Biblio

Found 175 results

Filters: Keyword is SDN  [Clear All Filters]
2019-04-29
Jevtic, Stefan, Lotfalizadeh, Hamidreza, Kim, Dongsoo S..  2018.  Toward Network-based DDoS Detection in Software-defined Networks. Proceedings of the 12th International Conference on Ubiquitous Information Management and Communication. :40:1–40:8.
To combat susceptibility of modern computing systems to cyberattack, identifying and disrupting malicious traffic without human intervention is essential. To accomplish this, three main tasks for an effective intrusion detection system have been identified: monitor network traffic, categorize and identify anomalous behavior in near real time, and take appropriate action against the identified threat. This system leverages distributed SDN architecture and the principles of Artificial Immune Systems and Self-Organizing Maps to build a network-based intrusion detection system capable of detecting and terminating DDoS attacks in progress.
2019-06-28
Dixit, Vaibhav Hemant, Doupé, Adam, Shoshitaishvili, Yan, Zhao, Ziming, Ahn, Gail-Joon.  2018.  AIM-SDN: Attacking Information Mismanagement in SDN-Datastores. Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security. :664-676.

Network Management is a critical process for an enterprise to configure and monitor the network devices using cost effective methods. It is imperative for it to be robust and free from adversarial or accidental security flaws. With the advent of cloud computing and increasing demands for centralized network control, conventional management protocols like SNMP appear inadequate and newer techniques like NMDA and NETCONF have been invented. However, unlike SNMP which underwent improvements concentrating on security, the new data management and storage techniques have not been scrutinized for the inherent security flaws. In this paper, we identify several vulnerabilities in the widely used critical infrastructures which leverage the Network Management Datastore Architecture design (NMDA). Software Defined Networking (SDN), a proponent of NMDA, heavily relies on its datastores to program and manage the network. We base our research on the security challenges put forth by the existing datastore's design as implemented by the SDN controllers. The vulnerabilities identified in this work have a direct impact on the controllers like OpenDayLight, Open Network Operating System and their proprietary implementations (by CISCO, Ericsson, RedHat, Brocade, Juniper, etc). Using our threat detection methodology, we demonstrate how the NMDA-based implementations are vulnerable to attacks which compromise availability, integrity, and confidentiality of the network. We finally propose defense measures to address the security threats in the existing design and discuss the challenges faced while employing these countermeasures.

Shan-Shan, Jia, Ya-Bin, Xu.  2018.  The APT Detection Method Based on Attack Tree for SDN. Proceedings of the 2Nd International Conference on Cryptography, Security and Privacy. :116-121.

SDN with centralized control is more vulnerable to suffer from APT than traditional network. To accurately detect the APT that the SDN may suffer from, this paper proposes the APT detection method based on attack tree for SDN. Firstly, after deeply analyzing the process of APT in SDN, we establish APT attack model based on attack tree. Then, correlation analysis of attack behavior that detected by multiple detection methods to get attack path. Finally, the attack path match the APT attack model to judge whether there is an APT in SDN. Experiment shows that the method is more accurate to detect APT in SDN, and less overhead.

Hamza, Ayyoob, Gharakheili, Hassan Habibi, Sivaraman, Vijay.  2018.  Combining MUD Policies with SDN for IoT Intrusion Detection. Proceedings of the 2018 Workshop on IoT Security and Privacy. :1-7.

The IETF's push towards standardizing the Manufacturer Usage Description (MUD) grammar and mechanism for specifying IoT device behavior is gaining increasing interest from industry. The ability to control inappropriate communication between devices in the form of access control lists (ACLs) is expected to limit the attack surface on IoT devices; however, little is known about how MUD policies will get enforced in operational networks, and how they will interact with current and future intrusion detection systems (IDS). We believe this paper is the first attempt to translate MUD policies into flow rules that can be enforced using SDN, and in relating exception behavior to attacks that can be detected via off-the-shelf IDS. Our first contribution develops and implements a system that translates MUD policies to flow rules that are proactively configured into network switches, as well as reactively inserted based on run-time bindings of DNS. We use traces of 28 consumer IoT devices taken over several months to evaluate the performance of our system in terms of switch flow-table size and fraction of exception traffic that needs software inspection. Our second contribution identifies the limitations of flow-rules derived from MUD in protecting IoT devices from internal and external network attacks, and we show how our system is able to detect such volumetric attacks (including port scanning, TCP/UDP/ICMP flooding, ARP spoofing, and TCP/SSDP/SNMP reflection) by sending only a very small fraction of exception packets to off-the-shelf IDS.

Shi, Jiangyong, Zeng, Yingzhi, Wang, Wenhao, Yang, Yuexiang.  2018.  Feedback Based Sampling for Intrusion Detection in Software Defined Network. Proceedings of the 2Nd International Conference on Cryptography, Security and Privacy. :95-99.

Cloud computing is being deployed more and more widely. However, the difficulty of monitoring the huge east-west traffic is a great security concern. In this paper, we proposed FBSample, a sampling method which employs the central control feature of SDN and feedback information of IDS. Evaluation results show FBSample can largely reduce the amount of packets to be transferred while maintaining a relatively high detection precision.

Park, Taejune, Xu, Zhaoyan, Shin, Seungwon.  2018.  HEX Switch: Hardware-Assisted Security Extensions of OpenFlow. Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges. :33-39.

Software-defined networking (SDN) and Network Function Virtualization (NFV) have inspired security researchers to devise new security applications for these new network technology. However, since SDN and NFV are basically faithful to operating a network, they only focus on providing features related to network control. Therefore, it is challenging to implement complex security functions such as packet payload inspection. Several studies have addressed this challenge through an SDN data plane extension, but there were problems with performance and control interfaces. In this paper, we introduce a new data plane architecture, HEX which leverages existing data plane architectures for SDN to enable network security applications in an SDN environment efficiently and effectively. HEX provides security services as a set of OpenFlow actions ensuring high performance and a function of handling multiple SDN actions with a simple control command. We implemented a DoS detector and Deep Packet Inspection (DPI) as the prototype features of HEX using the NetFPGA-1G-CML, and our evaluation results demonstrate that HEX can provide security services as a line-rate performance.

2019-06-17
Shif, L., Wang, F., Lung, C..  2018.  Improvement of security and scalability for IoT network using SD-VPN. NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium. :1–5.

The growing interest in the smart device/home/city has resulted in increasing popularity of Internet of Things (IoT) deployment. However, due to the open and heterogeneous nature of IoT networks, there are various challenges to deploy an IoT network, among which security and scalability are the top two to be addressed. To improve the security and scalability for IoT networks, we propose a Software-Defined Virtual Private Network (SD-VPN) solution, in which each IoT application is allocated with its own overlay VPN. The VPN tunnels used in this paper are VxLAN based tunnels and we propose to use the SDN controller to push the flow table of each VPN to the related OpenvSwitch via the OpenFlow protocol. The SD-VPN solution can improve the security of an IoT network by separating the VPN traffic and utilizing service chaining. Meanwhile, it also improves the scalability by its overlay VPN nature and the VxLAN technology.

2019-06-28
Gillani, Fida, Al-Shaer, Ehab, Duan, Qi.  2018.  In-Design Resilient SDN Control Plane and Elastic Forwarding Against Aggressive DDoS Attacks. Proceedings of the 5th ACM Workshop on Moving Target Defense. :80-89.

Using Software-defined Networks in wide area (SDN-WAN) has been strongly emerging in the past years. Due to scalability and economical reasons, SDN-WAN mostly uses an in-band control mechanism, which implies that control and data sharing the same critical physical links. However, the in-band control and centralized control architecture can be exploited by attackers to launch distributed denial of service (DDoS) on SDN control plane by flooding the shared links and/or the Open flow agents. Therefore, constructing a resilient software designed network requires dynamic isolation and distribution of the control flow to minimize damage and significantly increase attack cost. Existing solutions fall short to address this challenge because they require expensive extra dedicated resources or changes in OpenFlow protocol. In this paper, we propose a moving target technique called REsilient COntrol Network architecture (ReCON) that uses the same SDN network resources to defend SDN control plane dynamically against the DDoS attacks. ReCON essentially, (1) minimizes the sharing of critical resources among data and control traffic, and (2) elastically increases the limited capacity of the software control agents on-demand by dynamically using the under-utilized resources from within the same SDN network. To implement a practical solution, we formalize ReCON as a constraints satisfaction problem using Satisfiability Modulo Theory (SMT) to guarantee a correct-by-construction control plan placement that can handle dynamic network conditions.

Sahoo, Kshira Sagar, Tiwary, Mayank, Sahoo, Sampa, Nambiar, Rohit, Sahoo, Bibhudatta, Dash, Ratnakar.  2018.  A Learning Automata-Based DDoS Attack Defense Mechanism in Software Defined Networks. Proceedings of the 24th Annual International Conference on Mobile Computing and Networking. :795-797.

The primary innovations behind Software Defined Networks (SDN)are the decoupling of the control plane from the data plane and centralizing the network management through a specialized application running on the controller. Despite all its capabilities, the introduction of various architectural entities of SDN poses many security threats and potential target. Especially, Distributed Denial of Services (DDoS) is a rapidly growing attack that poses a tremendous threat to both control plane and forwarding plane of SDN. Asthe control layer is vulnerable to DDoS attack, the goal of this paper is to provide a defense system which is based on Learning Automata (LA) concepts. It is a self-operating mechanism that responds to a sequence of actions in a certain way to achieve a specific goal. The simulation results show that this scheme effectively reduces the TCP connection setup delay due to DDoS attack.

2019-11-12
Xiao, Lili, Xiang, Shuangqing, Zhuy, Huibiao.  2018.  Modeling and Verifying SDN with Multiple Controllers. Proceedings of the 33rd Annual ACM Symposium on Applied Computing. :419-422.

SDN (Software Defined Network) with multiple controllers draws more attention for the increasing scale of the network. The architecture can handle what SDN with single controller is not able to address. In order to understand what this architecture can accomplish and face precisely, we analyze it with formal methods. In this paper, we apply CSP (Communicating Sequential Processes) to model the routing service of SDN under HyperFlow architecture based on OpenFlow protocol. By using model checker PAT (Process Analysis Toolkit), we verify that the models satisfy three properties, covering deadlock freeness, consistency and fault tolerance.

2019-06-28
Cho, Joo Yeon, Szyrkowiec, Thomas.  2018.  Practical Authentication and Access Control for Software-Defined Networking over Optical Networks. Proceedings of the 2018 Workshop on Security in Softwarized Networks: Prospects and Challenges. :8-13.

A framework of Software-Defined Networking (SDN) provides a centralized and integrated method to manage and control modern optical networks. Unfortunately, the centralized and programmable structure of SDN introduces several new security threats, which may allow an adversary to take over the entire operation of the network. In this paper, we investigate the potential security threats of SDN over optical networks and propose a mutual authentication and a fine-grained access control mechanism, which are essential to avoid an unauthorized access to the network. The proposed schemes are based only on cryptographic hash functions and do not require an installation of the complicated cryptographic library such as SSL. Unlike conventional authentication and access control schemes, the proposed schemes are flexible, compact and, in addition, are resistant to quantum computer attacks, which may become critical in the near future.

2019-06-10
Arsalan, A., Rehman, R. A..  2018.  Prevention of Timing Attack in Software Defined Named Data Network with VANETs. 2018 International Conference on Frontiers of Information Technology (FIT). :247–252.

Software Defined Network (SDN) is getting popularity both from academic and industry. Lot of researches have been made to combine SDN with future Internet paradigms to manage and control networks efficiently. SDN provides better management and control in a network through decoupling of data and control plane. Named Data Networking (NDN) is a future Internet technique with aim to replace IPv4 addressing problems. In NDN, communication between different nodes done on the basis of content names rather than IP addresses. Vehicular Ad-hoc Network (VANET) is a subtype of MANET which is also considered as a hot area for future applications. Different vehicles communicate with each other to form a network known as VANET. Communication between VANET can be done in two ways (i) Vehicle to Vehicle (V2V) (ii) Vehicle to Infrastructure (V2I). Combination of SDN and NDN techniques in future Internet can solve lot of problems which were hard to answer by considering a single technique. Security in VANET is always challenging due to unstable topology of VANET. In this paper, we merge future Internet techniques and propose a new scheme to answer timing attack problem in VANETs named as Timing Attack Prevention (TAP) protocol. Proposed scheme is evaluated through simulations which shows the superiority of proposed protocol regarding detection and mitigation of attacker vehicles as compared to normal timing attack scenario in NDN based VANET.

2019-02-08
Du, Sang Gyun, Lee, Jong Won, Kim, Keecheon.  2018.  Proposal of GRPC As a New Northbound API for Application Layer Communication Efficiency in SDN. Proceedings of the 12th International Conference on Ubiquitous Information Management and Communication. :68:1-68:6.

Software Defined Networking (SDN) is a programmable network technology which aims to move an existing controller role in hardware equipment into an area of software. The control layer employs an application programming interface (API) to communicate with the application and infrastructure layers as it is centered between two layers. As the Southbound API used in communication with the infrastructure layer, the OpenFlow is defined as the current de factor standard in most SDN controllers. In contrast, the Northbound API used in communication with the application layer had no standard. Only REST API is used in Floodlight or OpenDaylight. Thus, the development in application area where SDN's true value lies to achieve network intelligence is not promoted well enough. In this paper, a gRPC protocol is proposed as useable Northbound API rather than REST API used in some controllers, and applicability of new standard as Northbound API is investigated.

Thimmaraju, Kashyap, Shastry, Bhargava, Fiebig, Tobias, Hetzelt, Felicitas, Seifert, Jean-Pierre, Feldmann, Anja, Schmid, Stefan.  2018.  Taking Control of SDN-Based Cloud Systems via the Data Plane. Proceedings of the Symposium on SDN Research. :1:1-1:15.

Virtual switches are a crucial component of SDN-based cloud systems, enabling the interconnection of virtual machines in a flexible and "software-defined" manner. This paper raises the alarm on the security implications of virtual switches. In particular, we show that virtual switches not only increase the attack surface of the cloud, but virtual switch vulnerabilities can also lead to attacks of much higher impact compared to traditional switches. We present a systematic security analysis and identify four design decisions which introduce vulnerabilities. Our findings motivate us to revisit existing threat models for SDN-based cloud setups, and introduce a new attacker model for SDN-based cloud systems using virtual switches. We demonstrate the practical relevance of our analysis using a case study with Open vSwitch and OpenStack. Employing a fuzzing methodology, we find several exploitable vulnerabilities in Open vSwitch. Using just one vulnerability we were able to create a worm that can compromise hundreds of servers in a matter of minutes. Our findings are applicable beyond virtual switches: NFV and high-performance fast path implementations face similar issues. This paper also studies various mitigation techniques and discusses how to redesign virtual switches for their integration.

2020-05-15
Khorsandroo, Sajad, Tosun, Ali Saman.  2018.  Time Inference Attacks on Software Defined Networks: Challenges and Countermeasures. 2018 IEEE 11th International Conference on Cloud Computing (CLOUD). :342—349.

Through time inference attacks, adversaries fingerprint SDN controllers, estimate switches flow-table size, and perform flow state reconnaissance. In fact, timing a SDN and analyzing its results can expose information which later empowers SDN resource-consumption or saturation attacks. In the real world, however, launching such attacks is not easy. This is due to some challenges attackers may encounter while attacking an actual SDN deployment. These challenges, which are not addressed adequately in the related literature, are investigated in this paper. Accordingly, practical solutions to mitigate such attacks are also proposed. Discussed challenges are clarified by means of conducting extensive experiments on an actual cloud data center testbed. Moreover, mitigation schemes have been implemented and examined in details. Experimental results show that proposed countermeasures effectively block time inference attacks.

Aydeger, Abdullah, Saputro, Nico, Akkaya, Kemal.  2018.  Utilizing NFV for Effective Moving Target Defense Against Link Flooding Reconnaissance Attacks. MILCOM 2018 - 2018 IEEE Military Communications Conference (MILCOM). :946—951.

Moving target defense (MTD) is becoming popular with the advancements in Software Defined Networking (SDN) technologies. With centralized management through SDN, changing the network attributes such as routes to escape from attacks is simple and fast. Yet, the available alternate routes are bounded by the network topology, and a persistent attacker that continuously perform the reconnaissance can extract the whole link-map of the network. To address this issue, we propose to use virtual shadow networks (VSNs) by applying Network Function Virtualization (NFV) abilities to the network in order to deceive attacker with the fake topology information and not reveal the actual network topology and characteristics. We design this approach under a formal framework for Internet Service Provider (ISP) networks and apply it to the recently emerged indirect DDoS attacks, namely Crossfire, for evaluation. The results show that attacker spends more time to figure out the network behavior while the costs on the defender and network operations are negligible until reaching a certain network size.

2019-12-05
Akhtar, Nabeel, Matta, Ibrahim, Raza, Ali, Wang, Yuefeng.  2018.  EL-SEC: ELastic Management of Security Applications on Virtualized Infrastructure. IEEE INFOCOM 2018 - IEEE Conference on Computer Communications Workshops (INFOCOM WKSHPS). :778-783.

The concept of Virtualized Network Functions (VNFs) aims to move Network Functions (NFs) out of dedicated hardware devices into software that runs on commodity hardware. A single NF consists of multiple VNF instances, usually running on virtual machines in a cloud infrastructure. The elastic management of an NF refers to load management across the VNF instances and the autonomic scaling of the number of VNF instances as the load on the NF changes. In this paper, we present EL-SEC, an autonomic framework to elastically manage security NFs on a virtualized infrastructure. As a use case, we deploy the Snort Intrusion Detection System as the NF on the GENI testbed. Concepts from control theory are used to create an Elastic Manager, which implements various controllers - in this paper, Proportional Integral (PI) and Proportional Integral Derivative (PID) - to direct traffic across the VNF Snort instances by monitoring the current load. RINA (a clean-slate Recursive InterNetwork Architecture) is used to build a distributed application that monitors load and collects Snort alerts, which are processed by the Elastic Manager and an Attack Analyzer, respectively. Software Defined Networking (SDN) is used to steer traffic through the VNF instances, and to block attack traffic. Our results show that virtualized security NFs can be easily deployed using our EL-SEC framework. With the help of real-time graphs, we show that PI and PID controllers can be used to easily scale the system, which leads to quicker detection of attacks.

2020-11-02
Siddiqui, Abdul Jabbar, Boukerche, Azzedine.  2018.  On the Impact of DDoS Attacks on Software-Defined Internet-of-Vehicles Control Plane. 2018 14th International Wireless Communications Mobile Computing Conference (IWCMC). :1284—1289.

To enhance the programmability and flexibility of network and service management, the Software-Defined Networking (SDN) paradigm is gaining growing attention by academia and industry. Motivated by its success in wired networks, researchers have recently started to embrace SDN towards developing next generation wireless networks such as Software-Defined Internet of Vehicles (SD-IoV). As the SD-IoV evolves, new security threats would emerge and demand attention. And since the core of the SD-IoV would be the control plane, it is highly vulnerable to Distributed Denial of Service (DDoS) Attacks. In this work, we investigate the impact of DDoS attacks on the controllers in a SD-IoV environment. Through experimental evaluations, we highlight the drastic effects DDoS attacks could have on a SD-IoV in terms of throughput and controller load. Our results could be a starting point to motivate further research in the area of SD-IoV security and would give deeper insights into the problems of DDoS attacks on SD-IoV.

2019-03-18
Demirci, S., Sagiroglu, S..  2018.  Software-Defined Networking for Improving Security in Smart Grid Systems. 2018 7th International Conference on Renewable Energy Research and Applications (ICRERA). :1021–1026.

This paper presents a review on how to benefit from software-defined networking (SDN) to enhance smart grid security. For this purpose, the attacks threatening traditional smart grid systems are classified according to availability, integrity, and confidentiality, which are the main cyber-security objectives. The traditional smart grid architecture is redefined with SDN and a conceptual model for SDN-based smart grid systems is proposed. SDN based solutions to the mentioned security threats are also classified and evaluated. Our conclusions suggest that SDN helps to improve smart grid security by providing real-time monitoring, programmability, wide-area security management, fast recovery from failures, distributed security and smart decision making based on big data analytics.

2020-11-02
Sahbi, Roumissa, Ghanemi, Salim, Djouani, Ramissa.  2018.  A Network Model for Internet of vehicles based on SDN and Cloud Computing. 2018 6th International Conference on Wireless Networks and Mobile Communications (WINCOM). :1—4.

Internet of vehicles (IoV) is the evolution of conventional vehicle network (VANET), a recent domain attracting a large number of companies and researchers. It is an integration of three networks: an inter-vehicle network, an intra-vehicle network, and vehicular mobile Internet, in which the vehicle is considered as a smart object equipped with powerful multi-sensors platform, connectivity and communication technologies, enabling it to communicate with the world. The cooperative communication between vehicles and other devices causes diverse challenges in terms of: storage and computing capability, energy of vehicle and network's control and management. Security is very important aspect in IoV and it is required to protect connected cars from cybercrime and accidents. In this article, we propose a network model for IoV based on software Defined Network and Cloud Computing.

2018-05-09
Aseeri, Ahmad, Netjinda, Nuttapong, Hewett, Rattikorn.  2017.  Alleviating Eavesdropping Attacks in Software-defined Networking Data Plane. Proceedings of the 12th Annual Conference on Cyber and Information Security Research. :1:1–1:8.
Software-Defined Networking (SDN) is an emerging paradigm that introduces a concept of programmable networks to enhance the agility in networking management. By separating concerns of the data plane and the control plane, implementing network switching as packet forwarding, and using centralized software to logically control the entire networks, SDN makes it simpler to automate and configure the network to respond to high-level policy enforcement and dynamically changing network conditions. As SDN becomes more prevalent, its security issues are increasingly critical. Eaves-dropping attacks are one of the most common and important network attacks because they are relatively easy to implement and their effects can escalate to more severe attacks. This paper addresses the issue of how to cope with eavesdropping attacks in the SDN data plane by using multiple routing paths to reduce the severity of data leakage. While this existing approach appears to be considerably effective, our simple analysis uncovers that without a proper strategy of data communication, it can still lead to 100% of data exposure. The paper describes a remedy along with illustrations both analytically and experimentally. The results show that our proposed remedy can avoid such catastrophe and further reduces the percentage of risk from data exposure approximately by a factor of 1/n where n is the number of alternate disjoint paths.
S R, Sivaramakrishnan, Mikovic, Jelena, Kannan, Pravein G., Mun Choon, Chan, Sklower, Keith.  2017.  Enabling SDN Experimentation in Network Testbeds. Proceedings of the ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization. :7–12.
Software-defined networking (SDN) has become a popular technology, being adopted in operational networks and being a hot research topic. Many network testbeds today are used to test new research solutions and would benefit from offering SDN experimentation capabilities to their users. Yet, exposing SDN to experimenters is challenging because experiments must be isolated from each other and limited switch resources must be shared fairly. We outline three different approaches for exposing SDN to experimenters while achieving isolation and fair sharing goals. These solutions use software implementation, shared hardware switches and smart network interface cards to implement SDN in testbeds. These approaches are under development on two operational SDN testbeds: the DeterLab at USC/ISI/Berkeley and the NCL testbed at the National University of Singapore.
2018-02-21
Kalinin, Maxim, Krundyshev, Vasiliy, Zegzhda, Peter, Belenko, Viacheslav.  2017.  Network Security Architectures for VANET. Proceedings of the 10th International Conference on Security of Information and Networks. :73–79.
In recent years, cyber security oriented research is paying much close attention on Vehicular Adhoc NETworks (VANETs). However, existing vehicular networks do not meet current security requirements. Typically for dynamic networks, maximal decentralization and rapidly changing topology of moving hosts form a number of security issues associated with ensuring access control of hosts, security policy enforcement, and resistance of the routing methods. To solve these problems generally, the paper reviews SDN (software defined networks) based network security architectures of VANET. The following tasks are solved in our work: composing of network security architectures for SDN-VANET (architecture with the central control and shared security servers, decentralized (zoned) architecture, hierarchical architecture); implementation of these architectures in virtual modeling environment; and experimental study of effectiveness of the suggested architectures. With large-scale vehicular networks, architectures with multiple SDN controllers are most effective. In small networks, the architecture with the central control also significantly outperforms the traditional VANET architecture. For the suggested architectures, three control modes are discussed in the paper: central, distributed and hybrid modes. Unlike common architectures, all of the proposed security architectures allow us to establish a security policy in m2m-networks and increase resistance capabilities of self-organizing networks.
2017-12-20
Pritchard, S. W., Hancke, G. P., Abu-Mahfouz, A. M..  2017.  Security in software-defined wireless sensor networks: Threats, challenges and potential solutions. 2017 IEEE 15th International Conference on Industrial Informatics (INDIN). :168–173.
A Software-Defined Wireless Sensor Network (SD-WSN) is a recently developed model which is expected to play a large role not only in the development of the Internet of Things (IoT) paradigm but also as a platform for other applications such as smart water management. This model makes use of a Software-Defined Networking (SDN) approach to manage a Wireless Sensor Network (WSN) in order to solve most of the inherent issues surrounding WSNs. One of the most important aspects of any network, is security. This is an area that has received little attention within the development of SDWSNs, as most research addresses security concerns within SDN and WSNs independently. There is a need for research into the security of SDWSN. Some concepts from both SDN and WSN security can be adjusted to suit the SDWSN model while others cannot. Further research is needed into consolidating SDN and WSN security measures to consider security in SDWSN. Threats, challenges and potential solutions to securing SDWSN are presented by considering both the WSN and SDN paradigms.
2018-05-09
Kim, Green, An, Junghyun, Kim, Keecheon.  2017.  A Study on Authentication Mechanism in SEaaS for SDN. Proceedings of the 11th International Conference on Ubiquitous Information Management and Communication. :51:1–51:6.
SDN (Software Defined Network) separates control plane from data plane (forwarding plane) which leads programmability of network and scalability, flexibility of existed network. nevertheless, the reason that security requirements had never considered during the initial design of SDN brought various security issues. And this security issues includes vulnerabilities (such as unauthorized access, data modification and leakage) and attacks (for example, DoS (Denial of Service) and MIITM (Main-in-the-Middle attack)). In this paper, we proposed SEaaS (Security as a Service) which can provide security within SDN environment. Also, we suggest authentication mechanism between application and controller among the various services of SEaaS.