An active defense method for timing side-channel attacks on SDN networks

Abstract

The invention discloses an active defense method for time sequence side channel attacks facing an SDN network. The method comprises the following steps that: after a controller monitors a Packet-In message, the controller issues a first flow table rule and a second flow table rule to a switch which triggers the Packet-In message; the data packet is matched with the first flow table rule, and the switch forwards the data packet to a delay host directly connected with the switch; the delay host captures the data packet and randomly adds delay T to the data packet; at the delay T after the capture moment, the delay host forwards the data packet back to the switch; wherein the first flow table rule is used for forwarding the data packet to the delay host by matching the target IP with the first input port number, and the second flow table rule is used for forwarding the data packet to the next hop switch or the target host by matching the target IP with the second input port number. The Delay host is used for adding delay to the data packet, pre-installing the flow rule and dynamically installing the flow rule during topology change, noise adding and confusion are carried out on side information, judgment of an attacker is interfered, and defending of side channel attacks is achieved.

Description

technical field [0001] The invention belongs to the technical field of defense against side channel attacks, and more particularly relates to an active defense method for timing side channel attacks oriented to an SDN network. Background technique [0002] Since the SDN network is centralized control, when the switch encounters a problem in data forwarding, the switch will send a request to the controller. For example, when the data flow cannot match the flow rules on the switch, the switch will send a request to the controller to inquire about the routing path, and the controller will calculate and install new flow rules into the switch. Until then, the switch is blocked, which increases latency in this case. Therefore, the SDN network has the characteristics of easy access to network information and a unique centralized data packet forwarding control mechanism, and is relatively vulnerable to side channel attacks. [0003] Existing defense methods for side channel attack...

AI Technical Summary

Problems solved by technology

[0005] Aiming at the defects of the prior art, the purpose of the present invention is to solve the technical problems that the performance overhead of the side channel defense method in the prior art is very large, and it is difficult to be compatible with the general SDN framework or hardware in the industry

Images