A survey on OpenFlow-based Software Defined Networks: Security challenges and countermeasures

Journal of Network and Computer Applications

Volumn 68, Issue , 2016, Pages 126-139

  Li, Wenjuan ^a   Meng, Weizhi ^a,b   Kwok, Lam For ^a  

^a CITY UNIVERSITY OF HONG KONG   (Hong Kong)

^b INSTITUTE FOR INFOCOMM RESEARCH   (Singapore)

Author keywords

Control and data planes; OpenFlow; Review and survey; Security challenges and countermeasures; Software Defined Networking

Indexed keywords

DENIAL-OF-SERVICE ATTACK; NETWORK ARCHITECTURE; SOFTWARE DEFINED NETWORKING; SURVEYS;

DATA PLANES; DENIAL OF SERVICE; DESIGN AND IMPLEMENTS; NETWORK FUNCTIONS; OPENFLOW; PROGRAMMABLE NETWORK; SECURITY CHALLENGES; SOFTWARE DEFINED NETWORKING (SDN);

NETWORK SECURITY;

EID: 84964587049     PISSN: 10848045     EISSN: 10958592     Source Type: Journal    
DOI: 10.1016/j.jnca.2016.04.011     Document Type: Review

References (79)

1. Al-Shaer, E., Al-Haj, S., 2010. FlowChecker: configuration analysis and verification of federated openflow infrastructures. In: Proceedings of the 3rd ACM Workshop on Assurable and Usable Security Configuration, Chicago, IL, USA, pp. 37-44.
2. I. Alsmadi, and D. Xu Security of software defined networks: a survey Comput. Secur. 53 2015 79 108
3. Benton, K., Camp, L.J., Small, C., 2013. OpenFlow vulnerability assessment. In: Proceedings of the 2nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking (HotSDN), Hong Kong, China, pp. 151-152.
4. Bifulco, R., Karame, G.O., 2014. Towards a richer set of services in software-defined networks. In: Proceedings of SENT, San Diego, CA, USA.
5. Braga, R., Mota, E., Passito, A., 2010. Lightweight DDoS flooding attack detection using NOX/OpenFlow. In: Proceedings of the 35th Conference on Local Computer Networks (LCN), Denver, Colorado, USA, pp. 408-415.
6. Beacon: Java-Based OpenFlow Controller < https://openflow.stanford.edu/display/Beacon/Home >.
7. Canini, M., Venzano, D., Perešíni, P., Kostić, D., Rexford, J., 2012. A nice way to test OpenFlow applications. In: Proceedings of the 9th USENIX Conference on Networked Systems Design and Implementation (NSDI), San Jose, CA, USA, pp. 1-14.
8. Casado, M., Garfinkel, T., Akella, A., Freedman, M.J., Boneh, D., McKeown, N., Shenker, S., 2006. SANE: a protection architecture for enterprise networks. In: Proceedings of USENIX Security Symposium, Vancouver, BC, Canada, pp. 1-15.
9. Casado, M., Freedman, M.J., Pettit, J., Luo, J., McKeown, N., Shenker, S., 2007. Ethane: taking control of the enterprise. In: Proceedings of the 2007 ACM SIGCOMM. Kyoto, Japan, pp. 1-12.
10. Cisco: Software Defined Networking (SDN), 2015 < http://www.cisco.com/web/solutions/trends/sdn/index.html >.
11. Crenshaw, A., 2012. Security and Software Defined Networking: Practical Possibilities and Potential Pitfalls. Available online < http://www.irongeek.com/i.php?page=security/security-and-software-defined-networking-sdn-openflow >.
12. Dover, J., 2013. A Denial of Service Attack Against the Open Floodlight SDN Controller. Dover Networks, Research Report.
13. H. Farhady, H. Lee, and A. Nakao Software-defined networking: a survey Comput. Netw. 81 2015 79 95
14. Fayazbakhsh, S.K., Sekar, V., Yu, M., Mogul, J.C., 2013. FlowTags: enforcing network-wide policies in the presence of dynamic middlebox actions. In: Proceedings of the 2nd ACM Workshop on Hot Topics in Software Defined Networks (HotSDN), pp. 19-24.
15. Feng, T., Bi, J., Hu, H., 2011. OpenRouter: openflow extension and implementation based on a commercial router. In: Proceedings of the 19th IEEE International Conference on Network Protocols (ICNP), Vancouver, BC, pp. 141-142.
16. Feng, T., Bi, J., Hu, H., Yao, G., Xiao, P., 2012. InSAVO: Intra-AS IP source address validation solution with OpenRouter. In: Proceedings of INFOCOM.
17. S. Fichera, L. Galluccio, S.C. Grancagnolo, G. Morabito, and S. Palazzo OPERETTA: an openflow-based remedy to mitigate TCP SYNFLOOD attacks against web servers Comput. Netw 92 2015 89 100
18. Floodlight: Apache-Licensed, Java-Based OpenFlow Controller < http://www.projectfloodlight.org/floodlight/ gt;.
19. K. Greenk TR10: software-defined networking MIT Technol. Rev. 112 2 2009 54
20. N. Gude, T. Koponen, J. Pettit, B. Pfaff, M. Casado, N. McKeown, and S. Shenker NOX: towards an operating system for networks ACM Comput. Commun. Rev. 51 7 2008 105 110
21. Hampel, G., Steiner, M., Bu, T., 2013. Applying software-defined networking to the telecom domain. In: Proceedings of 2013 IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS), Turin, Italy, pp. 133-138.
22. A. Hakiri, A. Gokhale, P. Berthou, D.C. Schmidt, and T. Gayraud Software-defined networking: challenges and research opportunities for future internet Comput. Netw. 75 2014 453 471
23. Hong, S., Xu, L., Wang, H., Gu, G., 2015. Poisoning network visibility in software-defined networks: new attacks and countermeasures. In: Proceedings of NDSS, San Diego, USA.
24. F. Hu, Q. Hao, and K. Bao A survey on software-defined network and OpenFlow: from concept to implementation IEEE Commun. Surv. Tutor. 16 4 2014 2181 2206
25. Hu, H., Han, W., Ahn, G.-J., Zhao, Z., 2014. FLOWGUARD: building robust firewalls for software-defined networks. In: Proceedings of the 3rd Workshop on Hot Topics in Software Defined Networking (HotSDN), Chicago, Illinois, USA, pp. 97-102.
26. IRIS < https://github.com/bjlee72/IRIS >.
27. M. Jammal, T. Singh, A. Shami, R. Asal, and Y. Li Software defined networking: state of the art and research challenges Comput. Netw. 72 2014 74 98
28. N.A. Jagadeesan, and B. Krishnamachari Software-defined networking paradigms in wireless networks: a survey ACM Comput. Surv. 47 2 2015
29. Jafarian, J.H., Al-Shaer, E., Duan, Q., 2012. Openflow random host mutation: transparent moving target defense using software defined networking. In: Proceedings of the ACM Workshop on Hot Topics in Software Defined Networks (HotSDN), Helsinki, Finland, pp. 127-132.
30. Jaxon < http://jaxon.onuos.org/ >.
31. Kampanakis, P., Perros, H., Beyene, T., 2014. SDN-based solutions for moving target defense network protection. In: Proceedings of the 2014 IEEE 15th International Symposium on a World of Wireless, Mobile and Multimedia Networks (WoWMoM), Sydney, NSW, pp. 1-6.
32. Kamisinski, A., Fung, C., 2015. FlowMon: detecting malicious switches in software-defined networks. In: Proceedings of the 2015 Workshop on Automated Decision Making for Active Cyber Defense (SafeConfig).
33. Khurshid, A., Zhou, W., Caesar, M., Godfrey, P.B., 2012. VeriFlow: verifying network-wide invariants in real time. In: Proceedings of the 1st Workshop on Hot Topics in Software Defined Networks (HotSDN), Helsinki, Finland, pp. 49-54.
34. Kloeti, R., Vasileios, K., Paul, S., 2013. OpenFlow: a security analysis. In: Proceedings of the 21st IEEE International Conference on Network Protocols (ICNP), Gottingen, German, pp. 1-6.
35. Kotani, D., Okabe, Y., 2014. A packet-in message filtering mechanism for protection of control plane in openflow networks. In: Proceedings of the 10th ACM/IEEE Symposium on Architectures for Networking and Communications Systems (ANCS), pp. 29-40.
36. Kreutz, D., Ramos, F.M.V., Verissimo, P., 2013. Towards secure and dependable software-defined networks. In: Proceedings of the 2nd ACM Workshop on Hot Topics in Software Defined Networking (HotSDN), Hong Kong, China, pp. 55-60.
37. A. Lara, A. Kolasani, and B. Ramamurthy Network innovation using openflow: a survey IEEE Commun. Surv. Tutor. 16 1 2014 493 512
38. Lara, A., Ramamurthy, B., 2014. OpenSec: a framework for implementing security policies using OpenFlow. In: Proceedings of the IEEE Global Communications Conference (GLOBECOM), Austin, Texas, pp. 781-786.
39. Li, L.E., Mao, Z.M., Rexford, J., 2012. Toward software-defined cellular networks. In: Proceedings of 2012 European Workshop on Software Defined Networking (EWSDN), Darmstadt, Germany, pp. 7-12.
40. Liyanage, M., Ylianttila, M., Gurtov, A., 2014. Securing the control channel of software-defined mobile networks. In: Proceedings of the 2014 IEEE 15th International Symposium on World of Wireless, Mobile and Multimedia Networks (WoWMoM), Sydney, Australia, pp. 1-6.
41. J. Liu, Y. Li, H. Wang, D. Jin, L. Su, L. Zeng, and T. Vasilakos Leveraging software-defined networking for security policy enforcement Inf. Sci. 327 2016 288 299
42. T. Luo, H.P. Tan, and T.Q.S. Quek Sensor OpenFlow: enabling software-defined wireless sensor networks IEEE Commun. Lett. 16 11 2012 1896 1899
43. Matias, J., Borja, T., Alaitz, M., Jacob, E., Nerea, T., 2012. Implementing layer 2 network virtualization using OpenFlow: challenges and solutions. In: Proceedings of the 2012 European Workshop on Software Defined Networking, pp. 30-35.
44. Matias, J., Garay, J., Mendiola, A., Toledo, N., Jacob, E., 2014. FlowNAC: flow-based network access control. In: Proceedings of the 3rd European Workshop on Software Defined Networks (EWSDN), Budapest, pp. 79-84.
45. Mehdi, S.A., Khalid, J., Khayam, S.A., 2011. Revisiting traffic anomaly detection using software defined networking. In: Proceedings of the 14th International Conference on Recent Advances in Intrusion Detection (RAID), Menlo Park, California, pp. 161-180.
46. Mendonca, M., Seetharaman, S., Obraczka, K., 2012. A flexible innetwork IP anonymization service. In: Proceedings of the 2012 IEEE International Conference on Communications (ICC), Ottawa, ON, pp. 6651-6656.
47. W. Meng, W. Li, and L.F. Kwok EFM: enhancing the performance of signature-based network intrusion detection systems using enhanced filter mechanism Comput. Secur. 43 2014 189 204
48. Maestro Project < http://zhengcai.github.io/maestro-platform/ >.
49. Nayak, A.K., Reimers, A., Feamster, N., Clark, R., 2009. Resonance: dynamic access control for enterprise. In: Proceedings of the 1st ACM Workshop on Research on Enterprise Networking (WREN), Barcelona, Spain, pp. 11-18.
50. Open Networking Foundation, 2012. Sofware-Defined Networking: The New Norm for Networks. White Paper, April < https://www.opennetworking.org/images/stories/downloads/sdn-resources/white-papers/wp-sdn-newnorm.pdf >.
51. OpenFlow Switch Specification Version 1.5.0, 2014. Technical Report, December 19 < https://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-switch-v1.5.0.noipr.pdf >.
52. K. Pentikousis, Y. Wang, and W. Hu Mobileflow: toward software-defined mobile networks IEEE Commun. Mag. 51 7 2013 44 53
53. Porras, P., Shin, S., Yegneswaran, V., Fong, M., Tyson, M., Gu, G., 2012. A Security Enforcement Kernel for OpenFlow Networks. In: Proceedings of the 1st Workshop on Hot topics in Software Defined Networks (HotSDN), pp. 121-126.
54. Perrin, C., 2012. The CIA Triad, Retrieved May 31 < http://www.techrepublic.com/blog/it-security/the-cia-triad/ >.
55. POX: A Python-Based OpenFlow Controller < https://github.com/noxrepo/pox >.
56. RouteFlow Open Source Project < https://sites.google.com/site/routeflow/home >.
57. Ryu < https://github.com/osrg/ryu >.
58. Scott, H., 2014. SDN Security Attack Vectors and SDN Hardening. Available online < http://www.networkworld.com/article/2840273/sdn/ >.
59. Scott-Hayward, S., O'Callaghan, G., Sezer, S., 2013. SDN security: a survey. In: Proceedings of the 2013 IEEE SDN for Future Networks and Services (SDN4FNS), Trento, pp. 1-7.
60. Shirali-Shahreza, S., Ganjali, Y., 2013. Efficient implementation of security applications in OpenFlow controller with FleXam. In: Proceedings of the 2nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking (HotSDN), Hong Kong, pp. 167-168.
61. Schehlmann, L., Harald, B., 2013. COFFEE: a concept based on OpenFlow to filter and erase events of botnet activity at highspeed nodes. In: Proceedings of INFORMATIK, Darmstadt.
62. Seeber, S., Rodosek, G.D., 2015. In: Proceedings of the 9th International Conference on Autonomous Infrastructure, Management, and Security (AIMS), Ghent, Belgium, pp. 134-139.
63. Sherwood, R., Gibb, G., Yap, K.-K., Appenzeller, G., Casado, M., McKeown, N., Parulkar, G., 2010. Can the production network be the testbed. In: Proceedings of the 9th USENIX conference on Operating systems design and implementation (OSDI), Vancouver, BC, pp. 1-6.
64. Shin, S., Gu, G., 2012. CloudWatcher: network security monitoring using OpenFlow in dynamic cloud networks. In: Proceedings of the 20th IEEE International Conference on Network Protocols (ICNP), Austin, TX, pp. 1-6.
65. Shin, S., Porras, P., Yegneswaran, V., Fong, M., Gu, G., Tyson, M., 2013. FRESCO: modular composable security services for software-defined networks. In: Proceedings of the ISOC Network and Distributed System Security Symposium (NDSS), San Diego, California, USA, pp. 1-16.
66. Shin, S., Gu, G., 2013. Attacking software-defined networks: a first feasibility study. In: Proceedings of the 2nd Workshop on Hot Topics in Software Defined Networks (HotSDN), Hong Kong, China, pp. 165-166.
67. Shin, S., Yegneswaran, V., Porras, P., Gu, G., 2013. AVANT-GUARD: scalable and vigilant switch flow management in software-defined networks. In: Proceedings of ACM SIGSAC Conference on Computer and Communications Security (CCS), ACM Press, Berlin, Germany, pp. 413-424.
68. Sonchack, J., Aviv, A.J., Keller, E., Smith, J.M., 2015. OFX: enabling openflow extensions for switch-level security applications (POSTER). In: Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security (CCS).
69. Suh, J., Choi, H., Yoon, W., You, T., Kwon, T., Choi, Y., 2010. Implementation of content-oriented networking architecture (CONA): a focus on DDoS countermeasure. In: Proceedings of the 1st European NetFPGA Developers Workshop, ACM Press, Cambridge, UK, pp. 1-5.
70. SNAC < https://github.com/bigswitch/snac >.
71. Tavakoli, A., Casado, M., Koponen, T., Shenker, S., 2009. Applying NOX to the datacenter. In: Proceedings of HotNet. ACM Press, New York City, NY, pp. 1-6.
72. Tootoonchian, A., Ganjali, Y., 2010. HyperFlow: a distributed control plane for openflow. In: Proceedings of the Internet Network Management Workshop/Workshop on Research on Enterprise Networking (INM/WREN). Usenix, San Jose, CA, pp. 1-6.
73. Wang, H., Xu, L., Gu, G., 2014. OF-GURAD: A DoS Attack Prevention Extension in Software-Defined Networks. ONS
74. Wang, H., Xu, L., Gu, G., 2015. FloodGuard: a DoS attack prevention extension in software-defined networks. In: Proceedings of the International Conference on Dependable Systems and Networks (DSN), pp. 239-250.
75. Wen, X., Chen, Y., Hu, C., Shi, C., Wang, Y., 2013. Towards a secure controller platform for openflow applications. In: Proceedings of the 2nd ACM Workshop on Hot Topics in Software Defined Networking (HotSDN), Hong Kong, China, pp. 171-172.
76. Xiao, P., Bi, J., Feng, T., 2013. O-CPF: an OpenFlow based intra-AS source address validation application. In: Proceedings of CFI, Beijing, China.
77. Yamasaki, Y., Miyamoto, Y., Yamato, J., Goto, H., 2011. Flexible access management system for campus VLAN based on OpenFlow. In: Proceedings of 2011 IEEE/IPSJ 11th International Symposium on Applications and the Internet (SAINT), Munich, Germany, pp. 347-351.
78. Yao, G., Bi, J., Xiao, P., 2011. Source address validation solution with OpenFlow/NOX architecture. In: Proceedings of the IEEE International Conference on Network Protocols (ICNP), Vancouver, BC, Canada, pp. 7-12.
79. Yuzawa, T., 2013. OpenFlow 1.0 Actual Use-Case: RTBH of DDoS Traffic While Keeping the Target.