Advance reservation access control using software-defined networking and tokens

Toward Formal Verification of SDN Access-Control Misconfigurations

Artificial Intelligence and Security Challenges in Emerging Networks - Advances in Computational Intelligence and Robotics ◽

10.4018/978-1-5225-7353-1.ch006 ◽

2019 ◽

pp. 146-161

Author(s):

Amina Saadaoui

Keyword(s):

Access Control ◽

Network Management ◽

Formal Verification ◽

Software Defined Networking ◽

Management Control ◽

New Method ◽

Automatic Identification ◽

Security Challenges ◽

Flow Table ◽

Single Flow

Software-defined networking (SDN) allows centralizing and simplifying network management control. It brings a significant flexibility and visibility to networking, but at the same time creates new security challenges. The promise of SDN is the ability to allow networks to keep pace with the speed of change. It allows frequent modifications to the network configuration. However, these changes may introduce misconfigurations by writing inconsistent rules for single flow table or within a multiple open flow switches that need multiple FlowTables to be maintained at the same time. Misconfigurations can arise also between firewalls and FlowTables in OpenFlow-based networks. Problems arising from these misconfigurations are common and have dramatic consequences for networks operations. To avoid such scenarios, mechanisms to prevent these anomalies and inconsistencies are of paramount importance. To address these challenges, the authors present a new method that allows the automatic identification of inter and inter Flowtables anomalies. They also use the Firewall to bring out real misconfigurations.

Download Full-text

Attribute-Guard: Attribute-Based Flow Access Control Framework in Software-Defined Networking

Security and Communication Networks ◽

10.1155/2020/6302739 ◽

2020 ◽

Vol 2020 ◽

pp. 1-18 ◽

Cited By ~ 1

Author(s):

Xianwei Zhu ◽

ChaoWen Chang ◽

Qin Xi ◽

ZhiBin Zuo

Keyword(s):

Access Control ◽

Software Defined Networking ◽

Authentication Protocol ◽

Network Characteristics ◽

Fine Grained ◽

Control Framework ◽

Data Plane ◽

Data Validity ◽

The One ◽

Matching Field

Software-defined networking (SDN) decouples the control plane from the data plane, offering flexible network configuration and management. Because of this architecture, some security features are missing. On the one hand, because the data plane only has the packet forwarding function, it is impossible to effectively authenticate the data validity. On the other hand, OpenFlow can only match based on network characteristics, and it is impossible to achieve fine-grained access control. In this paper, we aim to develop solutions to guarantee the validity of flow in SDN and present Attribute-Guard, a fine-grained access control and authentication scheme for flow in SDN. We design an attribute-based flow authentication protocol to verify the legitimacy of the validity flow. The attribute identifier is used as a matching field to define a forwarding control. The flow matching based on the attribute identifier and the flow authentication protocol jointly implement fine-grained access control. We conduct theoretical analysis and simulation-based evaluation of Attribute-Guard. The results show that Attribute-Guard can efficiently identify and reject fake flow.

Download Full-text