Abstract:Software-Defined Networking (SDN) greatly meets the need in industry for programmable, agile, and dynamic networks by deploying diversified SDN applications on a centralized controller. However, SDN application ecosystem inevitably introduces new security threats since compromised or malicious applications can significantly disrupt network operations. Thus, a number of effective security enhancement systems have been developed to defend against potential attacks from SDN applications. In this paper, we identify a new vulnerability on flow rule installation in SDN, namely, buffered packet hijacking, which can be exploited by malicious applications to launch effective attacks bypassing all existing defense systems. The root cause of this vulnerability lies in that SDN systems do not check the inconsistency between buffer IDs and match fields when an application attempts to install flow rules. Thus, a malicious application can manipulate buffer IDs to hijack buffered packets even though they do not match any installed flow rules. We design effective attacks exploiting this vulnerability to disrupt all three SDN layers, i.e., application layer, data plane layer, and control layer. First, by modifying buffered packets and resending them to controllers, a malicious application can poison other applications. Second, by manipulating forwarding behaviors of buffered packets, a malicious application can not only disrupt TCP connections of flows but also make flows bypass network security policies. Third, by copying massive buffered packets to controllers, a malicious application can saturate the bandwidth of SDN control channels and their computing resources. We demonstrate the feasibility and effectiveness of these attacks with both theoretical analysis and experiments in a real SDN testbed. Finally, we develop a lightweight defense system that can be readily deployed in existing SDN controllers as a patch.

Vulnerabilities and Attacks of Inter-device Coordination in Programmable Networks.

In-band Network Telemetry Manipulation Attacks and Countermeasures in Programmable Networks.

Toward Security-Enhanced In-band Network Telemetry in Programmable Networks

Flow Anomaly Telemetry Driven by Programmable Data Plane

Combination Attacks and Defenses on SDN Topology Discovery.

Survey of Attacks and Countermeasures for SDN

Attacks against Network Coordinate System: Vulnerable PIC

Constructing SDN Covert Timing Channels Between Hosts with Unprivileged Attackers

Fuzzing proprietary protocols of programmable controllers to find vulnerabilities that affect physical control

Control Plane Reflection Attacks and Defenses in Software-Defined Networks.

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

Exploiting Cross-Layer Vulnerabilities: Off-Path Attacks on the TCP/IP Protocol Suite

When Match Fields Do Not Need to Match: Buffered Packets Hijacking in SDN

Exploiting the Vulnerability of Flow Table Overflow in Software-Defined Network: Attack Model, Evaluation, and Defense

Novel Mitm Attacks On Security Protocols In Sdn: A Feasibility Study

Connectivity Jamming Game for Physical Layer Attack in Peer to Peer Networks

Stalker Attacks: Imperceptibly Dropping Sketch Measurement Accuracy on Programmable Switches

Cross-layer detection and defence mechanism against DDoS and DRDoS attacks in software-defined networks using P4 switches

Detection and Defense Against Network Isolation Attacks in Software‐defined Networks

DoS Attack on Networked Control System: From the Viewpoint on Communication-Control Cost

Enabling Cooperative IoT Security via Software Defined Networks (SDN)