Search

Whereas SDN (Software Defined Networks) provides the opportunity for the flexibility of network configuration, the introduction of controller systems raises new issues about developing firewall system design, such as controller attack, rule setup, and communication overhead for control messages. Especially, the delay and overload for dynamic control of stateful firewall are serious bottlenecks. This paper examines the current challenges and their origins, and presents a comprehensive solution to the key operational steps: topology-based selective filtering rules for setup and maintenance stage, three-layer rule structure for in-switch flow tables, and controller attack protection based on adaptive host connection tracking with multiple hashing queues named FlowTracker algorithm. The experiment results using multiple OVS switches and virtual hosts in GENI testbed demonstrate FlowTracker succeeds in monitoring all network connections and completely profiling host normal routine with acceptable latency increment (170 ms). Moreover, by utilizing multiple request queues, the proposed DoS attack detection algorithm reduce the response time to DoS 5 to 20 times less than using a single queue. [ABSTRACT FROM AUTHOR]

Summary: SummarySoftware‐defined network (SDN) is constructed by decoupling the control and data plane from the forwarding devices. The control plane operations are managed by centralized or distributed controllers, and the data plane operation is managed by respective forwarding devices. SDN provides an easy and efficient management solutions for software‐programmed consolidated middlebox in virtual machines. Additionally, SDN with centralized controller faces complications like scalability, network bottle neck, and single point failure. In this study, a stateful inspection firewall acts as a middlebox in distributed SDN‐controlled network. The controller is programmed with a failure detection and recovery mechanism to provide reliability and redundancy and enhance the overall performance of the network. The objective of stateful firewall on SDN architecture is to secure the network by monitoring the current connections and maintain its state information until the connection is active. In this paper, the performance of firewall‐enabled SDN with centralized and distributed controllers are measured, compared, and analyzed. The experiments are done using POX controller, and the results are verified by Mininet network emulation tool. The results show that the stateful firewall‐enabled SDN with distributed controller network improves the security, reliability, availability, and overall performance of the network. In the proposed SDN, average network throughput is improved by 43%, average network delay is reduced by 4%, average channel utilization is increased by 40%, average network overhead is reduced by 26%, and average network response time is reduced by 23%. [ABSTRACT FROM AUTHOR]