Abstract:Software-Defined Networking (SDN) greatly meets the need in industry for programmable, agile, and dynamic networks by deploying diversified SDN applications on a centralized controller. However, SDN application ecosystem inevitably introduces new security threats since compromised or malicious applications can significantly disrupt network operations. Thus, a number of effective security enhancement systems have been developed to defend against potential attacks from SDN applications. In this paper, we identify a new vulnerability on flow rule installation in SDN, namely, buffered packet hijacking, which can be exploited by malicious applications to launch effective attacks bypassing all existing defense systems. The root cause of this vulnerability lies in that SDN systems do not check the inconsistency between buffer IDs and match fields when an application attempts to install flow rules. Thus, a malicious application can manipulate buffer IDs to hijack buffered packets even though they do not match any installed flow rules. We design effective attacks exploiting this vulnerability to disrupt all three SDN layers, i.e., application layer, data plane layer, and control layer. First, by modifying buffered packets and resending them to controllers, a malicious application can poison other applications. Second, by manipulating forwarding behaviors of buffered packets, a malicious application can not only disrupt TCP connections of flows but also make flows bypass network security policies. Third, by copying massive buffered packets to controllers, a malicious application can saturate the bandwidth of SDN control channels and their computing resources. We demonstrate the feasibility and effectiveness of these attacks with both theoretical analysis and experiments in a real SDN testbed. Finally, we develop a lightweight defense system that can be readily deployed in existing SDN controllers as a patch.

Constructing SDN Covert Timing Channels Between Hosts with Unprivileged Attackers

Combination Attacks and Defenses on SDN Topology Discovery.

Covert Channels in SDN: Leaking Out Information from Controllers to End Hosts

Vulnerabilities and Attacks of Inter-device Coordination in Programmable Networks.

Flow Table Saturation Attack Against Dynamic Timeout Mechanisms in SDN

SDN-RDCD: A Real-Time and Reliable Method for Detecting Compromised SDN Devices.

Hiding and Trapping: A Deceptive Approach for Defending against Network Reconnaissance with Software-Defined Network

Disrupting the SDN Control Channel Via Shared Links: Attacks and Countermeasures.

I DPID It My Way! A Covert Timing Channel in Software-Defined Networks

Defending Against SDN Network Topology Poisoning Attacks

Attacking Network Isolation in Software-Defined Networks: New Attacks and Countermeasures

Security Policy Violations in SDN Data Plane

Securing Middlebox Policy Enforcement in SDN

When Match Fields Do Not Need to Match: Buffered Packets Hijacking in SDN

Novel Mitm Attacks On Security Protocols In Sdn: A Feasibility Study

FlowCloak: Defeating Middlebox-Bypass Attacks in Software-Defined Networking.

Detection and Defense Against Network Isolation Attacks in Software‐defined Networks

Detection and Mitigation of DoS Attacks in Software Defined Networks

A Method of DDoS Attack Detection and Mitigation for the Comprehensive Coordinated Protection of SDN Controllers

A Covert Timing Channel via Algorithmic Complexity Attacks: Design and Analysis

SDNShield: Towards More Comprehensive Defense Against DDoS Attacks on SDN Control Plane