Securing the Software-Defined Network Control Layer

22nd Annual Network and Distributed System Security Symposium, NDSS 2015

Volumn , Issue , 2015, Pages

  Porras, Phillip ^a   Cheung, Steven ^a   Fong, Martin ^a   Skinner, Keith ^a   Yegneswaran, Vinod ^a  

^a SRI INTERNATIONAL   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

AUTHENTICATION; AUTHORIZATION; COMPUTATION THEORY; COMPUTER CIRCUITS; ELECTRIC LIGHTING; FLOODS; NETWORK LAYERS; NETWORK SECURITY; SOFTWARE DEFINED NETWORKING;

CONTROL LAYERS; DATA PLANES; DATA-PLANE; FLOW RULES; NETWORK APPLICATIONS; NETWORK-CONTROL; NETWORKS SECURITY; OPENFLOW; SECURITY ENFORCEMENT; SOFTWARE-DEFINED NETWORKS;

CONTROLLERS;

EID: 85049403057     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.14722/ndss.2015.23222     Document Type: Conference Paper

References (43)

1. N. McKeown, T. Anderson, H. Balakrishnan, G. Parulkar, L. Peterson, J. Rexford, S. Shenker, and J. Turner, “OpenFlow: Enabling Innovation in Campus Networks, ” in Proceedings of ACM Computer Communications Review, April 2008.
2. POX, “Python network controller, ” http://www.noxrepo.org/pox/aboutpox/.
3. N. Gude, T. Koponen, J. Pettit, B. Pfaff, M. Casado, N. McKeown, and S. Shenker, “NOX: Towards an Operating System for Networks, ” in Proceedings of ACM Computer Communications Review, July 2008.
4. FloodLight, “Open SDN controller, ” http://floodlight.openflowhub.org/.
5. D. Erickson, “The beacon openflow controller, ” in Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, 2013.
6. R. Sherwood, G. Gibb, K.-K. Yap, G. Appenzeller, M. Casado, N. McKeown, and G. Parulkar, “Can the Production Network Be the Testbed, ” in Proceedings of the Usenix Symposium on Operating System Design and Implementation (OSDI), 2010.
7. S. Jain, A. Kumar, S. Mandal, J. Ong, L. Poutievski, A. Singh, S. Venkata, J. Wanderer, J. Zhou, M. Zhu, J. Zolla, U. Hölzle, S. Stuart, and A. Vahdat, “B4: Experience with a Globally-deployed Software Defined WAN, ” in Proceedings of ACM SIGCOMM, 2013.
8. S. Shin, P. Porras, V. Yegneswaran, M. Fong, G. Gu, and M. Tyson, “Fresco: Modular composable security services for software-defined networks, ” in Proceedings of the 20th Annual Network and Distributed System Security Symposium (NDSS'13), February 2013.
9. OpenFlowHub, “BEACON, ” http://www.openflowhub.org/display/Beacon.
10. S. K. Fayazbakhsh, V. Sekar, M. Yu, and J. C. Mogul, “FlowTags: Enforcing Network-wide Policies in the Presence of Dynamic Middlebox Actions, ” in Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, 2013.
11. A. Khurshid, W. Zhou, M. Caesar, and P. B. Godfrey, “VeriFlow: Verifying Network-Wide Invariants in Real Time, ” in Proceedings of ACM Sigcomm HotSDN Workshop, 2012.
12. VArmour, http://www.varmour.com/.
13. S. Shin, Y. Song, T. Lee, S. Lee, J. Chung, P. Porras, V. Yegneswaran, J. Noh, and B. B. Kang, “Rosemary: A robust, secure, and high-performance network operating system, ” in Proceedings of the ACM SIGSAC Conference on Computer Communications Security, ser. CCS, 2014.
14. Open Networking Foundation Northbound Interfaces Working Group, https://www.opennetworking.org/images/stories/downloads/workinggroups/charter-nbi.pdf/.
15. P. Porras, S. Shin, V. Yegneswaran, M. Fong, M. Tyson, and G. Gu, “A Security Enforcement Kernel for OpenFlow Networks, ” in Proceedings of the ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking (HotSDN), 2012.
16. N. Handigol, B. Heller, V. Jeyakumar, D. Mazieres, and N. McKeown, “I Know What Your Packet Did Last Hop: Using Packet Histories to Troubleshoot Networks, ” in Proceedings of the Usenix Symposium on Operating System Design and Implementation, 2014.
17. N. Handigol, B. Heller, V. Jeyakumar, D. Maziéres, and N. McKeown, “Where is the debugger for my software-defined network?” in Proceedings of the First Workshop on Hot Topics in Software Defined Networks, ser. HotSDN'12. ACM, 2012.
18. A. Wundsam, D. Levin, S. Seetharaman, and A. Feldmann, “Ofrewind: Enabling record and replay troubleshooting for networks, ” in Proceedings of the 2011 USENIX Conference on USENIX Annual Technical Conference, ser. USENIXATC'11. USENIX Association, 2011.
19. Department of Defense, Trusted Computer System Evaluation Criteria, Dec. 1985.
20. K. Varda, “Protocol buffers: Google's data interchange format, ” Google, Tech. Rep., 2008. [Online]. Available: http://google-opensource.blogspot.com/2008/07/protocol-buffers-googles-data.html
21. G. Gu, P. Porras, V. Yegneswaran, M. Fong, and W. Lee, “BotHunter: Detecting Malware Infection Through IDS-driven Dialog Correlation, ” in Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium, 2007.
22. S. Kandula, S. Sengupta, A. Greenberg, and P. Patel, “The nature of datacenter traffic: Measurements and analysis, ” in In Proceedings of Usenix/ACM IMC, 2009.
23. S. Shin, V. Yegneswaran, P. Porras, and G. Gu, “Avant-guard: Scalable and vigilant switch flow management in software-defined networks, ” in Proceedings of the 2013 ACM SIGSAC Conference on Computer Communications Security, ser. CCS, 2013.
24. M. Casado, M. J. Freedman, J. Pettit, J. Luo, N. McKeown, and S. Shenker, “Ethane: Taking Control of the Enterprise, ” in Proceedings of ACM SIGCOMM, 2007.
25. M. Casado, T. Garfinkel, M. Freedman, A. Akella, D. Boneh, N. McKeowon, and S. Shenker, “SANE: A Protection Architecture for Enterprise Networks, ” in Proceedings of the Usenix Security Symposium, 2006.
26. A. Greenberg, G. Hjalmtysson, D. A. Maltz, A. Myers, J. Rexford, G. Xie, H. Yan, J. Zhan, and H. Zhang, “A Clean Slate 4D Approach to Network Control and Management, ” in Proceedings of ACM Computer Communications Review, 2005.
27. Z. Cai, A. L. Cox, and T. E. Ng, “Maestro: A System for Scalable OpenFlow Control, ” in Rice University Technical Report, 2010.
28. J. C. Mogul, J. Tourrilhes, P. Yalagandula, P. Sharma, A. R. Curtis, and S. Banerjee, “DevoFlow: Cost-effective Flow Management for High Performance Enterprise Networks, ” in Proceedings of the 10th ACM Workshop on Hot Topics in Networks (HotNets), 2010.
29. E. Al-shaer, W. Marrero, A. El-atawy, and K. Elbadawi, “Network Configuration in A Box: Towards End-to-End Verification of Network Reachability and Security, ” in Proceedings of the IEEE International Conference on Network Protocols, 2009.
30. G. Xie, J. Zhan, D. Maltz, H. Zhang, A. Greenberg, G. Hjalmtysson, and J. Rexford, “On Static Reachability Analysis of IP Networks, ” in Proceeding of IEEE INFOCOM, 2005.
31. A. Liu, “Formal Verification of Firewall Policies, ” in Proceedings of the International Conference on Communications (ICC), 2008.
32. D. Senn, D. Basin, and G. Caronni, “Firewall Conformance Testing, ” in Proceedings of the IFIP TestCom, 2005.
33. A. El-atawy, T. Samak, Z. Wali, E. Al-shaer, F. Lin, C. Pham, and S. Li, “An Automated Framework for Validating Firewall Policy Enforcement, ” Tech. Rep., 2007.
34. N. Feamster and H. Balakrishnan, “Detecting BGP Configuration Faults with Static Analysis, ” in Proceedings of the Usenix Symposium on Network Systems Design and Implementation, 2005.
35. A. Nayak, A. Reimers, N. Feamster, and R. Clark, “Resonance: Dynamic Access Control for Enterprise Networks, ” in Proceedings of the 1st ACM SIGCOMM WREN Workshop, 2009.
36. M. Canini, D. Venzano, P. Peresini, D. Kostic, and J. Rexford, “A NICE Way to Test OpenFlow Applications, ” in Proceedings of the Symposium on Network Systems Design and Implementation, 2012.
37. M. Reitblatt, N. Foster, J. Rexford, and D. Walker, “Consistent Update for Software-Defined Networks: Change You Can Believe In!” in Proceedings of the ACM Workshop on Hot Topics in Networks, 2011.
38. B. Anwer, T. Benson, N. Feamster, D. Levin, and J. Rexford, “A slick control plane for network middleboxes, ” in Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, 2013.
39. Z. A. Qazi, C.-C. Tu, L. Chiang, R. Miao, V. Sekar, and M. Yu, “Simplefying middlebox policy enforcement using sdn, ” in Proceedings of the ACM SIGCOMM Conference, 2013.
40. A. Gember, A. Krishnamurthy, S. S. John, and A. Akella, “Virtual middelboxes as first-class entities in the cloud, ” in Proceedings of the Open Network Summit, 2012.
41. E. Al-Shaer and S. Al-Haj, “FlowChecker: Configuration Analysis and Verification of Federated Openflow Infrastructures, ” in Proceedings of the 3rd ACM SafeConfig Workshop, 2010.
42. P. Kazemian, G. Varghese, and N. McKeown, “Header Space Analysis: Static Checking for Networks, ” in Proceedings of the Symposium on Network Systems Design and Implementation, 2012.
43. H. Hu, W. Han, G.-J. Ahn, and Z. Zhao, “Flowguard: Building robust firewalls for software-defined networks, ” in Proceedings of the Third ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, 2014.