Towards resilient in-band control path routing with malicious switch detection in SDN

In Software Defined Networks (SDNs), the control plane functionalities depend on the correctness of the information (e.g., network state) received from the data plane. A malicious switch on the in-band control path could tamper/drop the control messages, leading to misbehavior of the control plane. Hence, it is important to consider the security of in-band control paths on the southbound interface in SDN. Instead of actively probing the network with specific test packets/flows that incur high overhead on the control plane, we present in this paper, a novel control path routing approach that selects two node-disjoint control paths for every switch in the network in such a way that a malicious node can be detected based on the normal packet-in messages sent on the control paths. We develop an optimization programming formulation that provides control path routing solution and minimizes the average number of intermediate nodes while satisfying the malicious switch detection and resilience constraints. We demonstrate the effectiveness of the proposed approach through numerical analysis. The results show that the proposed approach enables faster malicious switch detection with less control overhead compared to an existing approach.