DASPN: A Multi-level Security Protection Model for Northbound Interface Based on Dynamic Access Control
摘要
As Software Defined Networking (SDN) applications gain fine-grained network control via the northbound interface, associated security risks are rising. Attackers can target this interface to steal sensitive network data and issue malicious commands, potentially causing network-wide outages. Current protection mechanisms offer coarse-grained protection and lack dynamic response capabilities. This paper presents DASPN (Dynamic Access Security Protection for Northbound Interface), a multi-level security model based on dynamic access control. DASPN ensures effective security through the joint operation of an Attribute-Based Access Control Layer and a Behavior Detection Layer. We make the following contributions: (1) We propose a fine-grained dynamic authorization decision and real-time threat identification method based on multi-dimensional attributes for northbound interface requests; (2) We propose a dynamic threshold adjustment scheme, enhancing the model’s defense capability against DoS attacks; (3) We propose a trust mechanism-based conflict management algorithm that resolves resource access conflicts during application requests. Experimental results on the Ryu controller demonstrate that DASPN reduces response time by 30.6% compared to state-of-the-art approaches, while achieving a 98% attack detection rate with false positive rate below 2%, all with acceptable system overhead.