A comprehensive 3‐dimensional security analysis of a controller in software‐defined networking

Abstract

Software-defined networking (SDN) has recently emerged as a novel networking paradigm that enables network administrators to manage network services through high-level abstraction of networking functions. This is achieved by mainly decoupling the control plane from the data plane. The control plane, namely the SDN controller, makes dynamic decisions on where traffic is sent in the underlying systems that forward data to the selected destinations. The SDN controller, seen as a networking operating system, acts, therefore, as the brain in SDN. Consequently, its importance makes it a privileged new target for future attackers. In order to have a comprehensive security assessment of the SDN controller, we conducted a 3-dimensional analysis to study the security of OpenFlow-based SDN controllers. This study includes: (1) the essential components of a controller, (2) the characteristics provided by a controller, and (3) the STRIDE model. At the end, we also summarized 9 principles that are necessary to secure an SDN controller from the reported attacks and analyzed the security of 5 active open-source controllers following those principles. KEYWORDSOpenFlow, SDN, SDN controller, security INTRODUCTIONSoftware-defined networking (SDN) is as susceptible to attacks as traditionally managed networks. A long and continuous series of attacks have revealed many areas of network vulnerability. The SDN controller is a key to any software-defined network and offers attackers a target not present in earlier network technologies. Clearly, any successful attack on the controller will halt or disrupt network operations. 1 To address this problem, some researchers have proposed to harden the SDN control plane. For example, FortNOX 2 hardens the kernel of the SDN controller (NOX) to avoid malicious rule injection from the application plane. Extending FortNOX, SE-Floodlight 3 enhances the security of the overall control plane through authentication, role authorization, and network application operation auditing. Rosemary 4 isolates the net-app from the control plane via interprocess communication (IPC), which enables the SDN controller to be immune from resource exhaustion attacks. Moreover, the distributed controllers have also been proposed for providing a more scalable control plane, such as ONOS, 5 Onix, 6 Kandoo, 7 and the 3-level controller architecture for IoT (Internet of things). 8 Moreover, a distributed architecture brings new challenges for data consistency between controllers. 9 However, the SDN controller remains vulnerable to many threats, such as data inconsistency, OpenFlow messages flooding, topology spoofing, malicious scanning, etc. Hence, the motivation of this work is to provide a clear view in order to evaluate the security of the control plane. A number of surveys on SDN/OpenFlow security also precede this analysis such as References 10-16. Reference 13 adopts STRIDE to evaluate the security of SDN. Conversely, Reference 17 uses STRIDE to evaluate the security of the Security Privacy. 2018;1:e21.wileyonlinelibrar...

InSDN: A Novel SDN Intrusion Dataset

“…This manuscript does not emphasize all attack types in the SDN context; instead, some attacks, which are relevant to the InSDN dataset are reported in the following paragraphs. Rather, interested readers may refer to previous studies [52], [57]- [60] for more detailed information.…”