跳到主要內容

簡易檢索 / 詳目顯示

研究生: 朱永彤
Chu-Yung-Tung
論文名稱: 基於OpenFlow交換機之跨雲端安全管理機制研究
指導教授: 陳奕明
Chen Yi-Ming
口試委員:
學位類別: 碩士
Master
系所名稱: 管理學院 - 資訊管理學系
Department of Information Management
論文出版年: 2013
畢業學年度: 101
語文別: 中文
論文頁數: 57
中文關鍵詞: 跨雲端安全OpenFlowSecure in-packet Bloom Filter
外文關鍵詞: OpenFlow, Secure in-packet Bloom Filter, Security, Inter-cloud
相關次數: 點閱:10下載:0
分享至:
查詢本校圖書館目錄 查詢臺灣博碩士論文知識加值系統 勘誤回報
  • 在跨雲端運算環境下,使用者可能將資訊存在不同的雲端上,使用者及雲端供應商可以對不同雲端上的資訊進行存取使用,然而隨之而來的則是必須面對資訊洩露和資訊安全政策等更多的挑戰,因為在跨雲端網路環境,封包傳出必須經過網際網路,若缺少妥善的安全機制,很可能遭到攻擊者竊聽封包進行惡意攻擊。另外也須確保使用者所接收資訊符合資訊安全政策。
    跨雲端運算環境需要高速運算需求,而近年來隨著網際網路的快速發展,現有網路設備及協定在跨雲端環境下更顯不敷使用,因此美國史丹佛大學開發的OpenFlow軟體定義網路(Software Defined Network, SDN)架構也成為研究重點。為滿足雲端間高速通信的需求及達成上述雲端安全管理需求的機制,本研究利用OpenFlow 架構出跨雲端運算的環境,探討並解決跨雲端運算的安全需求。
    目前雲端安全的相關研究大多偏重在雲端內部,OpenFlow於跨雲端安全管理之相關研究也尚未多見,所以本研究希望以OpenFlow來實現跨雲端安全管理機制,以OpenFlow建構出跨雲端運算的環境;結合Secure in-packet Bloom Filter封包轉發機制,將轉送路徑資訊儲存於跨雲端銜接的路徑節點及封包中,在進行跨雲端傳送時,得以隱藏雲端內部資訊,避免資訊外洩,同時也可利用 OpenFlow 的彈性架構達到使用者自訂的安全控制,符合跨雲端運算的安全需求。


    In inter-cloud computing environment, the user may be saved data on the different cloud, users and cloud providers can access different information on the different cloud. However, this will increase information divulged and information security policy challenge, because in inter-cloud environment, packet forward must pass internet, if the lack of proper security mechanisms, probably attacker can eavesdropping packet lead to malicious attack. Also, it’s required to ensure that the user receives information matches information security policy.
    Inter-cloud computing needs high-speed computing requires, and recent year with the rapid development of internet, the existing network equipment and protocols is not enough for use in inter-cloud environment. So the Stanford University developed the OpenFlow Software-Defined Networks architecture has become research priorities, our study used OpenFlow to build inter-cloud computing environment, explore and resolve requires of inter-cloud computing security .
    Currently, cloud security research mostly biased towards the internal of cloud, and OpenFlow has not yet common in inter-cloud security management. So our research hopes to use OpenFlow to achieve inter-cloud security management mechanism, use OpenFlow to construct inter-cloud high speed computing environments; combined with Secure in-packet Bloom Filter forwarding mechanism, to avoid information leakage, also can use flexible architecture of OpenFlow to achieve user-defined security controls to meet the security requires of inter-cloud computing.

    論文摘要 i Abstract ii 誌謝辭 iii 目錄 iv 圖目錄 vi 表目錄 viii 第一章 緒論 1 1-1 研究背景 1 1-2 動機與目的 3 1-3 研究貢獻 5 1-4 論文架構 5 第二章 相關研究 7 2-1 基於VPN 技術的跨雲端安全連線 7 2-2 OpenFlow 與 NOX Controller 8 2-2-1 OpenFlow 8 2-2-2 NOX 控制伺服器 12 2-3 LIPSIN 12 2-4 Secure In-packet Bloom Filter Forwarding 14 2-5 相關研究之整理 17 第三章 系統架構與設計 19 3-1 系統目標 19 3-2 系統架構 19 3-2-1 NOX Controller 系統架構 21 3-2-2 OpenFlow 系統架構 21 3-2-3 LinkID 與zFilter 22 3-2-4 Flow Table 23 3-2-5 Encryption 23 3-3系統運作流程 24 3-3-1 網路拓樸更新 24 3-3-2 zFilter值的產生 25 3-3-3 傳送封包 26 3-3-4 安全規則制訂 27 第四章 實驗與討論 28 4-1 實驗環境 28 4-2 系統架設及操作 29 4-2-1 NOX Controller 29 4-2-2 OpenFlow Switch 30 4-3 封包轉送 31 4-3-1程式流程圖 31 4-3-2 拓樸管理及計算轉送資訊 32 4-3-3 於轉送端上的處理 33 4-3-4 將封包轉向 34 4-4 實驗一 以SiBF方法封包轉送 34 4-5 實驗二 用Snort過濾與轉向封包 38 4-6 實驗結果討論 40 第五章 結論及未來方向 41 5-1 結論與貢獻 41 5-2 未來研究 41 參考文獻 43

    中文參考文獻
    [1] 陳仕明,「結合布隆過濾器暨OpenFlow交換機之跨雲端網路」,國立中央大學,資訊工程學系碩士論文,民國101年。

    英文參考文獻
    [2] Chen, S., et al., "Secure Connectivity for Intra-Cloud and Inter-Cloud Communication", Parallel Processing Workshops (ICPPW), 40th IEEE International Conference on, 2011
    [3] Ghani, A. and P. Nikander, "Secure in-packet Bloom Filter forwarding on the NetFPGA.", Proceedings of the European NetFPGA Developers Workshop, 2011
    [4] Gude, N., et al., "NOX: towards an operating system for networks.", ACM SIGCOMM Computer Communication Review 38(3): 105-110, 2008
    [5] Jokela, P., et al., "LIPSIN: line speed publish/subscribe inter-networking.", ACM SIGCOMM Computer Communication Review, 2009
    [6] Kretzschmar, et al., "Security Management Areas in the Inter-Cloud.", Cloud Computing (CLOUD), IEEE International Conference on, 2011
    [7] McKeown, N., et al., "OpenFlow: enabling Innovation in Campus Networks.", ACM SIGCOMM Computer Communication Review 38(2): 69-74, 2008
    [8] Mell, P., T. Grance, "The NIST Definition of Cloud Computing (draft).", NIST special publication 800: 145, 2011
    [9] Naous, J., et al., "Implementing an OpenFlow switch on the NetFPGA platform.", Proceedings of the 4th ACM/IEEE Symposium on Architectures for Networking and Communications Systems, 2008
    [10] Naous, J., et al., "NetFPGA: Reusable router architecture for experimental research.", Proceedings of the ACM workshop on Programmable routers for extensible services of tomorrow, 2008
    [11] Rothenberg, et al., "Self-routing Denial-of-service resistant capabilities using in-packet Bloom filters.", Computer Network Defense (EC2ND), 2009 European Conference on, IEEE 2009
    [12] Watson, G., et al., "NetFPGA: A tool for network research and education.", 2nd workshop on Architectural Research using FPGA Platforms (WARFP), 2006
    [13] Dayananda, M., et al. "Architecture for inter-cloud services using IPsec VPN." Advanced Computing & Communication Technologies (ACCT), 2012 Second International Conference on. IEEE, 2012.
    相關網站
    [14] NetFPGA, http://netfpga.org/
    [15] NOXRepo:NOX API, http://noxrepo.org/
    [16] Stanford University Course:CS344: Building an Internet Router, 2011年取自http://yuba.stanford.edu/cs344/
    [17] OpenFlow:OpenFlow Switch Specification, http://www.openflow.org/documents/openflow-spec-v0.8.9.pdf
    [18] Wikipedia, http://wikipedia.org/
    [19] 如何建構企業專屬的雲端運算平台,2010年取自http://www.ringline.com.tw/
    [20] 混合雲成未來雲端應用主流趨勢, 2012年8月13日取自http://digitimes.com.tw/
    [21] The Intercloud is a global cloud of clouds, 2009年6月取自http://samj.net/
    [22] Amazon Elastic Compute Cloud (Amazon EC2), http://aws.amazon.com/ec2/
    [23] Microsoft Windows Azure, http://www.windowsazure.com/en-us/
    [24] SDN at Google - Opportunities for WAN Optimization, 2012年8月1日取自http://ietf.org/
    [25] Google Sets New Internet Traffic Record, 2010年10月25日取自http://ddos.arbornetworks.com/2010/10/google-breaks-traffic-record/
    [26] http://noxrepo.org/noxwiki/index.php/NOX_Installation
    [27] http://www.openflow.org/wk/index.php/CentOS_NetFPGA_Install

    QR CODE
    :::