Network Anti-Spoofing with SDN Data plane Authors:Yehuda Afek et al. Presenter : Soorya Ravichandran

Flow-table rules and Switch-controller messages. Introduction Traditional Middle box for anti-spoofing mitigation  CAPEX, Latency and Complexity. Anti-DDOS system with SDN  Implementing mitigations for both SDN and underlaying infrastructure. Flow-table rules and Switch-controller messages.

Technologies Used OpenFLow 1.5 and P4 P4 for flexible programming of the any protocol header. Open Vswitch Hping 3 tool  For generating SYN flood attack.

OVerVIew OF SDN Software Defined Networking  Segregation of Control and Data Plane. OpenFlow The interface between the Control Plane and Forwarding Plane is done through Open Flow Match and Action frame work.  Single Match Table (SMT), Multi Match Table (MMT), Reconfigurable Match Table (RMT – Used in this Paper)

Problems and SoLutions DDOS using Spoofed SYN attack. Statefull and Control Plane saturation attack in SDN controller. Flow-state congestion Solutions : Anti-Sync Spoofing. State –less challenge response. Distributed Network Solution.

Anti-Sync Spoofing Exhaustion of TCP on server and SDN Flow-table. Sync Cookie method HTTP Redirect with same server address. TCP reset

SYNC Cookie Method

Generation OF Cookie Controller Communication for Cookie Generation. Random + SYNC packet parameters Parameters used = source IP + Source PORT + 32 bit random number 8 bit portion spanned periodically.

Distributed Network Solution Flow table exhaustion due to increased legitimate traffic pin holes. Vertical Distribution  Resources of Switches are utilised along the bottleneck traffic path. Table for Space Di for path Pi for each switch. Threshold level is 80% of rules capacity and processing power. All switches involving in a saturated path are involved for load balancing.

Anti-Spoofing Performance Without mitigation –Http request fails at 2.7k pps With mitigation Successful rate is upto 206kpps Throughput decreases as the mitigation actions are implemented.

Anti-Spoofing Performance - cntd

Criticism Open vSwitch Security Vulnerability to be taken care  Buffer Over read Vulnerability. Open Flow Bypass Vulnerability : bypass of actions in pinholes Execute Code Open Flow Vulnerability : Allows unauth attacker to execute code Time stamp consideration in cookie generation.