2015 IEEE 23rd International Conference on Network Protocols (ICNP) (2015)
San Francisco, CA, USA
Nov. 10, 2015 to Nov. 13, 2015
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/ICNP.2015.26
In this paper, we study the feasibility of fingerprinting of controller-switch interactions in SDN networks by a remote adversary whose aim is to acquire knowledge about specific flow rules that are installed at the switches. This knowledge empowers the adversary with a better understanding of the network's packet-forwarding logic and exposes the network to a number of threats. In our study, we collect measurements from hosts located across the globe using a realistic SDN network comprising of OpenFlow hardware switches. We show that, by leveraging information from the RTT and packet-pair dispersion of the exchanged packets, fingerprinting attacks on SDN networks succeed with overwhelming probability. We also show that these attacks are not restricted to active adversaries, but can be equally mounted by passive adversaries that only monitor traffic exchanged with the SDN network. Finally, we sketch an efficient countermeasure to strengthen SDN networks against fingerprinting.
Control systems, Dispersion, Servers, Delays, Probes, Internet, Europe
R. Bifulco, H. Cui, G. O. Karame and F. Klaedtke, "Fingerprinting Software-Defined Networks," 2015 IEEE 23rd International Conference on Network Protocols (ICNP), San Francisco, CA, USA, 2015, pp. 453-459.