Security for SDN environments with P4
Pires, Rui Manuel Marques
MSc Thesis · 2023 · University of Coimbra
Supervisors: Paulo Alexandre Ferreira Simões, Tiago José dos Santos Martins da Cruz
Abstract
Software-Defined Networks (SDN) separates the data plane from the control plane, where the control is handled by the SDN controller. So, the controllers have full visibility of the network. P4 programming language brings a new set of possibilities, as the way the packets are processed is not defined by the vendor but rather by the P4 program. This allows moving the applications to the data plane which can now work at line speed, with great advantage for network security functions. Functions such as access control, privacy, encryption, and integrated defense can be mostly assured by the programmable data plane, thus offloading the controller. P4-INT is a P4-powered data-planefunction that can monitor the network and provide telemetry per packet. A consequence of having the data plane taking care of the security features isthe difficulty to confirm if the data plane behavior corresponds to the securitypolicies.This work investigates how P4-INT, can act as security control, how it can be attacked and how it can be protected. Within this thesis it was developed a Mininet and a P4Pi network with INT-MD with BMv2 switches. Within this network, it was configured an INT collector with InfluxDB and a Grafana dashboard. This solution was tested as a possible security control in which some scenarios were executed. Given the value of INT for the defense, it was also tested how it could be attacked and defended. Due to the vulnerabilities found in this INT network, some future improvements are also proposed.