تحقيق خطة حماية شبكة محلية ذات تجزئة ميكروية باستخدام مفاهيم افتراضية الشبكة والشبكات المعرّفة برمجياً

Authors

  • سيرا أستور

Abstract

Legacy computer networks’ security and access rules rely on previously defined segments in the physical networks which usually leads to many, coarse-grained, hard to change security rules.  New technologies of network virtualization, programmable switches and Software Defined Network (SDN) allow the use of better approaches for securing networks.  This is especially crucial for the network portions that are not segmented, such as LANs, or inside one segment in a data center.  We implemented an inside segment, cross cutting security rules on a proposed network using the new previously mentioned technologies.  The implemented security rules are designed to be fine-grained, classless, and segment free that could work on multiple levels of the network reference model, or on the host port level inside a LAN at the same time. This was done in order to explore and show the benefits of using Network Virtualization (NV) and (SDN) technologies to achieve micro-fragmented security plans. A security plan scenario was designed in a way that demonstrates multiple network layers security objectives, and cross cutting access rules to multiple network segments.  These segments were defined physically, and by using virtual networks’ tags (VLAN).

The suggested network were implemented using the Mininet simulation for SDN, and the POX controller after adding the suitable code to realize the suggested security plan.  Results show the success of implementation of fine-grained, segments cross-cutting security rules, the ease and flexibility of applying such rules on-line, the dynamicity of it, and its adaptability with any changes applied to the proposed network.

تعتمد حماية الشبكات الحاسوبية التقليدية وقواعد النفاذ المستخدمة فيها حالياً على تعريف مسبق لمقاطع ضمن الشبكة الحاسوبية المستهدفة؛والذي عادة ما يقود إلى عدد كبير من قواعد النفاذ ذات الحبحبة الخشنة (Coarse-Grained) والتي تكون غير مرنة في التعامل، ومرتفعة الكلفة لتطبيق التغييرات والتعديلات على الشبكة خلال تطورها وتغييرها مع الزمن.  تسمح التقانات الحديثة في الشبكات الحاسوبية مثل تحقيق الافتراضية في الشبكات (NV)، والشبكات المعرّفة برمجياً (SDN) باستخدام مقاربات أفضل لتحقيق قواعد حماية الشبكة وبالأخص على الشبكات المحلية؛ وتمكّن من تحقيق الحماية على مستوى عناصر الشبكة وعلى أكثر من طبقة من طبقات الشبكة المرجعية بدلاً من حدود مقاطعها المعرّفة مسبقاً إما فيزيائياً، أو حتى إن كانت معرّفة عن طريق الشبكة الافتراضية VLAN.  تم في هذا البحث تطوير خطة حماية ذات تجزئة ميكروية تخترق عدة مقاطع شبكية معرّفة مسبقاً.هذه المقاربة الجديدة في الحماية لا ترتبط بطبقات الشبكة التقليدية مثل طبقة الشبكة أو طبقة ربط البيانات أو التطبيقات، وتوفّر قواعد حماية مختلفة على مستوى مضيف و/أو بوابة محددة من مضيف. تم تحقيق خطة الحماية على شبكة بسيطة تم تعريفها باستخدام برنامج المحاكاة (Mininet)، الأكثر شهرة عند التعامل مع تقانات الشبكة المعرّفة افتراضياً (SDN)، وتم التحكم بالدفق وقواعد النفاذ عبر استخدام المتحكم البرمجي (POX)، وتم إضافة الترميزات المناسبة للتحكم بقواعد النفاذ المختلفة.  وأظهرت النتائج نجاح عمليات الحماية الميكروية الجزئية والمقدرة العالية لتحديث وتعديل الخطط الأمنية بفاعلية وأداء عال.

References

KUSNETZKY D. K.,Virtualization is more than Virtual Machine Software. Available at http://www.kusnetzky.net/publications/ImpactPapers/20070829_Virtualization_is_more_than_VM.pdf - 2007.

(Last visited: November 2017).

EMMERICH P., RAUMER D., WOHLFART F., and CARLE G.,Performance characteristics of virtual switching. In Cloud Networking (CloudNet), 2014 IEEE 3rd International Conference on. IEEE, 2014.

MAHALINGAM M., DUTT D., DUDA K., AGARWAL L.,KREEGER P., SRIDHAR T., A Framework for Overlaying Virtualized Layer 2 Networks over Layer 3 Networks.RFC7348: Virtual eXtensible Local Area Network (VXLAN), 2014.

VMware Documentation; https://www.vmware.com/support/pubs/.(Last visited: November 2017).

Arista - Software Driven Cloud Networking; https://www.arista.com/.(Last visited: February 2018).

Publications | Cisco Research Center; research.cisco.com/publications.

RAGHAVAN B.et al., Software-defined internet architecture: decoupling architecture from infrastructure, in Proceedings of the 11th ACM Workshop on HotTopics in Networking. 2012, pp. 43–48.

KREUTZ D., RAMOS F. M., VERISSIMO P., et al.;Software-defined networking: A comprehensive survey, Proc. IEEE, vol. 103, no. 1, 2015, pp. 14–76.

OpenFlow; http://www.openflow.org

PFEFF B., DAVIE B., open vSwitch database management protocol, IETF RFC, 7047, 2015.

ENNS R., BJOVKLUND M, et al., Network Configuration Protocol (NETCONF),Network Configuration Working Group’s proposal of NETCONF, RFC 624, IETF, June 2011.

KREUTZ D., RAMOS F., and VERISSIMO P., Towards secure and dependable software-defined networks, in Proceedings of the 2nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, Hot SDN 2013, New York, USA, ACM, August 2013, pp. 55–60.

What are SDN Controllers?, SDX Central," [online] 2014,

https://www.sdxcentral.com/resources/sdn/sdn-controllers/(Last visited: November 2017).

Big Switch Networks, Inc.www.bigswitch.com/(Last visited: November 2017).

Pica8www.pica8.com/(Last visited: November2017).

SEZER S. et al., SDN security: A

Survey, in Proceedings of IEEE for Future Networks and Services (SDN4FNS), 2013, pp. 1–7.

NAYAK A., REIMERS A., FEAMSTER N., and CLARCK R., Resonance: Dynamic access control for enterprise networks. In Proceedings of the 1st ACM Workshop on Research on Enterprise Networking (WREN’09), New York, NY, USA, 2009, pp. 11–18.

YuHunagbC., MinChiT.,YaoTing C., YuChieh C., and YanRen C.,A novel design for future on-demand service and security. In 12th IEEE Int. Conf. on Communication Technology (ICCT), 2010, pp. 385–388

BILGER B., BOEHME A., et al.,Software Defined Perimeter. Cloud Security Alliance – CSA. 2013.

https: //cloudsecurityalliance.org/research/sdp/. (Last visited: October 2107).

YuHunag C., MinChi T., YaoTing C., YuChieh C., and YanRen C., A novel design for future on-demand service and security, In 12th IEEE International Conference on Communication Technology (ICCT), 2010, pp.385–388.

JAFARIAN J. H., AL-SHAER E., and DUAN Q., Openflow random host mutation: Transparent moving target defense using software defined networking. In Hot Topics in Software Defined Networks –HotSDN. ACM, 2012

Open vSwitch (2015). Production Quality, Multilayer Open Virtual Switch. Last visitedFebruary 2018).

NOXRepo.org (2015). About NOX.

http://www.noxrepo.org/pox/about-nox/. (Last visited:February 2018).

GREENBERG A., MALTZ D. A., et al.,A clean slate 4d approach to network control and management. ACM SIGCOMM Computer Communication Review, vol. 35, no. 5, Oct. 2005. pp. 41–54.

CASADO M., GARFINKEL T., et al., SANE: A Protection Architecture for Enterprise Networks. In Proceedings ofUsenix Security,2006, pp. 137–151.

CASADO M., FREEDMAN M., et al., Ethane: Taking control of the enterprise. In Proceedings of the 2007 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications (SIGCOMM’07), Rev., vol. 37, no. 4, NY, USA, 2007,pp. 1–12.

AHMAD I., NAMAL S., et al., Security in software defined networks: A survey,IEEE Communication Surveys and Tutorials, 2015.

Downloads

Published

2018-12-30

How to Cite

1.
أستور س. تحقيق خطة حماية شبكة محلية ذات تجزئة ميكروية باستخدام مفاهيم افتراضية الشبكة والشبكات المعرّفة برمجياً. Tuj-eng [Internet]. 2018Dec.30 [cited 2024Apr.19];40(6). Available from: https://journal.tishreen.edu.sy/index.php/engscnc/article/view/5805

Issue

Vol. 40 No. 6 (2018): العلوم الهندسية

Section

Articles

License

Copyright (c) 2018 ttps://creativecommons.org/licenses/by-nc-sa/4.0/

Creative Commons License

This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.

The authors retain the copyright and grant the right to publish in the magazine for the first time with the transfer of the commercial right to Tishreen University Journal for Research and Scientific Studies - Engineering Sciences Series

 Under a CC BY- NC-SA 04 license that allows others to share the work with of the work's authorship and initial publication in this journal. Authors can use a copy of their articles in their scientific activity, and on their scientific websites, provided that the place of publication is indicted in  Tishreen University Journal for Research and Scientific Studies - Engineering Sciences Series   .  The Readers have the right to send, print and subscribe to the initial version of the article, and the title of  Tishreen University Journal for Research and Scientific Studies - Engineering Sciences Series     Publisher

journal uses a CC BY-NC-SA license which mean

You are free to:

  • Adapt — remix, transform, and build upon the material
  •  
  • The licensor cannot revoke these freedoms as long as you follow the license terms.

 

  • Attribution — You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
  • NonCommercial — You may not use the material for commercial purposes.
  • ShareAlike — If you remix, transform, or build upon the material, you must distribute your contributions under the same license as the original.
  • No additional restrictions — You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.