Host-Based Flow Table Size Inference in Multi-Hop SDN
Host-Based Flow Table Size Inference in Multi-Hop SDN
复制标题
DOI：
10.1109/globecom54140.2023.10436907
复制
发表时间：
2023-12
期刊：
影响因子：
--
通讯作者：
Tian Xie;Sanchal Thakkar;Ting He;N. Bartolini;Patrick D. McDaniel
中科院分区：
文献类型：
--
作者：
Tian Xie;Sanchal Thakkar;Ting He;N. Bartolini;Patrick D. McDaniel
作为一种新型的网络模式，软件定义网络（SDN）极大地简化了网络管理，但也引入了新的漏洞。一个特别令人感兴趣的漏洞是流表，这是每个启用SDN的交换机中的数据结构，它缓存来自控制器的流规则，以弥合数据平面和控制平面之间的速度差距。先前的工作已经表明，对手控制的主机可以在其直接连接的边缘交换机处准确地推断流表的参数，然后可以使用这些参数来发起智能攻击。然而，这些解决方案不适用于内部交换机处的流表。在这项工作中，我们开发了一种算法，可以推断不同的流表大小在内部交换机通过测量往返时间（RTT）的路径穿越这些开关从它的端点之一。在这个问题中的一个主要挑战是在RTT和流表命中/未命中之间缺乏可推断的关系在遍历的交换机。我们的解决方案通过实验识别可推断的信息并设计推理算法来解决这一挑战，该算法结合了精心设计的探测序列和统计工具，以减轻测量噪声和干扰。我们的解决方案的有效性通过Mininet实验验证。
As a novel network paradigm, Software Defined Networking (SDN) has greatly simplified network management, but also introduced new vulnerabilities. One vulnerability of particular interest is the flow table, a data structure in every SDN-enabled switch that caches flow rules from the controller to bridge the speed gap between the data plane and the control plane. Prior works have shown that an adversary-controlled host can accurately infer parameters of the flow table at its directly-connected edge switch, which can then be used to launch intelligent attacks. However, those solutions do not work for flow tables at internal switches. In this work, we develop an algorithm that can infer the different flow table sizes at internal switches by measuring the Round Trip Times (RTTs) of a path traversing these switches from one of its endpoints. A major challenge in this problem is the lack of an inferable relationship between the RTTs and the flow table hits/misses at the traversed switches. Our solution addresses this challenge by experimentally identifying the inferable information and designing an inference algorithm that combines carefully designed probing sequences and statistical tools to mitigate measurement noise and interference. The efficacy of our solution is validated through experiments in Mininet.