Flow Wars: Systemizing the Attack Surface and Defenses in Software-Defined Networks

IEEE/ACM Transactions on Networking

Volumn 25, Issue 6, 2017, Pages 3514-3530

  Yoon, Changhoon ^a   Lee, Seungsoo ^a   Kang, Heedo ^a   Park, Taejune ^a   Shin, Seungwon ^a   Yegneswaran, Vinod ^b   Porras, Phillip ^b   Gu, Guofei ^c  

^a Korea Advanced Institute of Science and Technology (KAIST)   (South Korea)

^b SRI INTERNATIONAL   (United States)

^c TEXAS A AND M UNIVERSITY   (United States)

Author keywords

network security; SDN security; Software defined network security

Indexed keywords

AVAILABILITY; COMPUTER SOFTWARE; NETWORK PROTOCOLS; SOFTWARE DEFINED NETWORKING; SWITCHES; TAXONOMIES;

AVAILABILITY MODELS; COMPUTING ENVIRONMENTS; CONTROLLER IMPLEMENTATION; DESIGN AND IMPLEMENTATIONS; NETWORK TOPOLOGY; RESEARCH AND DEVELOPMENT; SDN SECURITY; SECURITY;

NETWORK SECURITY;

EID: 85030678416     PISSN: 10636692     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNET.2017.2748159     Document Type: Article

References (63)

1. A Linux Foundation Collaborative Project. OpenDaylight SDN Controller. Accessed: Sep. 14, 2017. [Online]: Http://www.opendaylight.org
2. Arista. Arista 7050 Series. Accessed: Dec. 12, 2015. [Online]: Http://www.arista.com/en/products/7050-series/articletabs
3. R. Beckett, et al., "An assertion language for debugging SDN applications, " Proc. 3rd Workshop Hot Topics Softw. Defined Netw., 2014, pp. 91-96.
4. K. Benton, L. J. Camp, C. Small, "OpenFlow vulnerability assessment, " Proc. 2nd ACM SIGCOMM Workshop Hot Topics Softw. Defined Netw., 2013, pp. 151-152.
5. P. Berde, et al., "ONOS: Towards an open, distributed SDN OS, " Proc. 3rd Workshop Hot Topics Softw. Defined Netw., 2014, pp. 1-6.
6. P. Bosshart, et al., "P4: Programming protocol-independent packet processors, " ACM SIGCOMM Comput. Commun. Rev., vol. 44, no. 3, pp. 87-95, 2014.
7. M. Canini, D. Venzano, P. Perešíni, D. Kostíc, J. Rexford, "A NICE way to test OpenFlow applications, " Proc. Usenix Symp. Netw. Syst. Design Implement., Apr. 2012, pp. 1-14.
8. B. Chandrasekaran and T. Benson, "Tolerating SDN application failures with LegoSDN, " Proc. 3rd Workshop Hot Topics Softw. Defined Netw., 2014, pp. 235-236.
9. A. Cui and S. J. Stolfo, "A quantitative analysis of the insecurity of embedded network devices: Results of a wide-area scan, " Proc. 26th Annu. Comput. Secur. Appl. Conf., 2010, pp. 97-106.
10. A. R. Curtis, et al., "DevoFlow: Scaling flow management for highperformance networks, " ACM SIGCOMM Comput. Commun. Rev., vol. 41, no. 4, pp. 254-265, 2011.
11. J. M. Dover. A Denial of Service Attack Against the Open Floodlight SDN Controller. Accessed: Sep. 14, 2017. [Online]: Http://dovernetworks.com/wp-content/uploads/2013/12/OpenFloodlight-12302013.pdf
12. J. M. Dover. A Switch Table Vulnerability in the Open Floodlight SDN Controller. Accessed: Sep. 14, 2017. [Online]: Http://dovernetworks.com/wp-content/uploads/2014/03/OpenFloodlight-03052014.pdf
13. R. Durner and W. Kellerer, "The cost of security in the SDN control plane, " Proc. CoNEXT Student Workshop, 2015, pp. 1-3.
14. A. D. Ferguson, A. Guha, C. Liang, R. Fonseca, S. Krishnamurthi, "Participatory networking: An API for application control of SDNs, " Proc. ACM SIGCOMM, 2013, pp. 327-338.
15. FloodLight Open SDN Controller. Accessed: Sep. 14, 2017. [Online]: Http://floodlight.openflowhub.org/
16. N. Foster, et al., "Frenetic: A high-level language for OpenFlow networks, " Proc. Workshop Program. Routers Extensible Services Tomorrow, 2010, pp. 1-6.
17. A. Greenberg, et al., "A clean slate 4D approach to network control and management, " ACM Comput. Commun. Rev., vol. 35, no. 5, pp. 41-54, 2005.
18. N. Gude, et al., "NOX: Towards an operating system for networks, " ACM SIGCOMM Comput. Commun. Rev., vol. 38, no. 3, pp. 105-110, Jul. 2008.
19. A. Guha, M. Reitblatt, N. Foster, "Machine-verified network controllers, " Proc. 34th ACM SIGPLAN Conf. Program. Lang. Design Implement., 2013, pp. 483-494.
20. N. Handigol, B. Heller, V. Jeyakumar, D. Maziéres, N. Mckeown, "Where is the debugger for my software-defined network" in Proc. 1st Workshop Hot Topics Softw. Defined Netw., 2012, pp. 55-60.
21. M. Handley, O. Hodson, E. Kohler, "XORP: An open platform for network research, " ACM SIGCOMM Comput. Commun. Rev., vol. 31, no. 3, pp. 53-57, 2003.
22. K. Hong, L. Xu, H. Wang, G. Gu, "Poisoning network visibility in software-defined networks: New attacks and countermeasures, " Proc. 22nd Annu. Netw. Distrib. Syst. Secur. Symp. (NDSS), Feb. 2015.
23. Hewlett-Packard. Hp 3500 and 3500 yl Switch. Accessed: Dec. 12, 2015. [Online]: Http://h17007.www1.hp.com/us/en/networking/products/switches/HP-3500-and-3500-yl-Switch-Series/index.aspx
24. Hewlett-Packard. Hp 3800 Switch. Accessed: Dec. 12, 2015. [Online]: Http://h17007.www1.hp.com/us/en/networking/products/switches/HP-3800-Switch-Series/index.aspx
25. Hewlett-Packard. Hp SDN Devcenter: SDN App Store. Accessed: Dec. 12, 2015. [Online]: Http://www.hp.com/go/sdndevcenter
26. S. Jain, et al., "B4: Experience with a globally-deployed software defined wan, " Proc. ACM SIGCOMM Conf. (SIGCOMM), 2013, pp. 3-14.
27. Y. Jarraya, T. Madi, M. Debbabi, "A survey and a layered taxonomy of software-defined networking, " IEEE Commun. Surveys Tuts., vol. 16, no. 4, pp. 1955-1980, 4th Quart., 2014.
28. N. Katta, H. Zhang, M. Freedman, J. Rexford, "Ravana: Controller fault-tolerance in software-defined networking, " Proc. 1st ACM SIGCOMM Symp. Softw. Defined Netw. Res., 2015, p. 4.
29. S. M. Kerner. Is SDN Secure Accessed: Sep. 14, 2017. [Online]: Http://www.enterprisenetworkingplanet.com/netsecur/is-sdnsecure. html
30. A. Khurshid, W. Zhou, M. Caesar, P. B. Godfrey, "VeriFlow: Verifying network-wide invariants in real time, " Proc. 1st Workshop Hot Topics Softw. Defined Netw. (HotSDN), 2012, pp. 467-472.
31. R. Kloti, V. Kotronis, P. Smith, "OpenFlow: A security analysis, " Proc. IEEE Int. Conf. Netw. Protocols (NPSec), Oct. 2013, pp. 1-6.
32. T. Koponen, et al., "Onix: A distributed control platform for largescale production networks, " Proc. Symp. Oper. Syst. Design Implement. (OSDI), 2010, pp. 1-6.
33. D. Kotani and Y. Okabe, "A packet-in message filtering mechanism for protection of control plane in OpenFlow networks, " Proc. 10th ACM/IEEE Symp. Archit. Netw. Commun. Syst. (ANCS), New York, NY, USA, Oct. 2014, pp. 29-40.
34. D. Kreutz, et al. (2014). "Software-defined networking: A comprehensive survey." [Online]: Https://arxiv.org/pdf/1406.0440.pdf
35. D. Kreutz, F. M. V. Ramos, P. Verissimo, "Towards secure and dependable software-defined networks, " Proc. ACM SIGCOMM Workshop Hot Topics Softw. Defined Netw. (HotSDN), Aug. 2013, pp. 55-60.
36. S. Lee, et al., "DELTA: A security assessment framework for softwaredefined networks, " Proc. NDSS, vol. 17. 2017, pp. .
37. A. Malhotra, I. E. Cohen, E. Brakke, S. Goldberg, "Attacking the network time protocol, " Proc. Netw. Distrib. Syst. Secur. Symp., 2016, pp. 1-15.
38. N. Mckeown, et al., "OpenFlow: Enabling innovation in campus networks, " ACM SIGCOMM Comput. Commun. Rev., vol. 38, no. 2, pp. 69-74, Mar. 2008.
39. J. Mirkovic and P. Reiher, "A taxonomy of DDoS attack and DDoS defense mechanisms, " ACM SIGCOMM Comput. Commun. Rev., vol. 34, no. 2, pp. 39-53, 2004.
40. Open Networking Foundation. Accessed: Sep. 14, 2017. [Online]: Https://www.opennetworking.org/
41. Open Networking Fundation, "Software-defined networking: The new norm for networks, " ONF White Paper, vol. 2, pp. 2-6, 2012.
42. Open Networking Laboratory. Recent Security Extensions to ONOS. Accessed: Sep. 14, 2017. [Online]: Https://wiki.onosproject.org/display/ONOS/Security-Mode+ONOS
43. OpenFlow Security Analysis Project. Accessed: Dec. 12, 2015. [Online]: Http://www.openflowsec.org
44. P. A. Porras, S. Cheung, M. W. Fong, K. Skinner, V. Yegneswaran, "Securing the software defined network control layer, " in NDSS, 2015.
45. P. Porras, et al., "A security enforcement kernel for OpenFlow networks, " Proc. 1st Workshop Hot Topics Softw. Defined Netw. (HotSDN), 2012, pp. 121-126.
46. Noxrepo. The POX Controller. Accessed: Sep. 14, 2017. [Online]: Https://github.com/noxrepo/pox
47. B. McCarty, Selinux: NSA's Open Source Security Enhanced Linux. Sebastopol, CA, USA: O'Reilly Media, 2004.
48. C. Röpke and T. Holz, "SDN rootkits: Subverting network operating systems of software-defined networks, " Proc. Int. Symp. Res. Attacks, Intrusions, Defenses, 2015, pp. 339-356.
49. S. Scott-Hayward, S. Natarajan, S. Sezer, "A survey of security in software defined networks, " IEEE Commun. Surveys Tuts., vol. 18, no. 1, pp. 623-654, 1st Quart., 2015.
50. S. Scott-Hayward, G. Ocallaghan, S. Sezer, "SDN security: A survey, " Proc. IEEE SDN Future Netw. Services (SDN4FNS), Nov. 2013, pp. 1-7.
51. A. Shalimov, D. Zuikov, D. Zimarina, V. Pashkov, R. Smeliansky, "Advanced study of SDN/OpenFlow controllers, " Proc. 9th Central Eastern Eur. Softw. Eng. Conf. Russia (CEE-SECR), New York, NY, USA, 2013, pp. 1-1-1-6.
52. S. Shin and G. Gu, "Attacking software-defined networks: A first feasibility study, " Proc. ACM SIGCOMM Workshop Hot Topics Softw. Defined Netw. (HotSDN), Aug. 2013, pp. 165-166.
53. S. Shin, et al., "Rosemary: A robust, secure, high-performance network operating system, " Proc. 21st ACM Conf. Comput. Commun. Secur. (CCS), Nov. 2014, pp. 78-89.
54. S. Shin, V. Yegneswaran, P. Porras, G. Gu, "Avant-guard: Scalable and vigilant switch flow management in software-defined networks, " Proc. 20th ACM Conf. Comput. Commun. Secur. (CCS), Nov. 2013, pp. 413-424.
55. J. Sonchack, A. Dubey, A. J. Aviv, J. M. Smith, E. Keller, "Timingbased reconnaissance and defense in software-defined networks, " Proc. 32nd Annu. Conf. Comput. Secur. Appl., 2016, pp. 89-100.
56. S. Sorensen. (May 14, 2012). Security Implications of Software-Defined Networks. [Online]: Http://www.fiercetelecom.com/story/security-implications-software-defined-networks/
57. T. Spalink, S. Karlin, L. Peterson, Y. Gottlieb, "Building a robust software-based router using network processors, " Proc. 18th ACM Symp. Oper. Syst. Principles (SOSP), 2001, pp. 216-229.
58. A. Tootoonchian, S. Gorbunov, Y. Ganjali, M. Casado, R. Sherwood, "On controller performance in software-defined networks, " Proc. 2nd USENIX Conf. Hot Topics Manage. Internet, Cloud, Enterprise Netw. Services, 2012, pp. 1-6.
59. A. Wang, Y. Guo, F. Hao, T. Lakshman, S. Chen, "Scotch: Elastically scaling up SDN control-plane using vSwitch based overlay, " Proc. 10th ACM Int. Conf. Emerg. Netw. Experim. Technol., 2014, pp. 403-414.
60. H. Wang, L. Xu, G. Gu, "FloodGuard: A DoS attack prevention extension in software-defined networks, " Proc. 45th Annu. IEEE/IFIP Int. Conf. Depend. Syst. Netw. (DSN), Jun. 2015, pp. 239-250.
61. M. Wasserman and S. Hartman, "Security analysis of the open networking foundation (ONF) openflow switch specification, " IETF Secretariat, Tech. Rep., 2013.
62. WIRED. Going With the Flow: Google's Secret Switch to the Next Wave of Networking. Accessed: Sep. 14, 2017. [Online]: Http://www.wired.com/wiredenterprise/2012/04/going-with-the-flowgoogle/
63. M. Yu, J. Rexford, M. J. Freedman, J. Wang, "Scalable flow-based networking with DIFANE, " ACM SIGCOMM Comput. Commun. Rev., vol. 40, no. 4, pp. 351-362, Oct. 2010.