The transmission of data flows in current networks is in a scattered and disordered state, which makes it difficult to effectively discover and defend against network attacks in a timely manner, while network managers lack the tools for the secure and orderly management of data flows. To solve this problem, a secure data flow forwarding method based on service ordering management is proposed in this paper. By defining the service header, the scheme realizes a fine-grained service-based division of data flows. The rules for services in the network are formulated, and orderly control over data flows based on the rules is implemented through the software-defined network architecture, such that only data flows meeting the rules are allowed to pass through the network. Meanwhile, to achieve secure data flow forwarding, data flow is signed, and the signature fields are sampled and verified on the forwarding device to ensure the correctness and tamperproof nature of the data flow forwarding process. The experimental results reveal that the proposed method based on service ordering management can achieve fine-grained and orderly secure data flow control forwarding, effectively defending against network attacks and improving network security. Furthermore, the additional forwarding delay introduced by the scheme is in the controllable range, making the approach practical.

The existing path consistency verification solutions in software-defined networking (SDN) were implemented by proactive injecting large number of probing packets or by embedding linear-scale tags as the path lengthens, which incurred significant bandwidth and communication overhead. A lightweight path consistency validation mechanism based on in-band network telemetry (INT) in SDN is proposed. Based on INT, in the scheme, the ingress switch inserts a telemetry instruction header with probability, each subsequent switch updates the telemetry data using a uniform sampling algorithm and only carries partial path information in INT packet to keep the head space size constant, the egress switch reports the final sampled telemetry data to the controller to verify the path compliance according to aggregated telemetry data. A heuristic flow selection algorithm is proposed to implement network-level path consistency validation. The proposed scheme was implemented and evaluated. The analyses and experiments demonstrate the proposed mechanism effectively limits the packet head overhead and introduces less than 7% of additional forwarding delays and 6% of throughput degradation at most.

The security requirements for SDN (Software-Defined Network) cross-domain communication are diverse and dynamically changing; thus, a security service negotiation function is required for the SDN interdomain. However, the SDN interdomain distributed communication environment leads to a lack of trustworthiness and security. Therefore, this paper proposes a blockchain-based SDN interdomain security service negotiation mechanism, BSSN-SDNs, to provide automatic, secure, and trustworthy SDN interdomain security service negotiation. BSSN-SDNs proposes a three-layer reference architecture that enables joint on-chain and off-chain work by extending the security service negotiation module and blockchain client on the controller and deploying security service negotiation smart contracts on the blockchain. It especially adopts non-interactive key exchange and the message authentication code to ensure the confidentiality of the secure service negotiated on-chain. Finally, the timeliness as well as security and trustworthiness of BSSN-SDNs are analyzed, and the FISCO BCOS-based experiment results show that the delay of BSSN-SDNs is acceptable and is positively correlated with the number of policies and the number of SDN domains involved in negotiation.

The emerging software-defined networking (SDN) technology lacks tools to proactively ensure that policies will be followed or to inspect the behavior of the network. The network is vulnerable to sophisticated attacks against packets, such as alteration, injection, dropping, and hijacking attacks. Accurate and efficient network packet forwarding verification is a critical issue to ensure the correctness of packet forwarding when confronting with malicious attacks, while most of the existing packet forwarding verification solutions were implemented by inserting linear-scale cryptographic tags that increased with path length, which introduced significant communication overhead. In this paper, we propose a constant-size credential based packet forwarding verification mechanism in SDN. In the scheme, the ingress switch of a flow embeds a tag credential of constant-size which is independent of the packet forwarding path, each downstream switch verifies packets basing on the constant-size credential, and the controller periodically acquires node forwarding statistics along the path and localizes anomaly. The header space communication overhead of the proposed scheme is less than existing linear-scale mechanisms. We further prototype and evaluate the proposed scheme. Experiments demonstrate that the scheme achieves efficient forwarding and effective anomaly localization with less than 11% of additional forwarding delays and no more than 10% of throughput degradation.

Policy-oriented forwarding control has been widely recognized in a software-defined network (SDN). However, in the multidomain SDN scenario, policy-oriented forwarding control confronts the challenges that the lack of a higher-level abstraction policy paradigm, cross-domain policy unknowability and policy conflict, a distributed and untrusted communication environment, and latency sensitivity. To tackle these challenges, this article proposes BPFC-SDNs, a blockchain-based and policy-oriented forwarding control for the SDN interdomain. As the basis of BPFC-SDNs, we define an attribute-based interdomain forwarding control policy paradigm and implement secure and trusted cross-domain information and policy sharing based on blockchain. The main idea of BPFC-SDNs is to achieve cross-domain dataflow forwarding control based on the global collaborative policy. Specifically, we propose a physically centralized and logically isolated architecture to ensure efficient and secure information exchange between the SDN and blockchain. Moreover, we design a combined on-chain and off-chain functional model to separate forwarding control from the blockchain, which enables forwarding control based on trusted data while avoiding the introduction of high latency and computational overhead of the blockchain. Finally, we implement a prototype for BPFC-SDNs, and the experimental results indicate that BPFC-SDNs can provide effective forwarding control for the SDN interdomain with acceptable latency and good scalability.

Electric Internet of Things (EIoT) faces a large scale of attacking for massive terminal access, and there exists a certain challenge to make modeling security situation for EIoT. A network security situational awareness architecture based on vulnerability risk and stochastic game is proposed by abstracting network elements, which depict the threat diffusion and vulnerability relevance between devices of EIoT in view of the Petri Net, and introduce main risk and diffusion risk of vulnerability, and the profits and costs during the course of attacker and defender are taken into consideration according to stochastic game, the network security situation is quantified and evaluated. The simulation experiment verifies the effectiveness of the proposed model, which can effectively reflect the cost trend curve of defense according to the EIoT situation, and is applicable for the complex environment of EIoT.