软件定义网络中的KISS原则：保持简单和安全的体系结构
The KISS principle in Software-Defined Networking: An architecture for Keeping It Simple and Secure
摘要：
安全性是软件定义网络（SDN）中日益重要的基本要求。然而，采用安全机制的速度一直很慢，我们估计这是传统解决方案的性能开销和所需支持基础设施的复杂性的结果。作为解决这些问题的第一步，我们提出了一个模块化的安全SDN控制平面通信架构，KISS，在密钥分发和安全信道支持的背景下创新的解决方案。基本安全原语的性能影响的比较分析指导我们选择KISS的基本原语。我们进一步提出了iDVV，集成设备验证值，一个确定性的，但不可否认的随机秘密代码生成协议，允许本地，但同步生成/验证的密钥在两端的通道，甚至在每一个消息的基础上。iDVV有望为SDN中认证和安全通信问题的鲁棒性和简化做出重要贡献。我们表明，我们的解决方案，同时提供相同的安全属性，优于参考的替代品，性能提高了30%以上的OpenSSL，并提高鲁棒性的基础上的代码足迹一个数量级小。最后，我们还证明和测试所提出的算法的随机性。
英文摘要：
Security is an increasingly fundamental requirement in Software-Defined Networking (SDN). However, the pace of adoption of secure mechanisms has been slow, which we estimate to be a consequence of the performance overhead of traditional solutions and of the complexity of the support infrastructure required. As a first step to addressing these problems, we propose a modular secure SDN control plane communications architecture, KISS, with innovative solutions in the context of key distribution and secure channel support. A comparative analysis of the performance impact of essential security primitives guided our selection of basic primitives for KISS. We further propose iDVV, the integrated device verification value, a deterministic but indistinguishable-from-random secret code generation protocol, allowing the local but synchronized generation/verification of keys at both ends of the channel, even on a per-message basis. iDVV is expected to give an important contribution both to the robustness and simplification of the authentication and secure communication problems in SDN. We show that our solution, while offering the same security properties, outperforms reference alternatives, with performance improvements up to 30% over OpenSSL, and improvement in robustness based on a code footprint one order of magnitude smaller. Finally, we also prove and test randomness of the proposed algorithms.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
