Abstract: Although the security of software-defined networking (SDN) obtains great attention,the threat of SDN controllers from the UDP duplicate packets in a heavy flow has not been eliminated yet.In response,based on the features of SDN and network function virtualization (NFV) technology,combining the load condition of SDN controller in handling both UDP and TCP data streams,firstly,this paper proposed a new NFV-based mechanism to guard against UDP control packet redundancy in SDN controller.The detection middlebox located in front of the OpenFlow switch interface can detect and filter UDP duplicate packets effectively.Secondly,this paper put forward a cost-effective NFV-based implementation method of detection middlebox.The detection middlebox is implemented by the Linux container and only the first UDP flow packet is allowed to pass through before a path is established by the SDN controller,ensuring that subsequent UDP flow packets already have relevant flow table entry when they reach the OpenFlow switch.Finally,this paper implemented and tested the prototype system of the mechanism in Linux server.The experimental results demonstrate that the method can effectively free from threat of the UDP redundant packets when the setting of the delay t of non-first packets is larger than or equal to the time for controller processing a single packet.

Key words: Detection middlebox, Network function virtualization, Network security, Software defined network, UDP