Um Mecanismo para Isolamento Seguro de Redes Virtuais Usando a Abordagem Hı́brida Xen e OpenFlow⇤

Secure virtual networks must provide privacy and avoid denial of service attacks. In this paper, we propose a mechanism which securely isolates virtual networks based on the paradigm of data and control plane separation. The proposal is deployed over XenFlow, a hybrid network virtualization tool that uses both Xen and OpenFlow. The proposed mechanism associates an OpenFlow control application with a labeling scheme for each virtual network of Xen virtual machines. In the plane separation paradigm, packets of each virtual network are forwarded directly in data plane, and the proposal ensures traffic isolation with resource reservation for each virtual network. The experiments evaluate two attackers’ models: one that tries to exhaust the resources of virtual networks and other that attempts to eavesdrop on communications from other virtual networks. The results show that the proposal completely blocks the action of both attackers’ model. Results reveal the effectiveness for traffic isolation, even on adverse situations, where virtual networks share the same IP address space or broadcast packets.