Software-defined network controller security : empirical study

Software-defined networks (SDN) introduce a novel networking paradigm. SDN architecture separates the control and data planes, whereas the control plane generates flow rules required to forward packets by data plane devices. Devices logic detached to form a new plane named controller. SDN model decomposes the complexity of the traditional network and leverages management flexibility and scalability. Nevertheless, security is a major challenge in SDN networks. The controller is a crucial element in the SDN model, considering a single entity governs the entire network. A centralized configuration is highly vulnerable, as the controller is an attractive target for intruders. This paper explores the threats related to the SDN architecture, specifically, threats originated from the existence of controller. The study analyzes controller security on three levels. The first phase of the analysis defines potential threats in various literature. Therefore, we expand and formalize threats in a STRIDE analysis. In the second phase, we deeply analyze the attacks through several attack trees. The third phase is an experiment to evince the threats and the consequence. The study investigates the current security solutions and their limitations. The paper provides an empirical analysis of the controller security to identify, formalize, and quantify the security concerns related to the new model.