SIMPLE-fying middlebox policy enforcement using SDN

Qazi, Zafar Ayyub; Tu, Cheng-Chun; Chiang, Luis; Miao, Rui; Sekar, Vyas; Yu, Minlan

doi:10.1145/2486001.2486022

Cited by 569 publications

(312 citation statements)

References 25 publications

Supporting

Mentioning

302

Contrasting

Unclassified

Order By: Relevance

“…Gibb et al [9] present a similar approach where a cloud-based architecture is designed for outsourcing network functionalities using SDN. Regarding the chaining of such network functionalities, Qazi et al introduces SIMPLE [10], a policy enforcement layer based on SDN and flow correlation for middlebox traffic steering. In the same vein, Fayazbakhsh et al propose Flowtags [11], an architecture where middleboxes are extended to support OpenFlow and to deal with dynamic middlebox flow mangling.…”

Section: Related Workmentioning

confidence: 99%

Automated verification of security chains in software-defined networks with synaptic

Schnepf¹,

Badonnel²,

Lahmadi³

et al. 2017

2017 IEEE Conference on Network Softwarization (NetSoft)

View full text Add to dashboard Cite

Software-defined networks provide new facilities for deploying security mechanisms dynamically. In particular, it is possible to build and adjust security chains to protect the infrastructures, by combining different security functions, such as firewalls, intrusion detection systems and services for preventing data leakage. It is important to ensure that these security chains, in view of their complexity and dynamics, are consistent and do not include security violations. We propose in this paper an automated strategy for supporting the verification of security chains in software-defined networks. It relies on an architecture integrating formal verification methods for checking both the control and data planes of these chains, before their deployment. We describe algorithms for translating specifications of security chains into formal models that can then be verified by Satisfiability Modulo Theories (SMT) solving or model checking. Our solution is prototyped as a package, named Synaptic, built as an extension of the Frenetic family of SDN programming languages. The performances of our approach are evaluated through extensive experimentations based on the CVC4, veriT, and nuXmv checkers.

show abstract

Section: Related Workmentioning

confidence: 99%

Automated verification of security chains in software-defined networks with synaptic

Schnepf¹,

Badonnel²,

Lahmadi³

et al. 2017

2017 IEEE Conference on Network Softwarization (NetSoft)

View full text Add to dashboard Cite

show abstract

“…Additionally, in traditional networks the lack of a centralized control of these security functions can further complicate their deployment [61]. In contrast, SDN enables the implementation of applications that have the ability to support similar security functions in a much more flexible manner, and it offers a suitable place for the implementation of more accurate, reliable 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 Qazi et al [84] and efficient security solutions. Table 3 presents the major research efforts addressing security in SDN.…”

Section: Securitymentioning

confidence: 99%

“…Firewalls are an example of network application that can be fully assisted by SDN because: (i) the need of additional middleboxes to enforce policies in the network is reduced because this functionality can be placed in the SDN control plane; (ii) the con -1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 trol plane has a comprehensive view of the network; and (iii) the management of heterogeneous devices is abstracted by the control plane. Also, Qazi et al [84] present a policy security monitoring layer for efficient middlebox-specific traffic steering. Another work that goes in this direction is proposed by Son et al [85].…”

Section: Securitymentioning

confidence: 99%

“…In scenarios where the network controller is usually overloaded, such solutions serve as an efficient alternative to avoid communication latency. To enforce capabilities related to policy management in the performance context, Qazi et al [84] propose the use of middleboxes orchestrated by SIMPLE, a policy enforcement layer in the control plane. Additionally, the specification of packet-forwarding policies can be assisted by highlevel languages, such as those proposed by Voellmy et al [125] and Foster et al [126].…”

Section: Legitimate Trafficmentioning

confidence: 99%

See 1 more Smart Citation

Resilience support in software-defined networking: A survey

et al. 2015

View full text Add to dashboard Cite

Software-Defined Networking (SDN) is an architecture for computer networking that provides a clear separation between network control functions and forwarding operations. The abstractions supported by this architecture are intended to simplify the implementation of several tasks that are critical to network operation, such as routing and network management. Computer networks have an increasingly important societal role, requiring them to be resilient to a range of challenges. Previously, research into network resilience has focused on the mitigation of several types of challenges, such as natural disasters and attacks. Capitalising on its benefits, including increased programmability and a clearer separation of concerns, significant attention has recently focused on the development of resilience mechanisms that use software-defined networking approaches. In this article, we present a survey that provides a structured overview of the resilience support that currently exists in this important area. We categorize the most recent research on this topic with respect to a number of resilience disciplines. Additionally, we discuss the lessons learned from this investigation, highlight the main challenges faced by SDNs moving forward, and outline the research trends in terms of solutions to mitigate these challenges . 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 This article presents a survey on the support for network resilience in SoftwareDefined Networking (SDN). This has been the subject of intense investigation by the academic and industrial community in the past few years, as evidenced by the number of papers included in our survey (159 references in total). Capitalizing on the benefits of SDN, including increased programmability and a clearer separation of concerns, significant attention has recently focused on the development of resilience mechanisms that use software-defined networking approaches. Thus, a wide range of solutions to classical network problems have been revisited using this architecture, but many problems continue to be challenging.Our survey investigates the resilience support that currently exists in this important area, and categorizes the most recent research on this topic with respect to a number of resilience disciplines. Additionally, we discuss the lessons learned from this investigation, highlight the main challenges faced by SDNs moving forward, and outline the research trends in terms of solutions to mitigate these challenges. The aim of the survey is to offer to the reader a structured view of network resilience in the SDN spectrum, and how resilience aspects are supported in these architectures.We believe that this subject material is closely aligned with the objectives of the journal. Please be assured that:1. This paper has not been published or accepted for publication w...

show abstract

“…For instance, recent work has demonstrated that OpenFlow can help deploying security policies in the network [8], performing dynamic load-balancing [9], [10], implementing network intrusion detection/prevention [11], performing secure end-to-end network measurements [12], etc.…”

Section: Introductionmentioning

confidence: 99%

Towards a Richer Set of Services in Software-Defined Networks

Bifulco¹,

Karame²

2014

Proceedings 2014 Workshop on Security of Emerging Networking Technologies

View full text Add to dashboard Cite

Abstract-Software-Defined Networking (SDN) has drawn increasing attention from both industry and academia, owing to its premise to simplify the management and control over large networks. While the SDN technology was initially deployed within datacenters, there are currently early deployments of SDN in Wide-Area Networks; SDN is further envisioned to be deployed in the near future within fixed and mobile networks.In this paper, we show that the envisioned deployment of SDN within operator networks opens the doors to novel network security services that the operators can efficiently offer. More specifically, we propose in this work two exemplary operator services; our first solution enables the construction of secure location proofs for registered network users. Our second solution offers users the possibility to request the setup of network paths that are tailored to their specific security constraints, e.g., that only cross domains regulated by appropriate legislations which match their security policies. We show that this can be securely and efficiently attained by leveraging basic functionality from the OpenFlow protocol. In this respect, we evaluate the feasibility of our proposals by means of implementation within a realistic testbed composed of hardware OpenFlow-enabled switches; our findings suggest that our proposals can be deployed with minimal overhead within existing SDN-enabled networks.

show abstract

SIMPLE-fying middlebox policy enforcement using SDN

Cited by 569 publications

References 25 publications

Automated verification of security chains in software-defined networks with synaptic

Automated verification of security chains in software-defined networks with synaptic

Resilience support in software-defined networking: A survey

Towards a Richer Set of Services in Software-Defined Networks

Contact Info

Product

Resources

About