Regulatory Impact on 5G Security and Privacy 409
17.4.3 Security and Privacy Issues in Software Defined Networking (SDN)
Software‐Defined Networking (SDN) provides a centralized intelligence and control
model that is well suited to offer much‐needed flexibility for network security deployments. Along with many benefits, SDN also poses new threats, particularly with the
emergence of cloud and virtualized environments [27]. The central control of the SDN
architecture could give an attacker the command over the entire network [28].
OpenFlow‐enabled SDN offers a wide range of benefits for security implementation
and management [27]:
● fine‐grained enforcement and control of multiple simultaneous security policies
throughout the data center;
● rapid response to threats, with the ability to rapidly steer or guarantee flows and VMs
based on real‐time network conditions;
● validation of security policies, and quick identification and resolution of any policy
conflicts that may arise;
● efficient authentication of the flow rule producers through the use of digital
signatures;
● incorporation of a trust model with live rule‐conflict detection and resolution at the
controller layer;
● synchronization of distributed policy insertion and removal;
● optimization of secure flow routing in a highly dynamic environment;
● dynamic assertion of extensions to the security policy when new threats are detected;
● provision of a mechanism for auditing and audit trails.
The separation of the different planes and aggregating the control functionality to a
centralized system also opens up new challenges. The communication channels between
the isolated planes can be targeted to masquerade one plane for attacking the other. The
control plane can become a single point of failure and render the whole network down
in the case of compromise. The malfunctioning or malicious software can compromise
the whole network, having access granted to the control plane [29].
Basically, the security issues in SDN are concentrated around the main areas of:
1) application plane;
2) control plane;
3) data plane; and
4) communication security.
SDN enables applications to interact with and manipulate the behavior of network elements through the control layer. SDN has two properties which can be seen
as attractive to malicious users: i) the ability to control the network by software; and
ii) centralization of network intelligence in network controllers. Since, there are no
standards or open specifications to facilitate open APIs for applications to control
the network services and functions through the control plane, applications can pose
serious security threats to the network resources, services and functions [32].
The Open Networking Foundation (ONF) organization has launched a study to determine how to make SDN more secure. The ONF is considering, for example, the idea of
using distributed protocols, which are more resilient and harder to attack, simply because
they are not concentrated [30].
17.4.3 Security and Privacy Issues in Software Defined Networking (SDN)
Software‐Defined Networking (SDN) provides a centralized intelligence and control
model that is well suited to offer much‐needed flexibility for network security deployments. Along with many benefits, SDN also poses new threats, particularly with the
emergence of cloud and virtualized environments [27]. The central control of the SDN
architecture could give an attacker the command over the entire network [28].
OpenFlow‐enabled SDN offers a wide range of benefits for security implementation
and management [27]:
● fine‐grained enforcement and control of multiple simultaneous security policies
throughout the data center;
● rapid response to threats, with the ability to rapidly steer or guarantee flows and VMs
based on real‐time network conditions;
● validation of security policies, and quick identification and resolution of any policy
conflicts that may arise;
● efficient authentication of the flow rule producers through the use of digital
signatures;
● incorporation of a trust model with live rule‐conflict detection and resolution at the
controller layer;
● synchronization of distributed policy insertion and removal;
● optimization of secure flow routing in a highly dynamic environment;
● dynamic assertion of extensions to the security policy when new threats are detected;
● provision of a mechanism for auditing and audit trails.
The separation of the different planes and aggregating the control functionality to a
centralized system also opens up new challenges. The communication channels between
the isolated planes can be targeted to masquerade one plane for attacking the other. The
control plane can become a single point of failure and render the whole network down
in the case of compromise. The malfunctioning or malicious software can compromise
the whole network, having access granted to the control plane [29].
Basically, the security issues in SDN are concentrated around the main areas of:
1) application plane;
2) control plane;
3) data plane; and
4) communication security.
SDN enables applications to interact with and manipulate the behavior of network elements through the control layer. SDN has two properties which can be seen
as attractive to malicious users: i) the ability to control the network by software; and
ii) centralization of network intelligence in network controllers. Since, there are no
standards or open specifications to facilitate open APIs for applications to control
the network services and functions through the control plane, applications can pose
serious security threats to the network resources, services and functions [32].
The Open Networking Foundation (ONF) organization has launched a study to determine how to make SDN more secure. The ONF is considering, for example, the idea of
using distributed protocols, which are more resilient and harder to attack, simply because
they are not concentrated [30].