Secure communication method for distributed multi-granularity controller of software defined network based on proxy

Abstract

The invention relates to a secure communication method for a distributed multi-granularity controller of a software defined network based on proxy, and belongs to the technical field of inter-domain secure communication of a multi-domain SDN. The method comprises the following steps: designing architecture of a distributed multi-granularity security controller, wherein the architecture comprises a message data packet format between controllers, establishing a communication tunnel via the connection between a controller domain and inter-domain proxies and the connection between the inter-domain proxies, and completing neighbor discovery between the controller, two-step identity authentication and encrypted transmission to achieve direct communication between multi-domain network controllers. In the communication method, the infrastructure is based on the security controller and the inter-domain proxies, a message of a control plane is released to a data plane by the inter-domain proxies for transmission, and thus the communication problem between independent control planes is solved; and meanwhile, the two-step authentication scheme of communication of the controller is given based on a challenge response mechanism and a DTLS protocol, service supply can be defended and refused, and the identity authentication is completed to improve the security.

Description

technical field [0001] The invention belongs to the technical field of inter-domain communication security of a multi-domain SDN network, and relates to an agent-based software-defined network distributed multi-granularity controller security communication method. Background technique [0002] In recent years, more and more researchers have begun to address the problems in the large-scale deployment of SDN, including the cooperation of multiple controllers in the control plane, the division of controller management areas, and load balancing. In the case of multiple SDN autonomous domains, the routing problem between autonomous domains is also of particular concern. [0003] In terms of the expansion of the intra-domain control plane, there are research results such as DIFANE, DevoFlow, HyperFlow, and Onix. Aiming at the performance bottleneck of the controller in real-time flow table processing, DIFANE uses active and passive simultaneous methods to add flow tables to the s...

AI Technical Summary

Problems solved by technology

Due to the characteristics of SDN, inter-domain interconnection is basically realized through the east-west communication of controllers, but the communication method and security between controllers have not received much attention

Images