A data plane security model of segmented routing based on SDP trust enhancement architecture

Area of Science:

• Computer Science
• Network Security
• Software-Defined Networking

Background:

• Segment Routing (SR) faces security challenges in its data plane, including data monitoring, denial of service, loop attacks, and label detection.
• Traditional network security measures are insufficient for the dynamic and complex nature of SR networks.

Purpose of the Study:

• To propose a novel security model, SbSR (SDP-based SR), for enhancing the security management of access devices in the SR data plane.
• To address traditional and emerging security threats within SR networks by integrating SR with Software-Defined Perimeter (SDP).

Main Methods:

• Development of an SR security model (SbSR) based on an SDP trust enhancement architecture.
• Design of a two-level SDP AH trust verification mechanism and four trust management mechanisms (initial trust value, evaluation, renewal, inheritance).
• Implementation of a System Cloud Grey Model (1,1) weighted Markov prediction model for real-time trust evaluation using historical device behavior and four key performance indexes.

Main Results:

• The SbSR model effectively addresses security issues such as port scanning, traffic monitoring, topology detection, loop attacks, and DoS attacks in the SR data plane.
• Simulation results demonstrate the model's efficacy across five security functions with an average access delay cost of 2.84 seconds per new network agent.
• The proposed architecture provides multi-faceted protection for the SR network data plane.

Conclusions:

• The integration of SDP with SR provides a robust framework for securing network data planes.
• The developed trust management mechanisms and evaluation model are effective in identifying and mitigating malicious devices.
• The SbSR model offers a viable solution for enhancing the security posture of modern SR networks.