Dynamic Virtualization Security Service Construction Strategy for Software Defined Networks
Zhenji Wang, Dan Tao, Zhaowen Lin · 2016
For Software Defined Network(SDN), security is an important factor which affects its large-scale deployment. The existing security solutions for SDN mainly focus on the controller itself, which has to handle all the security protection task by using the programmability of network. It will undoubtedly bring the heavy burden to the controller. More devastating, once the controller itself is attacked, the entire network will be paralyzed. Motivated by this, this paper proposes a novel security protection architecture for SDN. We design a security service orchestration center in the control plane of SDN. This center physically decouples from SDN controller, and thus constructs SDN security service to defense security threats. In particular, we set up a security meta-function base which can be used for security service composition in a rule engine. The rule engine can be realized by using the optimized rule composition algorithms. Finally, a series of experimental results show that the proposed security protection architecture for SDN can achieve effective security protection with small burden of controller.