SDN are next generation networks. They provide high flexibility, reliability, and security. The main difference between SDN and the traditional network is separation of control and data plane. In SDN, only the controller has the decision-making capabilities. Whereas switches are responsible for traffic forwarding. The controller and switches can be programmed dynamically or as needed. Applications communicate directly with the SDN controller via the northbound interface. This plane is also called as application plane. On the other hand, SDN data plane communicates via the southbound interface. The data plane contains the hardware infrastructure of the SDN (e.g. routers, switches, etc.). The controller is a software program that controls the
…show more content…
Current SDN standard (Overflow) does not cover security aspect of the architecture~cite{Scott2015}. In this section, we will briefly discuss security challenges of SDN.
Some of the security threats to SDN are not new. They already exist for the traditional networks but their effect is much more devastating for SDN. DoS/DDoS attack is not new or limited to SDN but its effect is amplified several folds. If DDoS attack is launched on the controller from the southbound interface, its effect on the network will be much worse as compared to attack against a single node in the traditional network. On the other hand, if a successful controller spoofing attack is launched from the northbound interface then practically entire network is compromised~cite{Zhiyuan2015}.
SDN also presents some new and unique security challenges. Applications can dictate their networking requirements to the controller via northbound PAIS. In response, the controller converts those requirements into flows and installs them into the switches. Any malicious application can overwrite past policies/rules and make the network vulnerable (e.g. overwrite the old security rule with a new rule: bypass the firewall). There is no security mechanism in place to stop this kind of policy …show more content…
An attacker can find out the action taken by the switch on a specific packet (Drop, forward, or send it to the controller) by doing processing time analysis. Having discovered the action, the attacker can easily craft such a packet that will be forwarded to the controller. It could lead to DDoS attack on the SDN controller~cite{Scott2015}.
Misconfiguration of the policies could be an issue in SDN. These policies are updated continuously as new security threats are detected. If there is inconsistency in network or security policies, it can open network to potential vulnerabilities and attacks. Currently, there is no protection from such misconfiguration of policies in Overflow.
Another concern for the SDN is system level security. It should be able to provide network audit all the time (e.g. which devices are up or down, network state etc). It can be a challenging task. For example, Overflow supports a fail-secure mode for switches, if they are disconnected from the controller they can choose to operate on their internal logic that might not be desired behavior. Therefore, it is important to understand the forwarding behavior of the switch during interruptions because in order to provide auditing and accountability such information should be managed by the
Current SDN standard (Overflow) does not cover security aspect of the architecture~cite{Scott2015}. In this section, we will briefly discuss security challenges of SDN.
Some of the security threats to SDN are not new. They already exist for the traditional networks but their effect is much more devastating for SDN. DoS/DDoS attack is not new or limited to SDN but its effect is amplified several folds. If DDoS attack is launched on the controller from the southbound interface, its effect on the network will be much worse as compared to attack against a single node in the traditional network. On the other hand, if a successful controller spoofing attack is launched from the northbound interface then practically entire network is compromised~cite{Zhiyuan2015}.
SDN also presents some new and unique security challenges. Applications can dictate their networking requirements to the controller via northbound PAIS. In response, the controller converts those requirements into flows and installs them into the switches. Any malicious application can overwrite past policies/rules and make the network vulnerable (e.g. overwrite the old security rule with a new rule: bypass the firewall). There is no security mechanism in place to stop this kind of policy …show more content…
An attacker can find out the action taken by the switch on a specific packet (Drop, forward, or send it to the controller) by doing processing time analysis. Having discovered the action, the attacker can easily craft such a packet that will be forwarded to the controller. It could lead to DDoS attack on the SDN controller~cite{Scott2015}.
Misconfiguration of the policies could be an issue in SDN. These policies are updated continuously as new security threats are detected. If there is inconsistency in network or security policies, it can open network to potential vulnerabilities and attacks. Currently, there is no protection from such misconfiguration of policies in Overflow.
Another concern for the SDN is system level security. It should be able to provide network audit all the time (e.g. which devices are up or down, network state etc). It can be a challenging task. For example, Overflow supports a fail-secure mode for switches, if they are disconnected from the controller they can choose to operate on their internal logic that might not be desired behavior. Therefore, it is important to understand the forwarding behavior of the switch during interruptions because in order to provide auditing and accountability such information should be managed by the