Efficient and safe software defined network topology discovery protocol - Dong LI; Junqing YU; Yongpu GU; Pengcheng ZHAO (网络与信息安全学报)
The network topology discovery in OpenFlow-based software-defined networks is mainly achieved by utilizing the OpenFlow discovery protocol (OFDP).However, it has been observed in existing research that OFDP exhibits low updating efficiency and is susceptible to network topology pollution attacks.To address the efficiency and safety concerns of the network topology discovery protocol, an in-depth investigation was conducted on the mechanism and safety of OFDP network topology discovery.The characteristics of network topology establishment and updating in OFDP were analyzed, and an improved protocol named Im-OFDP (improved OpenFlow discovery protocol) based on the minimum vertex covering problem in graph theory was proposed.In Im-OFDP, the switch port table and network link table were initially established using prior information obtained from OFDP network topology discovery.Subsequently, a graph model of the network topology was constructed, and the minimum vertex covering algorithm in graph theory was employed to select specific switches for the reception and forwarding of topology discovery link layer discovery protocol (LLDP) packets.Multi-level flow tables were designed based on the network topology structure, and these flow entries were installed on the selected switches by the controller to process LLDP packets.To address security issues, dynamic check code verification in LLDP packets was employed to ensure the safety of network links.Additionally, a network equipment information maintenance mechanism was established based on known network topologies to ensure the safety of the network equipment.Experimental results demonstrate a significant reduction in the number of network topology discovery messages, bandwidth overhead, and CPU overhead through the deployment of Im-OFDP.Moreover, the response time for node failures and link recovery time after mode failure is substantially reduced.Im-OFDP also effectively mitigates various network topology pollution attacks, such as link fabrication and switch forgery attacks.Overall, Im-OFDP has the capability to enhance the efficiency and safety of SDN topology discovery.