Security Domains are only tangentia

Security Domains are only tangentially covered in the ONF security evaluation, but a differentiation of authorisation levels in the Openflow protocol itself is postulated. [99] Although
the Architecture Recommendation [36] discussed methods to restrict access and provide services to different user levels, detailed mechanics are not proposed and not part of the scope of
the document. The OF-Protocol itself is currently not able to differentiate between various
trust and authentication levels. In the data plane, separation of Security Domains is not
possible and has to be handled by proxy applications such as FlowVisor or Hyperflow.
Two aspects can be classified as approaches to develop Security Domains. Kreutz et al.,
2013 [8] focus on the control platform and the need to isolate the software from the underlying
system. Failures of the controller should not affect the remaining programs on the server
and vice versa. While team does not further specify the term ”Security Domains”, a second
definition may be the partitioning of the network into various restricted domains. Control
systems such as RADIUS and Kerberos could restrict access to the sensitive control plane
services or limit the extent of an attack from a compromised host in the network.
Concerning the protection and isolation of the control software, the previous section addressed the risk of equal security levels of applications. However, applications are often
coupled to the controlling operating system and risk operation shut-down as evidenced in
Section 3.2.6. As a result, Shin et al., 2014 [79] developed Rosemary, a controller specialised
in isolation and robustness. The team highlights the problem of poor resource separation
and control of applications residing on current software designs. The proposed controller
implements the design philosophies of SE-Floodlight and Fort-NOX of role-based access and
application authentication. Applications are outsourced to external processes independent
of the main control software and are thus unable to accidentally or intentionally terminate
the controller. The memory consumption of applications is limited by a resource monitor,
which restricts the CPU and memory usage based on a predefined threshold.
The controller design has been deployed and tested successfully. Nonetheless, the proposal
contributes to the aforementioned problem of controller fragmentation. It would be recommendable to integrate the robust and independent architecture into well-maintained and
dominating network control systems (e.g. OpenDaylight, ONOS, Floodlight). As several
members of the research team that has developed Rosemary contribute to ONOS, advanced
security developments are a possibility. A further and potentially controller-agnostic solution to protect the controller from application failures is LegoSDN [121]. The prototype
integrates a hybrid of an application hypervisor and rollback-mechansism to isolate the control kernel from the custom applications, while enabling quick recovery to stable state in case
of faulty configurations. Potentially failing and memory-exhaustive application processes are
also separated from the sensitive controller.
Approaches such as Rosemary and LegoSDN heavily decrease the destructive capabilities
of applications and thus Tampering and Denial of Service in the system. Nearly all dangers
stemming from rogue applications and spoofed authentication are addressed in this design.
Albeit a very robust architecture, performance could be a limiting factor.
The second significant aspect is the separation of network hosts and sections into Security
Domains with restricted view and access. Accessing vital network services, particularly the
OpenFlow configuration service, has to be limited to authenticated hosts and network partitions to reduce the range of attackable devices in the network. As discussed in Section 3.2.7
and 4.3.2 the network slicing of FlowVisor and similar approaches are not mature enough to provide secure network restrictions yet. However, OpenFlow is able to leverage the 802.1X
mechanisms and protocol for Authentication, Access, and Accounting (AAA). If 802.1X is
not supported by OpenFlow devices, the controller could integrate the authentication protocol or communicate with a dedicated authentication server using standardised commodity
switches. As the flow matching is capable of dropping packets based on port, EtherType and
source addresses, it is possible to filter service access from certain network regions. Mattor
& Ferraz [122] utilise this mechanism and augment the OpenFlow network with a RADIUS
based authentication to install fine-grade access control. The team develops the AuthFlow
mechanism to match credentials and service access to flows and restricts admission based
on individual host credentials and network location. Access to sensitive services and the
control plane from insecure hosts or network section is effectively impeded. This aspect does
not prevent a specific STRIDE threat, but it considerably diminishes the risk of infected
conventional hosts or personal devices of the network.
In summary, the two interpretations of Security Domains are viable techniques to limit
the open access to software-defined networks. Specific to SDN is the need to segregate the
controller from applications and the remaining network services to establish a proper isolation
of the operation and management planes. Extraction of controller application and general
services processes coupled with tight access control reduces the risk of software failure and
prevents several STRIDE threats of the control plane. On a larger scale, the adaptation and
enhancement of conventional network access control, host verification, and service restriction
in SDN is one viable way to fully secure important components of the network.

Kết quả (Việt) 1:

Lĩnh vực an ninh chỉ câu hơi mơ được bảo hiểm trong việc đánh giá bảo mật ONF, nhưng một sự khác biệt của các cấp uỷ quyền trong giao thức Openflow chính nó giả thuyết. [99] mặc dùphương pháp khuyến nghị kiến trúc [36] thảo luận để hạn chế truy cập và cung cấp dịch vụ cho người dùng khác nhau levels, chi tiết cơ học không đề xuất và không một phần của phạm vi củaCác tài liệu. CỦA-giao thức chính nó là hiện nay không thể phân biệt giữa khác nhaumức độ tin cậy và xác thực. Trong mặt phẳng dữ liệu, tách biệt của lĩnh vực an ninh là khôngcó thể và phải được xử lý bởi các proxy ứng dụng ví dụ như FlowVisor hoặc Hyperflow.Hai khía cạnh có thể được phân loại như là phương pháp tiếp cận để phát triển lĩnh vực an ninh. Kreutz et al.,năm 2013 [8] tập trung vào nền tảng kiểm soát và sự cần thiết để cô lập các phần mềm từ các cơ bảnHệ thống. Thất bại của bộ điều khiển không nên ảnh hưởng đến các chương trình còn lại trên máy chủvà ngược lại. Trong khi đội không hơn nữa xác định các thuật ngữ "bảo mật tên miền", một lần thứ haiđịnh nghĩa có thể là các phân vùng của mạng vào tên miền hạn chế khác nhau. Kiểm soátHệ thống chẳng hạn như bán kính và Kerberos có thể hạn chế truy cập đến máy bay nhạy cảm điều khiểnDịch vụ hoặc giới hạn trong phạm vi của một cuộc tấn công từ một máy chủ bị xâm phạm trong mạng.Liên quan đến việc bảo vệ và sự cô lập của phần mềm điều khiển, phần trước địa chỉ nguy cơ bằng mức bảo mật của ứng dụng. Tuy nhiên, ứng dụng thườngcoupled to the controlling operating system and risk operation shut-down as evidenced inSection 3.2.6. As a result, Shin et al., 2014 [79] developed Rosemary, a controller specialisedin isolation and robustness. The team highlights the problem of poor resource separationand control of applications residing on current software designs. The proposed controllerimplements the design philosophies of SE-Floodlight and Fort-NOX of role-based access andapplication authentication. Applications are outsourced to external processes independentof the main control software and are thus unable to accidentally or intentionally terminatethe controller. The memory consumption of applications is limited by a resource monitor,which restricts the CPU and memory usage based on a predefined threshold.The controller design has been deployed and tested successfully. Nonetheless, the proposalcontributes to the aforementioned problem of controller fragmentation. It would be recommendable to integrate the robust and independent architecture into well-maintained anddominating network control systems (e.g. OpenDaylight, ONOS, Floodlight). As severalmembers of the research team that has developed Rosemary contribute to ONOS, advancedsecurity developments are a possibility. A further and potentially controller-agnostic solution to protect the controller from application failures is LegoSDN [121]. The prototypeintegrates a hybrid of an application hypervisor and rollback-mechansism to isolate the control kernel from the custom applications, while enabling quick recovery to stable state in caseof faulty configurations. Potentially failing and memory-exhaustive application processes arealso separated from the sensitive controller.Approaches such as Rosemary and LegoSDN heavily decrease the destructive capabilitiesof applications and thus Tampering and Denial of Service in the system. Nearly all dangersstemming from rogue applications and spoofed authentication are addressed in this design.Albeit a very robust architecture, performance could be a limiting factor.The second significant aspect is the separation of network hosts and sections into SecurityDomains with restricted view and access. Accessing vital network services, particularly theOpenFlow configuration service, has to be limited to authenticated hosts and network partitions to reduce the range of attackable devices in the network. As discussed in Section 3.2.7and 4.3.2 the network slicing of FlowVisor and similar approaches are not mature enough to provide secure network restrictions yet. However, OpenFlow is able to leverage the 802.1Xmechanisms and protocol for Authentication, Access, and Accounting (AAA). If 802.1X isnot supported by OpenFlow devices, the controller could integrate the authentication protocol or communicate with a dedicated authentication server using standardised commodityswitches. As the flow matching is capable of dropping packets based on port, EtherType and
source addresses, it is possible to filter service access from certain network regions. Mattor
& Ferraz [122] utilise this mechanism and augment the OpenFlow network with a RADIUS
based authentication to install fine-grade access control. The team develops the AuthFlow
mechanism to match credentials and service access to flows and restricts admission based
on individual host credentials and network location. Access to sensitive services and the
control plane from insecure hosts or network section is effectively impeded. This aspect does
not prevent a specific STRIDE threat, but it considerably diminishes the risk of infected
conventional hosts or personal devices of the network.
In summary, the two interpretations of Security Domains are viable techniques to limit
the open access to software-defined networks. Specific to SDN is the need to segregate the
controller from applications and the remaining network services to establish a proper isolation
of the operation and management planes. Extraction of controller application and general
services processes coupled with tight access control reduces the risk of software failure and
prevents several STRIDE threats of the control plane. On a larger scale, the adaptation and
enhancement of conventional network access control, host verification, and service restriction
in SDN is one viable way to fully secure important components of the network.