When traditional networks try to meet the needs of today’s society, they encounter many limitations such as dependence on unchanged protocols, distributed control and hardware that is difficult to reprogram, which is why the concept of SDN has emerged. SDN networks separate the control plane from the data plane and thus combine the logic of the entire network in a centralized controller that can be accessed and programmed by the administrator via the NBI API interface. With the help of a global view of the network, the controller can make optimal network decisions. In addition to improved control and management, the concept of SDN also provides a higher level of automation, while the main drawback of SDN is poor security.
The centralization of network control implies a higher frequency and greater success of DoS attacks since the controller presents a single point of failure. Successful DoS attacks result in controller overload and failure, or in flooded flow tables of the switches in the network's data plane. The second most dangerous type of attack on SDN networks is unauthorized access to the controller, as the attacker can change the existing flow rules and therefore redirect traffic to malicious nodes or perform poisoning attack by injecting malicious packets into the network.
Networks are being protected from attacks by security mechanisms. They are used to capture (honeypots, honeynets), detect (IDS, DDoS detector) or prevent (IPS, firewall) attacks. Methods of hashing, encryption and authentication are also involved in security. We can also use solutions such as deep packet inspection, security information and event management, blockchains and machine learning. In SDN networks, virtualization also plays an important role. In addition to a greater capacity, agility of network and load distribution, virtualization also provides an extensible framework for dynamic cybersecurity management.
In the last part of my thesis, I focused on five examples of practical use of SDN technology in different areas, namely in: data centres, wide-area networks, secure access service edge, 5G networks and in connected autonomous vehicles. I researched security challenges and solutions in SDN networks.
|
