File:SOFTWARE-DEFINED NETWORKS- PROTOCOL DIALECTS (IA softwaredefinedn1094564066).pdf

Software-defined networks (SDNs) are attractive to businesses and the military because they enable centralized and policy-based control at per flow level. However, current SDN standards by the Open Networking Foundation do not require the use of encryption or authentication for communication between controllers and switches. We propose a novel method to add message authentication to SDN control plane traffic via the use of a protocol dialect. A protocol dialect is a variation of an existing implementation of an open-source protocol such as OpenFlow, achieved by either adding proxies or directly modifying the binary code to incorporate new security measures or remove unused features. This research provides a framework for systematic creation and evaluation of a protocol dialect, and presents a novel design of a protocol dialect for OpenFlow. The protocol dialect includes three derivatives and provides authentication that not only is independent of Transport Layer Security (TLS) but also may mitigate some attacks, e.g., cipher-suite downgrade attacks, against TLS. Performance measurements from a Mininet experiment show that the derivatives did not significantly impact the communication latency of OpenFlow, adding less than 1% overhead when TLS is not enabled and less than 22% with TLS enabled.