A Security assessment framework for software-defined networking

Abstract

As Software-Defined Networking (SDN) is getting popular, developing a systematic understanding of the attack surface of SDN is necessary to operate more securely. However, most existing studies depend on empirical methods to evaluate the security of particular SDN elements from their own perspectives. Besides, none of them has carefully inspected network policy inconsistency problems that can cause severe network reliability and security issues in SDN. Hence, this dissertation focuses on how to systematically assess the security problems of SDN by following three subjects: (1) the understanding SDN attack surfaces from control flow perspective, (2) the security evaluation in the SDN layers, and (3) the detection of network policy inconsistencies between the SDN layers. Thus, this dissertation analyzes the various vulnerability cases first, and then propose a first security assessment framework for SDN, and automated detection framework for network policy inconsistencies in SDN, to assess the security of SDN. Even though those systems are not enough to fully assess all kinds of security in the broad SDN infrastructure, we believe that they would be the starting point toward making it more secure.