software define network
TRANSCRIPT
SECURITY MANAGEMENT FOR
SOFTWARE DEFINED NETWORK
BY:-SUBITH BABU140303002
Contents
SDN OpenFlow Why security? SDN security Algorithms Anomaly detection algorithm Conclusion References
SDN
software-defined networks (SDN) offer researchers unprecedented control over network infrastructure .
define a single point of control over the data flows routing of all network infrastructure.
OpenFlow protocol is an embodiment of the software-defined networking paradigm.
OPENFLOW
the OpenFlow (OF) is the mostly commonly used SDN communication protocol.
OpenFlow protocol can offer the flexibility. In OpenFlow control plane rules define the
basic instructions for flows that specify forwarding, changing, or dropping packets that enter the OF-switch.
OpenFlow controller contains the logic for defining,update and adapt of flow rules.
ARCITECTURE
Why security ???
Because the control plane plays a critical role and changes are typically propagated throughout the network, ensuring that applications are authenticated, connections are securely encrypted, security policies are properly applied.
SDN security algorithm
Different steps are involved in the algorithm :-A. Aggregation of parameters and statistics collectionB. ActionsC. Adapted network operating system software
interfaceD. Statistical data processing and calculation of the
characteristicsE. Decision-making based on the calculated
characteristicsF. Training of decision-making system
Aggregation of parameters and statistics collection
statistics collection directly on the switch;
this gives the opportunity to analyze the traffic and perform actions closer to the source of malicious activity or destination host.
Actions
Main purpose: pass traffic, traffic filtering by specific signatures, active response or checking host.
These actions are performed by the switch in accordance with the tables of flows specified by the controller.
Adapted network operating system software interface
A network operating system of SDN controller should provide a specialized set of functions for efficient network security application operation.
a set of functions to work with the flow rules :A. Identifying the source of the rules , and provide
a method for signing rules.B. Detection of conflicts between rules, for example
between the rules issued by the various applications.C. Conflict resolution based on the priorities of the
sources of the rules and their signatures.
Statistical data processing and calculation of the characteristics
For processing collected statistical data is proposed to use time-series analysis methods like wavelet, spectrum analysis and etc.
These methods facilitate analysis of time-frequency traffic characteristics
Decision-making based on the calculated characteristics
The main objective of the information security management system is to detect malicious activity on the basis of a set of input variables.
Use the fuzzy logic decision making.
Training of decision-making system
Implementation of the training subsystem includes short-term and long-term learning modules.
A. shortterm learning module is implemented directly in the controller.
B. long-term learning module can be implemented either directly in the controller, or in an external device,.
Architecture of a protected SDN
ANOMALY DETECTION ALGORITHMS
constructed a prototype implementation of the proposed architecture of protected SDN that includes statistic collection and processing module and decisionmaking module.
A. TRW-CB B. Rate Limit
TRW-CB algorithm
TRW-CB algorithm was implemented as follows: 1. Assume that the host A sends a TCP SYN packet to the new
host B. Since there are no flows in the switch matching this packet, the packet is forwarded to the controller.
2. The algorithm instance running on the controller simply forwards this packet, through the switch, to host B, without setting any new flows. At the same time, the algorithm adds host B to the list of hosts that host A tried to contact and decrements host’s balance.
Contd…..
3. There are two possible answers from host B: a. If TCP SYNACK packet from B to A is received
(switch again forwards this packet to the controller, because still no flows matching this packet) then algorithm sets two flows (from A to B and backwards), and deletes the request from A host queue, as well as increments balance.
b. If TCP SYNACK packet from B is not received, the algorithm does standard counters processing for the case of connection failure without interacting with the switch and without setting any flows.
Host balance table
Rate Limiting
Implementation:-A. Whenever a new connection request arrives to a host which
has recently been successful connected, we set two flows in either direction between hosts.
B. If new request to connect arrives to a host, which is not in the working set, we add it into the delay queue.
C. Every d seconds, the new connection requests are moved from the delay queue to the working set and we forward these requests through the switch without installing any flows.
D. When receiving a positive reply, we install a pair of flows in both directions.
Example package main import "time"import "fmt"func main() { requests := make(chan int, 5) for i := 1; i <= 5; i++ { requests <- i } close(requests) limiter := time.Tick(time.Millisecond * 200) for req := range requests { <-limiter fmt.Println("request", req, time.Now()) } burstyLimiter := make(chan time.Time, 3) for i := 0; i < 3; i++ { burstyLimiter <- time.Now() }
Contd…. go func() { for t := range time.Tick(time.Millisecond * 200) { burstyLimiter <- t } }()burstyRequests := make(chan int, 5) for i := 1; i <= 5; i++ { burstyRequests <- i } close(burstyRequests) for req := range burstyRequests { <-burstyLimiter fmt.Println("request", req, time.Now()) }}
CONCLUSION
Software-defined networks provide a unique opportunity for effective detection and containment of network security problems.
OpenFlow protocol may eventually become one of the most effective technologies
References
http://en.wikipedia.org/wiki/OpenFlow
https://globalconfig.net/software-defined-networking-vs-traditional/
http://en.wikipedia.org/wiki/Software-defined_networking