Research on Endogenous Security Mechanism of Cloud Network Driven by IPv6 Address
Cloud networking can rapidly deploy and configure virtual network resource on cloud platform according to different business scenarios,which is an important guarantee for performance and security in modern data center.However,traditional cloud network cannot make transparent end-to-end transmission due to the limitation of IPv4.The multi-tenant feature makes it difficult for cloud manager to constrain traffic on tenant subnets,and external security solutions lack of traceability of traffic from different tenants,making it impossible to restrict attack at the source.IPv6 has large address space,strong addressing ability,and high security.Guided by the endogenous security concept and centered on IPv6 address driven,this article proposed an IPv6 address driven cloud network endogenous security hierarchy architecture,including address generation layer,address verification layer,and address utilization layer.At the address generation layer,the tenant identity was embedded into the last 64 bits of IPv6 address using symmetric encryption algorithm,and the DHCPv6 address allocation strategy was modified.The implementation was based on Openstack Neutron.At the address verification layer,a dynamic source address verification method was designed and implemented for cloud networks.Specific transition methods and security policies were designed for different port status sets.At the address utilization layer,based on the characteristics of real IPv6 address,a packet tracing mechanism and an access control policy based on IPv6 addresses were implemented.
万方数据
维普
