A data plane security model of segmented routing based on SDP trust enhancement architecture

Abstract

Segment routing (SR) technology is a new network functional technology derived from MPLS technology and based on SDN. Combining SR with software-defined perimeter (SDP), a new network security technology, is expected to solve the traditional problems such as data monitoring, denial of service, and new threats such as loop attack and label detection faced by SR data plane. Focusing on the security management of access devices in the SR data plane, first, this paper proposes an SR security model SbSR (SDP-based SR) based on SDP trust enhancement architecture, then, two-level SDP AH trust verification mechanism and 4 trust management mechanisms including initial trust value, trust evaluation, trust renewal, trust inheritance are designed. In the trust evaluation mechanism as the core of the model, System cloud grey model (1,1) weighted Markov prediction model is introduced to obtain real-time trust based on the historical behavior of device nodes, and 4 indexes, namely benign message ratio, loyal forwarding ratio, forwarding ratio stationarity coefficient, packet rate stationarity coefficient, are introduced to distinguish malicious devices from normal devices. Finally, the simulation test results of 5 security functions and security costs show that the proposed architecture can solve port scanning, traffic monitoring, topology detection, loop attack, and DoS attack of SR network data plane with an average access delay cost of 2.84 s for each new network agent, and realize multi-faceted protection of SR network data plane.

A data plane security model of SR-BE/TE based on zero-trust architecture

“…SbSR (SDP based SR)30 ZbSR (ZTA based SR)Problem orientedThe terminal device of the SR network data planeThe switching device of the SR network data plane Modeling The migration model of the mature SDP model is carried out Based on the concept of ZTA, a new ZTA model is designed by adding security components and reassembling the original functional components Assessment Port scanning; Traffic monitoring; DoS attack; Topology detection based on label detection; Routing loop attack based on directional label; Performance overhead Control plane message tampering; Data plane loop attack; Identity deception; Back door utilization; DOS attack; Performance overhead Figure 2. ZbSR security model.…”