ETRI-Knowledge Sharing Plaform

KOREAN
논문 검색
Type SCI
Year ~ Keyword

Detail

Conference Paper AudiSDN: Automated Detection of Network Policy Inconsistencies in Software-Defined Networks
Cited 9 time in scopus Share share facebook twitter linkedin kakaostory
Authors
Seungsoo Lee, Seungwon Woo, Jinwoo Kim, Vinod Yegneswaran, Phillip Porras, Seungwon Shin
Issue Date
2020-07
Citation
Conference on Computer Communications (INFOCOM) 2020, pp.1788-1797
Language
English
Type
Conference Paper
DOI
https://dx.doi.org/10.1109/INFOCOM41043.2020.9155378
Abstract
At the foundation of every network security architecture lies the premise that formulated network flow policies are reliably deployed and enforced by the network infrastructure. However, software-defined networks (SDNs) add a particular challenge to satisfying this premise, as for SDNs the flow pol-icy implementation spans multiple applications and abstraction layers across the SDN stack. In this paper, we focus on the question of how to automatically identify cases in which the SDN stack fails to prevent policy inconsistencies from arising among these components. This question is rather essential, as when such inconsistencies arise the implications to the security and reliability of the network are devastating. We present AudiSDN, an automated fuzz-testing framework designed to formulate test cases in which policy inconsistencies can arise in OpenFlow networks, the most prevalent SDN protocol used today. We also present results from applying AudiSDN to two widely used SDN controllers, Floodlight and ONOS. In fact, our test results have led to the filing of 3 separate CVE reports. We believe that the approach presented in this paper is applicable to the breadth of OpenFlow platforms used today, and that its broader usage will help to address a serious but yet understudied pragmatic concern.
KSP Keywords
Automated Detection, Multiple Applications, Network flow, OpenFlow networks, Security and Reliability, Security architecture, Software-Defined Networking(SDN), Testing Framework, network infrastructure, network security, sdn controller