Security enhancement through flow based centralized control in software defined networking

Abstract

Software Defined Networking (SDN) is a new trend that can provide innovative security techniques for finding and mitigating attacks in efficient ways as compared to the distributed environment in legacy networks. In SDN, the presence of network intelligence at the central point provides opportunities to strengthen security but it introduces some new challenges also. This work evaluates the current security status of SDN itself, makes a comparative analysis with traditional network security and suggests security improvements in SDN based on a comparative study. To address the SDN security issues, four use cases based threat model has been proposed that covers the security requirements of SDN. These use cases are: (I) protecting controllers from applications, (II) inter controller protection, (III) protecting data plane or switches from the controller, and (IV) protecting controllers from malicious switches. All probabilities of attack patterns and possible solutions have been considered and it has been found that these SDN components are interrelated. If one is secure another one is already secured. The current work also compares the SDN and traditional network security in terms of these four use cases and provides insights for protection mechanisms and security enhancements. Moreover SDN can also use third-party applications. An infected application can be distributed in the network and SDN-based systems may easily be collapsed. Further work presents a threat assessment model which highlights the critical threats areas with mitigation requirements in SDN. Based on the threat assessment model, Security Threats Assessment and Diagnostic System (STADS) is proposed for establishing a reliable SDN framework. The proposed STADS detects and diagnoses various threats based on specified policy mechanism when different components of SDN communicate with the controller to fulfill network requirements. Ryu controller and its python based modules have been used for system development. Mininet which is an SDN emulator has been