AVANT-GUARD: Scalable and Vigilant Switch Flow Management in Software-Defined Networks

Cited 0 time in webofscience Cited 0 time in scopus
  • Hit : 231
  • Download : 715
Among the leading reference implementations of the Software Defined Networking (SDN) paradigm is the OpenFlow framework, which decouples the control plane into a centralized application. In this paper, we consider two aspects of OpenFlow that pose security challenges, and we propose two solutions that could address these concerns. The first challenge is the inherent communication bottleneck that arises between the data plane and the control plane, which an adversary could exploit by mounting a "control plane saturation attack" that disrupts network operations. Indeed, even well-mined adversarial models, such as scanning or denial-of-service (DoS) activity, can produce more potent impacts on OpenFlow networks than traditional networks. To address this challenge, we introduce an extension to the OpenFlow data plane called "connection migration", which dramatically reduces the amount of data-to-control-plane interactions that arise during such attacks. The second challenge is that of enabling the control plane to expedite both detection of, and responses to, the changing flow dynamics within the data plane. For this, we introduce "actuating triggers" over the data plane's existing statistics collection services. These triggers are inserted by control layer applications to both register for asynchronous call backs, and insert conditional flow rules that are only activated when a trigger condition is detected within the data plane's statistics module. We present Avant-Guard, an implementation of our two data plane extensions, evaluate the performance impact, and examine its use for developing more scalable and resilient SDN security services.
Publisher
ACM
Issue Date
2013-11-06
Language
English
Citation

20st ACM Conference on Computer and Communications Security (CCS), pp.413 - 424

ISBN
978-1-4503-2477-9
URI
http://hdl.handle.net/10203/205898
Appears in Collection
EE-Conference Papers(학술회의논문)
Files in This Item
avant-guard_ccs13.pdf(1.29 MB)Download

qr_code

  • mendeley

    citeulike


rss_1.0 rss_2.0 atom_1.0