A data plane security model of SR-BE/TE based on zero-trust architecture

Area of Science:

• Computer Science
• Network Security
• Cybersecurity

Background:

• The Segment Routing-BE/TE (SR-BE/TE) data plane faces significant security challenges in zero-trust network environments, including untrusted network elements and Public Key Infrastructure/Certificate Authority (PKI/CA) vulnerabilities.
• Existing network audit mechanisms often lack specific support for SR-BE/TE, leaving it susceptible to various attacks.

Purpose of the Study:

• To propose a novel security model for the SR-BE/TE data plane within a zero-trust architecture.
• To address specific security issues and enhance data exchange reliability and network audit capabilities for SR-BE/TE.

Main Methods:

• Refined untrusted threats into eight specific security issues.
• Developed the ZbSR (ZTA-based SR) model, reconstructing the SR control plane into a two-layer 'trust-agent' plane with controller, agent, cryptographic center, and information base components.
• Introduced north-south security verification (identity authentication, trust evaluation, key agreement) for reliable east-west data exchange.
• Proposed a network audit security algorithm based on solid authentication, auditing message fields, behaviors, loops, labels, paths, and SIDs.

Main Results:

• The ZbSR model effectively addresses identified security issues in the SR-BE/TE data plane.
• Security algorithms ensure reliable data exchange between terminal devices and enable effective detection of threats like stream path tampering, SID tampering, DoS attacks, and loop attacks.
• Simulation tests confirmed the model's ability to provide security protection across various threat scenarios.

Conclusions:

• The proposed ZbSR model offers a robust security solution for the SR-BE/TE data plane in zero-trust environments.
• The implemented security algorithms and audit mechanisms significantly enhance network resilience and data integrity.
• The model provides effective security protection with an acceptable average incremental delay overhead of 19.3%.