Abstract. Software Defined Networks (SDN) aim to deconstruct current routers into a small number of controllers, which are general purpose machines, and a large number of switches that contain programmable forwarding engines. The vision is that instead of the ad-hoc mechanisms used in current routers we can build programmable networks using proper computer science abstractions. This technology is now at the startup stage, and is being deployed in the data centres of large web service firms. We are interested in protecting a future SDN. The current designs follow traditional security assumptions and do not consider many likely deployment scenarios. We discuss how SDN architecture can be structured to offer more security, the auxiliary services that such a network will require and the advantages that it can offer.

Software Defined Networking (SDN) deconstructs the current routing infrastructure into a small number of controllers, which are general purpose computers, and a large number of switches which are programmable forwarding engines. It is already deployed in data centres, where it offers considerable advantages of both cost and flexibility over a switching fabric of traditional routers. Such applications have a single controlling organisation and issues of trust between subdomains do not really arise. However for SDN to fulfil its potential, it is necessary to design and develop mechanisms for smart networks with mututally mistrustful principals.

Conventional techniques for combating phishing have focused primarily on detecting phishing web sites and preventing users from revealing their passwords to such sites. This passive form of defense is by its nature incomplete and does nothing to protect users that do reveal their passwords. Combating the phishing threat requires more than simple avoidance-it requires a more active approach to disrupting even successful phishing operations.Humboldt is a distributed system that submits poisonous fake data to phishing web sites that is indistinguishable from the input of actual phishing victims. The poisonous data collected by a phisher produces detectable behaviors when the phisher attempts to use it and provides a mechanism for tracking activities associated with identity theft. We evaluate Humboldt to show that it is effective in disrupting phishing operations with a reasonably low overhead.

The public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS.Software Defined Networking (SDN) has been developed rapidly and is now used by early adopters such as data centres. It offers immediate capital cost savings by replacing proprietary routers with commodity switches and controllers; the use of computer science abstractions in network management offers operational cost savings, with performance and functionality improvements too. However, there is a third class of benefits, that will come into their own once SDN is deployed in less controlled environments: and that is security. Traditional network architectures have many points of serious failure; the compromise of a single router can lead to significant attacks. SDN enables network designers to limit the damage that compromised switches can do, and thus can support more resilient and survivable networks in environments where opponents may have access to some of the infrastructure. In this paper we discuss the security aspects of SDN, and the possible opportunities that result. SUBJECT TERMS

No abstract