Paper Info
Title
Tilak: A Token-Based Prevention Approach For Topology Discovery Threats In Sdn
Abstract
Software-defined networks (SDNs) decouple the data plane from the control plane. Thus, it provides logically centralized visibility of the entire networking infrastructure to the controller. It enables the applications running on top of the control plane to innovate through network management and programmability. To envision the centralized control and visibility, the controller needs to discover the networking topology of the entire SDN infrastructure. However, discovering and maintaining a global view of the underlying network topology is a challenging task because of (i) frequently changing network topology caused by migration of the virtual machines in the data centers, mobile, end hosts and change in the number of data plane switches because of technical faults or network upgrade; (ii) lack of authentication mechanisms and scarcity in SDN standards; and (iii) availability of security solutions during topology discovery process. To this end, the aim of this paper is threefold. First, we investigate the working methodologies used to achieve global view by different SDN controllers, specifically, POX, Ryu, OpenDaylight, Floodlight, Beacon, ONOS, and HPEVAN. Second, we identify vulnerabilities that affect the topology discovery process in the above controller implementation. In particular, we provide a detailed analysis of the threats namely link layer discovery protocol (LLDP) poisoning, LLDP flooding, and LLDP replay attack concerning these controllers. Finally, to countermeasure the identified risks, we propose a novel mechanism called TILAK which generates random MAC destination addresses for LLDP packets and use this randomness to create a flow entry for the LLDP packets. It is a periodic process to prevent LLDP packet-based attacks that are caused only because of lack of verification of source authentication and integrity of LLDP packets. The implementation results for TILAK confirm that it covers targeted threats with lower resource penalty.
Year
DOI
Venue
2019
10.1002/dac.3781
INTERNATIONAL JOURNAL OF COMMUNICATION SYSTEMS
Keywords
Field
DocType
flooding, link layer discovery protocol (LLDP), replay attack, route poisoning, software-defined networking (SDN), topology discovery
Prevention approach,Computer science,Computer network,Route poisoning,Replay attack,Security token
Journal
Volume
Issue
ISSN
32
17
1074-5351
Citations 
PageRank 
References 
0
0.34
11
Authors
5
Name
Order
Citations
PageRank
Ajay Nehra181.55
Meenakshi Tripathi2478.95
Manoj S. Gaur350163.38
Ramesh Babu Battula455.16
Chhagan lal514618.92