As Software Defined Networking (SDN) applications gain fine-grained network control via the northbound interface, associated security risks are rising. Attackers can target this interface to steal sensitive network data and issue malicious commands, potentially causing network-wide outages. Current protection mechanisms offer coarse-grained protection and lack dynamic response capabilities. This paper presents DASPN (Dynamic Access Security Protection for Northbound Interface), a multi-level security model based on dynamic access control. DASPN ensures effective security through the joint operation of an Attribute-Based Access Control Layer and a Behavior Detection Layer. We make the following contributions: (1) We propose a fine-grained dynamic authorization decision and real-time threat identification method based on multi-dimensional attributes for northbound interface requests; (2) We propose a dynamic threshold adjustment scheme, enhancing the model’s defense capability against DoS attacks; (3) We propose a trust mechanism-based conflict management algorithm that resolves resource access conflicts during application requests. Experimental results on the Ryu controller demonstrate that DASPN reduces response time by 30.6% compared to state-of-the-art approaches, while achieving a 98% attack detection rate with false positive rate below 2%, all with acceptable system overhead.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

DASPN: A Multi-level Security Protection Model for Northbound Interface Based on Dynamic Access Control

  • Yining Huang,
  • Jianfeng Guan,
  • Yilan Gu,
  • Kexian Liu

摘要

As Software Defined Networking (SDN) applications gain fine-grained network control via the northbound interface, associated security risks are rising. Attackers can target this interface to steal sensitive network data and issue malicious commands, potentially causing network-wide outages. Current protection mechanisms offer coarse-grained protection and lack dynamic response capabilities. This paper presents DASPN (Dynamic Access Security Protection for Northbound Interface), a multi-level security model based on dynamic access control. DASPN ensures effective security through the joint operation of an Attribute-Based Access Control Layer and a Behavior Detection Layer. We make the following contributions: (1) We propose a fine-grained dynamic authorization decision and real-time threat identification method based on multi-dimensional attributes for northbound interface requests; (2) We propose a dynamic threshold adjustment scheme, enhancing the model’s defense capability against DoS attacks; (3) We propose a trust mechanism-based conflict management algorithm that resolves resource access conflicts during application requests. Experimental results on the Ryu controller demonstrate that DASPN reduces response time by 30.6% compared to state-of-the-art approaches, while achieving a 98% attack detection rate with false positive rate below 2%, all with acceptable system overhead.