Strengthening SDN Security: Protocol Dialecting and Downgrade Attacks

Software-defined networking (SDN) has become a fundamental technology for data centers and 5G networks. Transport Layer Security (TLS) has been proposed as its single security layer for SDN networks; however, use of TLS is optional and TLS connections between the controller and switches are still vulnerable to downgrade attacks. In this paper, we propose a protocol dialecting approach to provide additional and customizable security assurance for network control messages. We consider and evaluate two dialecting approaches for OpenFlow protocol operation, adding per-message authentication to the SDN control channel that is independent of TLS and provides robustness against downgrade attacks targeting TLS. Furthermore, we measure the performance impact of using these dialecting primitives in a Mininet experiment. The results show a modest increase of communication latency of less than 22%.