ZbSR: A Data Plane Security Model of SR-BE/TE based on Zero-Trust Architecture

Abstract

Facing the untrusted threats of network elements and PKI/CA faced by SR-BE/TE(Segment Routing-BE/TE) data plane in the zero-trust network environment, firstly, this paper refines it into eight specific security issues. Secondly, an SR-BE/TE data plane security model ZbSR(ZTA-based SR) based on zero-trust architecture is proposed, which reconstructs the original SR control plane into a "trust-agent" two-layer plane based on 4 components of the controller, agent, cryptographic center and information base. On one hand, we distinguish between the two segment list generation modes and proposes corresponding data exchange security algorithms, by introducing north-south security verification based on identity authentication, trust evaluation, and key agreement before the terminal device establishes an east-west access connection, so reliable data exchange between terminal devices can be realized. On the other hand, for the network audit lacking SR-BE/TE, a network audit security algorithm based on solid authentication is proposed. By auditing the fields, behaviors, loops, labels, paths, and SIDs of messages, threats such as stream path tampering, SID tampering, DoS attacks, and loop attacks can be effectively detected. Finally, through the simulation test, the proposed model can provide security protection for the SR data plane with a 19.3% average incremental delay overhead for various threat scenarios.

A Study Of Civil Engineering Education At Singapore Nanyang Technology University And At The University Of Florida

“…Unlike the static trust model, zero-trust follows the principle of "never trust, always verify" by performing per-session authentication and continuous identification [1]. Trustworthiness evaluations, such as those by reputation [14], social theory [19], and tags [20], accurately reflect the trust level of each entity. Rational trustworthiness values enable granular zerotrust policies in various scenarios.…”

“…To ensure the adaptability of our proposal, M(., .) is regarded as a pluggable module, supporting various wellproven proposals, e.g., reputation [14] and tags [20]. Similarly, more customized/fine-grained authentication mechanisms can be deployed on PE, e.g., blockchain-based voting [7].…”