Poisoning Network Visibility in Software-Defined Networks: New Attacks and Countermeasures

22nd Annual Network and Distributed System Security Symposium, NDSS 2015

Volumn , Issue , 2015, Pages

  Hong, Sungmin ^a   Xu, Lei ^a   Wang, Haopei ^a   Gu, Guofei ^a  

^a TEXAS A AND M UNIVERSITY   (United States)

Author keywords

[No Author keywords available]

Indexed keywords

APPLICATION PROGRAMS; CONTROLLERS; DENIAL-OF-SERVICE ATTACK; ELECTRIC LIGHTING; FLOODS; NETWORK PROTOCOLS; NETWORK SECURITY; NETWORK TOPOLOGY; VISIBILITY;

'CURRENT; ITS APPLICATIONS; LEGACY NETWORKS; NETWORK TOPOLOGY; NETWORKING APPLICATIONS; OPENFLOW; POISONING ATTACKS; POWER; SOFTWARE-DEFINED NETWORKINGS; SOFTWARE-DEFINED NETWORKS;

SOFTWARE DEFINED NETWORKING;

EID: 85117525688     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.14722/ndss.2015.23283     Document Type: Conference Paper

References (32)

1. Apache http server project. https://httpd.apache.org/.
2. Configuring port security. http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst4500/12-2/25ew/configuration/guide/conf/port_sec. html.
3. n-casting using openflow. http://archive.openflow.org/wp/n-casting-mobility-using-openflow/.
4. OpenFlow Specification v1.4.0. http://www.opennetworking.org/images/stories/downloads/sdn-resources/onf-specifications/openflow/openflow-spec-v1.4.0.pdf.
5. Openflow wireshark dissector. http://archive.openflow.org/wk/index.php/OpenFlow_Wireshark_Dissector.
6. Optimized Link State Routing Protocol (OLSR). http://www.ietf.org/rfc/rfc3626.txt.
7. Proxy ARP. http://www.cisco.com/c/en/us/support/docs/ip/dynamic-address-allocation-resolution/13718-5.html# howdoesproxyarpwork.
8. Scapy: Packet manipulation program. http://www.secdev.org/projects/scapy/.
9. K. Benton, L. J. Camp, and C. Small. Openflow vulnerability assessment. In Proceedings of ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking (HotSDN'13), August 2013.
10. D. Raffo C. Adjih and P. Mhlethaler. Attacks against olsr: Distributed key management for security. In 2005 OLSR Interop and Workshop, July 2005.
11. M. Dobrescu and K. Argyraki. Software dataplane verification. In Proceedings of the 11th USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2014.
12. D. Gonikman G. Nakibly, A. Kirshon and D. Boneh. Persistent ospf attacks. In In proceedings of the 19th Annual Network & Distributed System Security Conference (NDSS'12), 2012.
13. Natasha Gude, Teemu Koponen, Justin Pettit, Ben Pfaff, Martin Casado, Nick McKeown, and Scott Shenker. Nox: towards an operating system for networks. July 2008.
14. A. Guha, M. Reitblatt, and N. Foster. Machine-verified network controller. In Proceedings of the ACM Conference on Programming Language Design and Implementation (PLDI), 2013.
15. B. Heller, S. Seetharaman, P. Mahadevan, Y. Yiakoumis, P. Sharma, S. Banerjee, and N. McKeown. Elastictree: Saving energy in data center networks. In Proceedings of the 7th USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2010.
16. J. H. Jafarian, E. Al-Shaer, and Q. Duan. Openflow random host mutation: Transparent moving target defense using software defined networking. In Proceedings of ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking (HotSDN'12).
17. E. Jones and O. L. Moigne. Ospf security vulnerabilities analysis. In Internet-Draft draft-ietf-rpsec-ospf-vuln-02, IETF, June 2006.
18. P. Kazemian, M. Chang, H. Zeng, S. Whyte, G. Varghese, and N. McKeown. Real time network policy checking using header space analysis. In Proceedings of the 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2013.
19. A. Khurshid, X. Zou, W. Zhou, M. Caesar, and P. B. Godfrey. Veriflow: Verifying network-wide invariants in real time. In Proceedings of the 10th USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2013.
20. L.B. Kish. Protection against the man-in-the-middle-attack for the kirchhoff-loop-johnson(-like)-noise cipher and expansion by voltage-based security. In Fluctuation and Noise Letters 6 (2006) L57L63.
21. M. Kuzniar, P. Peresini, M. Canini, D. Venzano, and D. Kostic. A soft way for openflow switch interoperability testing. In Proceedings of ACM Conference on emerging Networking EXperiments and Technologies (CoNEXT), 2012.
22. P. Peresini D. Kostic M. Canini, D. Venzano and Jennifer Rexford. A nice way to test openflow applications. In Proceedings of the 9th USENIX Symposium on Networked Systems Design and Implementation (NSDI), 2012.
23. K. Mahajan M. Dhawan, R. Poddar and V. Mann. Cloudnaas: a cloud networking platform for enterprise applications. In In proceedings of the 22th Annual Network & Distributed System Security Conference (NDSS'15), 2015.
24. Mininet. Rapid prototyping for software defined networks. http://yuba.stanford.edu/foswiki/bin/view/OpenFlow/.
25. C. Monsanto, N. Foster, R. Harrison, and D. Walker. A compiler and run-time system for network programming languages. In Proceedings of the 39th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages, 2012.
26. A. Ornaghi and M. Valleri. Man In The Middle Attacks. http://www.blackhat.com/presentations/bh-europe-03/bh-europe-03-valleri.pdf.
27. P. Porras, S. Shin, V. Yegneswaran, M. Fong, M. Tyson, and G. Gu. A security enforcement kernel for openflow networks. In Proceedings of ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking (HotSDN'12), August 2012.
28. R. Sherwood, G. Gibb, K. Yap, G. Appenzeller, M. Casado, N. McKeown, and G. Parulkar. Can the production network be the testbed? In Proceedings of the USENIX Symposium on Operating Systems Design and Implementation (OSDI), 2010.
29. S. Shin and G. Gu. Attacking software-defined networks: A first feasibility study (short paper). In Proceedings of ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking (HotSDN), 2013.
30. S. Shin, P. Porras, V. Yegneswaran, M. Fong, G. Gu, and M. Tyson. Fresco: Modular composable security services for software-defined networks. In Proceedings of the 20th Annual Network and Distributed System Security Symposium (NDSS'13), 2013.
31. S. Shin, V. Yegneswaran, P. Porras, and G. Gu. Avant-guard: Scalable and vigilant switch flow management in software-defined networks. In Proceedings of the 20th ACM Conference on Computer and Communications Security (CCS), 2013.
32. A. Perrig Y. Hu and D. B. Johnson. Wormhole attacks in wireless networks. In 2005 OLSR Interop and Workshop, July 2005.