Uploaded bywolverinetyagi
SDN and Named Data Networking Security
The document discusses the security implications of Software Defined Networking (SDN) and Named Data Networking (NDN), highlighting their architectures, advantages, vulnerabilities, and mitigation strategies. It addresses the centralized management and dynamic nature of SDN, while emphasizing NDN's content-centric approach and its benefits in security and routing. The conclusion suggests a paradigm shift towards securing content rather than just the communication channels.
More Related Content
Similar to SDN and Named Data Networking Security
SDN and Named Data Networking Security
- 1. Software Defined Network& Named Data Network – Security Implications By: Anuj Tyagi http://packetflows.com
- 2. Organization: 1. What isSoftware Defined Networking ? 2. SDN Architecture 3. SDN advantages 4. Attacks and Mitigations on SDN 5. What is NDN ? 6. TCP/IP vs NDN 7. NDN packet types 8. TCP/IP vs NDN – security prospective 9. NDN lookup testbeds 10. Conclusion and future work
- 3. Software Defined Network •SDN decouple the data and control Plane, network intelligence and state are logically centralized, and the underlying network infrastructure is abstracted from the applications. - ONF
- 4.
- 5. OpenFlow Channel • Usedto exchange OpenFlow message between switch and controller • Switch can establish single or multiple connections to same or different controllers • A controller configures and manages the switch, receives events from switch, and send packets out the switch via this interface • The OpenFlow channel is TLS/TCP connection. Switch and controller mutually authenticate by exchanging certificates signed by site-specific private key
- 6. Why SDN ? •Complexity in the Network - Protocols are defined in isolation - migration challenges • Inconsistent policies - Difficult to apply consistent set of access, security, QOS and other policies • Inability to scale - Scaling challenges based on unpredictable traffic pattern • Vendor dependence - Lack of standards and open interfaces
- 7. Advantages of SDN •Centralized network provisioning • Holistic enterprise management • More granular security • Lower operating cost • Hardware savings and reduced capital expenditures • Easier Interoperability
- 8. Security Advantages ofSDN SDN allows for creative new approaches to security 1. Traffic Filtering and shaping 2. Network slicing/multi-tenancy, isolation, network segmentation 3. DDOS mitigation 4. Network Access Control 5. Security traffic Monitoring 6. Moving Target Defense (MTD)
- 9. SDN Attack Surface •Controller uses protocol like OpenFlow to control switches, which are now only responsible for handling the data plane • When OpenFlow packet that doesn’t match forwarding rules, packet passed to the controller Attack : The SDN controller’s ability to control an entire network makes it a high value target. Attack on a vulnerable controller can have disastrous effect on the network
- 10. SDN Attack Surface Packetdoesn’t match rules Control Plane Attack Data Plane Attack Traditional Network Control Plane Attack SDN Controller Data Plane DeviceData Plane Attack
- 11. SDN Attack Surface •DOS attack by spoofing northbound API messages and southbound flows • Attacker can create their own controller and gets network element to receive flows from that controller – spoofing flows from the legitimate controller • Attacking the DCI protocol – NVGRE, STT, VXLAN. These protocols lack authentication, with no encryption – this is either part of the protocol design or the way the vendor has implemented the protocol
- 12. SDN Vulnerabilities • NetConfAPI processes user-supplied XML/REST Conf • Example vulnerable code: https://lists.opendaylight.org/pipermail/bugs/2014-December/009794.html
- 13.
- 14. Topology Spoofing viahost tracking • Most SDN controllers include host tracking, allowing hosts to migrate between different physical locations in the network • Host tracking is based on monitoring of Packet-In messages, and doesn’t require validation, authentication or authorization • An attacker can impersonate a host and make the SDN controller believe it has migrated to a physical network location controller by the attacker • For this, attacker must know the mac-address of the target host. Attacker need to send malicious message through a switch controlled by SDN controller. • Ref: http://www.internetsociety.org/sites/default/files/10_4_2.pdf
- 15. Mitigation of TopologySpoofing • Same research team developed path to mitigate it • A legitimate host migration involve port down before host migration finished. It would also mean that host would be unreachable at it’s old physical location after the migration complete • Currently, patched in FloodLight controller
- 16. DOS attack onONOS packet deserializer • When OpenFlow switch encounter a packet that does not match any forwarding rules, it passes this packet to the controller for advice • Packet deserialization in ONOS throw exceptions when handling malformed, truncated or maliciously crafted packets • The exceptions were not caught and handled, which would result in the relevant switch being disconnected because exception occur in I/O thread
- 17. Security Mode Mitigation •Vulnerability in ONOS application could not exploited to perform actions that are not permitted by security mode ONOS. This is similar to protection SELinux provides for applications running on Linux System
- 18. Other hardening Approach •Use out of band (OOB) network for controlling traffic and secure protocol controller management and northbound communications • Closely monitor controller for suspicious activities • Use Data Center Interconnect(DCI) protocols that can use authenticate tunnel end points and secure tunneled traffic
- 19.
- 20. Named Data Network– What is it ? • Using “name” instead of IP address to identify chunks of content instead of IP address • Originated in 2006 as content centric networking • Funded by NSF ( National Science Foundation) and 12 universities involved, part of ICN( Information Centric Network) • First NDN community meeting took place in Sep 2014
- 21.
- 22. NDN Packet Structure •Content name is the object identifier and most important part • Selector is an optional field indicating packet order, scope, preference etc. • Nonce is a random number assigned by Pending Interest Table
- 23. NDN Packet Structure… •Content name contains object identifier • Signature of producer is available to review for inconsistencies • Publisher key is required by the responding node • Data portion contain the information requested
- 24. Naming convention Hierarchical StructureIP vs NDN approach
- 25.
- 26. What NDN hasproduced so far ? • NDN Testbeds: http://ndnmap.arl.wustl.edu/
- 27.
- 28. Attacks of TCPand Countermeasures by NDN • Sequence Number Attack - Attempt to predict the sequence number used to identify packets in a TCP connection SYN SYN-ACK ACK A B
- 29. NDN solution toTCP attack • No IP address information required • Object identifier takes its place • No information gleaned from identifier can be used to attack system
- 30. DNS Servers • Cachecontaining hostname IP information, source operating system, configuration information etc. • DNS spoofing occurs when IP address associated with trusted sites are replaced with the third party sources • Once used, the third party can be granted access to the system
- 31. NDN Solution… - Signaturekey returned contains information about the source - This information can be viewed by the information recipient to verify validity - If the information is invalid, it can be rejected without harming the system
- 32.
- 33.
- 34.
- 35.
- 36. NDN Solution… - Containsa random nonce - When packet is passed through PIT, nonce is cross-referenced against original interest packet - If interest packet is returned with a nonce matching one already in the PIT, it is discarded - No possible routing loop issue
- 37. Conclusion: A newway to think about security • Secure the Content, Not the Channel ! - SSL, VPN, SSH tunnel, TOR etc all provide secure channel - Users don’t really care if channel is secure or not. They care about data security • Require Authentication on all content - Security is not optional but part of architecture • Encrypt the content if you don’t trust the channel - Encryption is optional and applied where required