摘要
面对日益严重的网络安全问题时，网络管理员主要使用解决特定问题的工具如 ping、traceroute、SNMP、tcpdump 等，能否找到故障位置的关键是网络管理员的经验和能力，因此出现故障以后，没有经验的网络管理员往往不能正确应对，可能对网络服务造成极大的二次损失。另一方面，通用工具或者框架工具，使用复杂的同时也无法满足用户灵活配置的需求。
论文在 SDN 中提出意向回溯和分类故障排除两种扩展的网络安全策略。
基于逆向转发的数据包回溯通过运行在控制器上的应用管理程序来实现，对于无法使用数据包抽象信息的问题，提出的意向回溯策略将底层 IP 地址、端口信息抽象为逻辑上具有应用软件、控制器、移动设备的意向特征。意向回溯策略由控制应用组件统一管理，用户使用时通过接口调用，并由运行时系统环境负责对其进行解释、转换和维护。
通过路径查询得到数据包的上游和下游路径信息，对于不确定存在的故障事件，提出基于路径查询进行故障发现的方法，以便于尽可能提前确认网络内有无故障。结合故障排除算法，故障定位通过计算处于故障路径上的链路权重，对链路的权重分析得到最大可能发生故障的位置，从而为下一步修复故障提供依据，搭建实验环境测试故障排除策略的实际效果。
通过分析实验结果，意向回溯策略和分类故障排除策略对现有网络 SDN 安全策略具有重要补充意义，意向回溯策略是满足了用户根据不同的意向进行回溯的需求，故障排除策略能够帮助网络管理员尽早确定故障类型，便于对故障的深入分析和积累经验。
关键词： 软件定义网络，故障排除，意向策略，分类策略
Abstract
With the increasing number of security problems, network operators solve specific problemsthat mainly use the tool such as ping, traceroute, SNMP, tcpdump and so on. The key to finding thelocation of the fault is the experience and capability, for inexperienced operators that may cause asecondary damage to network services. However, the configuration of general-purpose tools andframework tools is not only sophisticated but also not flexible enough. This paper presents twonetwork security policies, intentional packet traceback and classifying troubleshooting.
Packet traceback application that based on backward policy runs on the control plane, for theproblem that people cannot use abstract information of packets, this paper presents the policy ofintentional traceback, which mapping IP addresses and port numbers or other low-level featureswith abstractions to intents such as some high-level features, like people, applications and devices,which is managed by a control application component and called by the interface when used. Therun-time environment is responsible for the interpretation of the intentional traceback policy, as wellas the transformation and the maintenance.
Path query can return upstream or downstream information of captured packets, for uncertainexisting of fault event, this paper presents a way of fault detection based on path query, in order toconfirm the existence of fault as soon as possible. Combined with the troubleshooting algorithm,calculating the link weight, which is on the path of fault and analyzing the weight of the link to getthe most possible position of the root cause, thus above way provides the basis for the next step offault recovery, which is tested in an experimental environment.
From the results, the policies of intentional traceback and classifying troubleshootingcomplement existing SDN security policies well. The policy of intentional tracetrack is used tomeet the needs of the user for tracing packet back according to different intents, and the policy ofclassifying troubleshooting may help network operators detect the fault as soon as possible, analyzethoroughly of the fault and accumulate experience.
Key words: Software defined networks, troubleshooting, intentional policy, classifying policy
目录
第一章 绪论
1.1 研究背景和意义
1.2 研究现状
1.2.1 SDN 安全架构现状
1.2.2 SDN 安全策略现状
1.3 论文主要研究内容
1.4 论文章节安排
第二章 相关背景知识介绍
2.1 SDN 架构与 OpenFlow 技术
2.1.1 流表项
2.1.2 消息
2.2 数据包回溯策略
2.3 故障排除策略
2.4 本章小结
第三章 基于 SDN 的安全策略扩展
3.1 基于依赖关系图的回溯策略
3.2 基于因果图的故障排除策略
3.3 扩展的 SDN 安全策略
3.3.1 逆向转发技术
3.3.2 路径查询技术
3.3.3 网络分层技术
3.4 本章小结
第四章 基于逆向转发的意向回溯策略
4.1 意向策略
4.2 意向回溯策略
4.2.1 带应用特征的意向回溯
4.2.2 带控制器特征的意向回溯
4.2.3 带移动设备特征的意向回溯
4.3 意向回溯实验验证
4.3.1 模块化组件
4.3.2 拓扑策略
4.3.3 迭代回溯
4.4 本章小结
第五章 基于路径查询的分类故障排除策略
5.1 分类策略
5.2 分类故障排除策略
5.2.1 故障排除实例
5.2.2 故障排除框架
5.2.3 故障排除算法
5.3 故障排除实验验证
5.3.1 实验方案
5.3.2 实验环境
5.3.3 测试和结果
5.4 本章小结
第六章 总结与展望
6.1 论文工作总结
6.2 参考文献
致谢
