Software-defined networking (SDN) has revolutionized the world of technology as networks have become more flexible, dynamic and programmable. The ability to conduct network slicing in 5G networks is one of the most crucial features of SDN implementation. Although network programming provides new security solutions of traditional networks, SDN and network slicing also have security issues, an important one being the weaknesses related to openflow channel between the data plane and controller as the network can be attacked via the openflow channel and exploit communications with the control plane. Our work proposes a solution to provide adequate security for openflow messages through using a hybrid key consisting of classical and quantum key distribution protocols to provide double security depending on the computational complexity and physical properties of quantum. To achieve this goal, the hybrid key used with transport layer security protocol to provide confidentiality, integrity and quantum authentication to secure openflow channel. We experimentally based on the SDN-testbed and network slicing to show the workflow of exchanging quantum and classical keys between the control plane and data plane and our results showed the effectiveness of the hybrid key to enhance the security of the transport layer security protocol. Thereby achieving adequate security for openflow channel against classical and quantum computer attacks.
Software-defined networking (SDN) has revolutionized the world of technology as networks have become more flexible, dynamic and programmable. The ability to conduct network slicing in 5G networks is one of the most crucial features of SDN implementation. Although network programming provides new security solutions of traditional networks, SDN and network slicing also have security issues, an important one being the weaknesses related to openflow channel between the data plane and controller as the network can be attacked via the openflow channel and exploit communications with the control plane. Our work proposes a solution to provide adequate security for openflow messages through using a hybrid key consisting of classical and quantum key distribution protocols to provide double security depending on the computational complexity and physical properties of quantum. To achieve this goal, the hybrid key used with transport layer security protocol to provide confidentiality, integrity and quantum authentication to secure openflow channel. We experimentally based on the SDN-testbed and network slicing to show the workflow of exchanging quantum and classical keys between the control plane and data plane and our results showed the effectiveness of the hybrid key to enhance the security of the transport layer security protocol. Thereby achieving adequate security for openflow channel against classical and quantum computer attacks.
Network programming provides new security solutions for traditional networks. However, software-defined networking still suffers from security issues. An important one is the weaknesses related to the OpenFlow channel between network devices and controller, as the network can be attacked via the OpenFlow channel and exploit communications with the control plane. Our work proposes a solution to provide adequate security for OpenFlow messages in software-defined networks by using a hybrid key consisting of classical and quantum key distribution protocols to provide double security depending on the quantum's computational complexity and physical properties. To achieve this goal, the hybrid key is used with transport layer security protocol to provide confidentiality, integrity and quantum authentication to secure software-defined network connections between the control and data planes. We experimentally based on the SDN-testbed to show the workflow of exchanging quantum and classical keys between the control plane and network devices in the data plane, and our results showed the effectiveness of the hybrid key to enhance the security of the transport layer security protocol. Thereby achieving adequate security for controller communications with the data plane against classical and quantum computer attacks by conducting security analysis and clarifying the efficiency of the proposal in terms of the average required time.
Software-defined networking (SDN) has emerged as a promising paradigm for managing and controlling network resources efficiently. However, ensuring the security of data packets transmitted within an SDN environment remains a critical challenge. Traditional networking relies on static configurations, while SDN offers dynamic control and programmability, revolutionizing network management. In SDN, the application layer employs tools like OpenDaylight and Mininet for network management and testing. The control layer, managed by controllers such as Floodlight or ONOS, orchestrates traffic flow among switches. In the infrastructure layer, Quantum Key Distribution (QKD) with the BB84 protocol ensures secure communication. Together, these layers enable agile, programmable, and secure networking paradigms. This paper proposes integrating quantum key distribution (QKD) into SDN architectures to bolster packet-level security. By leveraging quantum entanglement and uncertainty, a secure communication channel between SDN controllers and switches is established, resilient to quantum attacks. Evaluation through simulations and real-world experiments demonstrates efficacy in mitigating security threats while minimizing overhead and latency, advancing SDN security IEEE 802.1X capabilities and leveraging quantum technologies for cybersecurity.
Software-Defined Networking (SDN) is an emerging networking paradigm that decouples the control and data plane in order to enable programmable and flexible networks, optimizing its applications and advancing computer systems. It does so through its architecture, a key part of which is a centralized network management through open interfaces that revolutionizes the way in which networks are designed and makes them more agile and versatile to the evolving needs of modern and future applications services. This also means, however, that there is now a centralized point of attack that is a major vulnerability, threatening the security of the entire network. With such an advanced network paradigm, it requires a security system that will mitigate these risks and warrant long-term security. In attempts to allow secure communications within the network, this research proposes the implementation of Quantum Key Distribution (QKD), leveraging quantum mechanics to secure the network against any computational advancements in the future. QKD is a recent cryptographic system that includes a traditional-computational channel and a physical-quantum channel to generate and distribute keys between parties. It uses the principles of quantum mechanics including entanglement and superposition to ensure that the physical layer cannot be compromised computationally. QKD provides confidentiality and privacy of information and communication. Moreover, it is resistant to technological advancements. The implications of QKD significantly enhance SDN security through its protection against attacks, efficient key distribution, reliable network orchestration, and data integrity, creating an architecture that establishes stable communication channels that are resistant to cyber threats.
Software Defined Networking (SDN) is one of the key networking technologies with broad applications in data centers, cloud computing, and networking. SDN uses isolation of data planes and control planes to offer more efficient control of data communication. Security and reliability of communication between controllers that manage network control information and network switches that route traffic in the data plane, is essential in SDN architecture. The communication between these two layers uses OpenFlow protocol. We propose a quantum-safe solution for providing security and reliability for OpenFlow communication that exploits multiple paths between a switch and a controller. We analyze our solution regarding security and reliability and show its efficiency is comparable to an alternative solution that does not provide quantum-safe security.
Man-in-the-middle (MitM) attacks became one of the most risk attacks on OpenFlow communication channel in software-defined networking, its detection is a very hard task due there is no authentication in OpenFlow protocol. This channel is the most important in the network and is responsible for sending the control commands from the controller to the switches, so once the OpenFlow channel is hacked, the entire network is controlled by the attacker. Therefore, we propose a complementary solution to transport layer security protocol to detect man-in-the-middle attacks based on hybrid quantum-classical protocol. Based on the hybrid protocol, an easy-toimplement authentication between controller and switches depends on quantum and classical security layers. Also, detect eavesdropping on channel depending on quantum parameters. In this paper, we implement a simulation of hybrid protocol using a software-defined networking emulator for monitoring the OpenFlow channel to detect attacks, and the results showed the ease of detecting the eavesdrop and verifying the authentication of the other party with a hybrid method to get a high level of authentication.
Today’s networks are quickly evolving toward more dynamic and flexible infrastructures and architectures. This software-based evolution has seen its peak with the development of the software-defined networking (SDN) and network functions virtualization (NFV) paradigms. These new concepts allow operators to automate the setup of services, thus reducing costs in deploying and operating the required infrastructure. On the other hand, these novel paradigms expose new vulnerabilities, as critical information travels through the infrastructure from central offices, down to remote data centers and network devices. Quantum key distribution (QKD) is a state-of-the-art technology that can be seen as a source of symmetric keys in two separated domains. It is immune to any algorithmic cryptanalysis and is thus suitable for long-term security. This technology is based on the laws of physics, which forbids us from copying the quantum states exchanged between two endpoints from which a secret key can be extracted. Thus, even though it has some limitations, a correct implementation can deliver keys of the highest security. In this paper, we propose the integration of QKD systems with well-known protocols and methodologies to secure the network’s control plane in an SDN and NFV environment. Furthermore, we experimentally demonstrate a workflow where QKD keys are used together with classically generated keys to encrypt communications between cloud and SDN platforms for setting up a service via secure shell, while showcasing the applicability to other cryptographic protocols.