Security in Software Defined Networking. Professor : Admela Jukan Supervisor : Marcel Caria Student : Siqian Zhao

Security in Software Defined Networking

P f Ad l J k

• Professor : Admela Jukan • Supervisor : Marcel Caria • Student : Siqian Zhao

Overview

• Software Defined Networking (SDN)

 Legacy Networking VS. SDN

 d t f SDN

 advantages of SDN

• the security problems in SDN

caused by malicious attack

 d b i fi ti

caused by misconfiguration

Routing in Legacy Networking

• Routing : select a path to forward packets from sender to receiver.

• In Legacy networking :In Legacy networking :

Each network node has its own control plane.

Information is collected individually from all network nodes.→ Problem

Management Plane

Control Control Control Control Control Control Control Plane Control Plane Control Plane Control Plane Control Plane Control Plane Data Plane

Routing in SDN

• Centralized control in SDN :

API

App App App App App

SDN controller

Data

Plane

Plane

SDN Deployment and Market

• Deployment example --- Google

• 2010: Google started implementing SDN.

O t b 2012 G l id th t it' i t t d it t i t ti l SDN b d

• October 2012: Google said, that it's going to extend its current international SDN-based

inter-data center network.

SDN Future

• According to SDN Central :

Security Concern in SDN

• Since the beginning of 2013, various working groups have been established to

study the security in SDN.

• Such as : ONF,ETSI,ITU

Id i t f d i i it i f th t t

• Idea : importance of designing security in from the start.

• However, SDN hardware, software and services which are already in production and

service lack of consideration of security implication!

• Mission : explore techniques and policies to overcome the SDN security challenges

Security in SDN---Challenges

• Security Challenges :

Attack on the centralized controller

T t bl b t t ll d ft li ti

Trust problem between controller and software applications

Attack on the communication channel between controller and devices Conflicting flow rules

F di l Forwarding loops Application Malicious Application

SDN Controller

Security in SDN---DoS

• Attack on the controller : Denial of Service

Flow matched ? ---forward packet.

No flow matched ? send packet to the controller No flow matched ? ---send packet to the controller.

• Thus , an attacker can execute a DoS attack on the node by setting up constantly new

and unknown flows.

SDN controller SDN controller

step 2 step 3

step 1 step 4

packet

Security in SDN---DoS

• Possible solution to DoS attack :

Run the device in proactive mode or using Firewall

Fi ll ft h d b d t k it t th t t l th

• Firewall : a software or hardware-based network security system that controls the

incoming and outgoing network traffic based on applied rule set.

Internet

Header

Security in SDN---Malicious Applications

• Trust issue between controller and applications

A

SDN controller

App App App App

• Malicious application can now be easily developed and deployed on controllers.

Security in SDN---Control Channel Attack

• Attack on the control channel

SDN Controller

control channel

SSL

• Attack can either pretend to be the controller or the switch!

Security in SDN---Control Channel Attack

• Possible solution 2 to the attack on the control channel :

Security in SDN---Misconfiguration

• Conflicting flow rules by OF switch :

 Multiple OF applications run on a network controller device.  Diff t li ti i t diff t t l li i d i ll  Different applications insert different control policies dynamically.

conflicting flow rules may arise! _{App 1 : A to B ; Modify SRC IP to X.}

App 2 : X to B ; Modify DST IP to C

SDN controller App 2 : X to B ; Modify DST IP to C.

App 3 : X to C , Forward.

BLOCK : A C Host B

Host A

Security in SDN---Misconfiguration

10.1.x.x

Packet PacketPacket

10.1.x.x ; to A 10.x.x.x ; to Green

Security in SDN---Misconfiguration

• Nox Controller

 Nox : an open-source platform that simplifies the creation of software for controlling or monitoring networks

monitoring networks.

: relay flow rules from OF application t th it h

Security in SDN---Misconfiguration

• Possible solution : Fortnox --- an extension to the NOX controller by providing

non-bypass flow rules.

when flow rules when flow rules

are conflict,compare the level of h i i authorization roles.

Security in SDN---Misconfiguration

• Role-based Source Authentication :

 assign priority to a candidate flow rule , recognize 3 standard authorization levels among flow rule producers

among flow rule producers.

OF Operator Level : _{define authoritative security policy}

OF Security Level : add flow constraints to combat live _{threat activity}

Security in SDN---OpenDaylight Controller

• Another possible solution in OpenDaylight Controller : Defense4All.

 Monitoring behavior of protected traffic  Diverting attacked traffic to selected AMSs

SDN Security Research in IDA

• SASER : Safe And Secure European Routing

--- Start date : August 2012 E d S t b 2015 --- End : September 2015

--- Total Budget : about 80 million Euros --- Effort : more than 500 person years

SDN l t d h

• SDN related researches :

---Security concept for a new architecture based on software defined networking. ---General architecture specification

---Network optimization …

Conclusion

• The evolvement of SDN from the legacy network • Security challenges in SDN and possible solutions

SDN h i IDA