1、 I n t e r n a t i o n a l T e l e c o m m u n i c a t i o n U n i o n ITU-T X.1038 TELECOMMUNICATION STANDARDIZATION SECTOR OF ITU (10/2016) SERIES X: DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY Information and network security Network security Security requirements and reference archite
2、cture for software-defined networking Recommendation ITU-T X.1038 ITU-T X-SERIES RECOMMENDATIONS DATA NETWORKS, OPEN SYSTEM COMMUNICATIONS AND SECURITY PUBLIC DATA NETWORKS X.1X.199 OPEN SYSTEMS INTERCONNECTION X.200X.299 INTERWORKING BETWEEN NETWORKS X.300X.399 MESSAGE HANDLING SYSTEMS X.400X.499 D
3、IRECTORY X.500X.599 OSI NETWORKING AND SYSTEM ASPECTS X.600X.699 OSI MANAGEMENT X.700X.799 SECURITY X.800X.849 OSI APPLICATIONS X.850X.899 OPEN DISTRIBUTED PROCESSING X.900X.999 INFORMATION AND NETWORK SECURITY General security aspects X.1000X.1029 Network security X.1030X.1049 Security management X
4、.1050X.1069 Telebiometrics X.1080X.1099 SECURE APPLICATIONS AND SERVICES Multicast security X.1100X.1109 Home network security X.1110X.1119 Mobile security X.1120X.1139 Web security X.1140X.1149 Security protocols X.1150X.1159 Peer-to-peer security X.1160X.1169 Networked ID security X.1170X.1179 IPT
5、V security X.1180X.1199 CYBERSPACE SECURITY Cybersecurity X.1200X.1229 Countering spam X.1230X.1249 Identity management X.1250X.1279 SECURE APPLICATIONS AND SERVICES Emergency communications X.1300X.1309 Ubiquitous sensor network security X.1310X.1339 PKI related Recommendations X.1340X.1349 CYBERSE
6、CURITY INFORMATION EXCHANGE Overview of cybersecurity X.1500X.1519 Vulnerability/state exchange X.1520X.1539 Event/incident/heuristics exchange X.1540X.1549 Exchange of policies X.1550X.1559 Heuristics and information request X.1560X.1569 Identification and discovery X.1570X.1579 Assured exchange X.
7、1580X.1589 CLOUD COMPUTING SECURITY Overview of cloud computing security X.1600X.1601 Cloud computing security design X.1602X.1639 Cloud computing security best practices and guidelines X.1640X.1659 Cloud computing security implementation X.1660X.1679 Other cloud computing security X.1680X.1699 For
8、further details, please refer to the list of ITU-T Recommendations. Rec. ITU-T X.1038 (10/2016) i Recommendation ITU-T X.1038 Security requirements and reference architecture for software-defined networking Summary Recommendation ITU-T X.1038 supports security protection and provides security requir
9、ements and a reference architecture for software-defined networking (SDN). This Recommendation identifies new security threats as well as traditional network security threats to SDN, defines security requirements, provides possible security countermeasures against new security threats, and designs a
10、 security reference architecture for SDN. History Edition Recommendation Approval Study Group Unique ID* 1.0 ITU-T X.1038 2016-10-14 17 11.1002/1000/13058 Keywords SDN security, security reference architecture, security requirement, security threat. * To access the Recommendation, type the URL http:
11、/handle.itu.int/ in the address field of your web browser, followed by the Recommendations unique ID. For example, http:/handle.itu.int/11.1002/1000/11830-en. ii Rec. ITU-T X.1038 (10/2016) FOREWORD The International Telecommunication Union (ITU) is the United Nations specialized agency in the field
12、 of telecommunications, information and communication technologies (ICTs). The ITU Telecommunication Standardization Sector (ITU-T) is a permanent organ of ITU. ITU-T is responsible for studying technical, operating and tariff questions and issuing Recommendations on them with a view to standardizin
13、g telecommunications on a worldwide basis. The World Telecommunication Standardization Assembly (WTSA), which meets every four years, establishes the topics for study by the ITU-T study groups which, in turn, produce Recommendations on these topics. The approval of ITU-T Recommendations is covered b
14、y the procedure laid down in WTSA Resolution 1. In some areas of information technology which fall within ITU-Ts purview, the necessary standards are prepared on a collaborative basis with ISO and IEC. NOTE In this Recommendation, the expression “Administration“ is used for conciseness to indicate b
15、oth a telecommunication administration and a recognized operating agency. Compliance with this Recommendation is voluntary. However, the Recommendation may contain certain mandatory provisions (to ensure, e.g., interoperability or applicability) and compliance with the Recommendation is achieved whe
16、n all of these mandatory provisions are met. The words “shall“ or some other obligatory language such as “must“ and the negative equivalents are used to express requirements. The use of such words does not suggest that compliance with the Recommendation is required of any party. INTELLECTUAL PROPERT
17、Y RIGHTSITU draws attention to the possibility that the practice or implementation of this Recommendation may involve the use of a claimed Intellectual Property Right. ITU takes no position concerning the evidence, validity or applicability of claimed Intellectual Property Rights, whether asserted b
18、y ITU members or others outside of the Recommendation development process. As of the date of approval of this Recommendation, ITU had not received notice of intellectual property, protected by patents, which may be required to implement this Recommendation. However, implementers are cautioned that t
19、his may not represent the latest information and are therefore strongly urged to consult the TSB patent database at http:/www.itu.int/ITU-T/ipr/. ITU 2017 All rights reserved. No part of this publication may be reproduced, by any means whatsoever, without the prior written permission of ITU. Rec. IT
20、U-T X.1038 (10/2016) iii Table of Contents Page 1 Scope . 1 2 References . 1 3 Definitions 2 3.1 Terms defined elsewhere 2 3.2 Terms defined in this Recommendation . 2 4 Abbreviations and acronyms 3 5 Conventions 3 6 Overview . 4 7 Security threats and requirements . 4 7.1 SDN application layer 4 7.
21、2 SDN control layer . 5 7.3 SDN resource layer . 8 7.4 Application-control interface 9 7.5 Resource-control interface 10 8 Security reference architecture for SDN . 11 8.1 SDN application layer 11 8.2 SDN control layer . 13 8.3 SDN resource layer . 16 8.4 Multi-layer security management . 17 Annex A
22、 Use cases of new security threats to SDN . 19 A.1 Use case 1: Bypassing a predefined mandatory policy 19 A.2 Use case 2: Data eavesdropping attacks by inserting fraudulent flow entries . 20 Annex B Fine-grained naming scheme for flow entry 22 B.1 Fine-grained naming scheme for flow entry 22 Bibliog
23、raphy. 23 iv Rec. ITU-T X.1038 (10/2016) Introduction Generally, security threats to SDN are common to other targets and to traditional networking, but the profile of the threats (including their likelihood and impact and hence their overall risk level) changes with the new SDN architecture. With a
24、centralized SDN controller, the impact of a denial-of-service (DoS)/distributed denial-of-service (DDoS) attack can be higher than that directed against a single router. Some new functional entities (e.g., SDN controller), protocols (e.g., ONF OpenFlow) and interfaces (e.g., application-control inte
25、rface, resource-control interface) according to the framework of SDN ITU-T Y.3300 will pose new security threats. All these security threats must be understood and addressed. This Recommendation describes use cases to detail new security threats when introducing SDN. This Recommendation identifies s
26、ecurity threats for the SDN application layer, SDN control layer, SDN resource layer, application-control interface, and resource-control interface according to the framework of SDN ITU-T Y.3300. This Recommendation also defines security requirements from above security threats analysis and studies
27、possible security countermeasures against new security threats. With this information, a security reference architecture for SDN is designed based on the identified security threats, and security requirements and security countermeasures are specified. This security reference architecture can guide
28、the developer to design a SDN security functional architecture and implement security functions when developing an SDN controller. Rec. ITU-T X.1038 (10/2016) 1 Recommendation ITU-T X.1038 Security requirements and reference architecture for software-defined networking 1 Scope This Recommendation is
29、 to support security protection and to provide security requirements and a reference architecture for software-defined networking (SDN). This Recommendation: describes use cases to detail new security threats when introducing SDN; identifies major security threats to SDN; defines security requiremen
30、ts; provides possible security countermeasures against new security threats; designs a security reference architecture for SDN. 2 References The following ITU-T Recommendations and other references contain provisions which, through reference in this text, constitute provisions of this Recommendation
31、. At the time of publication, the editions indicated were valid. All Recommendations and other references are subject to revision; users of this Recommendation are therefore encouraged to investigate the possibility of applying the most recent edition of the Recommendations and other references list
32、ed below. A list of the currently valid ITU-T Recommendations is regularly published. The reference to a document within this Recommendation does not give it, as a stand-alone document, the status of a Recommendation. ITU-T X.800 Recommendation ITU-T X.800 (1991), Security architecture for Open Syst
33、ems Interconnection for CCITT applications. ITU-T Y.3300 Recommendation ITU-T Y.3300 (2014), Framework of software-defined networking. IETF RFC 4210 IETF RFC 4210 (2005), Internet X.509 Public Key Infrastructure Certificate Management Protocol (CMP). IETF RFC 4279 IETF RFC 4279 (2005), Pre-Shared Ke
34、y Ciphersuites for Transport Layer Security (TLS). IETF RFC 4301 IETF RFC 4301 (2005), Security Architecture for the Internet Protocol. IETF RFC 4303 IETF RFC 4303 (2005), IP Encapsulating Security Payload (ESP). IETF RFC 4306 IETF RFC 4306 (2005), Internet Key Exchange (IKEv2) Protocol. IETF RFC 43
35、14 IETF RFC 4314 (2005), IMAP4 Access Control List (ACL) Extension. IETF RFC 4835 IETF RFC 4835 (2007), Cryptographic Algorithm Implementation Requirements for Encapsulating Security Payload (ESP) and Authentication Header (AH). IETF RFC 5246 IETF RFC 5246 (2008), The Transport Layer Security (TLS)
36、Protocol Version 1.2. NIST 3DES National Institute of Standards and Technology (2012), Recommendation for the Triple Data Encryption Algorithm (TDEA) Block Cipher (Revision 1), NIST Special Publication 800-67, January. 2 Rec. ITU-T X.1038 (10/2016) NIST AES National Institute of Standards and Techno
37、logy (2001), Specification for the Advanced Encryption Standard (AES) FIPS 197. November 26. NIST DSS NIST FIPS PUB 186-4 (2013), Digital Signature Standard, National Institute of Standards and Technology, U.S. Department of Commerce, July. 3 Definitions 3.1 Terms defined elsewhere This Recommendati
38、on uses the following terms defined elsewhere: 3.1.1 access control ITU-T X.800: The prevention of unauthorized use of a resource, including the prevention of use of a resource in an unauthorized manner. 3.1.2 authentication b-ISO/IEC 18014-2: Provision of assurance in the identity of an entity. 3.1
39、.3 authorization b-ITU-T X.1251: The authorization service is designed to make decisions regarding the users access rights and enforce authorization decisions according to the users privileges. Authorization is an optional service; it is only provided when access to resources needs to be controlled
40、based on the users rights. 3.1.4 confidentiality ITU-T X.800: The property that information is not made available or disclosed to unauthorized individuals, entities, or processes. 3.1.5 data integrity ITU-T X.800: The property that data has not been altered or destroyed in an unauthorized manner. 3.
41、1.6 firewall b-ISO/IEC 27033-1: Type of security barrier placed between network environments consisting of a dedicated device or a composite of several components and techniques through which all traffic from one network environment traverses to another, and vice versa, and only authorized traffic,
42、as defined by the local security policy, is allowed to pass. 3.1.7 intrusion detection system b-ISO/IEC 27039: Information systems used to identify that an intrusion has been attempted, is occurring, or has occurred. 3.1.8 key ITU-T X.800: A sequence of symbols that controls the operations of enciph
43、erment and decipherment. 3.1.9 key management ITU-T X.800: The generation, storage, distribution, deletion, archiving and application of keys in accordance with a security policy. 3.1.10 public-key certificate (PKC) b-ITU-T X.509: The public key of an entity, together with some other information, re
44、ndered unforgeable by digital signature with the private key of the certification authority (CA) that issued it. 3.1.11 software-defined networking ITU-T Y.3300: A set of techniques that enables to directly program, orchestrate, control and manage network resources, which facilitates the design, del
45、ivery and operation of network services in a dynamic and scalable manner. 3.1.12 threat b-ISO/IEC 27000: Potential cause of an unwanted incident, which may result in harm to a system or organization. 3.2 Terms defined in this Recommendation This Recommendation defines the following terms: 3.2.1 netw
46、ork resources: Network devices that can perform packet forwarding in a network system. The network resources include network switch, router, gateway, WiFi access points, and similar devices. Rec. ITU-T X.1038 (10/2016) 3 3.2.2 certificate management: The creation, storage, distribution, suspension,
47、revocation, archiving and application of certificates in accordance with a security policy. 4 Abbreviations and acronyms This Recommendation uses the following abbreviations and acronyms: 3DES Triple Data Encryption Algorithm ACL Access Control List AES Advanced Encryption Standard DDoS Distributed
48、Denial of Service DoS Denial of Service DPI Deep Packet Inspection HMAC keyed-Hash Message Authentication Code ICT Information and Communications Technology IDP Intrusion Detection and Prevention IETF Internet Engineering Task Force IPsec Internet Protocol Security MAC Message Authentication Code ON
49、F Open Networking Foundation OS Operating System PSK Pre-Shared Key QoS Quality of Service RBAC Role Based Access Control SDN Software-Defined Networking SLA Service Level Agreement TLS Transport Layer Security 5 Conventions In this Recommendation: The keywords “is required to“ indicate a requirement which must be strictly followed and from which no deviation is permitted, if conformance to this Recommendation is to be claimed. The keywords “is recommended“
