encryption;(2)The encryption algorithm in the existing secure forwarding mechanism does not match the data security requirements and cannot effectively balance security and transmission performance;(3)Heterogeneous networks lack a secure and effective interconnection mechanism,and heterogeneous subnetworks are inefficiently interconnected and difficult to guarantee security.Therefore,this thesis addresses the above issues and implements the research of definable secure forwarding technology for new networks based on programmable data plane from three aspects.The research content and main contributions are as follows:(1)A protocol-independent definable secure forwarding mechanismIn order to solve the problem that "traditional network equipment data plane behavior is fixed,cannot meet the personalized encryption requirements of new network protocols",a protocol-independent definable secure forwarding mechanism(PIFET)is proposed.Firstly,the system architecture of definable secure forwarding for heterogeneous protocols is designed based on the programmable platform.Based on this,a flexible encrypted forwarding with definable encrypted messages,encryption methods,and encryption algorithms is realized according to the message characteristics and security requirements of heterogeneous data.Finally,a flexible optional encryption method for the packet header field of tunneling mode is designed to meet the personalized tunneling encryption requirements of different network protocols.The experimental results show that PIFET provides users with flexible and definable encryption methods to meet the encryption needs of different data types.In addition,flexible encryption reduces the amount of unnecessary encryption and improves system performance.(2)An encryption algorithm scheduling mechanism that balances security and transmission performanceIn order to solve the problem that "the encryption algorithm in the existing secure forwarding mechanism does not match the data security requirements and cannot effectively balance security and transmission performance",an encryption algorithm scheduling mechanism that balances security and transmission performance is proposed.First,we analyze the effect of different metrics on network performance,especially throughput,and latency,during encryption and decryption,and determine the key metrics that affect network performance.Then,a feedback scheduling algorithm is proposed to adjust the encryption algorithm used according to the network security level to achieve a balance between security and transmission performance.Finally,a comprehensive evaluation index that takes into account security and transmission performance is proposed to refine the encryption algorithm switching criteria.The experimental results show that the proposed mechanism can dynamically switch to the corresponding encryption algorithm when the network security requirements change,balancing system security and transmission performance while meeting the encryption requirements.(3)Multi-protocol secure forwarding technology for heterogeneous network interconnectionIn order to solve the problem that "lack of secure and effective interconnection mechanism between heterogeneous networks,network interconnection is inefficient and security is difficult to guarantee",Multi Sec(Multi-Protocol Security),a multi-protocol security forwarding technology for heterogeneous network interconnection,is designed to realize the interconnection between heterogeneous subnets based on the PIFET mechanism proposed in Chapter 2.First,a programmable protocol conversion mechanism is designed to achieve multi-protocol parsing.Then,based on cyclic parsing,an integrated design scheme of secure forwarding and protocol conversion is proposed,which can complete the conversion of heterogeneous protocols and IP protocols while performing data message encryption and decryption.Finally,to further improve the overall performance,the encryption card is configured to work in asynchronous mode.Experiments show that Multi Sec can effectively meet the requirements of multi-protocol secure forwarding.Compared with mainstream IPsec,Multi Sec has significant advantages in terms of performance and applicability. |
