Attribute-Guard: Attribute-Based Flow Access Control Framework in Software-Defined Networking

Abstract

Software-defined networking (SDN) decouples the control plane from the data plane, offering flexible network configuration and management. Because of this architecture, some security features are missing. On the one hand, because the data plane only has the packet forwarding function, it is impossible to effectively authenticate the data validity. On the other hand, OpenFlow can only match based on network characteristics, and it is impossible to achieve fine-grained access control. In this paper, we aim to develop solutions to guarantee the validity of flow in SDN and present Attribute-Guard, a fine-grained access control and authentication scheme for flow in SDN. We design an attribute-based flow authentication protocol to verify the legitimacy of the validity flow. The attribute identifier is used as a matching field to define a forwarding control. The flow matching based on the attribute identifier and the flow authentication protocol jointly implement fine-grained access control. We conduct theoretical analysis and simulation-based evaluation of Attribute-Guard. The results show that Attribute-Guard can efficiently identify and reject fake flow.

Attribute identification based IoT fog data security control and forwarding

“…In the table, l denotes the number of switches in the forwarding path, and M denotes the computation process of a message authentication code. It can be seen from Table 3 that the extra header overhead and the verification overhead of data packets for SDNsec ( Sasaki et al, 2016 ) grow linearly with l , which will incur large overhead when the forwarding path is long; P4Label ( Zuo et al, 2020 ) introduces large extra header overhead and requires three pairing bilinear operations at the egress switch; Attribute-Guard’s ( Zhu et al, 2020 ) verification overhead of data packets increases linearly with the number of attribute features, when the value of | S Υ | is large, it will cause huge cost to the controller. Compared to related schemes, AISCF incurs less extra header overhead and has smaller and more stable time overhead for data packet verification.…”

“…To enable users to flexibly use data streams on demand, Halpern & Pignataro (2015) proposed service function chain (SFC), which built the SDN flow table and controlled and forwarded data streams according to different user needs, but SFC did not analyze the security of the scheme. Zhu et al ’s ( 2020 ) Attribute-Guard used attribute features to classify rules issued by SDN controller into fine-grained categories, improving the drawback of fixed OpenFlow match item categories, and combined digital signature to verify the source of different types of data streams, but the scheme executed signature verification process on switches, introducing large forwarding delay.…”

“…AISCF only performs sampling at the switching devices, and delegates the signature verification process to the controller. Attribute-Guard ( Zhu et al, 2020 ) has a large time overhead in the verification process, because it involves multiple bilinear pairings and polynomial calculations in the signature verification process, and the number of calculations is linearly related to the number of attributes, which increases the forwarding delay of data packets. Compared with Attribute-Guard, AISCF only performs one bilinear pairing and one exponentiation in the signature verification process, which significantly improves the signature verification overhead.…”

A Secure Data Flow Forwarding Method Based on Service Ordering Management

“…Password identification enabled a more accurate representation of the data flow and ensured the integrity of the message. Previous studies [28] introduced an attribute-based group signature algorithm to verify the data packet forwarding process, signed data packets flowing into the network according to the user identity and other attributes, and controlled and forwarded data flows based on user attributes, achieving fine-grained secure data flow forwarding and verification. However, the methods proposed in [27,28] only signed the message load, which could not guarantee the security of the matches as the basis for forwarding and could not defend against network attacks launched by attackers through match tampering or forgery.…”

“…Previous studies [28] introduced an attribute-based group signature algorithm to verify the data packet forwarding process, signed data packets flowing into the network according to the user identity and other attributes, and controlled and forwarded data flows based on user attributes, achieving fine-grained secure data flow forwarding and verification. However, the methods proposed in [27,28] only signed the message load, which could not guarantee the security of the matches as the basis for forwarding and could not defend against network attacks launched by attackers through match tampering or forgery. SDNsec [29] added a code containing the transmission path information to the data packet; thus, the switch could verify this field of data packets that pass through the switch in the network, discard those that violated the path rules, and ensure data packet forwarding according to the path specified path in the SDN.…”