Abstract:Software-defined networking (SDN) utilizes a centralized controller to distribute packet processing rules to network switches. However, rules are often generated by the applications developed by different organizations, so they may conflict with each other in data plane and lead to violations with security rules. The problem is similar to firewall conflicts in IP networks. Rule conflict resolution should incur negligible process delay, such that all rules can he correctly and safely enforced in the data plane in real time. However, since SDN allows users to use more than 35 fields to specify rules (including field transition rules), it is much more complicated to prevent enforcement of SDN rules from violating with security rules than to resolve firewall rule violation, and in particular, field transition rules are enforced. Therefore, it is extremely difficult to resolve such rule conflicts in real time before the rules are installed in SDN data plane. In this paper, we investigate the rule conflict problem in SDN and identify new covert channel attacks due to rule conflicts. To the end, we propose the covert channel defender (CCD) that prevents covert channel attacks by verifying and resolving rule conflicts. Specifically, CCD tracks all rule insertion and modification messages from applications running on the controller. It analyzes the correlation among rules based on multiple packet header fields and resolves any identified rule conflict in real time before rule installation. We implement CCD with the Floodlight controller and evaluate its performance with the real-world Stanford topology. We show that CCD can efficiently detect and prevent rule conflicts in the data plane that may raise covert channels within hundreds of microseconds and brings small overhead to the packet delivery.

SDNKeeper: Lightweight Resource Protection and Management System for SDN-based Cloud

Guarding the Perimeter of Cloud-Based Enterprise Networks: an Intelligent SDN Firewall

Safe Reconfiguring Data Plane Via Supervision over Resource and Flow States

Intrinsic Security: A Robust Framework for Cloud-Native Network Slicing via a Proactive Defense Paradigm

Intrinsic Security and Self-Adaptive Cooperative Protection Enabling Cloud Native Network Slicing

SDN-RDCD: A Real-Time and Reliable Method for Detecting Compromised SDN Devices.

Asidps: Auto-Scaling Intrusion Detection And Prevention System For Cloud

SDNShield: Reconciliating Configurable Application Permissions for SDN App Markets

SDN-ESRC: A Secure and Resilient Control Plane for Software-Defined Networks

Toward Taming Policy Enforcement for Sdn in the Right Way: or Can We?

SDN-Empowered Reliable and Dynamic Scheduling Scheme for Security Resources.

SEAPP: A secure application management framework based on REST API access control in SDN-enabled cloud environment

Security Policy Violations in SDN Data Plane

SDN Oriented Software-Defined Security Architecture

SDN-Defend: A Lightweight Online Attack Detection and Mitigation System for DDoS Attacks in SDN

SDNShield: Towards More Comprehensive Defense Against DDoS Attacks on SDN Control Plane

SDNShield: NFV-Based Defense Framework Against DDoS Attacks on SDN Control Plane.

PDSDN: A Policy-Driven SDN Controller Improving Scheme for Multi-tenant Cloud Datacenter Environments

SDN-based Runtime Security Enforcement Approach for Privacy Preservation of Dynamic Web Service Composition

DoSGuard: Mitigating Denial-of-Service Attacks in Software-Defined Networks

REAL-GUARD