Attack Framework for SDN Networks and Protocols
Dias, Duarte Manuel Bento
MSc Thesis · 2023 · University of Coimbra
Supervisors: Bruno Miguel de Oliveira Sousa, Tiago José dos Santos Martins da Cruz
Abstract
This thesis examines the security implications of the emerging technology P4. Assuming that a switch can be injected with a rogue program using an infected library, three attacks data-plane attacks were developed: Traffic Re-routing, Man-in-the-Middle (MiTM), and Denial-of-Service (DoS). The thesis explores the implementation of all mentioned attacks, with emphasis on creating a remote trigger that allows the attack to be used at a different time other than infection. Mitigation strategies for the described attacks were also studied. In terms of statical analysis, the state of the art was searched, resulting in the retrieval of only two suitable tools, Gauntlet and BF4. After testing using the said tool, it was concluded that neither is able to detect rogue data-plane changes in code.In regards to network-based mitigation, P4-INT was tested as a network monitoring solution. INT was implemented in a spine-leaf (with 2 spines as 4 leaves), and it is responsible for collecting several network-related metrics: ingress and egress port, ingress and egress timestamp, ingress and egress interface, protocol, node ID and queue occupancy. It was concluded that P4-INT can detect a subset of the tested attacks (such as switch-DoS, MiTM, and to an extent, traffic re-routing), but it is not as successful in Single-Host DoS.Finally, an implementation of a controller-based countermeasure is demonstrated using the P4Runtime Controller. The example uses Grafana as a notification system, and the P4 runtime controller is used to issue a control-plane reset, followed by a system recovery.