Attribute-Guard: Attribute-Based Flow Access Control Framework in Software-Defined Networking

Software-defined networking (SDN) decouples the control plane from the data plane, offering flexible network configuration and management. Because of this architecture, some security features are missing. On the one hand, because the data plane only has the packet forwarding function, it is impossib...

Full description

Saved in:
Bibliographic Details
Published in:Security and communication networks 2020, Vol.2020 (2020), p.1-18
Main Authors: Zuo, ZhiBin, Xi, Qin, Chang, Chaowen, Zhu, Xianwei
Format: Article
Language:English
Subjects:
Access control
Configuration management
Cybersecurity
Digital signatures
Firewalls
Forgery
Matching
Protocol
Roles
Security management
Software
Software-defined networking
Citations: Items that this one cites
Items that cite this one
Online Access:Get full text
Tags: Add Tag
No Tags, Be the first to tag this record!
Description
Summary:Software-defined networking (SDN) decouples the control plane from the data plane, offering flexible network configuration and management. Because of this architecture, some security features are missing. On the one hand, because the data plane only has the packet forwarding function, it is impossible to effectively authenticate the data validity. On the other hand, OpenFlow can only match based on network characteristics, and it is impossible to achieve fine-grained access control. In this paper, we aim to develop solutions to guarantee the validity of flow in SDN and present Attribute-Guard, a fine-grained access control and authentication scheme for flow in SDN. We design an attribute-based flow authentication protocol to verify the legitimacy of the validity flow. The attribute identifier is used as a matching field to define a forwarding control. The flow matching based on the attribute identifier and the flow authentication protocol jointly implement fine-grained access control. We conduct theoretical analysis and simulation-based evaluation of Attribute-Guard. The results show that Attribute-Guard can efficiently identify and reject fake flow.
ISSN:1939-0114
1939-0122
DOI:10.1155/2020/6302739