於OpenFlow 網路實作網路使用者認證、授權及計費系統

Implementation of User Authentication， Authorization and Accounting System for OpenFlow Networks

王定山 ； 簡芝盈 ； 陳益群 ； 李光益 ； 吳承崧

《TANET2016 臺灣網際網路研討會》 2016 (2016/11) Pp. 187-192-034

https://doi.org/10.6679/TANET.2016.34

摘要

近年來軟體定義網路（ Software Defined Network，SDN）成為新的網路型態趨勢，其核心概念是將控制層（control plane）與資料層（data plane）功能分離，以集中管理的方式，讓資料層的網路設備由控制層的OpenFlow 控制器管理，OpenFlow 交換機則負責封包轉送的工作，提高網路效能與管理彈性，改善傳統網路缺乏的靈活性、改善網路需求變化時反應速度遲緩及降低昂貴的管理與設備成本等問題。目前OpenFlow 協定為實現SDN 架構的核心關鍵技術；OpenFlow 協定作為OpenFlow 交換機與OpenFlow 控制器間溝通的橋樑，控制器可以透過OpenFlow 協定對交換器下達指令，或從交換器裡收到事件通知。然而在網路中非常重要的使用者認證功能上，大部分還是以傳統網路為主。在這份論文中，我們實作IEEE 802.1X 的認證標準於OpenFlow 網路，相較傳統網路架構下，交換機擔任認證者（Authenticator）進行封包轉換，而本論文提出的系統架構中，所有封包的轉換程序將會由OpenFlow 控制器取代。此系統架構的驗證（Authentication）系統是在OpenFlow 網路數據鏈路層進行，因此能提供一個低處理效能但高安全性的使用者認證效果，當終端機成功經過驗證後，OpenFlow 控制器會按照使用者記錄的服務類型提供相對的授權（Authorization）存取權限，以及網路可用頻寬等。當終端機得到授權後，OpenFlow 控制器存取使用者紀錄於資料庫，藉由計算終端機使用時間來達到計費（Accounting）目的，並針對使用者服務類型進行流量控制。

關鍵字

軟體定義網路 ； 使用者認證 ； IEEE802.1X ； 認證 ； 授權及計費

並列摘要

In recent year, Software Defined Network （SDN） has become a latest network type. The core concept of SDN is to separate control plane from data plane. The network equipment of the data plane will be centralized management by the OpenFlow controller form the control plane. The OpenFlow switches are responsible for packet forwarding. This architecture increases network performance and spring of the management, to make up for the flexibility of the traditional network, solving the problems about network reaction rate slow, and reducing the human resource and hardware costs. Nowadays, the essential technology in SDN architecture is OpenFlow protocol; OpenFlow protocol is communication protocol between OpenFlow switches and OpenFlow controllers. By using the OpenFlow protocol, controllers can control the switches behaviors via the OpenFlow commands, or receive the event notifications from OpenFlow switches. Although there are so many applications based on the SDN, but most of the literatures about AAA (authentication, authorization and accounting) are still depending on traditional network architecture. In this paper, we implemented authentication process by the IEEE 802.1X standard based on the OpenFlow network. In our proposed system architecture, all of packet encapsulates or de-encapsulates by OpenFlow controller. Our implementation's authentication conduct on the data link layer on OpenFlow network, because it can provide a low process performance but enough security. After the successful authentication has done, pairing the access credentials according the service type in the user record. When the end host got the authorization, OpenFlow controller access the user's record in the database, we achieve the accounting by counting the time used by end host, and flow controlling by user service types.

並列關鍵字

Software Defined Network ； User Authentication ； IEEE802.1X Mechanism ； AAA（Authentication, Authorization and Accounting）