🏛️國立陽明交通大學機構典藏

Search Results

Now showing 1 - 5 of 5

Mitigating DoS Attacks against SDN Controller Using Information Hiding
(2019-01-01)
Abdullaziz, Osamah Ibrahiem
;
Wang, Li-Chun
;
電機工程學系
;
Department of Electrical and Computer Engineering
Because of SDN centralization nature, denial of service (DoS) attacks have become a prominent concern. In the OpenFlow (OF) protocol, the transport layer security (TLS) protocol is recommended to secure the control channel. Unfortunately, the tasks involved in the proper configuration of a secured TLS are very challenging. Even worse, TLS is made an optional mode of communication in OF. As a consequence, some OF-enabled switches and controllers do not adopt TLS. In this paper, we develop a lightweight authentication mechanism, called Hidden Authentication (HiAuth), to protect SDN controller against DoS attacks. HiAuth legitimizes SDN forwarding devices by hiding authentication information into the header of control channel packets. Our experimental results prove that HiAuth is lightweight and can not only mitigate DoS attacks, but also provide high undetectability to the attacker.
HiAuth: Hidden Authentication for Protecting Software Defined Networks
(2019-06-01)
Abdullaziz, Osamah Ibrahiem
;
Wang, Li-Chun
;
Chen, Yu-Jia
;
電機工程學系
;
Department of Electrical and Computer Engineering
Software defined networking (SDN) enables network function programmability for ease of configuration and maintenance, and also allows network administrators to change traffic rules on the fly. However, denial of service (DoS) attacks pose security challenges on the centralized control plane of SDN. Although the transport layer security (TLS) can help secure the control plane, it is computationally intensive, complex to configure, and not mandatory in OpenFlow protocol. In this paper, we present a lightweight authentication solution, called hidden authentication (HiAuth), to protect the SDN controller by hiding the identities of the forwarding devices into the control packets via efficient bitwise operations. HiAuth is the first to incorporate information hiding techniques into OpenFlow to provide security against DoS attacks. HiAuth exploits the IP identification field of IPv4 and the transaction identification field of OpenFlow in two authentication schemes. The experimental results show that HiAuth can effectively mitigate intruder DoS attacks and provide high undetectability to attackers.
Heterogeneous Flow Table Integration for Capacity Enhancement in Software-Defined Networks
(2018-01-01)
Hung, Chi-Hsiang
;
Wang, Jheng-Jyun
;
Wang, Li-Chun
;
Wang, Kuo-Chen
;
Lee, Chain-Wu
Commercial OpenFlow-enabled legacy switches implement flow tables with Ternary Content Addressable Memory (TCAM) to perform high speed flow matching process. However, the size of TCAM-based flow table is restricted to few thousands of entries due to manufacturing cost and high power consumption. In this paper, we propose the Flow Entry Agent which can integrate heterogeneous flow tables, such as ASIC-side MAC/IP/ACL tables and CPU-side SRAM-based tables to increase the storage capacity without modifying ASIC. Besides, the Agent will compress the CPU-side tables and perform flow matching process with these tables. Simulation results show that our Agent can not only increase the capacity of flow table to 11.38x to 65.24x but also reduce 80.99% to 87.36% of Packet_In messages with additional 1 MB CPU-side SRAM.
High-Efficiency Matching Mechanism for Off-Chip Tables in OpenFlow-enabled Legacy Switch
(2017-01-01)
Wang, Jheng-Jyun
;
Hung, Chi-Hsiang
;
Wang, Li-Chun
;
Wang, Kuo-Chen
;
Lee, Chain-Wu
Commercial OpenFlow-enabled legacy switches implement flow tables with Ternary Content Addressable Memory (TCAM) to perform high-speed flow matching process. However, the size of TCAM-based flow table is restricted to few thousands of entries due to manufacturing cost and high power consumption. In our previous research, we proposed Flow Entry Agent to integrate Off-Chip tables to increase the storage capacity without modifying Application Specific Integrated Circuit (ASIC). In this paper, we propose an efficient matching mechanism for Off-Chip tables. Simulation results show that our mechanism significantly increase the efficiency of flow matching process.
Scalable Topology-based Flow Entry Management in Data Center
(2016)
Hung, Chi-Hsiang
;
Huang, Chao-Wei
;
Wang, Li-Chun
;
Chen, Chien
;
資訊工程學系
Compared with current distributed networks, Software defined networking is an innovative technology to manage networks by a centralized controller with global visibility. OpenFlow is one kind of SDN protocols. It provides flow-level controllability of network traffic to simplify the management of the administrators of data center. Flow control rules used by OpenFlow in switch flow table are called flow entries. Modern commodity switches use TCAM to implement flow table because of its high matching speed. However, the general TCAM size of switch only accommodates up to thousands of flow entries due to its high cost-to-density ratio and high power consumption. It indicates that the maximal number of flow that can be controlled is restricted to the TCAM size of switch. That leads to several scalability issues, especially in a data center. In this paper, we propose a topology based flow entry management (TFEM) technique, which is a scalable and memory-efficient solution by exploiting the hierarchical topology characteristic to aggregate the uses of flow entries for most of the small flows in a data center. With the proposed downlink and uplink separated flow tables structure, our results show that TFEM can reduce the average number of flow entries by 50%similar to 78% for fat-tree topology against the traditional SDN without any switch hardware modification.

學術出版;;Publications

Browse

Filters

Settings

Sort By

Results per page

🏛️國立陽明交通大學機構典藏

Search Results