Software Defined Networking : A Security Perspective Dr. Sarker - PowerPoint PPT Presentation

Software Defined Networking : A Security Perspective Dr. Sarker Tanveer Ahmed Rumee Dept. of CSE, University of Dhaka

Traditional Network Infrastructure

Two Main Tasks • Control of information flow (control plane) – Calculation of routing decisions / tables – Additional decision: QoS, Security etc. • Forwarding of information (data plane) – Forward network packets based on predetermined/ precalculclated decisions

Traditional Computer Networks Data plane: Packet streaming Forward, filter, buffer, mark, rate-limit, and measure packets

Traditional Computer Networks Control plane: Distributed algorithms Track topology changes, compute routes, install forwarding rules

Traditional Computer Networks Management plane: Human time scale Collect measurements and configure the equipment

We want to do better • How? – One possible solution is to separate the control plane from the data plane – Provides great flexibility – Easier to accommodate change – Solution: Software Defined Network

Software Defined Networking (SDN) Smart, Logically-centralized control slow API to the data plane (e.g., OpenFlow) Dumb, fast Switches

Software Defined Network (SDN) Control Program A Control Program B Network OS Packet Forwarding Packet Forwarding Packet Forwarding Packet Forwarding Packet Forwarding

Applications Applications Applications North bound API Network O.S. SDN Southbound API Switch Operating System Switch Hardware

Implications Of SDN Current Networking SDN Enabled Environment Applications Applications Applications Applications Applications Applications Applications Network O.S. Network O.S. Global View ASIC ASIC Controller (N. O.S.) Applications Applications Programmatic Southbound Network O.S. Control ASIC API Switch O.S Switch HW Switch O.S Switch O.S Switch HW Switch HW

SDN Challenges

Controller Availability Applications Applications Applications Controller (N. O.S.) 13

Controller Availability Applications Applications Applications Controller (N. O.S.) 14

Controller Availability “ control a large force like a small force: divide and conquer” --Sun Tzu, Art of war • How many controllers? • How do you assign switches to controllers? • More importantly: which assignment reduces Applications processing time Applications Applications • How to ensure consistency between Controller (N. O.S.) controllers Applications Applications Applications Applications Applications Applications Controller (N. O.S.) Controller (N. O.S.) 15

SDN Reliability/Fault Tolerance Controller : Single point of Existing network control • Bug in controller takes the survives failures or bugs whole network down in code for any one devices Applications Applications Applications Controller (N. O.S.) 16

SDN Security Controller: Single point of control If one device in the • Compromise controller current networks are compromised the network may still be Applications Applications Applications safe Controller (N. O.S.) 17

SDN Security Controller: Single point of control • Compromise controller • Denial of Service attack the control channel Applications Applications Applications Controller (N. O.S.) 18

SDN Security issues

Primary Concerns • Security Challenges :  Attack on the centralized controller  Trust problem between controller and software applications  Attack on the communication channel between controller and devices

Security in SDN---DoS Attack in Detail step 2 step 3 packet step 1 step 4 sender switch receiver

Security in SDN---DoS • Possible solution to DoS attack :  Run the device in proactive mode or using Firewall Internet Header Header

Security in SDN---Malicious Applications App App App App SDN controller • Malicious application can now be easily developed and deployed on controllers. • Possible solutions : software attestation.

Security in SDN---Control Channel Attack SDN Controller control channel SSL • Attack can either pretend to be the controller or the switch! • Possible solution 1: encrypt the channel by SSL.

Control Channel Attack Solution -2

Conclusion • SDN is still is in infancy period • Security protection of SDN – standards not developed yet • Eventually SDN will be standard • We need to find solutions and mechanisms to make it work for all kinds of networks