Sdn link discovery improved by dynamic randomization to block attacks
Rethinking Software-Defined Networking Link Discovery with Dynamic Randomization
Networking and Internet ArchitectureCryptography and Security
Summary
Discovering how different parts of a computer network connect is important but current methods can be tricked by attackers. The authors found that traditional link discovery techniques use fixed signals that are easy for bad actors to spot and misuse. They created a new system called ChameleonDisc that changes these signals dynamically, making it much harder for attackers to fake or mess with the network map. Their tests show it works well with little added cost.
What this means in practice
- •For network operators: Deploy ChameleonDisc to enhance detection and prevention of fake network links in SDN deployments.
- •For cloud infrastructure teams: Use dynamic randomized discovery protocols to secure cloud data center networks against topology manipulation.
Authors
Mingming Chen, Teryl Taylor, Frederico Araujo, Benjamin E. Ujcich, Thomas La Porta, Trent Jaeger
Abstract
Software-defined networking (SDN) separates the control and data planes, enabling programmable, centralized network management. A core SDN service is topology discovery --- a periodic process that identifies network links. However, our analysis of five open-source SDN controllers and ten discovery protocols shows that all remain vulnerable to at least one form of link-fabrication attack. The common root cause is their reliance on traditional Link Layer Discovery Protocol (LLDP) packets, whose static identifiers expose their discovery purpose and attract adversaries to exploit them. We propose ChameleonDisc, a dynamic link-discovery protocol that simultaneously prevents and detects topology-poisoning attacks by eliminating this root cause. Our key insight is that an SDN controller can infer topology without embedding meaningful information in discovery packets. ChameleonDisc removes targetable static LLDP signatures and employs a moving-target defense that combines decoy, obfuscation, and camouflage techniques instantiated dynamically at runtime to prevent topology poisoning and detect manipulation. We implement ChameleonDisc on OpenDaylight and demonstrate effectiveness against all identifier-based topology-poisoning attacks. On a 252-link topology, median convergence is 1.37--4.53\,s for legitimate link changes and 4.06\,s for malicious relay detection, with 13.0 percentage points of additional mean CPU and negligible retained-heap difference. Across topologies up to 816 links, ChameleonDisc provides a tunable security--performance trade-off; expanding discovery intervals reduces CPU and mapping state at the cost of increased attack-detection latency.