Affiliation:
1. College of Computer Science and Technology, Zhejiang University, Hangzhou 310027, China
Abstract
Software-defined networking (SDN) enables dynamic management and flexible network control by employing reactive rule installation. Due to high power consumption and cost, current OpenFlow switches only support a limited number of flow rules, which is a major limitation for deploying massive fine-grained policies. This bottleneck can be exploited by attackers to launch saturation attacks to overflow the flow table. Moreover, flow table overflow can occur in the absence of malicious attackers. To cope with this, researchers have developed many proposals to relieve the load under benign conditions. Among them, the dynamic timeout mechanism is one of the most effective solutions. We notice that when the SDN controller adopts dynamic timeouts, existing flow table saturation attacks can fail, or even expose the attackers, due to inaccurate inferring results. In this paper, we extract the common features of dynamic timeout strategies and propose an advanced flow table saturation attack. We explore the definition of flow rule lifetime and use a timing-based side-channel to infer the timeout of flow rules. Moreover, we leverage the dynamic timeout mechanisms to proactively interfere with the decision of timeout values and perform an attack. We conduct extensive experiments in various settings to demonstrate its effectiveness. We also notice that some replacement strategies work differently when the controller assigns dynamic timeouts. The experiment results show that the attack can incur significant network performance degradation and carry out the attack in a stealthy manner.
Funder
National Key R&D Program of China
the Key R&D Program of Zhejiang Province
Subject
Fluid Flow and Transfer Processes,Computer Science Applications,Process Chemistry and Technology,General Engineering,Instrumentation,General Materials Science
Reference52 articles.
1. A clean slate 4D approach to network control and management;Greenberg;Acm Sigcomm Comput. Commun. Rev.,2005
2. OpenFlow: Enabling innovation in campus networks;McKeown;Comput. Commun. Rev.,2008
3. P., S., Kavin, B.P., Srividhya, S.R., V., R., C., K., and Lai, W.C. (2022). Performance Evaluation of Stateful Firewall-Enabled SDN with Flow-Based Scheduling for Distributed Controllers. Electronics, 11.
4. Towards SDN-based smart contract solution for IoT access control;Khalid;Comput. Commun.,2023
5. Software defined networking architecture, traffic management, security, and placement: A survey;Priyadarsini;Comput. Netw.,2021
Cited by
6 articles.
订阅此论文施引文献
订阅此论文施引文献,注册后可以免费订阅5篇论文的施引文献,订阅后可以查看论文全部施引文献