Traditional networks possess a natural immunity to common attacks due to their closed hardware, stable design, consistent software, and decentralized control system. For example, if an attacker exploits a vulnerability in a particular company’s hardware, the network will only be affected in the portion containing that company’s hardware, while the remaining hardware from other manufacturers, which may not have the same vulnerability, will remain unaffected.
In SDN networks, the shared open streaming protocol between devices from different companies increases the risk of threats and widespread outages. Therefore, while SDN is a powerful networking technology, it also carries risks. Consequently, it is essential to discuss security and reliability issues and the solutions that should be considered when designing an SDN (1, 2).
Threats and risks facing SDN networks
SDN networks have two main characteristics that make them attractive to attackers and hackers, and a source of concern for network owners:
1- The network is programmed using software.
2- Centralized control of the network, and therefore access to one of the controllers means access to and control of the entire network.
Below we list the most important threats that we may face in SDN networks, which we compile in Figure (1), along with suggesting simple solutions (2).
1- Entering false or misleading information:
Figure (1): A map showing the weaknesses in SDN networks
Switches or routers can be attacked by compromised devices in the network, or by a malicious attacker using any network component (router, switch, server, etc.) to launch large numbers of data packets in order to achieve a Denial of Service (DoS) attack, which could be – for example – against switches using the Open Flow protocol, where all the memory inside the switch is consumed.
Proposed solution:
The use of an Intrusion Detection System (IDS), supported by runtime root cause analysis, to detect abnormal behavior of network elements, in addition to using mechanisms for dynamically controlling switch behavior, such as setting a certain limit on the rate of control requests.
2- Attacking the weaknesses of the transformers:
Attacking or controlling a single switch means the possibility of ignoring a data packet, redirecting it to the wrong destination, copying certain data packets, slowing down their flow within the network, or even injecting fake data or requests into it, with the aim of disrupting the operation of neighboring controllers or switches.
Proposed solution:
Using mechanisms to perform software validation processes; such as software component self-confidence management systems, or using mechanisms to monitor and detect abnormal network device behavior (2).
3- Attacking control layer communications:
This technique can be used to launch a Denial-of-Service (DoS) attack or steal data, even with encrypted communications. Control layer lines remain vulnerable. Communication security is measured by the strength of its weakest lines or elements, which can stem from self-signed certificates, digital certificates issued by an insecure entity, or weak applications and libraries. This creates an opportunity for what is known as a Man-in-the-Middle (MITM) attack. If an attacker succeeds in compromising control layer communications, they can muster sufficient force—which varies depending on the number of switches they control—to launch a Denial-of-Service (DoS) attack.
Proposed solution:
Securing communication between controllers by encoding this layer, in addition to the possibility of using dynamic and secure mechanisms to link devices to ensure trust between control layer devices and data layer devices (2).
4- Attacking the controller’s weaknesses:
This attack is one of the most serious threats facing SDN networks; the failure of a single control unit or its infection by a malicious attack can lead to the collapse of the entire network. Furthermore, using an Intrusion Detection System (IDS) may not be sufficient, as it is difficult to pinpoint the precise sequence of events that might lead to a particular behavior, and more importantly, to confirm that this behavior is malicious.
Proposed solution:
Several techniques, such as replication or duplication, can be used (to detect, eliminate, or hide abnormal behavior). It is also important to secure all sensitive elements within the controller (such as encryption keys). Furthermore, security policies can ensure the correct implementation of these techniques, and can restrict the interfaces that applications can use, as well as the rules and commands they can create to program the network (2).
5- Lack of mechanisms to ensure trust between controllers and management applications:
Similar to threat number 3, control devices and applications lack the ability to establish trusting relationships.
The main difference from the aforementioned threat lies in the method of certificate construction. The techniques used to verify network devices differ from those used for applications.
Proposed solution:
Use confidence management mechanisms to ensure that applications are reliable throughout their lifecycle (2).
6- Attacking weaknesses in management stations:
Management stations are typically found within traditional networks, but they are also used in Software-Defined Networks (SDNs) to access the network controller. The difference is that if a single management device or station is compromised, the risk increases significantly in SDNs because the network can be easily reconfigured from a single location.
Proposed solution:
Using protocols that require two-factor authentication; for example, requesting access to a controller requires the approval of two people. Reliable recovery mechanisms can also be used to ensure a stable state after a restart (2).
7- Lack of reliable sources for description and retrieval:
Having reliable sources for problem identification and recovery allows for understanding the cause and quickly addressing it to return to a safe state. To investigate and verify any incident, we need reliable information from all parts and areas of the network, and this information will only be useful if its reliability is guaranteed. Furthermore, the recovery process requires secure and reliable system monitoring to ensure that network components are quickly and accurately restored to their previous operational state.
Proposed solution:
The use of recording and tracking mechanisms is essential at the data and control levels; however, for these mechanisms to be effective, they must not be erased or become unalterable. Records must also be stored in secure and remote environments (2).
*DDoS Attack: A denial-of-service attack—also known as a distributed denial-of-service attack—is used to render an internet service unresponsive, completely disabled, or responding in a way that can be exploited to gather information, for example. The attack occurs by sending repeated requests to the server until its resources are exhausted. In a distributed environment, the requests are fulfilled by multiple clients simultaneously, which greatly increases the load on the targeted server (3).
*Man-in-the-middle attack: One method of compromising a system is to impersonate a server component instead of the client, often referred to as a “man-in-the-middle attack.” In this process, the attacker gains access to sensitive information within messages, such as client credentials (4).
sources:
1. Deep R., Roy S. Dynamic assessments of vulnerabilities in software-defined networks. Innovative Software Systems Engineering [Internet]. 2020 [accessed April 30, 2021]; 16, 45-51. Available from: here
2. Kreutz D, Ramos F, Verissimo B: Towards Secure and Reliable Software Networks. Proceedings of the Second ACM SIGCOMM Workshop on Hot Topics in Software Networking. Hong Kong: ACM; [Internet] 2013 [Accessed 29 April 2021]. pp. 55-60. Available from: here
3. Lau, F., Rubin, S., Smith, M., and Trajkovic, L.: Distributed Denial-of-Service Attacks. Proceedings of the SMC 2000 Conference. 2000 IEEE International Conference on Systems, Humans, and Cybernetics. “Cybernetics Evolves to Include Systems, Humans, Organizations, and Their Complex Interactions.” Nashville, TN, USA: IEEE; [Internet] 2000 [Accessed May 10, 2021]. pp. 2275–2280. Available from: here
4. Conti M, Dragoni N, Voh S, Lesek F. A survey of median attacks. IEEE Research & Studies in Communications [Internet]. 2016 [accessed May 10, 2021]; 18(3): 2027-2051. Available from: here
0 Comments