The (in)security of Topology Discovery in Software Defined Networks

Alharbi, Talal; Portmann, Marius; Pakzad, Farzaneh

doi:10.1109/lcn.2015.7366363

Cited by 62 publications

(57 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Today's controllers use OpenFlow discovery protocol (OFDP) which leverages link layer discovery protocol (LLDP) to detect internal links between switches. However, as previous studies pointed out [5,19], OFDP is vulnerable to link fabrication attack due to absence of LLDP message authentication.…”

Section: Integrity Issuesmentioning

confidence: 94%

NOSArmor: Building a Secure Network Operating System

Nam

Shin

2018

Security and Communication Networks

View full text Add to dashboard Cite

Software-Defined Networking (SDN), controlling underlying network devices (i.e., data plane) in a logically centralized manner, is now actively adopted in many real world networking environments. It is clear that a network administrator can easily understand and manage his networking environments with the help of SDN. In SDN, a network operating system (NOS), also known as an SDN controller, is the most critical component because it should be involved in all transactions for controlling network devices, and thus the security of NOS cannot be highly exaggerated. However, in spite of its importance, no previous works have thoroughly investigated the security of NOS. In this work, to address this problem, we present the NOSArmor, which integrates several security mechanisms, named as security building block (SBB), into a consolidated SDN controller. NOSArmor consists of eight SBBs and each of them addresses different security principles of network assets. For example, while role-based authorization focuses on securing confidentiality of internal storage from malicious applications, OpenFlow protocol verifier protects availability of core service in the controller from malformed control messages received from switches. In addition, NOSArmor shows competitive performance compared to existing other controllers (i.e., ONOS, Floodlight) with secureness of network assets.

show abstract

Section: Integrity Issuesmentioning

confidence: 94%

NOSArmor: Building a Secure Network Operating System

Nam

Shin

2018

Security and Communication Networks

View full text Add to dashboard Cite

show abstract

“…1) Security of OFDP: The authors of [21], [22], [23], and [24] show that OFDP is vulnerable to spoofing attacks. Injected LLDP control messages may create fake links that redirect traffic to the host of an attacker.…”

Section: Optimized Variants Of Ofdpmentioning

confidence: 99%

P4-MACsec: Dynamic Topology Monitoring and Data Layer Protection With MACsec in P4-Based SDN

et al. 2020

View full text Add to dashboard Cite

We propose P4-MACsec to protect network links between P4 switches through automated deployment of MACsec, a widespread IEEE standard for securing Layer 2 infrastructures. It is supported by switches and routers from major manufacturers and has only little performance limitations compared to VPN technologies such as IPsec. P4-MACsec introduces a data plane implementation of MACsec including AES-GCM encryption and decryption directly on P4 switches. P4-MACsec features a twotier control plane structure where local controllers running on the P4 switches interact with a central controller. We propose a novel secure link discovery mechanism that leverages protected LLDP frames and the two-tier control plane structure for secure and efficient management of a global link map. Automated deployment of MACsec creates secure channel, generates keying material, and configures the P4 switches for each detected link between two P4 switches. It detects link changes and performs rekeying to provide a secure, configuration-free operation of MACsec. In this paper, we review the technological background of P4-MACsec and explain its architecture. To demonstrate the feasibility of P4-MACsec, we implement it on the BMv2 P4 software switch and validate the prototype through experiments. We evaluate its performance through experiments that focus on TCP throughput and round-trip time. We publish the prototype and experiment setups on Github.

show abstract

“…Equation 8 indicates that the efficiency gained in ESLD is directly proportional to the ratio of hosts. And the overall packet reduction ratio G is calculated as…”

Section: Efficiency Promotionmentioning

confidence: 99%

“…Given the central control policy of SDNs, processing these packets may cause much workload of the controller. Meanwhile, attackers can poison the network topology visibility of the controller by forging or simply relaying link discovery packets . Thereby, an efficient and secure link discovery approach is quite crucial for the performance and reliability of SDNs.…”

Section: Introductionmentioning

confidence: 99%

ESLD: An efficient and secure link discovery scheme for software‐defined networking

Zhao

Yao

2018

Int J Communication

View full text Add to dashboard Cite

Summary Software‐defined networking simplifies network management by decoupling the control plane from the data plane and centralizing it to the controller. As the brain of the network, the controller gains up‐to‐date holistic network visibility via topology discovery. However, as a key service of topology discovery, the link discovery service opens problems on efficiency and security. On the one hand, sending link discovery packets to all ports wastes not only the limited controller resources (such as CPU and memory) but also control channel bandwidth. On the other hand, attackers may use these packets to create fake links and perform link fabrication attack. Because of the centralized control paradigm, wasting controller resources may degrade network performance, and all the fake links may severely poison the network topology, even causing the denial of service or man‐in‐the‐middle attack. In this paper, we propose an efficient and secure link discovery scheme to improve link discovery performance and resist link fabrication attack caused by the software‐defined networking link discovery service. By adopting port classification technique and directionally transmitting packets to appropriate ports, our approach can reduce or eliminate redundant packets and improve link discovery performance. Meanwhile, we adopt the directional packet transmitting approach and the time‐marked hash‐based message authentication code authenticate scheme to resist the link fabrication attack. A prototype system is implemented on the basis of POX controller and Mininet simulator to evaluate our scheme. Simulation results demonstrate that our scheme can solve the link fabrication problems with less overload of both the control plane and the data plane.

show abstract

The (in)security of Topology Discovery in Software Defined Networks

Cited by 62 publications

References 4 publications

NOSArmor: Building a Secure Network Operating System

NOSArmor: Building a Secure Network Operating System

P4-MACsec: Dynamic Topology Monitoring and Data Layer Protection With MACsec in P4-Based SDN

ESLD: An efficient and secure link discovery scheme for software‐defined networking

Contact Info

Product

Resources

About