一种软件定义网络的安全服务路径优化构建机制

doi:10.19665/j.issn1001-2400.2019.01.025

西安电子科技大学学报 ›› 2019, Vol. 46 ›› Issue (1): 158-165.doi: 10.19665/j.issn1001-2400.2019.01.025

一种软件定义网络的安全服务路径优化构建机制

刘益岑,陈兴凯,卢昱,乔文欣

陆军工程大学装备模拟训练中心,河北石家庄 050003

收稿日期:2018-07-24 出版日期:2019-02-20 发布日期:2019-03-05
作者简介:刘益岑(1993-),男,陆军工程大学硕士研究生,E-mail: 18419764051@163.com
基金资助:
国家自然科学基金(61271152);国家自然科学基金青年基金(61602505)

SDN-based optimal security service path construction mechanism

LIU Yicen,CHEN Xingkai,LU Yu,QIAO Wenxin

Equipment Simulation Training Center, Army Engineering Univ., Shijiazhuang 050003, China

Received:2018-07-24 Online:2019-02-20 Published:2019-03-05

摘要/Abstract

摘要：

针对现有的安全服务路径优化构建方法缺乏综合考虑具体安全需求和底层资源状态的问题,提出一种基于启发式广度优先搜索算法的安全服务路径优化构建机制。首先,给出了基于软件定义网络的安全服务路径构建的总体结构,并引入整数线性规划对安全服务路径优化构建问题进行数学建模;其次,提出一种启发式广度优先搜索的模型求解算法,主要采用“先选择后搜索”的方式,解决同时考虑具体安全需求和底层资源状态的安全服务路径优化构建问题。仿真实验结果表明,所提出的构建机制在性能指标上优于对比方法。

关键词: 软件定义网络, 安全服务路径, 线性整数规划, 广度优先搜索

Abstract:

In view of the fact that existing security service path optimization methods lack a comprehensive consideration of the specific security requirements and the underlying resource status, a dynamic construction mechanism of security service path based on the heuristic breadth first search algorithm is proposed. First, the overall structure of the dynamic construction of the security service path based on the software-defined networking is given, and the integer linear programming is introduced to model this problem. Second, a model solving algorithm is proposed, which mainly adopts the "first select after search" method to solve the security service path construction problem which considers both the specific security needs and the underlying resource status. Finally, simulation results show that the proposed construction mechanism is better than the compared method in terms of the performance index.

Key words: software-defined networking, security service path, integer linear programming, breadth first search algorithm

中图分类号:

TN915.81

刘益岑,陈兴凯,卢昱,乔文欣. 一种软件定义网络的安全服务路径优化构建机制[J]. 西安电子科技大学学报, 2019, 46(1): 158-165.

LIU Yicen,CHEN Xingkai,LU Yu,QIAO Wenxin. SDN-based optimal security service path construction mechanism[J]. Journal of Xidian University, 2019, 46(1): 158-165.

图/表 9

图1

图2

图3

表1

图4

图5

图6

图7

图8

参考文献 8

[1]	左青云, 陈鸣, 王秀磊 , 等. 一种基于SDN的在线流量异常检测方法[J]. 西安电子科技大学学报, 2015,42(1):155-160. doi: 10.3969/j.issn.1001-2400.2015.01.025
	ZUO Qingyun, CHEN Ming, WANG Xiulei , et al. Online Traffic Anomaly Detection Method for SDN[J]. Journal of Xidian Univerisity, 2015,42(1):155-160. doi: 10.3969/j.issn.1001-2400.2015.01.025
[2]	LEE W, KIM N . Security Policy Scheme for an Efficient Security Architecture in Software-Defined Networking[J]. Information, 2017,8(2):65. doi: 10.3390/info8020065
[3]	LIU Y, ZHANG H Q, LIU J , et al. A New Approach for Delivering Customized Security Everywhere: Security Service Chain[J]. Security and Communication Networks, 2017,2017:9534754.
[4]	SENDI A S, JARRAYA Y, POURZANDI M , et al. Efficient Provisioning of Security Service Function Chaining Using Network Security Defense Patterns[J]. IEEE Transactions on Services Computing, 2016, DOI 10.1109/TSC.2016.2616867. doi: 10.1109/TSC.2016.2616867
[5]	BASILE C, PITSCHEIDER C, RISSO F, et al. Towards the Dynamic Provision of Virtualized Security Services [C]// Communications in Computer and Information Science: 530. Heidelberg: Springer Verlag, 2015: 65-76.
[6]	PARK Y, CHANDALIYA P, MURALIDHARAN A, et al. Dynamic Defense Provision via Network Functions Virtualization [C]// Proceedings of the 2017 ACM International Workshop on Security in Software Defined Networks and Network Function Virtualization. New York: ACM, 2017: 43-46.
[7]	BONAKDARPOUR B, BOZGA M, JABER M , et al. A Framework for Automated Distributed Implementation of Component-based Models[J]. Distributed Computing, 2012,25(5):383-409. doi: 10.1007/s00446-012-0168-6
[8]	SAHHAF S, TAVERNIER W, ROST M , et al. Network Service Chaining with Optimized Network Function Embedding Supporting Service Decompositions[J]. Computer Networks, 2015,93:492-505. doi: 10.1016/j.comnet.2015.09.035

算法	描述
TS	文献[3]所提出的一种基于启发式的禁忌方法,其主要通过设置禁忌表的方式搜索最优安全服务路径,这是一种侧重节点资源利用的方法
LG	文献[6]所提出的一种基于启发式的分层图方法,其主要通过在构建图上应用最短路径算法构建安全路径,这是一种侧重链路资源利用的方法
BFS	文中提出的启发式广度优先搜索模型求解算法,这是一种基于全局搜索的算法

一种软件定义网络的安全服务路径优化构建机制

SDN-based optimal security service path construction mechanism

RichHTML

PDF (PC)

赞

可视化

摘要/Abstract

引用本文

使用本文

图/表 9

参考文献 8

相关文章 7

Metrics

本文评价

推荐阅读 10

[1]	柴艳娜,李坤伦,宋焕生. 智能汽车的入侵检测系统安全研究[J]. 西安电子科技大学学报, 2021, 48(3): 31-39.
[2]	凌敏,罗影,袁亮,靳传学. 一种面向智慧交通的车联网网络流量估计方法[J]. 西安电子科技大学学报, 2021, 48(3): 40-48.
[3]	甄岩,赵虎. 层次型软件定义无线传感器网络资源调度策略[J]. 西安电子科技大学学报, 2019, 46(4): 87-98.
[4]	郑凌;邱智亮;孙士勇;潘伟涛;王伟娜;张之义. 软件定义网络中一种两步式多级流表构建算法[J]. 西安电子科技大学学报, 2018, 45(5): 25-31.
[5]	熊余;张振振;师劲;吴大鹏. TWDM-PON中软件定义控制的全局资源分配机制[J]. 西安电子科技大学学报, 2017, 44(5): 140-146.
[6]	左青云;陈鸣;王秀磊;刘波. 一种基于SDN的在线流量异常检测方法[J]. J4, 2015, 42(1): 155-160.
[7]	暂时无作者信息. 非线性整数二层规划的一种算法[J]. J4, 2001, 28(2): 198-202.