The previously discussed FlowVisor

The previously discussed FlowVisor [55], which separates the network into disjunct slices
for controllers to manage, is a viable and practical approach. Although the presentation of
the software was performed with homogeneous NOX controllers, FlowVisor is theoretically
agnostic of the controller design due to the standardised OpenFlow communication protocol.
It might be feasible to implement diverse controllers as proposed in the threat vector approach (see Figure 4.1). Using distributed controllers for a single FlowVisor network slice it
is also possible to integrate further DoS robustness and the Replication aspect. FlowVisor,
however, is not able to operate multiple controller types on the same network slice without
introducing rule conflicts.
The hypervisor proposal CoVisor [108] addresses this problem and specifically focusses on
the deployment of different controller platforms and applications in the network in order to
provide administrators with the ability to select the best network applications and functions.
Using detailed access control the modification capabilities of the controllers are limited to
their dedicated purposes. Additionally, administrators can customise the control and topology view of the controller to limit the power of malicious or faulty devices. The project has
been published very recently in May 2015. Albeit an feasible concept, a full assessment of
its practicality is not possible yet.
If Diversity is present in the network the impact factor of individual vulnerabilities is
significantly reduced. Diversity specifically addresses the Denial of Service threat by reducing
the overall availability of switch and controller bugs to an attacker. The amount of security
holes and the resulting Tampering risk in the software might increase with different controller
types, but a software failure will not affect all network components. If a switch or controller
is incapacitated due to an attack, an immune device could theoretically take over the load in
the network and prevent Denial of Service. Additionally, Elevation of Privilege is limited as
the concurrent devices are restricted to only perform certain actions, as proposed in CoVisor.
It is achievable to utilise the FlowVisor mechanism to construct an architecture as described
in this chapter. However, the lack of current practical implementations impedes a proper
evaluation of the concept. Overall, negligence of controller interoperability and northbound
interface standardisation poses a potential future problem, which is currently circumvented
with the use of application hypervisors.
It might be a matter of debate, if a diverse system is a necessity when designing for security or if a homogeneous approach is not sufficient. In risk assessments such as CVSS [66]
homogeneous systems increase the severity of the environmental risk factor. On the other
hand high diversity might violate the Saltzer & Schroeder [64] principle of keeping the system simple. Many different controllers and switches in the network increase the complexity and
overall fault probability that SDN attempted to solve. A counterargument is the choice of
”best of breed applications” [108] to achieve maximum security and reliability. In summary,
Diversity is currently neglected in SDN and is not mandatory for security, but provides additional reliability, which could work in favour of the network. Nevertheless it is unlikely that
this principle can be fulfilled, as controller interoperability requires the same standardisation
process as the southbound interface. At this moment true diversity is not practical.

Kết quả (Việt) 1:

FlowVisor thảo luận trước đó [55], tách mạng thành rời rạc látcho bộ điều khiển để quản lý, là một phương pháp khả thi và thực tế. Mặc dù trình bày củaphần mềm được thực hiện với đồng nhất NOX bộ điều khiển, FlowVisor là lý thuyếtthuyết bất khả tri của thiết kế điều khiển do giao thức truyền thông OpenFlow tiêu chuẩn hóa.Nó có thể là khả thi để thực hiện các điều khiển đa dạng như đề xuất trong vector mối đe dọa tiếp cận (xem hình 4.1). Bằng cách sử dụng bộ điều khiển phân phối cho một FlowVisor duy nhất mạng cắt nócũng có thể tích hợp thêm mạnh mẽ DoS và các khía cạnh nhân rộng. FlowVisor,Tuy nhiên, là không có thể hoạt động nhiều điều khiển loại trên cùng một mạng lát mà không cầngiới thiệu về cuộc xung đột quy tắc.Đề nghị hypervisor CoVisor [108] địa chỉ vấn đề này và đặc biệt tập trênviệc triển khai các nền tảng khác nhau điều khiển và ứng dụng trong mạng đểcung cấp cho người quản trị khả năng để chọn các ứng dụng mạng tốt nhất và chức năng.Sử dụng kiểm soát chi tiết truy cập khả năng sửa đổi của bộ điều khiển có giới hạnmục đích chuyên dụng của họ. Ngoài ra, người quản trị có thể tùy chỉnh giao diện điều khiển và cấu trúc liên kết của bộ điều khiển để hạn chế sức mạnh của thiết bị độc hại hoặc bị lỗi. Dự án cóđược xuất bản gần đây vào tháng 5 năm 2015. Mặc dù một khái niệm khả thi, một đánh giá đầy đủ củathực tiễn của nó là không thể được.If Diversity is present in the network the impact factor of individual vulnerabilities issignificantly reduced. Diversity specifically addresses the Denial of Service threat by reducingthe overall availability of switch and controller bugs to an attacker. The amount of securityholes and the resulting Tampering risk in the software might increase with different controllertypes, but a software failure will not affect all network components. If a switch or controlleris incapacitated due to an attack, an immune device could theoretically take over the load inthe network and prevent Denial of Service. Additionally, Elevation of Privilege is limited asthe concurrent devices are restricted to only perform certain actions, as proposed in CoVisor.It is achievable to utilise the FlowVisor mechanism to construct an architecture as describedin this chapter. However, the lack of current practical implementations impedes a properevaluation of the concept. Overall, negligence of controller interoperability and northboundinterface standardisation poses a potential future problem, which is currently circumventedwith the use of application hypervisors.It might be a matter of debate, if a diverse system is a necessity when designing for security or if a homogeneous approach is not sufficient. In risk assessments such as CVSS [66]homogeneous systems increase the severity of the environmental risk factor. On the otherhand high diversity might violate the Saltzer & Schroeder [64] principle of keeping the system simple. Many different controllers and switches in the network increase the complexity and
overall fault probability that SDN attempted to solve. A counterargument is the choice of
”best of breed applications” [108] to achieve maximum security and reliability. In summary,
Diversity is currently neglected in SDN and is not mandatory for security, but provides additional reliability, which could work in favour of the network. Nevertheless it is unlikely that
this principle can be fulfilled, as controller interoperability requires the same standardisation
process as the southbound interface. At this moment true diversity is not practical.