Multidomain Network Based on Programmable Networks: Security Architecture

Abstract

This paper proposes a generic security architecture designed for a multidomain and multiservice network based on programmable networks. The multiservice network allows users of an IP network to run programmable services using programmable nodes located in the architecture of the network. The programmable nodes execute codes to process active packets, which can carry user data and control information. The multiservice network model defined here considers the more pragmatic trends in programmable networks. In this scenario, new security risks that do not appear in traditional IP networks become visible. These new risks are as a result of the execution of code in the programmable nodes and the processing of the active packets. The proposed security architecture is based on symmetric cryptography in the critical process, combined with an efficient manner of distributing the symmetric keys. Another important contribution has been to scale the security architecture to a multidomain scenario in a single and efficient way.

The Efficient Security Architecture for Authentication and Authorization in the Home Network

“…In that case, devices can get some services of another home. Similar research with relation to multi-domain network is studied in [1].…”

DoS Protection for a Pragmatic Multiservice Network Based on Programmable Networks

“…So, to prevent it, signalling packets must been protected against modification or fabrication. Because SAPs are active packets, protection of authentication and authorization mechanisms supported by the active network [3] are valid to protect signalling information.…”

“…In [3] we propose a security architecture to protect programmable networks such as SARA from malicious active packets and codes. This security architecture allows users to obtain authorization to send active packets from a specific source to a destination.…”

“…The active packets must be authenticated to avoid fake active packets changing the behaviour of active routers. We have proposed a security solution to tackle these problems in [3]. Other problem can appear when fake legacy packets, which are also processed by active routers, are injected into active routers.…”