Securing SDN-Controlled IoT Networks Through Edge Blockchain

Abstract

The Internet of Things (IoT) connected by Software Defined Networking (SDN) promises to bring great benefits to cyber-physical systems. However, the increased attack surface offered by the growing number of connected vulnerable devices and separation of SDN control and data planes could overturn the huge benefits of such a system. This paper addresses the vulnerability of the trust relationship between the control and data planes. To meet this aim, we propose an edge computing based blockchain-as-a-service (BaaS), enabled by an external BaaS provider. The proposed solution provides verification of inserted flows through an efficient, edge-distributed, blockchain solution. We study two scenarios for the blockchain reward purpose: (a) information symmetry, in which the SDN operator has direct knowledge of the real effort spent by the BaaS provider; and (b) information asymmetry, in which the BaaS provider controls the exposure of information regarding spent effort. The latter yields the so called "moral hazard", where the BaaS may claim higher than actual effort. We develop a novel mathematical model of the edge BaaS solution; and propose an innovative algorithm of a fair reward scheme based on game theory that takes into account moral hazard. We evaluate the viability of our solution through analytical simulations. The results demonstrate the ability of the proposed algorithm to maximize the joint profits of the BaaS and the SDN operator, i.e. maximizing the social welfare.

Hybrid Blockchain for IoT—Energy Analysis and Reward Plan

“…In our H-chain solution, the leading BCA in each organisation is in charge of public information verification. Our earlier work [ 28 ] introduced a single-organisation, PBFT-based, workflow in which leading BCAs run a permissioned-PoW once there is a new block. In this paper, we extend this approach to both PBFT- and PoW-based consensus, applicable across not only single but also multiple organisations.…”

“…Again we use the scenario of an IoT scenario with secured SDN to illustrate the workflow, but it could equally apply to any data/process verification. The workflow proceeds as follows: Leading BCAs collect the new data, for example, SDN flow rule [ 28 ], that is ready for verification, and build a block. We define the computational latency of this step as , where the latency is proportional to the blocksize s .…”

“…Leading BCAs collect the new data, for example, SDN flow rule [ 28 ], that is ready for verification, and build a block. We define the computational latency of this step as , where the latency is proportional to the blocksize s .…”

“…Then, all the BCAs begin with the verification that incurs a verification latency . For example, in our SDN/IoT scenario, BCAs conduct verification of the new SDN-flow as new data according to pre-defined flow conformance policy [ 28 ]. Another all-to-all ACK messages exchanging happens to confirm the verification result, which is similar to Step 3 ( and ).…”

“…Then, all the BCAs begin with the verification that incurs a verification latency . For example, in our SDN/IoT scenario, BCAs conduct verification of the new SDN-flow as new data according to pre-defined flow conformance policy [ 28 ].…”