A security enforcement kernel for OpenFlow networks

By Phillip A. Porras, Seungwon Shin, Vinod Yegneswaran, Martin W. Fong, Mabry Tyson, Guofei Gu. HotSDN '12, 2012

593 citations recorded by the source corpus.

Software-defined networks facilitate rapid and open innovation at the network control layer by providing a programmable network infrastructure for computing flow policies on demand. However, the dynamism of programmable networks also introduces new security challenges that demand innovative solutions. A critical challenge is efficient detection and reconciliation of potentially conflicting flow rules imposed by dynamic OpenFlow (OF) applications. To that end, we introduce FortNOX, a software extension that provides role-based authorization and security constraint enforcement for the NOX OpenFlow controller. FortNOX enables NOX to check flow rule contradictions in real time, and implements a novel analysis algorithm that is robust even in cases where an adversarial OF application attempts to strategically insert flow rules that would otherwise circumvent flow rules imposed by OF security applications. We demonstrate the utility of FortNOX through a prototype implementation and use it to examine performance and efficiency aspects of the proposed framework.

Subfields: Artificial Intelligence, Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/bb0621ec0d401962d5170ee7af5f3ac64f0b7064

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Networks and Communications

Citations in the corpus

A Survey on Software-Defined Wireless Sensor Networks: Challenges and Design Requirements (2017, methodology): “FortNox [63] is a perfect example of such, albeit implemented for basic SDN, the inference is relative to note.”
Poisoning Network Visibility in Software-Defined Networks: New Attacks and Countermeasures (2015, background): “FortNOX [27] solves the rule conflicts that violate existing security policies, and provides role-based authorization and security constraint enforcement in the controller kernel.”
Software Defined Networking Architecture, Security and Energy Efficiency: A Survey (2017, methodology): “FortNOX technique has been introduced in [101] and [113] to resolve the security threats in application layer and the control layer of SDN.”
Network Innovation using OpenFlow: A Survey (2014, unknown): “[78] propose a policy enforcement mechanism”
DDoS Attack Protection in the Era of Cloud Computing and Software-Defined Networking (2014, background): “proposed a security enforcement kernel for SDN in [24] to detect policy conflicts within the”
Security for 5G and Beyond (2019, background): “FortNox [204] provides the mechanism in the controller to check contradictions in flow rules that are generated by applications.”
Software-defined networking (SDN): a survey (2016, background): “According improperly high privileges can lead to serious malicious actions [127,137,144] XV) by relying on advanced techniques such as malwares [61], social engineering, man in the middle, and spoo ﬁ ng (Table XII).”
FloodGuard: A DoS Attack Prevention Extension in Software-Defined Networks (2015, background): “FortNOX [25] introduces the tunneling attack and proposes a security enforcement kernel to defend against this attack.”
A Survey of Security in Software Defined Networks (2016, background): “Similar to a security enhanced Linux (SELinux), their suite extended the Floodlight controller to introduce SEFloodlight [50], which is an extension to their security enforcement kernel project (FortNOX [52]).”
A Survey and a Layered Taxonomy of Software-Defined Networking (2014, methodology): “[58] focus on the problem of detecting and re-conciliating potentially conflicting”
VeriFlow: verifying network-wide invariants in real time (2012, unknown): “Recent work on debugging general networks and SDNs focuses on detecting network anomalies [10,19], checking OpenFlow applications [12], ensuring data-plane consistency [20, 24], and allowing multiple applications to run side-by-side in a non-conﬂicting manner [22, 23, 25].”
Sdn Security: A Survey (2013, background): “Without a signi ﬁ cant increase in focus on security, it will not be possible for SDN to support the evolving capability associated with, for example, Network Functions Virtualization (NFV) [3].”
Software-Defined Networking (SDN) and Distributed Denial of Service (DDoS) Attacks in Cloud Computing Environments: A Survey, Some Research Issues, and Challenges (2016, background): “mediates all Open-Flow rule insertion requests [92].”
A Survey on Emerging SDN and NFV Security Mechanisms for IoT Systems (2019, methodology): “FortNOX [135] has introduced a software extension for the NOX SDN controller to provide role-based authentication and security constraints enforcement by checking flow rules conflicts.”
Towards secure and dependable software-defined networks (2013, background): “[5] provided a security enforcement kernel in SDN controllers to allow security based prioritization.”
Security in Software Defined Networks: A Survey (2015, unknown): “FRESCO [52] and FortNOX [65] provides mechanisms to ensure data conﬁdentiality by ﬂow rules legitimacy.”
Attacking software-defined networks: a first feasibility study (2013, unknown): “In our early work [11], an evasion attack called dynamic flow tunneling is proposed to evade existing SDN security policies.”
SPHINX: Detecting Security Attacks in Software-Defined Networks (2015, background): “…SPHINX to detect both known and potentially unknown attacks on network topology and data plane forwarding originating within an SDN. SPHINX leverages the novel abstraction of flow graphs, which closely approximate the actual network operations, to enable incremental validation of all…”