Exploiting the Vulnerability of Flow Table Overflow in Software-Defined Network: Attack Model, Evaluation, and Defense

Abstract

As the most competitive solution for next-generation network, SDN and its dominant implementation OpenFlow are attracting more and more interests. But besides convenience and flexibility, SDN/OpenFlow also introduces new kinds of limitations and security issues. Of these limitations, the most obvious and maybe the most neglected one is the flow table capacity of SDN/OpenFlow switches. In this paper, we proposed a novel inference attack targeting at SDN/OpenFlow network, which is motivated by the limited flow table capacities of SDN/OpenFlow switches and the following measurable network performance decrease resulting from frequent interactions between data and control plane when the flow table is full. To the best of our knowledge, this is the first proposed inference attack model of this kind for SDN/OpenFlow. We implemented an inference attack framework according to our model and examined its efficiency and accuracy. The evaluation results demonstrate that our framework can infer the network parameters (flow table capacity and usage) with an accuracy of 80% or higher. We also proposed two possible defense strategies for the discovered vulnerability, including routing aggregation algorithm and multilevel flow table architecture. These findings give us a deeper understanding of SDN/OpenFlow limitations and serve as guidelines to future improvements of SDN/OpenFlow.

A Survey of the Main Security Issues and Solutions for the SDN Architecture

“…DoS attacks are launched from a single host, so their treatment can be easier, unlike DDoS attacks, which are launched through multiple hosts, usually botnets, and whose identification is more complex. Likewise, it has been observed that DoS attacks can be launched in conjunction with impersonation attacks, such as MAC or IP address spoofing [128], [129], or can even be triggered after an inference attack [130].…”

A Table Overflow LDoS Attack Defending Mechanism in Software-Defined Networks

“…In addition, under the attack of OpenFlow switch, the table overflow will be more serious, and how to deal with it is still a problem to be solved. Zhou et al proposed a strategy to build a new flow aggregation algorithm and a multilevel flow table architecture to defend against the overflow attack launched by the attacker [5]. Cao studied the effects of the LOFT (Low-Rate Flow Table ) overflow attacks on the SDN network, proposed a method for attackers to detect the SDN network configuration and build low-rate attack traffic, and gave two simple methods to prevent the network configuration detection [13].…”

“…However, the introduction of the new architecture also brings a lot of new problems [1], among which security is the most noteworthy, including the security of the data plane [2,3]. e data plane not only will be affected by existing attacks in traditional networks (such as DDoS attacks [4]) but will also bring new types of attacks due to its own architecture, the most typical of which are flow table overflow attacks [5,6].…”

A Systematic Treat Model for Software-Defined Networking

“…In response to the tampering threat, [23] proposed a method based on hierarchical protection to mitigate attacks against controller storage components. [53] proposed a route aggregation algorithm and a multi-level flow table structure, aiming to mitigate the vulnerability to flow table overflow. [24] proposed a defence framework, SPHINX, against network topology attacks and controller DoS attacks.…”