Abstract:Software-Defined Networking (SDN) greatly meets the need in industry for programmable, agile, and dynamic networks by deploying diversified SDN applications on a centralized controller. However, SDN application ecosystem inevitably introduces new security threats since compromised or malicious applications can significantly disrupt network operations. Thus, a number of effective security enhancement systems have been developed to defend against potential attacks from SDN applications. In this paper, we identify a new vulnerability on flow rule installation in SDN, namely, buffered packet hijacking, which can be exploited by malicious applications to launch effective attacks bypassing all existing defense systems. The root cause of this vulnerability lies in that SDN systems do not check the inconsistency between buffer IDs and match fields when an application attempts to install flow rules. Thus, a malicious application can manipulate buffer IDs to hijack buffered packets even though they do not match any installed flow rules. We design effective attacks exploiting this vulnerability to disrupt all three SDN layers, i.e., application layer, data plane layer, and control layer. First, by modifying buffered packets and resending them to controllers, a malicious application can poison other applications. Second, by manipulating forwarding behaviors of buffered packets, a malicious application can not only disrupt TCP connections of flows but also make flows bypass network security policies. Third, by copying massive buffered packets to controllers, a malicious application can saturate the bandwidth of SDN control channels and their computing resources. We demonstrate the feasibility and effectiveness of these attacks with both theoretical analysis and experiments in a real SDN testbed. Finally, we develop a lightweight defense system that can be readily deployed in existing SDN controllers as a patch.

A Bidirectional Data Packet Tampering Method for Linux System

Toward Security-Enhanced In-band Network Telemetry in Programmable Networks

In-band Network Telemetry Manipulation Attacks and Countermeasures in Programmable Networks.

Research of Improved Probabilistic Packet Marking Algorithms

When Match Fields Do Not Need to Match: Buffered Packets Hijacking in SDN

A Robust IP Packets Filtering Mechanism for Protecting Web Server from DDoS Attacks

Design and Implementation of a Firewall IPS Module

Design and Evaluation of a Policy-Based Security Routing and Switching System for Data Interception Attacks

Off-Path TCP Hijacking Attacks via the Side Channel of Downgraded IPID

Design and Implementation of Linux-gateway-based DoS/DDoS Protect System

Divert IP Datagram Based on Network Protocol of Linux

Improved User Datagram Porotocal Encapsulation Solution

Off-Path TCP Exploits of the Mixed IPID Assignment

An Integrative System for Deep Packet Inspection and Network Anomaly Detection & Defense

Network Stack Analyzing and Protocol Add Technology in Linux

Implementation of Linux Firewall with DMZ

Novel and Practical SDN-based Traceback Technique for Malicious Traffic over Anonymous Networks

Implementation of Trust DSR Protocol based on Linux Net-filter Frame

Design and Implementation of IPv6 Transparent Firewall with Virus Filtering

Design and Implementation of a Defense Mechanism for SQL Injection Attack

Exploiting Cross-Layer Vulnerabilities: Off-Path Attacks on the TCP/IP Protocol Suite