基于区块链的软件定义网络数据帧安全验证机制

为构建安全高效的网络环境，必须对伪造、受篡改数据帧进行有效的识别与过滤。然而，在软件定义网络（SDN）中，现有的安全验证机制通常在验证设备受到攻击或恶意控制时无法有效运行。为解决上述问题，提出了基于区块链的SDN数据帧安全验证机制。首先，设计帧转发证明（PoFF）共识算法并以此为基础建立轻量型区块链系统；然后，基于该系统构建针对SDN数据帧的安全验证体系；最后，提出可灵活调节的半随机选择验证模式以兼顾验证效率与资源开销。仿真结果表明，在同等比例的交换机被恶意控制情况下，所提机制的漏检概率较基于哈希链的验证机制有明显降低。其中，当受控交换机占比为40%时，降低效果尤其显著：此时所提机制在基本验证模式下的漏检概率低于32%，在辅助以半随机验证后可进一步降到7%，均远低于基于哈希链的验证机制72%的漏检概率；且所提机制引入的资源开销与通信代价在合理范围内。此外，即使在SDN控制器完全失效情况下，所提机制仍可保持良好的验证性能与效率。

Blockchain-based data frame security verification mechanism in software defined network

Forged and tampered data frames should be identified and filtered out to ensure network security and efficiency. However， the existing schemes usually fail to work when verification devices are attacked or maliciously controlled in the Software Defined Network （SDN）. To solve the above problem， a blockchain-based data frame security verification mechanism was proposed. Firstly， a Proof of Frame Forwarding （PoFF） consensus algorithm was designed and used to build a lightweight blockchain system. Then， an efficient data frame security verifying scheme for SDN data frame was proposed on the basis of this blockchain system. Finally， a flexible semi-random verifying scheme was presented to balance the verification efficiency and the resource cost. Simulation results show that compared with the hash chain based verifying scheme， the proposed scheme decreases the missed detection rate significantly when an equal proportion of switches are maliciously controlled. Specifically， when the proportion is 40%， the decrease effect is very obvious， the missed detection rate can still be kept no more than 32% in the basic verification mode， and can be further reduced to 7% with the assistance of the semi-random verifying scheme. Both are much lower than the missed detection rate of 72% in the hash chain based verifying scheme， and the resource overhead and communication cost introduced by the proposed mechanism are within a reasonable range. Additionally， the proposed scheme can still maintain good verification performance and efficiency even when the SDN controller is completely unable to work.