OpenFlow Controller Enables Security Apps
August 22, 2013, Hot Interconnects Symposium, San Jose, CA—This paper by Yashar Ganjali from the University of Toronto looked at the class of apps that are improved by extensions to OpenFlow in a software-defined network. A collection of smaller networks can be less expensive and complex than large ones, but the user needs to have packet-level information. Current OpenFlow specifications provide limited access to packet-level information such as packet content, making it very inefficient, if not impossible, to deploy security and monitoring applications as controller applications.
Software-defined networks are evolving to have separate control and data paths, with flow-level communications between the controls and data. This increase in information to the controllers changes the rules for traffic. The challenge is to get the information from a sample per flow. The choice is a stochastic or deterministic sample, and the tradeoff is higher sampling versus throughput.
Instead, the researchers have created an extension to OpenFlow. This new instruction uses existing counters to implement the various parameters in the instruction. The parameters set sample counts and frequencies, and well as determining hits and misses. Some of the applications enabled by this new extension are traffic classification, quality of service, and diagnostics and troubleshooting.
As a security app, the extension could detect a port scan with a dynamic threshold for a failure with >= 2 UDP passes or 1 non-TCP packet passes. The parameters allow for changes in accuracy versus processor loading. One problem is flow shortening, a number of flows with only one packet, could generate false positives.
For flow reduction, you could install a rule to check the next packet after the first UDP or TCP_SYN packet. This reduction would identify elephant flows and ignore them, since they represent over 90 percent of all traffic. The resulting flow has fairly low overhead. The sample rate is dynamic at the controller level, and the switch only sends the information to the controller. The controller only has to evaluate a sample of all the traffic to provide better throughput.
