Preventing flow rules injection attacks in SDNs using Blockchains

Abstract

Due to the programmability feature of Software-Defined Networks (SDNs), both the control software and network applications are susceptible to attacks, such as the injection of false flow rules. Thus, there is a need to investigate alternative solutions that enable the verification of integrity, authenticity, correctness, and agreement on the set of flow rules to be deployed on switches. In this context, the secure distribution of flow rules can be implemented through Distributed Ledgers (DLs), specifically utilizing Blockchain (BC) technology. This technology allows for the maintenance of a distributed and collaborative information registry among participants, who are responsible for the integrity and validation of the inserted data. With this in mind, this article presents an integrated model using BC to support security in the distribution and establishment of flow rules in SDNs. The proposed model was validated through experimental performance analysis and security assessment in an emulated environment. Results show that the proposed model is effective against attacks based on packet injection techniques.