Analysis and practical validation of a standard SDN-based framework for IPsec management

被引：11

作者：

Lopez-Millan, Gabriel ^{[1
,4
]}

Marin-Lopez, Rafael ^{[1
]}

Pereniguez-Garcia, Fernando ^{[2
]}

Canovas, Oscar ^{[3
]}

Espin, Jose Antonio Parra ^{[1
]}

机构：

[1] Univ Murcia, Dept Informat & Commun Engn, Murcia 30100, Spain

[2] Univ Def Ctr Spanish Air Force Acad, Dept Engn & Appl Technol, Murcia 30720, Spain

[3] Univ Murcia, Dept Comp Engn, Murcia 30100, Spain

[4] Fac Informat, Campus Espinardo S-N, Murcia 30100, Spain

来源：

COMPUTER STANDARDS & INTERFACES | 2023年 / 83卷

关键词：

IPSec; IKE; Management; SDN; Performance;

D O I：

10.1016/j.csi.2022.103665

中图分类号：

TP3 [计算技术、计算机技术];

学科分类号：

0812 ;

摘要：

The Internet Engineering Task Force (IETF), the international standardization organism for the Internet, has recently approved a standard, RFC 9061, which defines an interface and framework with which to manage IPsec SAs autonomously by using the Software Defined Networking (SDN) paradigm. In this framework, a centralized entity, the controller, sends configuration information to IPsec-enabled nodes in the network in order to create IPsec SAs. Two cases are presented: IKE-case, in which the nodes ship an IKE implementation that is configured by the controller or IKE-less, in which the controller sends the IPsec SAs directly to the nodes, among other relevant security information.This paper analyzes both cases in depth, provides a design for the controller's operation based on Mealy state machines and obtains experimental results from a virtualized testbed so as to compare these cases, which are missing parts in the standard.

引用

页数：13

共 43 条

[21]

IBM CLoud Private, 2021, ENCRYPTING CLUSTER D

[22]

Kent S., 2005, 4301 RFC

[23]

Li W, 2016, I C NETWORK PROTOCOL

[24]

Li YC, 2015, PROCEEDINGS OF 2015 4TH INTERNATIONAL CONFERENCE ON COMPUTER SCIENCE AND NETWORK TECHNOLOGY (ICCSNT 2015), P996, DOI 10.1109/ICCSNT.2015.7490904

[25] Towards a standard SDN-based IPsec management framework [J].

Lopez-Millan, Gabriel ;

Marin-Lopez, Rafael ;

Pereniguez-Garcia, Fernando .

COMPUTER STANDARDS & INTERFACES, 2019, 66

[26]

Marin-Lopez R., 2021, 9061 RFC, V9061, DOI [10.17487/RFC9061, DOI 10.17487/RFC9061]

[27]

Michel O, 2017, 2017 FOURTH INTERNATIONAL CONFERENCE ON SOFTWARE DEFINED SYSTEMS (SDS), P37, DOI 10.1109/SDS.2017.7939138

[28]

Nir Y., 2019, A Data Center Profile for Software Defined Networking (SDN)-based IPsec, draft-nir-i2nsf-ipsec-dc-prof-00

[29]

Open Network Foundation, 2016, SDNARCHITECTURE11TR

[30]

Ranjbar A, 2016, IEEE IFIP NETW OPER, P281, DOI 10.1109/NOMS.2016.7502823

← 1 2 3 4 5 →