Development of network security tools for enterprise software-defined networks

Shukhman, Alexander E.; Polezhaev, Petr; Ushakov, Yuri; Legashev, Leonid; Тарасов, В. Н.; Бахарева, Н. Ф.

doi:10.1145/2799979.2800009

“…However examining surveys of existing research also led to questioning the assertion repeated by many researchers (see Appendix A) that all network functionality should be moved out of the forwarding plane into the control plane. That this view is influential is reflected in the increasing numbers of research papers proposing or using such an architecture to provide SDN security [84][85][86][87][88][89][90][91]. Throughout the course of this research the author has sought to clarify the blanket assertion that network functions should be purged from the forwarding plane and has demonstrated that such a blanket approach is flawed.…”

Section: Resultsmentioning

confidence: 99%

“…They instead efficiently pass attack traffic to the controller for processing. None-the-less there are increasing numbers of research papers proposing or using such an architecture [84][85][86][87][88][89][90][91]. The Floodlight controller firewall module is an implemented example of a stateless firewall that passes rules to switches based on an ACL list.…”

Section: Firewalls -An Example Network Function In Sdnmentioning

confidence: 99%

Applying Formal Modelling to the Specification and Testing of SDN Network Functionality

Stevens¹

0

View full text Add to dashboard Cite

<p>Software Defined Networks offers a new paradigm to manage networks, one that favors centralised control over the distributed control used in legacy networks. This brings network operators potential efficiencies in capital investment, operating costs and wider choice in network appliance providers. We explore in this research whether these efficiencies apply to all network functionality by applying formal modelling to create a mathematically rigourous model of a service, a firewall, and using that model to derive tests that are ultimately applied to two SDN firewalls and a legacy stateful firewall. In the process we discover the only publicly available examples of SDN firewalls are not equivalent to legacy stateful firewalls and in fact create a security flaw that may be exploited by an attacker.</p>

show abstract

“…However examining surveys of existing research also led to questioning the assertion repeated by many researchers (see Appendix A) that all network functionality should be moved out of the forwarding plane into the control plane. That this view is influential is reflected in the increasing numbers of research papers proposing or using such an architecture to provide SDN security [84][85][86][87][88][89][90][91]. Throughout the course of this research the author has sought to clarify the blanket assertion that network functions should be purged from the forwarding plane and has demonstrated that such a blanket approach is flawed.…”

Section: Resultsmentioning

confidence: 99%

“…They instead efficiently pass attack traffic to the controller for processing. None-the-less there are increasing numbers of research papers proposing or using such an architecture [84][85][86][87][88][89][90][91]. The Floodlight controller firewall module is an implemented example of a stateless firewall that passes rules to switches based on an ACL list.…”

Section: Firewalls -An Example Network Function In Sdnmentioning

confidence: 99%

Applying Formal Modelling to the Specification and Testing of SDN Network Functionality

Stevens¹

0

View full text Add to dashboard Cite

<p>Software Defined Networks offers a new paradigm to manage networks, one that favors centralised control over the distributed control used in legacy networks. This brings network operators potential efficiencies in capital investment, operating costs and wider choice in network appliance providers. We explore in this research whether these efficiencies apply to all network functionality by applying formal modelling to create a mathematically rigourous model of a service, a firewall, and using that model to derive tests that are ultimately applied to two SDN firewalls and a legacy stateful firewall. In the process we discover the only publicly available examples of SDN firewalls are not equivalent to legacy stateful firewalls and in fact create a security flaw that may be exploited by an attacker.</p>

show abstract