LPV:Lightweight Packet Forwarding Verification in SDN
Shou-Yi WANG,Qi LI,Yun ZHANG
DOI: https://doi.org/10.11897/SP.J.1016.2019.00176
2019-01-01
Jisuanji Xuebao/Chinese Journal of Computers
Abstract:Software-Defined Networking (SDN) simplifies network management by separating control and data planes, and has been received much attention recently.However, SDN cannot ensure correctness of packet forwarding in the networks, e.g., the packets in SDN can be dropped, tampered with, or faked, which may be incurred by false forwarding rule enforcement or attacks.SDN has a simple packet forwarding mechanism in its data plane so that the forwarding verification techniques in the traditional IP networks cannot be applied in SDN.Therefore, it is challenging to verify packet forwarding and ensure correctness of packet forwarding in SDN.The existing studies verify packet forwarding in SDN by verifying packets hop-by-hop or periodically comparing flow statistics of all flows, which incurs significant computation and communication overhead.In this paper, we present LPV (Lightweight Packet Forwarding Verification), a system provides the ability of verifying SDN data plane forwarding.The goal of LPV is to provide a reliable and practical mechanism to detect and defend against wrong packet forwarding.To this end, we develop a lightweight forwarding verification approach to detecting forwarding anomalies and locating malicious switches by leveraging the Packet-in mechanism and the flow statistics maintained in switches.LPV samples packets delivered by ingress and egress switches according to dedicated flow rules, and reports the message authentication code (MAC) values of packets and the statistics of the corresponding flows by Packet-in messages.Thereby, the controllers can detect malicious forwarding behaviors by comparing the MAC values of the packets and the statistics of the flows.Moreover, LPV can locate the switches that perform the malicious packet forwarding behaviors, e.g., malicious packet modification and packet dropping, by analyzing the correlations of the information, i.e., the Packet-in messages and flow statistics.By enforcing the sample mechanism, LPV significantly reduces the computation cost, and communication and storage overheads, which incurred by packet processing in switches and controllers.In particular, by randomly sampling packets according to the flow rules, LPV ensures the consistency of packet processing performed by different switches.Adversaries cannot easily infer which packets are sampled so that they cannot interfere with the verification.We implement a prototype of LPV with open source OpenFlow controllers, i.e., Floodlight, and open source OpenFlow switches, i.e., ofsoftware13, and evaluate the performance by Mininet experiments.The experimental results show that LPV detects various forwarding anomalies, while introducing negligible overhead, i.e., around 10％average delays in packet forwarding and less than 10％communication overhead.