Vulnerabilities in SDN Due to Separation of Data and Control Planes

Abstract

Tremendous advancements over the past several decades revolutionized the networking research and technological industry, however, it is still dominated and remains hardware based. Such legacy networks are inflexible, hard and costly to scale and manage. Software defined networking (SDN) is a new approach to networking which enable comprehensive network programmability. SDN architecture bifurcates the data and control plane thereby simplifies network management. In this new architecture, the control plane consists of networking intelligence and the policy making ability is moved to a centralized entity called as controller. Commonly, SDN uses OpenFlow as the communication interface between the data and control planes. This separation while providing great opportunities for scalability, also introduces new vulnerabilities. We identify certain scenarios for vulnerabilities in the OpenFlow semantics that can subject the controller to distributed denial of service (DDoS) attack which is unique to SDN due to the new architecture where the control plane is separated from the data plane. We also explore some reactive mechanisms that can detect and help to devise techniques to prevent impending DDoS attack on an SDN controller.

Permissioned Blockchain-Based Security for SDN in IoT Cloud Networks

“…We have identified certain scenarios in which the SDN architecture becomes arXiv:2002.00456v1 [cs.CR] 2 Feb 2020 vulnerable to the attackers. These vulnerabilities allow attackers to execute a distributed denial of service (DDoS) attack on the network [2]. The DDoS attack can be performed by repeatedly sending unique packets requests to the controller.…”

“…From top-down, we have applications that use the two layers of control plane and data plane for communications. Note that the switches in SDN do not construct the forwarding table automatically but instead rely on the controller to construct a flow table [2], [3]. The control plane of the SDN architecture consists of a centralized controller, which is the most important new feature provided by SDN.…”

“…Access control mechanisms are widely using blockchain based solutions to manage access to sensitive and personal data [2], [14]. Access control systems manage the access of sensitive and personal data.…”

Detecting DDoS Attack on SDN Due to Vulnerabilities in OpenFlow

“…making decisions with a complete view of overall network conditions from a single and centralized point. Though SDN offers flexibility and efficient management at a low cost, it also introduces new vulnerabilities [3].…”