I DPID It My Way! A Covert Timing Channel in Software-Defined Networks

Software-defined networking is considered a promising new paradigm, enabling more reliable and formally verifiable communication networks. However, this paper shows that the separation of the control plane from the data plane, which lies at the heart of Software-Defined Networks (SDNs), can be exploited for covert channels based on SDN Teleportation, even when the data planes are physically disconnected.This paper describes the theoretical model and design of our covert timing channel based on SDN Teleportation. We implement our covert channel using a popular SDN switch, Open vSwitch, and a popular SDN controller, ONOS. Our evaluation of the prototype shows that even under load at the controller, throughput rates of 20 bits per second are possible, with a communication accuracy of approximately 90%. We also discuss techniques to increase the throughput further.

[1]  Gustavus J. Simmons,et al.  A Secure Subliminal Channel (?) , 1985, CRYPTO.

[2]  C. Gray Girling,et al.  Covert Channels in LAN's , 1987, IEEE Transactions on Software Engineering.

[3]  Y. Hu,et al.  Improving Covert Storage Channel Analysis with SDN and Experimentation on GENI , 2016 .

[4]  Phuoc Tran-Gia,et al.  Enhancing SDN security by device fingerprinting , 2017, 2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM).

[5]  Theodore G. Handel,et al.  Hiding Data in the OSI Network Model , 1996, Information Hiding.

[6]  Lei Xu,et al.  Poisoning Network Visibility in Software-Defined Networks: New Attacks and Countermeasures , 2015, NDSS.

[7]  David L. Mills,et al.  On the Accuracy and Stablility of Clocks Synchronized by the Network Time Protocol in the Internet System , 1989, CCRV.

[8]  Daniel Firestone,et al.  VFP: A Virtual Switch Platform for Host SDN in the Public Cloud , 2017, NSDI.

[9]  Matt Bishop,et al.  The Art and Science of Computer Security , 2002 .

[10]  Stefan Schmid,et al.  Outsmarting Network Security with SDN Teleportation , 2016, 2017 IEEE European Symposium on Security and Privacy (EuroS&P).

[11]  Scott Shenker,et al.  Overcoming the Internet impasse through virtualization , 2005, Computer.

[12]  William Koch,et al.  Identifier Binding Attacks and Defenses in Software-Defined Networks , 2017, USENIX Security Symposium.

[13]  Anja Feldmann,et al.  Taking Control of SDN-based Cloud Systems via the Data Plane , 2018, SOSR.

[14]  Vijay Mann,et al.  SPHINX: Detecting Security Attacks in Software-Defined Networks , 2015, NDSS.

[15]  Xun Gong,et al.  Sneak-Peek: High speed covert channels in data center networks , 2016, IEEE INFOCOM 2016 - The 35th Annual IEEE International Conference on Computer Communications.

[16]  Carla E. Brodley,et al.  IP covert timing channels: design and detection , 2004, CCS '04.

[17]  Phuoc Tran-Gia,et al.  OFCProbe: A platform-independent tool for OpenFlow controller analysis , 2014, 2014 IEEE Fifth International Conference on Communications and Electronics (ICCE).

[18]  Butler W. Lampson,et al.  A note on the confinement problem , 1973, CACM.