Software-Defined Networking (SDN) has redefined the architectural blueprint for designing networks suitable for future applications. Today, the idea of a centralized control plane managing its underlying resources is common for architectures in mobile and industrial networks. Guaranteeing resources availability for optimal operation of the control plane is of vital importance in SDN, since compromising the controller may result in an unforeseen behaviour in the data plane. This work focuses on the SDN reactive configuration mechanism, that although originally designed for the efficient handling of changing conditions in the data plane, it can be easily misused to overload the control plane. Aiming at addressing this problem, the PDP (Programmable Data Plane)-based Controller Protection Protocol (PCPP) is presented. This protocol introduces a mechanism that efficiently filters spoofed requests at the network edge. In PCPP, end-stations require to solve a challenge before sending any connection request to the controller. The challenge answer is checked at the edge switches, which only forward valid requests to the controller. PCPP is implemented using P4, a language for programming PDP-capable devices, and its evaluation is carried out using BMv2 software switches. The results demonstrate the effectiveness of PCPP at protecting bandwidth and processing resources in the control plane against spoofed requests. A comparison against an state-of-the-art alternative not only highlights the higher efficiency of PCPP, but also its application flexibility.

No abstract