AVANT-GUARD

TLDR

OpenFlow decouples the control plane from the data plane, creating a communication bottleneck that attackers can exploit via control‑plane saturation attacks and hindering rapid detection and response to dynamic flow changes. The authors aim to mitigate these security weaknesses by proposing two data‑plane extensions—connection migration and actuating triggers—to reduce attack impact and improve responsiveness. They implement Avant‑Guard, which adds a connection‑migration module that limits data‑to‑control‑plane exchanges and introduces actuating triggers that register asynchronous callbacks and install conditional flow rules based on data‑plane statistics. Evaluation shows that connection migration dramatically cuts control‑plane traffic during saturation attacks, and Avant‑Guard’s combined extensions enhance scalability and resilience of SDN security services.

Abstract

Among the leading reference implementations of the Software Defined Networking (SDN) paradigm is the OpenFlow framework, which decouples the control plane into a centralized application. In this paper, we consider two aspects of OpenFlow that pose security challenges, and we propose two solutions that could address these concerns. The first challenge is the inherent communication bottleneck that arises between the data plane and the control plane, which an adversary could exploit by mounting a "control plane saturation attack" that disrupts network operations. Indeed, even well-mined adversarial models, such as scanning or denial-of-service (DoS) activity, can produce more potent impacts on OpenFlow networks than traditional networks. To address this challenge, we introduce an extension to the OpenFlow data plane called "connection migration", which dramatically reduces the amount of data-to-control-plane interactions that arise during such attacks. The second challenge is that of enabling the control plane to expedite both detection of, and responses to, the changing flow dynamics within the data plane. For this, we introduce "actuating triggers" over the data plane's existing statistics collection services. These triggers are inserted by control layer applications to both register for asynchronous call backs, and insert conditional flow rules that are only activated when a trigger condition is detected within the data plane's statistics module. We present Avant-Guard, an implementation of our two data plane extensions, evaluate the performance impact, and examine its use for developing more scalable and resilient SDN security services.