I DPID It My Way! A Covert Timing Channel in Software-Defined Networks

Robert Krösche,Kashyap Thimmaraju,Liron Schiff,Stefan Schmid

2024-03-04

Abstract:Software-defined networking is considered a promising new paradigm, enabling more reliable and formally verifiable communication networks. However, this paper shows that the separation of the control plane from the data plane, which lies at the heart of Software-Defined Networks (SDNs), can be exploited for covert channels based on SDN Teleportation, even when the data planes are physically disconnected.

Cryptography and Security,Networking and Internet Architecture

What problem does this paper attempt to address?

The problem that this paper attempts to solve is: in Software - Defined Networking (SDN), by using the separation characteristic of the control plane and the data plane, design and implement a covert timing channel. Even if the data plane is physically disconnected, secret communication can be carried out through this channel. Specifically, the paper shows how to use the "teleportation" mechanism in SDN to create a covert timing channel, enabling malicious switches to transmit sensitive information, such as RSA private key files, without being detected.

### Main problems

1. **Feasibility of covert communication**:
- The paper explores how to use the separation characteristics of the control plane and the data plane in SDN to design a covert timing channel, so that malicious switches can bypass existing security mechanisms for secret communication.

2. **Utilization of the teleportation mechanism**:
- The author describes in detail how to use the "teleportation" mechanism (that is, two switches are connected to the same controller using the same DPID) to create a covert channel, and discusses four possible results and their impacts on covert communication.

3. **Design and implementation of the covert channel**:
- The paper proposes a time - based covert channel model, and through accurate state machines and time - delay models, realizes single - bit and multi - bit secret transmissions.

4. **Performance evaluation**:
- The author conducts a prototype implementation and performance evaluation of the designed covert channel, and verifies its throughput and accuracy under different load conditions.

### Key formulas

- Definition of time interval \(\Delta\):
\[
\Delta=\delta_s + \delta_r
\]
where \(\delta_s\) is the time required for the sender to send a binary bit, and \(\delta_r\) is the time required for the receiver to receive a binary bit.

- Time for the sender to send 0 or 1:
\[
\delta_s =
\begin{cases}
0, & \text{send 0} \\
\delta_{sc}+\delta_{dc}, & \text{send 1}
\end{cases}
\]

- Time for the receiver to receive 0 or 1:
\[
\delta_r =
\begin{cases}
\delta_{offset}+\delta_{sc}+\delta_{delay}+\delta_{chk - conn}+\delta_{dc}, & \text{receive 0} \\
\delta_{offset}+\delta_{sc}+\delta_{of - deny}+\delta_{delay}+\delta_{chk - conn}+\delta_{dc}, & \text{receive 1}
\end{cases}
\]

### Conclusion

Through theoretical modeling, prototype implementation and performance evaluation, the paper proves the feasibility and effectiveness of creating a covert timing channel using the teleportation mechanism in SDN. This research reveals the potential security threats in the SDN architecture and provides a new perspective for future research.