SDN Controller Flood Prevention via Flow Table Intermediary
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Software-Defined Networking (SDN) controllers are vulnerable to denial of service attacks, which overwhelm the infrastructure by generating malicious flows that exhaust resources and disrupt legitimate path setup requests, due to the lack of effective mechanisms to manage table-miss entries and prevent flooding.
Innovation Solution
Implementing flood prevention flow entries in networking devices to refrain from sending Packet_IN messages to the SDN controller until path setup is completed, and deleting these entries when the path is established, thereby controlling the ingress of data packets and preventing resource exhaustion.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the SDN controller processes all Packet_IN messages from table-miss entries, then path setup for legitimate flows is enabled, but resource exhaustion and service disruption occur due to malicious flows
Solution Approach 1:
The system performs preliminary actions by installing flood prevention flow entries in the second flow table before malicious flows can exhaust controller resources. These preemptive entries detect and drop suspicious Packet_IN messages early, preventing resource exhaustion while still allowing legitimate path setup requests to proceed to the controller.
Solution Approach 2:
The second flow table acts as an intermediary between the first flow table and the SDN controller. It intercepts Packet_IN messages from table-miss entries, filters out malicious flows using flood prevention entries, and only forwards legitimate requests to the controller, thus protecting resources while maintaining service functionality.
2Object-affected harmful factors
If flood prevention flow entries are installed to drop Packet_IN messages, then controller resource protection is achieved, but legitimate path setup requests may be blocked
Solution Approach 1:
The system applies different quality treatments to different flows locally at the switch level. Flood prevention flow entries are selectively installed for suspicious flows identified through table-miss patterns, while legitimate flows continue to be processed normally. This localized differentiation protects resources without blocking valid path setup requests.
Solution Approach 2:
The system uses feedback mechanisms where the SDN controller monitors Packet_IN message patterns and dynamically adjusts flood prevention flow entries. When legitimate flows are incorrectly blocked, the controller receives feedback and removes or modifies the restrictive entries, ensuring that resource protection does not compromise legitimate service requirements.
Data Source
AI summary
A Method and a system for securing a SDN controller from denial of service attack are provided. A SDN controller receives, from a networking device, data packets pertaining to a flow in Packet_IN messages, if the flow does not match flow entries in a first flow table of the networking device. A table miss flow entry pertaining to the flow is created in a second flow table of the networking device for sending the Packet_IN. The SDN controller installs a flood prevention flow entry in the second flow table to enable the networking device to drop subsequent data packets pertaining to the flow until the SDN controller installs, in the first flow table, a flow entry matching the flow. The flood prevention flow entry is deleted from the second flow table after the installation of the flow entry matching the flow.