TY - GEN
T1 - Security Function Virtualization Based Moving Target Defense of SDN-Enabled Smart Grid
AU - Lin, Gengshen
AU - Dong, Mianxiong
AU - Ota, Kaoru
AU - Li, Jianhua
AU - Yang, Wu
AU - Wu, Jun
N1 - Funding Information:
ACKNOWLEDGEMENT This work was supported in part by the National Natural Science Foundation of China under Grant 61431008, 61571300, 61831007 and partially supported by the JSPS KAKENHI Grant Number JP16K00117, KDDI Foundation.
Publisher Copyright:
© 2019 IEEE.
PY - 2019/5
Y1 - 2019/5
N2 - Software-defined networking (SDN) allows the smart grid to be centrally controlled and managed by decoupling the control plane from the data plane, but it also expands attack surface for attackers. Existing studies about the security of SDN-enabled smart grid (SDSG) mainly focused on static methods such as access control and identity authentication, which is vulnerable to attackers that carefully probe the system. As the attacks become more variable and complex, there is an urgent need for dynamic defense methods. In this paper, we propose a security function virtualization (SFV) based moving target defense of SDSG which makes the attack surface constantly changing. First, we design a dynamic defense mechanism by migrating virtual security function (VSF) instances as the traffic state changes. The centralized SDN controller is re-designed for global status monitoring and migration management. Moreover, we formalize the VSF instances migration problem as an integer nonlinear programming problem with multiple constraints and design a pre-migration algorithm to prevent VSF instances' resources from being exhausted. Simulation results indicate the feasibility of the proposed scheme.
AB - Software-defined networking (SDN) allows the smart grid to be centrally controlled and managed by decoupling the control plane from the data plane, but it also expands attack surface for attackers. Existing studies about the security of SDN-enabled smart grid (SDSG) mainly focused on static methods such as access control and identity authentication, which is vulnerable to attackers that carefully probe the system. As the attacks become more variable and complex, there is an urgent need for dynamic defense methods. In this paper, we propose a security function virtualization (SFV) based moving target defense of SDSG which makes the attack surface constantly changing. First, we design a dynamic defense mechanism by migrating virtual security function (VSF) instances as the traffic state changes. The centralized SDN controller is re-designed for global status monitoring and migration management. Moreover, we formalize the VSF instances migration problem as an integer nonlinear programming problem with multiple constraints and design a pre-migration algorithm to prevent VSF instances' resources from being exhausted. Simulation results indicate the feasibility of the proposed scheme.
UR - http://www.scopus.com/inward/record.url?scp=85070227476&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85070227476&partnerID=8YFLogxK
U2 - 10.1109/ICC.2019.8761217
DO - 10.1109/ICC.2019.8761217
M3 - Conference contribution
AN - SCOPUS:85070227476
T3 - IEEE International Conference on Communications
BT - 2019 IEEE International Conference on Communications, ICC 2019 - Proceedings
PB - Institute of Electrical and Electronics Engineers Inc.
T2 - 2019 IEEE International Conference on Communications, ICC 2019
Y2 - 20 May 2019 through 24 May 2019
ER -
