Machine-verified network controllers

Guha, Arjun; Reitblatt, Mark; Foster, Nate

doi:10.1145/2491956.2462178

Cited by 82 publications

(61 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…SOFT tests OpenFlow switches for interoperability with reference implementations [35]. Guha et al contributed "the first machine-verified [Software Defined Networking] controller" [23].…”

Section: Related Workmentioning

confidence: 99%

Software dataplane verification

Dobrescu

Argyraki

2015

Commun. ACM

View full text Add to dashboard Cite

Software dataplanes are emerging as an alternative to traditional hardware switches and routers, promising programmability and short time to market. These advantages are set against the risk of disrupting the network with bugs, unpredictable performance, or security vulnerabilities. We explore the feasibility of verifying software dataplanes to ensure smooth network operation. For general programs, verifiability and performance are competing goals; we argue that software dataplanes are different-we can write them in a way that enables verification and preserves performance. We present a verification tool that takes as input a software dataplane, written in a way that meets a given set of conditions, and (dis)proves that the dataplane satisfies crash-freedom, bounded-execution, and filtering properties. We evaluate our tool on stateless and simple stateful Click pipelines; we perform complete and sound verification of these pipelines within tens of minutes, whereas a state-of-theart general-purpose tool fails to complete the same task within several hours.

show abstract

“…SOFT tests OpenFlow switches for interoperability with reference implementations [35]. Guha et al contributed "the first machine-verified [Software Defined Networking] controller" [23].…”

Section: Related Workmentioning

confidence: 99%

Software dataplane verification

Dobrescu

Argyraki

2015

Commun. ACM

View full text Add to dashboard Cite

show abstract

“…SOFT [21] introduces an approach for testing the interoperability of OpenFlow switches with reference implementations. [14] designs and presents the first machine-verified SDN controller based on NetCore [25]. [11] introduces a verification tool that takes the software program of a data plane as input and check target properties.…”

Section: Related Workmentioning

confidence: 99%

Poisoning Network Visibility in Software-Defined Networks: New Attacks and Countermeasures

Hong

Wang

et al. 2015

Proceedings 2015 Network and Distributed System Security Symposium

331

256

View full text Add to dashboard Cite

Abstract-Software-Defined Networking (SDN) is a new networking paradigm that grants a controller and its applications an omnipotent power to have holistic network visibility and flexible network programmability, thus enabling new innovations in network protocols and applications. One of the core advantages of SDN is its logically centralized control plane to provide the entire network visibility, on which many SDN applications rely. For the first time in the literature, we propose new attack vectors unique to SDN that seriously challenge this foundation. Our new attacks are somewhat similar in spirit to spoofing attacks in legacy networks (e.g., ARP poisoning attack), however with significant differences in exploiting unique vulnerabilities how current S-DN operates differently from legacy networks. The successful attacks can effectively poison the network topology information, a fundamental building block for core SDN components and topology-aware SDN applications. With the poisoned network visibility, the upper-layer OpenFlow controller services/apps may be totally misled, leading to serious hijacking, denial of service or man-in-the-middle attacks. According to our study, all current major SDN controllers we find in the market (e.g., Floodlight, OpenDaylight, Beacon, and POX) are affected, i.e., they are subject to the Network Topology Poisoning Attacks. We then investigate the mitigation methods against the Network Topology Poisoning Attacks and present TopoGuard, a new security extension to SDN controllers, which provides automatic and real-time detection of Network Topology Poisoning Attacks. Our evaluation on a prototype implementation of TopoGuard in the Floodlight controller shows that the defense solution can effectively secure network topology while introducing only a minor impact on normal operations of OpenFlow controllers.

show abstract

“…And this fact requires a new set of development tools. As an example, we could mention PANE SDN controller [25]. The controller provides an API that allows applications to dynamically add autonomously request network resources.…”

Section: On Requirements For Sdn Apimentioning

confidence: 99%

On Standards for Application Level Interfaces in SDN

Daradkeh¹,

Al‐Dhaifallah²,

Namiot³

et al. 2016

ijacsa

View full text Add to dashboard Cite

Abstract-In this paper, authors discuss application level interfaces for Software Defined Networks. While the Application Programming Interfaces for the interaction with the hardware are widely described in Software Defined Networks, the software interfaces for applications received far less attention. However, it is obvious that interfaces to software applications are very important. Actually, application level interfaces should be one of the main elements in Software Defined Networks. It is a core feature. In this article, we want to discuss the issues of standardization of software interfaces for applications in Software Defined Networks area. Nowadays, there are several examples of unified Application Program Interfaces in the telecommunications area. Is it possible to reuse this experience for Software Defined Networks or Software Defined Networks standards are radically different? This is the main question discussed in this paper.

show abstract

Machine-verified network controllers

Cited by 82 publications

References 28 publications

Software dataplane verification

Software dataplane verification

Poisoning Network Visibility in Software-Defined Networks: New Attacks and Countermeasures

On Standards for Application Level Interfaces in SDN

Contact Info

Product

Resources

About