Keywords

1 Introduction

The cloud computing introduced the unlimited virtualized resources that changed the way of accessing and storing data. The cloud characterized with the five essential characteristics namely: (1) Resource pooling, (2) On-demand capabilities, (3) Broad network access, (4) Rapid elasticity and (5) Measured services. The providers offer these characteristics in the form of three major services such as Software as a Service (SaaS), Platform as a Service (PaaS) and Infrastructure as a Service (IaaS). Because of this attractiveness of the cloud, several organizations migrate from adopting traditional warehouse infrastructure to utilizing services provided by cloud computing [1]. Also, attracts the attackers to seeking for any vulnerability that can help them getting access to sensitive data or to get benefit of the advantages of the cloud in order to exercise attacks from the cloud against other organization.

The virtualization and the shared resource between multiple tenants are the backbones of cloud computing, the virtualization can be as a virtual machine and a virtual network. Software-defined networking is part of the virtualization systems, the use of SDN technology may improve the performance of network routing within the cloud computing. However, it increases the sensitivity to security issues namely confidentiality, integrity and availability issues.

The SDN is an element of the software-defined system (SDS) package that contains:

  • Software-defined Networking (SDN)

  • Software-defined Cloud Networking (SDCN)

  • Software-defined Storage (SDS)

  • Software-defined Data Center (SDDC)

  • Software-defined Radio (SDR)

SDN provides five major benefits [2], that we quote:

  • Accuracy: The IT resources become automatic and programmable. Also, the requests of clients are independent of the hardware.

  • Agility: The agility enables the components from migrating between environments in an easy and flexible way.

  • Adaptability: this property provides no reliance on hardware resources of the vendors, which leads to the adaptability to new configurations and environments.

  • Assurance: SDN provides an assurance that organizations are able to specify their own policy.

In addition to what is mentioned above, SDN characterizes with other advantages such as:

  • Network’s centralization: The SDN adopts the centralized monitoring and management of the network, as well as to the centralized security.

  • Hardware optimization: The SDN reduce the use of physical hardware by the orientation toward virtualized network infrastructures. When we say optimization of the hardware, we say coast reduction as well.

2 SDN Architecture

The SDN architecture is characterized by the separation of control plane from the data plane. Control plane is the brain who takes the decision of traffic networking. Data plane or forwarding plane is responsible of forwarding traffic, according to the control plane to the next component. The architecture of SDN contains three layers namely application layer, controller layer and infrastructure layer as it’s showed in Fig. 1.

Fig. 1.
figure 1

SDN’s architecture

Full size image

2.1 Controller Layer

Controller layer contains a bunch of controllers that are responsible of controlling the network. In other words, the controller layer is the control plane which is the principal component that takes the decision about the optimal path that traffic will take and monitor the behavior of the forwarding network. The controller uses protocols in order to configure the network devices such as OpenFlow [4, 10, 15].

Controllers communicate between them through east - west interfaces in order to maintain the synchronization and connectivity of the network [2, 3, 6, 8]. The controller layer communicates with other layers using north-bound API’s and south-bound API’s. Where, north-bound API’s (e.g. REST, frantic, etc.) are used to communicate with application layer and south-bound API’s (e.g. OpenFlow, NetConf, etc.) to communicate with infrastructure API’s [8,9,10].

2.2 Application Layer

The application layer is built on the controller layer, which represents the first layer in SDN architecture. It contains a set of software related to business requirements such as intrusion detection systems (IDS) [11], network virtualization [12], load balancing [13], and so on. In the case of changes at the application layer, controller layers afford an abstraction of network’s resources to be allocated to the software of the application layer, in order to avoid reconfiguration of the network’s resources such as switches and routers.

2.3 Infrastructure Layer

The infrastructures layer is also known as the data forwarding layer, it contains virtual or physical network resources and devices. As its name mentions, it’s responsible for the forwarding of packets of the network according to a set of rules within the flow table [10, 14, 15]. The flow table entries contain three section namely the pattern, action, and stats [2]. The pattern represents the header field of a packet; the action is executed according to the match of the rules, then stats, which are indications that indicates the network’s status.

3 Security Issues

In this section, we present a set of security issues of different layers that may lead to a successful attack.

Open programmable APIs: As it’s mentioned above, SDN communicates through programmable APIs, these APIs can be open which may cause security issues by making the layers open and the vulnerabilities of components of the SDN visible to attackers. This issue may lead to cross-site scripting attack (XSS) or injection of malicious code [16, 17].

The controller issues: Because of the central architecture of SDN, the configuration and the decision of the network is taken by the controllers. Therefore, an exploitation of vulnerability can gain the attacker to take control of the whole network which can cause huge damages [11].

The SDN switches issues: switches within SDN suffer from the limitation of entries of the flow table. This issue makes switches very sensitive to DDoS attacks.

4 SDN Attacks

SDN attracts attackers to look for vulnerabilities in order to use them to exercise attacks or a set of attacks. In this section, we classify the attacks according to target the layer.

Figure 2 shows the different attack point in the SDN architecture, which an attacker can exploit the existed vulnerability [11].

Fig. 2.
figure 2

Attack point in SDN architecture

Full size image

An attack can be exercised on the component of the application layer, against controllers of controller layer and at channels of communication between controllers. Switches are not excluded from these attacks. It also, can target the programmable API’s that connects layers to each other.

4.1 Application Layer

The application layer may contain vulnerabilities related to software and the difficulties of modeling a global security policy that is able to manage the whole network without fails. Where most of the applications are developed by a third party, which doesn’t take into consideration the mechanism of security standardization.

The rest of this section describes the major attacks faced by the application layer.

Unauthorized access: The large number of devices of a network may lead to the misuse of the application running on controllers by an intruder to gain unauthorized access to sensitive information such as network information. As most of the applications are made by third parties that have a limited knowledge about the security requirement such as the management of authentication systems, authorized accesses to an application, and the access of applications to the network information [11].

Malicious programs and application injection: Code, programs or applications injection is one of top ten attacks that target applications especially web applications according to OWASP project [16]. This attack may cause unauthorized access, data loss or information corruption. It’s used by worms to propagate within the network. Also, it helps attackers to gain more privileges to accomplish their malicious tasks.

Insertion of rules: In order to get the benefit of the advantages of SDN, SDN paradigm is applied in various areas namely cloud computing, data centers, cellular networks, wireless networks, mobile networks, etc. where the number of devices is huge, with complex applications and services. Therefore, The insertion and the management of security rules is a big challenge for administrators and providers in order to prevent security rules conflicts between applications and services [5, 6, 11].

4.2 Controller Layer

The controllers are the brain of the SDN. Thus, because of its importance, attackers aim to get control of the whole network by exploiting the existing vulnerabilities. This section presents the well-known attacks faced by controllers.

Attacks from application layer: Applications are running on controllers, were any successful attack on application layer may lead to security issues in the controller layer. For example, application injection attack can gain access to network devices information and monitor the behavior of the network, or exercise other attacks for more serious effects.

DDoS/ DoS attack: Denial of service (DoS) and distributed DoS (DDoS) is the simplest attack exercised by attackers that target the availability of the network and services for the legitimate users [11]. This attack consumes the controller’s resource such as CPU, memory, and bandwidth by rules installation and computation from the flooded flow requests [18]. Once the controller is saturated, the legitimate requests will be dropped and the switches connected to the affected controller will be affected as well [18].

Attacks against distributed multi-controllers: Because of the division of the main network into sub-networks, the need of using distributed multi-controller raises. This solution was proposed to overcome the DDoS/ DoS attacks and preventing the shutting down of the whole network. However, the SDN remains sensitive to DDoS/ DoS attacks, and to other issues related the management of the security policy and security conflict [11, 18].

4.3 Infrastructure Layer

Switches within infrastructure layer are divided into three part especially the OpenFlow switches: OpenFlow agent, packet buffer and table flow, which are a target for DoS attack.

DoS Attack: To perform the DoS attack, the attacker performs “the flow request flooding” by interrupting the performance of the three parts of OpenFlow switch. He/she sends a large number of malformed packets to saturate the OpenFlow agent since it generates a limited number of flow requests per second to be sent to the controller. Thus, the target switch is affected as well as to the hosts connected to the victim. In the case of a full packet buffer, the victim switch sends instead of packets headers, the entire packets to the controller that lead to the consumption of the bandwidth and channel congestion [11, 18]. Another drawback of the OpenFlow switch is the limited entries of a flow table, where the attacker aims to overflow it by installing new rules. This attack leads to dropping rules of legitimate flow [20].

Man-in-the-middle: The attacker of man-in-the-middle (MITM) monitors the traffic between controllers and switches, in order to intercept the information of communication without being detected. Controllers and switches are not directly connected to each other, which makes each entity doubtful to be a MITM node [19]. MITM attack leads to the implementation of other attacks such us eavesdropping and black-hole attack [11, 20].

5 Countermeasures of SDN Attacks

This section deals with the solution that has been proposed to solve some of SDN security issues mentioned above. The following table (Table 1) summarizes the proposed solution with a description.

Table 1. The proposed solution to sdn security issues [11, 42]
Full size table

6 Conclusion

In this paper, we presented a review of the security in the software-defined system. The first part describes the different components of SDN architecture with their characteristics. The second part contains the security issues and a list of attacks faced by the elements of SDN. And in the third part, we gave a set of proposed solutions that aim to solve or mitigate the harm of attacks, these solutions are divided according to the three layer: Application layer, the controller layer, and infrastructure layer. DDoS/ DoS attack is one of the most common attacks that target the SDN at different levels (Application layer, the controller layer, and infrastructure layer).

In our future research, we intend to concentrate on the lack of visibility of the SDN state within cloud computing by proposing an approach that measures the security state of the virtual network and provides the appropriate countermeasure in case of an attack.