Security Challenges in Software Defined Networks: Market and Applications
S
e
c
u
r
i
t
y
C
h
a
l
l
e
n
g
e
s
i
n
S
o
f
t
w
a
r
e
D
e
f
i
n
e
d
N
e
t
w
o
r
k
s
(
S
D
N
)
L
e
c
t
u
r
e
1
8
1
O
u
t
l
i
n
e
•
Market and SDN
•
Conventional Networks v.s SDN
•
OpenFlow-enabled SDN devices
•
SDN Security Applications
•
SDN Security Challenges
•
Community Debate regarding Security in SDN
2
M
a
r
k
e
t
a
n
d
S
D
N
•
I
n
2
0
1
6
,
t
h
e
m
a
r
k
e
t
r
e
s
e
a
r
c
h
f
i
r
m
I
D
C
p
r
e
d
i
c
t
e
d
t
h
a
t
t
h
e
m
a
r
k
e
t
f
o
r
S
D
N
n
e
t
w
o
r
k
a
p
p
l
i
c
a
t
i
o
n
s
w
o
u
l
d
r
e
a
c
h
U
S
$
3
.
5
b
i
l
l
i
o
n
b
y
2
0
2
0
.
•
Leading IT companies such as Nokia, Cisco, Dell, HP,
Juniper, IBM, and VMware have developed their own
SDN strategies.
•
In 2015, AT&T reduced provisioning cycle by 95% with
SDN.
3
Marc C. Dacier, Hartmut Cwalinski , Frank Kargl , Sven Dietrich, Security Challenges and
Opportunities of Software-Defined Networking, Apr 3, 2017
“We have taken a process from
low automation
and
weeks
to
complete to
high automation
and
minutes
to complete. We’re turning
the industry on its head in an unprecedented way.” John Donovan
AT&T’s analyst conference in August 2015, John Donovan
C
o
n
v
e
n
t
i
o
n
a
l
N
e
t
w
o
r
k
s
v
s
.
S
D
N
4
Customization
Programmability
Control Plane
Data Plane
Dumb, fast
Control Plane
Data Plane
Abstract
view
Global
view
Control Plane
Network
Applications
Open
North-bound API
OpenFlow
South-bound API
Traffic mngmnt,QoS
Policy Imp.
Security services
Decentralized Control
•
Limited visibility
•
Vendor-specfic
•
Missconfiguration
•
Poor responses
•
Policy conflicts
•
Security breaches
•
Decentralized.
•
Complex
•
Static architecture
•
Innovation is difficult
•
Costly
•
Yes costly
*Figure: Kreutz, Diego, et al. "Software-defined networking: A comprehensive survey."
Proceedings of the IEEE
103.1 (2015): 14-76.
*
Conventional Networks
Data Plane
Software Defined Networks
Decoupling
Smart
Policy mngmnt
O
p
e
n
F
l
o
w
-
e
n
a
b
l
e
d
S
D
N
d
e
v
i
c
e
s
5
Match Fields
*
00:2E
*
*
*
*
*
*
*
*
*
*
*
*
4.5.6.7
*
*
*
*
*
*
*
*
*
*
*
10
port3
port5
drop
Switching
Routing
Firewall
300
250
500
OpenFlow is: Enabler of SDN
•
Protocol between the control plan and data plane
•
Describes how controller and a network forwarding device should
communicate
Packet+ byte Counters
S
D
N
s
e
c
u
r
i
t
y
a
p
p
l
i
c
a
t
i
o
n
s
6
Control Plane
Application plane
Routing, Load Balancer,
Access Control, monitoring,
firewall, DDoS Mitigation,
IDS/IPS
examples
•
Load Balancer
: send each HTTP request
over
lightly loaded path to lightly loaded server.
•
Firewall
:
inform Central Controller about
malware’s packets, controller pushes new rules
to drop packets.
A
B drop
Network Virtualization
Up-to-date Global Network View
Abstract Network View
Incoming packets
6
Server
T
h
e
b
i
g
P
i
c
t
u
r
e
S
D
N
A
r
c
h
e
t
u
c
t
u
r
e
7
Alsmadi, Izzat, and Dianxiang Xu. "Security of software defined networks: A survey."
Computers & security
53 (2015): 79-108.
S
D
N
S
e
c
u
r
i
t
y
C
h
a
l
l
e
n
g
e
s
8
A
p
p
l
i
c
a
t
i
o
n
P
l
a
n
e
S
e
c
u
r
i
t
y
C
h
a
l
l
e
n
g
e
s
9
SDN aware & SDN unaware apps
Nested applications
Lack of Access
Control and
Accountability
Lack of
Authentication
and Authorization
Fraudulent
flow rule
insertion
Path characteristics
Access ports
Monitor traffic
Reject/Accept flows
sensitive apps
Service apps
Apps classes
A
p
p
l
i
c
a
t
i
o
n
P
l
a
n
e
T
a
r
g
e
t
e
d
T
h
r
e
a
t
/
P
r
o
p
o
s
e
d
S
o
l
u
t
i
o
n
10
Security policy
verification framework
-Flover
:
on controller
new/old rules conflict
-ndb
: root cause
-OFRewind :
trace anomalies
Security policy
violation
Threats
within/from apps
flow rules
contradiction
Framework for security
apps development
(FRESCO
Scripting
language)
Access control
breach
Assertion-
based language
-catch bugs before deployed
- forwarding loops
- black holes
Permission system
(
PermOF
):
least privilege on apps
P
e
r
m
O
F
11
Wen, Xitao, et al. "Towards a secure controller platform for openflow applications."
Proceedings of the second ACM
SIGCOMM workshop on Hot topics in software defined networking
. ACM, 2013.
The design is based on a Set of permissions & Isolation mechanisms
–
Ensures controller superiority over applications
–
Isolates control flow and data flow
–
controller should be able to mediate all the apps’ activity
Availability of
sensitive info
real time
controlled by the
controller kernel
dynamic
execute
C
o
n
t
r
o
l
P
l
a
n
e
S
e
c
u
r
i
t
y
C
h
a
l
l
e
n
g
e
s
12
DoS Attacks
Threats due to
Scalability
Challenges in
Distributed
Control Plane
-SDN response times
-IP packets with
random headers
-Huge # flow rules
-saturation
C
o
n
t
r
o
l
P
l
a
n
e
T
a
r
g
e
t
e
d
T
h
r
e
a
t
/
P
r
o
p
o
s
e
d
S
o
l
u
t
i
o
n
13
DDoS Attack
Controller scalability
Challenges in
distributed control
plane
1. Wildcards mechanism
-Load balancing: direct an
aggregate of client requests to
replicas
2. Increase the processing power
(McNettle controller)
parallelism
3. Hybrid reactively/Proactive
controller
Detection Framework
SDN DDoSDetection
intra-domain & inter-domain
(DISO)
McNettle
http://haskell.cs.yale.edu/wp-
content/uploads/2013/04/thesis-singlespace.pdf
•
NOX-MT scales to 5m f/s at 10 CPU cores
•
Beacon
13m f/s at 20 CPU cores
•
McNettle
20
m f/s at 46 CPU cores
R
e
a
c
t
i
v
e
l
y
v
s
.
P
r
o
a
c
t
i
v
e
C
o
n
t
r
o
l
l
e
r
14
Marcial P. Fernandez, Evaluating OpenFlow Controller Paradigms, 2013
S
D
N
D
D
o
S
D
e
t
e
c
t
i
o
n
1.
F
l
o
w
c
o
l
l
e
c
t
o
r
m
o
d
u
l
e
:
g
a
t
h
e
r
s
f
l
o
w
e
n
t
r
i
e
s
w
i
t
h
i
n
i
n
t
e
r
v
a
l
s
.
2.
F
e
a
t
u
r
e
e
x
t
r
a
c
t
o
r
:
A
v
g
.
p
a
c
k
e
t
s
/
f
,
A
v
g
.
B
y
t
e
s
/
f
,
a
v
g
d
u
r
a
t
i
o
n
/
f
,
g
r
o
w
t
h
o
f
s
i
n
g
l
e
-
f
l
o
w
s
,
a
n
d
g
r
o
w
t
h
o
f
d
i
f
f
e
r
e
n
t
p
o
r
t
s
.
3.
C
l
a
s
s
i
f
i
e
r
:
A
n
a
l
y
z
e
s
15
R. Braga, E. Mota, and A. Passito, “Lightweight DDoS flooding attack detection using NOX/OpenFlow,” in
Proc. IEEE 35th Conf. LCN,
Oct.
2010, pp. 408–415.
i
n
t
r
a
-
d
o
m
a
i
n
&
i
n
t
e
r
-
d
o
m
a
i
n
(
D
I
S
O
)
–
i
n
t
r
a
-
d
o
m
a
i
n
:
m
a
n
a
g
e
s
i
t
s
o
w
n
n
e
t
w
o
r
k
d
o
m
a
i
n
•
compute the paths of flows
•
dynamically react to network
issues (broken line, high latency,
bandwidth cap exceeded)
•
redirecting and/or stopping
traffic
–
i
n
t
e
r
-
d
o
m
a
i
n
:
•
discovers neighboring controllers
and manages communication
among controllers
•
exchange aggregated network-
wide information with others
16
C2
C3
C1
SubD3
SubD2
SubD1
Traffic Optimization...
Topology!
Link information!
A
D
a
t
a
P
l
a
n
e
S
e
c
u
r
i
t
y
C
h
a
l
l
e
n
g
e
s
17
Switch-Controller link
Flow rules installation
Genuine vs. malicious rules
Limited table entries
Limited switch buffer
#switches per controller
path Length
D
a
t
a
P
l
a
n
e
T
a
r
g
e
t
e
d
T
h
r
e
a
t
/
P
r
o
p
o
s
e
d
S
o
l
u
t
i
o
n
18
Real-time contradiction check
FortNox
man-in-the-middle
attacks
flow rule
contradiction
High level points
-- Debate
19
C
e
n
t
r
a
l
i
z
a
t
i
o
n
i
n
S
D
N
T
h
e
G
o
o
d
:
•
Fast responsiveness
•
Easy to removing policy inconsistencies
–
centralized routing algorithms
–
Firewalls
–
network-monitoring
T
h
e
B
a
d
:
•
S
i
n
g
l
e
p
o
i
n
t
o
f
f
a
i
l
u
r
e
m
a
y
b
e
e
x
p
l
o
i
t
e
d
b
y
a
n
i
n
t
e
r
n
a
l
o
r
e
x
t
e
r
n
a
l
a
t
t
a
c
k
e
r
R
e
g
a
r
d
i
n
g
D
D
o
S
B
a
d
:
c
e
n
t
r
a
l
i
z
a
t
i
o
n
a
d
d
e
d
a
n
e
w
t
y
p
e
o
f
d
e
n
i
a
l
-
o
f
-
s
e
r
v
i
c
e
(
D
o
S
)
v
e
c
t
o
r
.
G
o
o
d
:
E
f
f
e
c
t
i
v
e
m
a
n
a
g
e
m
e
n
t
o
f
e
x
i
s
t
i
n
g
D
o
S
a
t
t
a
c
k
t
y
p
e
s
–
Using Global view
–
Traffic analysis
N
e
w
s
e
c
u
r
i
t
y
c
h
a
l
l
e
n
g
e
s
b
u
t
b
e
n
e
f
i
t
s
a
p
p
e
a
r
t
o
b
e
p
r
e
d
o
m
i
n
a
n
t
!
!
!
20
Marc C. Dacier, Hartmut Cwalinski , Frank Kargl , Sven Dietrich, Security Challenges and Opportunities of Software-Defined Networking, Apr 3, 2017
A
t
t
a
c
k
S
u
r
f
a
c
e
v
s
.
D
e
f
e
n
s
e
O
p
p
o
r
t
u
n
i
t
i
e
s
G
o
o
d
:
•
In SDN defenders can create customized security solutions
•
e.g Anomaly detection systems
–
Global view
–
Open hardware interfaces
–
Centralized control
B
a
d
:
•
B
e
n
e
f
i
t
t
h
e
a
t
t
a
c
k
e
r
s
(
z
e
r
o
d
a
y
a
t
t
a
c
k
s
)
–
The centralized architecture
–
Lack of defender expertise
–
Still immature technology
21
Marc C. Dacier, Hartmut Cwalinski , Frank Kargl , Sven Dietrich, Security Challenges and Opportunities of Software-Defined Networking, Apr 3, 2017
C
e
n
t
r
a
l
i
z
e
d
v
s
.
D
i
s
t
r
i
b
u
t
e
d
A
p
p
r
o
a
c
h
G
o
o
d
:
•
Reduced complexity by splitting into planes.
–
Easier testable
–
E.g, routing algorithms simpler than the distributed approach in conventional
networks.
B
a
d
:
•
Stressed by two aspects that strongly call for the use of a
distributed approach.
–
T
h
e
n
e
e
d
f
o
r
s
c
a
l
a
b
i
l
i
t
y
–
O
p
e
r
a
t
i
o
n
a
l
r
e
q
u
i
r
e
m
e
n
t
s
(
f
a
u
l
t
t
o
l
e
r
a
n
c
e
)
22
Marc C. Dacier, Hartmut Cwalinski , Frank Kargl , Sven Dietrich, Security Challenges and Opportunities of Software-Defined Networking, Apr 3, 2017
I
s
S
D
N
M
o
r
e
C
o
m
p
l
e
x
?
,
o
r
I
s
I
t
S
i
m
p
l
e
r
?
I
m
p
l
e
m
e
n
t
i
n
g
t
h
e
c
o
n
t
r
o
l
p
l
a
n
e
c
o
m
p
l
e
t
e
l
y
i
n
s
o
f
t
w
a
r
e
G
o
o
d
:
•
Programmability
B
a
d
:
•
Opposes simplicity : raises issues about algorithmic complexity.
–
W
h
y
:
a
d
d
i
t
i
o
n
a
l
r
e
q
u
i
r
e
m
e
n
t
s
t
h
a
t
w
e
r
e
n
’
t
i
m
p
o
s
e
d
o
n
c
l
a
s
s
i
c
a
l
n
e
t
w
o
r
k
s
b
u
t
a
r
e
n
o
w
t
h
i
n
k
a
b
l
e
i
n
S
D
N
.
–
S
i
m
p
l
i
c
i
t
y
i
s
a
k
e
y
d
e
s
i
g
n
p
r
i
n
c
i
p
l
e
i
n
b
u
i
l
d
i
n
g
s
e
c
u
r
e
s
y
s
t
e
m
s
.
S
D
N
h
a
s
t
h
e
p
o
t
e
n
t
i
a
l
t
o
b
e
s
i
m
p
l
e
—
b
u
t
m
a
k
i
n
g
i
t
s
i
m
p
l
e
i
s
q
u
i
t
e
c
o
m
p
l
e
x
.
23
Marc C. Dacier, Hartmut Cwalinski , Frank Kargl , Sven Dietrich, Security Challenges and Opportunities of Software-Defined Networking, Apr 3, 2017
O
p
e
n
p
r
o
b
l
e
m
s
&
r
e
s
e
a
r
c
h
d
i
r
e
c
t
i
o
n
s
•
H
o
w
t
o
i
m
p
l
e
m
e
n
t
a
u
t
h
e
n
t
i
c
a
t
i
o
n
a
n
d
a
u
t
h
o
r
i
z
a
t
i
o
n
t
o
c
e
r
t
i
f
y
S
D
N
a
p
p
l
i
c
a
t
i
o
n
s
.
•
H
o
w
t
o
i
m
p
l
e
m
e
n
t
a
c
c
e
s
s
c
o
n
t
r
o
l
a
n
d
a
c
c
o
u
n
t
a
b
i
l
i
t
y
i
n
S
D
N
.
•
H
o
w
t
o
i
m
p
l
e
m
e
n
t
c
u
s
t
o
m
i
z
e
d
s
e
c
u
r
i
t
y
p
r
o
c
e
d
u
r
e
s
b
a
s
e
d
o
n
t
h
e
t
y
p
e
o
r
c
a
t
e
g
o
r
i
e
s
o
f
a
p
p
l
i
c
a
t
i
o
n
s
.
•
H
o
w
c
a
n
w
e
f
i
n
d
a
u
t
o
m
a
t
e
d
d
e
r
i
v
a
t
i
o
n
o
f
S
e
c
u
r
e
S
D
N
C
o
n
f
i
g
u
r
a
t
i
o
n
s
.
•
H
o
w
c
a
n
w
e
s
e
c
u
r
e
t
h
e
c
o
n
t
r
o
l
l
e
r
-
s
w
i
t
c
h
e
s
c
o
m
m
u
n
i
c
a
t
i
o
n
?
•
H
o
w
c
a
n
w
e
p
e
r
f
o
r
m
e
f
f
i
c
i
e
n
t
i
n
t
r
u
s
i
o
n
d
e
t
e
c
t
i
o
n
a
n
d
a
n
o
m
a
l
y
d
e
t
e
c
t
i
o
n
i
n
S
D
N
s
?
•
H
o
w
c
a
n
w
e
o
p
e
r
a
t
e
S
D
N
i
n
p
r
e
s
e
n
c
e
o
f
u
n
t
r
u
s
t
e
d
H
W
c
o
m
p
o
n
e
n
t
s
?
•
H
o
w
c
a
n
w
e
p
r
o
t
e
c
t
t
h
e
c
o
n
t
r
o
l
l
e
r
i
t
s
e
l
f
?
24
Without security, SDN will not succeed!
T
h
a
n
k
y
o
u
25
In the realm of Software Defined Networks (SDN), this content delves into market predictions, including major players and growth projections, as well as the applications and security challenges present within SDN. Discussing conventional networks versus SDN, the emergence of OpenFlow-enabled SDN devices, and the various security applications like Load Balancer and Firewall, this content sheds light on the evolving landscape of network technology.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Security Challenges in Security Challenges in Software Defined Networks (SDN) Software Defined Networks (SDN) Lecture 18 Lecture 18 1 World-Leading Research with Real-World Impact!
Outline Outline Market and SDN Conventional Networks v.s SDN OpenFlow-enabled SDN devices SDN Security Applications SDN Security Challenges Community Debate regarding Security in SDN 2 World-Leading Research with Real-World Impact!
Market and SDN Market and SDN In 2016, the market research firm IDC predicted that the market for SDN network applications would reach US$3.5 US$3.5 billion by 2020 2020. Leading IT companies such as Nokia, Cisco, Dell, HP, Juniper, IBM, and VMware have developed their own SDN strategies. Opportunities of Software-Defined Networking, Apr 3, 2017 Marc C. Dacier, Hartmut Cwalinski , Frank Kargl , Sven Dietrich, Security Challenges and In 2015, AT&T reduced provisioning cycle by 95% with SDN. We have taken a process from low automation and weeks to complete to high automation and minutesto complete. We re turning the industry on its head in an unprecedented way. John Donovan AT&T s analyst conference in August 2015, John Donovan 3 World-Leading Research with Real-World Impact!
Conventional Networks vs. SDN Conventional Networks vs. SDN Traffic mngmnt,QoS Policy Imp. Security services Control Plane Smart Network Applications Decoupling Open North-bound API Control Plane Abstract view Dumb, fast Data Plane Data Plane Policy mngmnt Control Plane Limited visibility Vendor-specfic Missconfiguration Poor responses Policy conflicts Security breaches Decentralized. Complex Static architecture Innovation is difficult Costly Yes costly OpenFlow South-bound API Global view Decentralized Control S S S S Data Plane Customization Programmability * Conventional Networks Software Defined Networks 4 *Figure: Kreutz, Diego, et al. "Software-defined networking: A comprehensive survey." Proceedings of the IEEE 103.1 (2015): 14-76. World-Leading Research with Real-World Impact!
OpenFlow OpenFlow- -enabled SDN devices enabled SDN devices OpenFlow is: Enabler of SDN Protocol between the control plan and data plane Describes how controller and a network forwarding device should communicate Packet+ byte Counters Match Fields * * * * * * * * 00:2E port3 300 Switching Routing * * * * * 4.5.6.7 * * * port5 250 * * * * * * * * Firewall 10 drop 500 5 World-Leading Research with Real-World Impact!
SDN security applications SDN security applications examples Load Balancer: send each HTTP request over lightly loaded path to lightly loaded server. Firewall: inform Central Controller about malware s packets, controller pushes new rules to drop packets. Routing, Load Balancer, Access Control, monitoring, firewall, DDoS Mitigation, IDS/IPS Application plane Abstract Network View Network Virtualization Up-to-date Global Network View Control Plane Server A B drop S S S S S S Incoming packets S S S R 6 6 World-Leading Research with Real-World Impact!
The big Picture The big Picture SDN SDN Archetucture Archetucture 7 Alsmadi, Izzat, and Dianxiang Xu. "Security of software defined networks: A survey." Computers & security 53 (2015): 79-108. World-Leading Research with Real-World Impact!
SDN Security Challenges SDN Security Challenges 8 World-Leading Research with Real-World Impact!
Application Plane Application Plane Security Challenges Security Challenges Lack of Access Control and Accountability Lack of Fraudulent flow rule insertion Authentication and Authorization SDN aware & SDN unaware apps Nested applications Apps classes Service apps sensitive apps Path characteristics Access ports Monitor traffic Reject/Accept flows 9 World-Leading Research with Real-World Impact!
Application Plane Application Plane Targeted Threat/Proposed Solution Targeted Threat/Proposed Solution Threats Security policy violation flow rules contradiction Access control breach within/from apps Security policy verification framework -Flover: on controller new/old rules conflict -ndb: root cause -OFRewind : trace anomalies Permission system (PermOF ): least privilege on apps Framework for security apps development (FRESCO Scripting language) Assertion-based language -catch bugs before deployed - forwarding loops - black holes 10 World-Leading Research with Real-World Impact!
PermOF PermOF The design is based on a Set of permissions & Isolation mechanisms Ensures controller superiority over applications Isolates control flow and data flow controller should be able to mediate all the apps activity Availability of sensitive info real time dynamic execute controlled by the controller kernel Wen, Xitao, et al. "Towards a secure controller platform for openflow applications." Proceedings of the second ACM SIGCOMM workshop on Hot topics in software defined networking. ACM, 2013. 11 World-Leading Research with Real-World Impact!
Control Plane Control Plane Security Challenges Security Challenges DoS Attacks Threats due to Scalability Challenges in Distributed Control Plane -SDN response times -IP packets with random headers -Huge # flow rules -saturation 12 World-Leading Research with Real-World Impact!
Control Plane Control Plane Targeted Threat/Proposed Solution Targeted Threat/Proposed Solution Controller scalability DDoS Attack Challenges in distributed control plane 1. Wildcards mechanism -Load balancing: direct an aggregate of client requests to replicas 2. Increase the processing power (McNettle controller) parallelism 3. Hybrid reactively/Proactive controller Detection Framework SDN DDoSDetection intra-domain & inter-domain (DISO) NOX-MT scales to 5m f/s at 10 CPU cores Beacon 13m f/s at 20 CPU cores McNettle 20m f/s at 46 CPU cores McNettle http://haskell.cs.yale.edu/wp- content/uploads/2013/04/thesis-singlespace.pdf 13 World-Leading Research with Real-World Impact!
Reactively vs. Proactive Controller Reactively vs. Proactive Controller Marcial P. Fernandez, Evaluating OpenFlow Controller Paradigms, 2013 14 World-Leading Research with Real-World Impact!
SDN SDN DDoSDetection DDoSDetection 1. 1. Flow collector module Flow collector module: gathers flow entries within intervals. Feature extractor Feature extractor: Avg. packets/f, Avg. Bytes /f, avg duration/f, growth of single- flows, and growth of different ports. Classifier Classifier: Analyzes Alarm? 2. 2. 3. 3. R. Braga, E. Mota, and A. Passito, Lightweight DDoS flooding attack detection using NOX/OpenFlow, in Proc. IEEE 35th Conf. LCN, Oct. 2010, pp. 408 415. 15 World-Leading Research with Real-World Impact!
intra-domain & inter-domain (DISO) intra intra- -domain : domain : manages its own network domain compute the paths of flows dynamically react to network issues (broken line, high latency, bandwidth cap exceeded) redirecting and/or stopping traffic inter inter- -domain domain: discovers neighboring controllers and manages communication among controllers exchange aggregated network- wide information with others Traffic Optimization... A Topology! Link information! C1 C2 C3 SubD1 SubD3 SubD2 16 World-Leading Research with Real-World Impact!
Data Plane Data Plane Security Challenges Security Challenges Flow rules installation Switch-Controller link Genuine vs. malicious rules Limited table entries Limited switch buffer #switches per controller path Length 17 World-Leading Research with Real-World Impact!
Data Plane Data Plane Targeted Threat/Proposed Solution Targeted Threat/Proposed Solution man-in-the-middle attacks flow rule contradiction Real-time contradiction check FortNox 18 World-Leading Research with Real-World Impact!
High level points -- Debate 19 World-Leading Research with Real-World Impact!
Centralization in SDN Centralization in SDN The Good: The Good: Fast responsiveness Easy to removing policy inconsistencies centralized routing algorithms Firewalls network-monitoring The Bad: The Bad: Single point of failure may be exploited by an internal internal or external external attacker Regarding Regarding DDoS Bad Bad: centralization added a new type of denial-of-service (DoS) vector. Good Good: Effective management of existing DoS attack types Using Global view Traffic analysis New security challenges but benefits appear to be predominant!!! New security challenges but benefits appear to be predominant!!! DDoS Marc C. Dacier, Hartmut Cwalinski , Frank Kargl , Sven Dietrich, Security Challenges and Opportunities of Software-Defined Networking, Apr 3, 2017 20 World-Leading Research with Real-World Impact!
Attack Surface vs. Defense Opportunities Attack Surface vs. Defense Opportunities Good: Good: In SDN defenders can create customized security solutions e.g Anomaly detection systems Global view Open hardware interfaces Centralized control Bad: Bad: Benefit the attackers (zero day attacks zero day attacks) The centralized architecture Lack of defender expertise Still immature technology Marc C. Dacier, Hartmut Cwalinski , Frank Kargl , Sven Dietrich, Security Challenges and Opportunities of Software-Defined Networking, Apr 3, 2017 21 World-Leading Research with Real-World Impact!
Centralized vs. Distributed Approach Centralized vs. Distributed Approach Good: Good: Reduced complexity by splitting into planes. Easier testable E.g, routing algorithms simpler than the distributed approach in conventional networks. Bad: Bad: Stressed by two aspects that strongly call for the use of a distributed approach. The need for scalability scalability Operational requirements ( Operational requirements (fault tolerance) Marc C. Dacier, Hartmut Cwalinski , Frank Kargl , Sven Dietrich, Security Challenges and Opportunities of Software-Defined Networking, Apr 3, 2017 22 World-Leading Research with Real-World Impact!
Is SDN More Complex?, or Is It Simpler? Is SDN More Complex?, or Is It Simpler? Implementing the control plane completely in software Implementing the control plane completely in software Good : Good : Programmability Bad: Bad: Opposes simplicity : raises issues about algorithmic complexity. Why Why: additional requirements that weren t imposed on classical networks but are now thinkable in SDN. Simplicity is a key design principle in building secure systems. SDN has the potential to be simple SDN has the potential to be simple but making it simple is quite complex. but making it simple is quite complex. Marc C. Dacier, Hartmut Cwalinski , Frank Kargl , Sven Dietrich, Security Challenges and Opportunities of Software-Defined Networking, Apr 3, 2017 23 World-Leading Research with Real-World Impact!
Open problems & research directions Open problems & research directions How to implement authentication and authorization authentication and authorization to certify SDN applications. How to implement access control and accountability access control and accountability in SDN. How to implement customized security procedures security procedures based on the type or categories of applications. categories of applications. How can we find automated automated derivation of Secure SDN Configurations How can we secure the controller controller- -switches communication switches communication? ? How can we perform efficient intrusion detection intrusion detection and anomaly detection SDNs? How can we operate SDN operate SDN in presence of untrusted How can we protect the controller protect the controller itself? ? type or Configurations. anomaly detection in untrusted HW HW components? Without security, SDN will not succeed! 24 World-Leading Research with Real-World Impact!
Thank you Thank you 25 World-Leading Research with Real-World Impact!
