Securing ARP in Software Defined Networks

Alharbi, Talal; Durando, Dario; Pakzad, Farzaneh; Portmann, Marius

doi:10.1109/lcn.2016.83

Cited by 24 publications

(22 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…There are two ways of handling ARP in SDN. These two ways are called as Proxy ARP and Regular ARP [4,5,21]. We will explain the working of both these types in this section.…”

Section: Arp Handling In Sdnmentioning

confidence: 99%

“…However, in regular ARP, the learning switch application on the Controller installs two flows on the switches, i.e., one flow related to source MAC and second is related to destination MAC. This reduces the traffic from switches to the Controller [4,5,21]. Regular ARP handling is supported by a few Controllers, e.g., Faucet [22].…”

Section: Regular Arpmentioning

confidence: 99%

“…The Controller builds and maintains a database of IP-MAC address bindings and on receiving ARP request sends an ARP reply as an OpenFlow Packet-Out message, which is ultimately delivered by the switch to the host attached to the corresponding port [4,5]. Proxy ARP technique is widely used by many SDN Controllers, e.g., Python-based OpenFlow Controller (POX), RYU and Open Network Operating System (ONOS) [21]. Proxy ARP in SDN is shown in Figure 3…”

Section: Proxy Arpmentioning

confidence: 99%

“…ARP Cache poisoning attack in SDN can be carried out against both Proxy ARP and Regular ARP [4,5,21]. In this subsection, we will discuss how attacker can carry out the attack in both cases.…”

Section: Arp Cache Poisoning In Sdnmentioning

confidence: 99%

See 3 more Smart Citations

Mitigating ARP Cache Poisoning Attack in Software-Defined Networking (SDN): A Survey

Shah

Cosgrove

2019

Electronics

View full text Add to dashboard Cite

Address Resolution Protocol (ARP) is a widely used protocol that provides a mapping of Internet Protocol (IP) addresses to Media Access Control (MAC) addresses in local area networks. This protocol suffers from many spoofing attacks because of its stateless nature and lack of authentication. One such spoofing attack is the ARP Cache Poisoning attack, in which attackers poison the cache of hosts on the network by sending spoofed ARP requests and replies. Detection and mitigation of ARP Cache Poisoning attack is important as this attack can be used by attackers to further launch Denial of Service (DoS) and Man-In-The Middle (MITM) attacks. As with traditional networks, an ARP Cache Poisoning attack is also a serious concern in Software Defined Networking (SDN) and consequently, many solutions are proposed in the literature to mitigate this attack. In this paper, a detailed survey on various solutions to mitigate ARP Cache Poisoning attack in SDN is carried out. In this survey, various solutions are classified into three categories: Flow Graph based solutions; Traffic Patterns based solutions; IP-MAC Address Bindings based solutions. All these solutions are critically evaluated in terms of their working principles, advantages and shortcomings. Another important feature of this survey is to compare various solutions with respect to different performance metrics, e.g., attack detection time, ARP response time, calculation of delay at the Controller etc. In addition, future research directions are also presented in this survey that can be explored by other researchers to propose better solutions to mitigate the ARP Cache Poisoning attack in SDN.

show abstract

“…There are two ways of handling ARP in SDN. These two ways are called as Proxy ARP and Regular ARP [4,5,21]. We will explain the working of both these types in this section.…”

Section: Arp Handling In Sdnmentioning

confidence: 99%

Section: Regular Arpmentioning

confidence: 99%

Section: Proxy Arpmentioning

confidence: 99%

Section: Arp Cache Poisoning In Sdnmentioning

confidence: 99%

See 2 more Smart Citations

Mitigating ARP Cache Poisoning Attack in Software-Defined Networking (SDN): A Survey

Shah

Cosgrove

2019

Electronics

View full text Add to dashboard Cite

show abstract

“…However, the solution is implemented as a controller application, which introduces latency due to [17] Reactive SPHINX [15] Reactive LineSwitch [18] Reactive/Proactive SecureBinder [6] Reactive (uses TopoGuard) OFMTL-SEC Reactive/Proactive the control communication. Similarly, SARP NAT [19] is a control plane based solution to ARP spoofing by sanitizing the ARP requests and checking the legitimacy of ARP replies. More generally, DoS on the control channel, also known as the control plane saturation attack, has been highlighted in [18], [20].…”

Section: B Sdn Attacks and Protection Mechanismsmentioning

confidence: 99%

OFMTL-SEC: State-based Security for Software Defined Networks

Scott-Hayward

Arumugam

2018

2018 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN)

View full text Add to dashboard Cite

Dynamic network security services have been proposed exploiting the benefits of Software Defined Networking (SDN) and Network Functions Virtualization (NFV) technologies. However, many of these services rely on controller interaction, which presents a performance and scalability challenge, and a threat vector. To overcome the performance issue, stateful data-plane designs have been proposed. Unfortunately, these solutions do not offer protection from attacks that exploit the SDN implementation of network functions such as topology and path update, or services such as the Address Resolution Protocol (ARP). In this work, we propose state-based SDN security protection mechanisms. Our stateful security data plane solution, OFMTL-SEC, is designed to provide protection against attacks on SDN and traditional network services. Specifically, we present a novel data plane protection against configuration-based attacks in SDN and against ARP spoofing. OFMTL-SEC is compared with the state-of-the-art solutions and offers increased security to SDNs with negligible performance impact.

show abstract