Software Defined Networking Security Research Articles

Malware Propagation and Prevention Model for Time-Varying Community Networks within Software Defined Networks

As the adoption of Software Defined Networks (SDNs) grows, the security of SDN still has several unaddressed limitations. A key network security research area is in the study of malware propagation across the SDN-enabled networks. To analyze the spreading processes of network malware (e.g., viruses) in SDN, we propose a dynamic model with a time-varying community network, inspired by research models on the spread of epidemics in complex networks across communities. We assume subnets of the network as communities and links that are dense in subnets but sparse between subnets. Using numerical simulation and theoretical analysis, we find that the efficiency of network malware propagation in this model depends on the mobility rate q of the nodes between subnets. We also find that there exists a mobility rate threshold qc. The network malware will spread in the SDN when the mobility rate q>qc. The malware will survive when q>qc and perish when q<qc. The results showed that our model is effective, and the results may help to decide the SDN control strategy to defend against network malware and provide a theoretical basis to reduce and prevent network security incidents.

A Preliminary Survey on the Security of Software-Defined Networks

The number of devices connected to the Internet is increasing, data centers are growing continuously and computer networks are getting more complex. Traditional network management approach is becoming more difficult and insufficient. Software-Defined Networks (SDN) is a new generation networking approach which is expected to take place of the traditional computer networks. SDN architecture provides effective management of the large and complex networks. Although SDN have benefits from the network security perspective, it also brings new attack vectors. We believe that the network security problems in SDN architecture need more advanced solutions. In this work, a survey on the SDN security problems is presented, challenges are discussed. In this context, security threats and attack surfaces in SDN are described, the significant SDN security solution examples in the literature are given.

Software‐defined networking (SDN): a survey

AbstractWith the advent of cloud computing, many new networking concepts have been introduced to simplify network management and bring innovation through network programmability. The emergence of the software‐defined networking (SDN) paradigm is one of these adopted concepts in the cloud model so as to eliminate the network infrastructure maintenance processes and guarantee easy management. In this fashion, SDN offers real‐time performance and responds to high availability requirements. However, this new emerging paradigm has been facing many technological hurdles; some of them are inherent, while others are inherited from existing adopted technologies. In this paper, our purpose is to shed light on SDN related issues and give insight into the challenges facing the future of this revolutionary network model, from both protocol and architecture perspectives. Additionally, we aim to present different existing solutions and mitigation techniques that address SDN scalability, elasticity, dependability, reliability, high availability, resiliency, security, and performance concerns. Copyright © 2017 John Wiley & Sons, Ltd.

Devolving IEEE 802.1X authentication capability to data plane in software‐defined networking (SDN) architecture

AbstractSoftware‐defined networking (SDN) is a relatively new approach in network management that proposes to separate the network control (Control plane) and the forwarding process (Data plane) to optimize the network infrastructure and improve network performance, controllability, manageability and flexibility. However, like every technology, SDN has brought its own new challenges in terms of security and scalability which are very important aspects that should be considered to design and build a resilient architecture in order to meet carrier grade network requirements. In this paper, we propose a secure SDN architecture with IEEE 802.1X port‐based authentication where we also consider the controller's scalability issue by devolving the access control capability to the data plane. In this way, we reduce the high demand and the workload on the SDN controller. Our proposed model presents a novel SDN network architecture and logical network segmentation which provides an optimal and secure network access with low latency. We have implemented and tested our architecture to show its performance (authentication delays). Copyright © 2016 John Wiley & Sons, Ltd.

Patterns for the design of secure and dependable software defined networks

In an interconnected world, cyber and physical networks face a number of challenges that need to be resolved. These challenges are mainly due to the nature and complexity of interconnected systems and networks and their ability to support heterogeneous physical and cyber components simultaneously. The construction of complex networks preserving Security and Dependability (S&D) properties is necessary to avoid system vulnerabilities, which may occur in all the different layers of Software Defined Networking (SDN) architectures. In this paper, we present a model based approach to support the design of secure and dependable SDN. This approach is based on executable patterns for designing networks able to guarantee S&D properties and can be used in SDN networks. The design patterns express conditions that can guarantee specific S&D properties and can be used to design networks that have these properties and manage them during their deployment. To evaluate our pattern approach, we have implemented executable pattern instances, in a rule-based reasoning system, and used them to design and verify wireless SDN networks with respect to availability and confidentiality. To complete this work, we propose and evaluate an implementation framework in which S&D patterns can be applied for the design and verification of SDN networks.

Security in Software-Defined Networking: Threats and Countermeasures

In recent years, Software-Defined Networking (SDN) has been a focus of research. As a promising network architecture, SDN will possibly replace traditional networking, as it brings promising opportunities for network management in terms of simplicity, programmability, and elasticity. While many efforts are currently being made to standardize this emerging paradigm, careful attention needs to be also paid to security at this early design stage. This paper focuses on the security aspects of SDN. We begin by discussing characteristics and standards of SDN. On the basis of these, we discuss the security features as a whole and then analyze the security threats and countermeasures in detail from three aspects, based on which part of the SDN paradigm they target, i.e., the data forwarding layer, the control layer and the application layer. Countermeasure techniques that could be used to prevent, mitigate, or recover from some of such attacks are also described, while the threats encountered when developing these defensive mechanisms are highlighted.

A Survey of Security in Software Defined Networks

The proposition of increased innovation in network applications and reduced cost for network operators has won over the networking world to the vision of software-defined networking (SDN). With the excitement of holistic visibility across the network and the ability to program network devices, developers have rushed to present a range of new SDN-compliant hardware, software, and services. However, amidst this frenzy of activity, one key element has only recently entered the debate: Network Security . In this paper, security in SDN is surveyed presenting both the research community and industry advances in this area. The challenges to securing the network from the persistent attacker are discussed, and the holistic approach to the security architecture that is required for SDN is described. Future research directions that will be key to providing network security in SDN are identified.

Software-Defined Networking (SDN) and Distributed Denial of Service (DDoS) Attacks in Cloud Computing Environments: A Survey, Some Research Issues, and Challenges

Distributed denial of service (DDoS) attacks in cloud computing environments are growing due to the essential characteristics of cloud computing. With recent advances in software-defined networking (SDN), SDN-based cloud brings us new chances to defeat DDoS attacks in cloud computing environments. Nevertheless, there is a contradictory relationship between SDN and DDoS attacks. On one hand, the capabilities of SDN, including software-based traffic analysis, centralized control, global view of the network, dynamic updating of forwarding rules, make it easier to detect and react to DDoS attacks. On the other hand, the security of SDN itself remains to be addressed, and potential DDoS vulnerabilities exist across SDN platforms. In this paper, we discuss the new trends and characteristics of DDoS attacks in cloud computing, and provide a comprehensive survey of defense mechanisms against DDoS attacks using SDN. In addition, we review the studies about launching DDoS attacks on SDN, as well as the methods against DDoS attacks in SDN. To the best of our knowledge, the contradictory relationship between SDN and DDoS attacks has not been well addressed in previous works. This work can help to understand how to make full use of SDN's advantages to defeat DDoS attacks in cloud computing environments and how to prevent SDN itself from becoming a victim of DDoS attacks, which are important for the smooth evolution of SDN-based cloud without the distraction of DDoS attacks.

A Security Analysis of a Hybrid Mechanism to Defend DDoS Attacks in SDN

Software Defined Network (SDN) is a new network architecture based on centralized management that configures a network in real time through a controller. In this paper, we analyze the vulnerability of an SDN security system in the midst of a DDoS attack. We regard an existing security mechanism, which employs a trust value and entropy computed by client's access behaviors, as a security mechanism of a controller. We analyze this security system using the STRIDE threat model. In addition, suggestions when designing a secure application for an SDN will be discussed in this paper.

Survey on SDN Security Mechanisms

Software Defined Network is developed by the demand of large business organization. Software Defined Network (SDN) is a new network architecture that provides central control over the network. SDN achieve the centralized control by separating the network control from forwarding and is directly programmable. In SDN there is a controller which controls the entire network. The main benefit of SDN is the centralized control and network control programmability. central control is the major advantage of SDN but it leads to central point of failure. The programmability of network control leads to another vulnerabilities. However, before any large scale deployments, it is important to understand security issues arising from this new technology. This survey paper deal with SDN security issues and 9 security mechanism.

Modelling cyber security for software-defined networks those grow strong when exposed to threats

With each passing day, the information and communication technologies are evolving with more and more information shared across the globe using the internet superhighway. The threats to information, while connected to the cyber world are getting more targeted, voluminous, and sophisticated requiring new antifragile and resilient network security mechanisms. Whether the information is being processed in the application, in transit within the network or residing in the storage, it is equally susceptible to attack at every level of abstraction and cannot be handled in isolation as the case has been with conventional security mechanisms. The advent of Software-Defined Networks (SDN) has given a new outlook to information protection, where the network can aid in the design of a system that is secure and dependable in case of cyber threats. The nature of SDN, mainly its programmability and centrality of network information and control has led us to think of security in an antifragile perspective. Our networks can now thrive and grow stronger when they are exposed to volatility by overwhelming cyber threats. However, SDN infrastructure itself is susceptible to severe threats that may mutilate the provision of its usability as security provider. Both these perspectives of “Security with SDN” and “Security for SDN” have invited research and innovations, yet both these approaches remain disintegrated, failing to support each other. The contribution of this paper is threefold, with first reviewing the current state of the art work for both perspectives of SDN security. Second, it advocates the necessity and introduces a novel approach of antifragile cyber security within SDN paradigm and finally it proposes a unified model for integrating both approaches of “Security with SDN” and “Security for SDN” to achieve the overall objective of protecting our information from cyber threats in this globally connected internetwork.

Security of Software Defined Networks: A survey

Software Defined Networking (SDN) has emerged as a new network architecture for dealing with network dynamics through software-enabled control. While SDN is promoting many new network applications, security has become an important concern. This paper provides an extensive survey on SDN security. We discuss the security threats to SDN according to their effects, i.e., Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service, and Elevation of Privilege. We also review a wide range of SDN security controls, such as firewalls, IDS/IPS, access control, auditing, and policy management. We describe several pathways of how SDN is evolving.

Software-defined networking security: pros and cons

Software-defined networking (SDN) is a new networking paradigm that decouples the forwarding and control planes, traditionally coupled with one another, while adopting a logically centralized architecture aiming to increase network agility and programability. While many efforts are currently being made to standardize this emerging paradigm, careful attention needs to be paid to security at this early design stage too, rather than waiting until the technology becomes mature, thereby potentially avoiding previous pitfalls made when designing the Internet in the 1980s. This article focuses on the security aspects of SDN networks. We begin by discussing the new security advantages that SDN brings and by showing how some of the long-lasting issues in network security can be addressed by exploiting SDN capabilities. Then we describe the new security threats that SDN is faced with and discuss possible techniques that can be used to prevent and mitigate such threats.

Enabling security functions with SDN: A feasibility study

Software-defined networking (SDN) is being strongly considered as the next promising networking platform, and studies regarding SDN have been actively conducted accordingly. However, the security of SDN remains undefined and unknown when considering the enhancement of network security in SDN. In this paper, we verify whether SDN can enhance network security. Specifically, the idea of enabling security functions with diverse SDN features is explored thoroughly. In order to elucidate the feasibility of SDN-based security functions, we implement four types of security functions with SDN in Floodlight applications: (i) in-line mode security functions (e.g. firewalls and IPS), (ii) passive mode security functions (e.g. IDS), (iii) network anomaly detection functions (e.g. scan and DDoS detector), and (iv) advanced security functions (e.g. stateful firewall and reflector networks). Furthermore, we focus on discovering issues that might arise throughout the implementation of SDN-based security applications and discuss how these issues can be addressed. In order to appropriately prove the feasibility of the SDN-based security applications, we evaluate our Floodlight applications in real testbeds that consist of SDN-enabled switches and a number of physical hosts.

IRIS-CoMan: Scalable and Reliable Control and Management Architecture for SDN-Enabled Large-Scale Networks

A software-defined network (SDN) enables agile network control and configuration as well as shortens the network function deployment time. Despite the projected benefits of an SDN, the abstractions toward the remote and centralized control tend to impose excessive control traffic overhead in order for the controller to acquire global network visibility as well as extend the legacy network's inaccurate and unreliable management problems into the control plane. In addition, many recent SDNs facilitate multiple management pillars (such as customized interfaces and protocols) so that user applications can directly communicate to the data plane to measure and monitor specific information. Not only logical control centralization, but also virtualization of the underlying computing and network resources add demands of more flexible and programmable monitoring functions per the virtual domain. A complex combination of multiple and heterogeneous management channels introduces the significant scalability, control tuning, and reliability problems in SDN. In this paper, to address the above control and management problems, we propose a highly scalable and reliable SDN control and management architecture, called IRIS Control and Management (IRIS-CoMan). It builds an intelligent agent based hybrid SDN architecture by providing a control and management abstraction and filtering layer. It serves an essential component for the reliable, scalable, and secure SDN deployment. We present design, implementation, deployment, and feasibility evaluation results of IRIS-CoMan.

Security in Software Defined Networks: A Survey

Software defined networking (SDN) decouples the network control and data planes. The network intelligence and state are logically centralized and the underlying network infrastructure is abstracted from applications. SDN enhances network security by means of global visibility of the network state where a conflict can be easily resolved from the logically centralized control plane. Hence, the SDN architecture empowers networks to actively monitor traffic and diagnose threats to facilitates network forensics, security policy alteration, and security service insertion. The separation of the control and data planes, however, opens security challenges, such as man-in-the middle attacks, denial of service (DoS) attacks, and saturation attacks. In this paper, we analyze security threats to application, control, and data planes of SDN. The security platforms that secure each of the planes are described followed by various security approaches for network-wide security in SDN. SDN security is analyzed according to security dimensions of the ITU-T recommendation, as well as, by the costs of security solutions. In a nutshell, this paper highlights the present and future security challenges in SDN and future directions for secure SDN.

New Security Architecture for IoT Network

We explain the notion of security architecture for Internet of Things (IoT) based on software-defined networking (SDN). In this context, the SDN-based architecture works with or without infrastructure, that we call SDN-Domain. This work describes the operation of the proposed architecture and summarizes the opportunity to achieve network security in a more efficient and flexible with SDN. An overview of existing SDN security applications were discussed and tackles its issues, presenting a new IoT system's architecture. In this paper we considered the network access control and global traffic monitoring for ad-hoc networks. Finally, we point out architectural design choices for SDN using OpenFlow and discuss their performance implications.

Guest Editorial: Cloud Security

Guest Editorial: Cloud Security

Byzantine-Resilient Secure Software-Defined Networks with Multiple Controllers in Cloud

Software-defined network (SDN) is the next generation of networking architecture that is dynamic, manageable, cost-effective, and adaptable, making it ideal for the high-bandwidth, dynamic nature of today’s applications. In SDN, network management is facilitated through software rather than low-level device configurations. However, the centralized control plane introduced by SDN imposes a great challenge for the network security. In this paper, we present a secure SDN structure, in which each device is managed by multiple controllers, not just a single as in a traditional manner, with the dynamic and isolated instance provided by the cloud. It can resist Byzantine attacks on controllers and the communication links between controllers and SDN switches. Furthermore, we study a controller minimization problem with security requirement and propose a cost-efficient controller assignment algorithm with a constant approximation ratio. From the experiment result, the secure SDN structure has little impact on the network latency, provide better security than general distributed controller, and the proposed algorithm performs higher efficiency than random assignment.