UNISAFE: A union of security actions for software switches

Abstract

As Software-defined architectures, such as Software-Defined Networking (SDN) and Network Function Virtualization (NFV), are getting popular, the necessity of software-based switch (a.k.a., software switch) is also increasing because it can adopt new functions/features without much difficulty compared with hardware-based switches. Nowadays we can easily observe that researchers devise new network functions and embed them into a software switch. However, most those proposals are highly biased at network communities, and thus it is hard to find some trials of leveraging the abilities of a software switch for security. In this paper, we consider that how we can enrich security functions/features in software-defined environments, and in this context we propose a new software switch architecture - with the name of Unisafe - that can enable diverse security actions. Furthermore, Unisafe provides action clustering which joins Unisafe actions of multiple-flows together. It makes that Unisafe can check flows synthetically, and thus a user can establish effective security policies and save system resources. In addition, we describe the design and implementation of Unisafe and suggest some use-cases for how Unisafe works.