Segurança em redes definidas por software :autenticação, controle de acesso e consistência com plano de controle eficientemente distribuído

Abstract

The control distribution in Software-Defined Networks improves the security, performance and scalability of the network. However, distributed control introduces consistency challenges into the network global view. In this work, we present the main security threats to the software-defined networks, we propose a host authentication and access control mechanism based on host credentials, we propose an efficient controller-distribution architecture, and we also propose consistent schemes for the policy updates on centralized or on distributed control networks. An authenticationmechanism prototype was implemented over POX, an OpenFlow controller. The results of the authentication prototype show that the proposal blocks access to unauthorized hosts, even in the scenario where a host has its access permission revoked. The distributed controller prototype was implemented and the placement heuristic was analyzed in several real topologies. The results of the controller placement evaluation show that network connectivity is maintained in scenarios where there is a high rate of network node failure. It is also proven that placement optimization reduces the average latency between controllers. A simulator for Software-Defined Networking has been developed and validated. The simulations of security policy enforcement in real network topologies show that the overhead generated by the proposed schemes is very low. Through formal verification, it is shown that the proposed consistency protocol guarantees a global order for all policy updates and that correctly composes all policies installed on the network.