BlockREV: Blockchain-Enabled Multi-Controller Rule Enforcement Verification in SDN

Abstract

Compared with the classical structure with only one controller in software-defined networking (SDN), multi-controller topology structure in SDN provides a new type of cross-domain forwarding network architecture with multiple centralized controllers and distributed forwarding devices. However, when the network includes multiple domains, lack of trust among the controllers remains a challenge how to verify the correctness of cross-domain forwarding behaviors in different domains. In this paper, we propose a novel secure multi-controller rule enforcement verification (BlockREV) mechanism in SDN to guarantee the correctness of cross-domain forwarding. We first adopt blockchain technology to provide the immutability and privacy protection for forwarding behaviors. Furthermore, we present an address-based aggregate signature scheme with appropriate cryptographic primitives, which is provably secure in the random oracle model. Moreover, we design a verification algorithm based on hash values of forwarding paths to check the consistency of forwarding order. Finally, experimental results demonstrate that the proposed BlockREV mechanism is effective and suitable for multi-controller scenarios in SDN.

Implementation of a SDN Architecture Observer: Detection of Failure, Distributed Denial-of-Service and Unauthorized Intrusion

“…A second controller, which played the role of a flter, was added for receiving the commands of the controller to the switches to validate them. Recently, blockchain has also been considered as an option to secure the control layer, particularly, the communication interface between the controllers, as in [21,31] or [32]. Te controllers' decisions are the subject of a vote among all other controllers to ensure the consistency of the decisions.…”

“…r learn ′ � r learn ; (26) if r learn ∈ R Set then (27) while timeout ps do (28) f � wait(fmod); (29) if type(f) � delete then (30) r learn ′ � r learn ′ /f′; (31) else if type(f) � add then (32) r learn ′ � r learn ′ ∪ f; (33) else if type(f) � modify then (34) r learn ′ � r learn ′ /f ′ & r learn ′ � r learn ′ ∪ f; (35) if cons(r learn ′ ) � � � � � � � r learn ′ � r learn then (36) return Fault; (43) while timeout mp do (44) f � wait(fmod); (45) if fmod ∈ R Set then (46) R Set � R Set /fmod (47) else (48) return Fault ALGORITHM 1: Observer Logic.…”