OpenSec: A framework for implementing security policies using OpenFlow

Adrian Lara, Byrav Ramamurthy
December 2014
Cite DOI URL

Abstract

As the popularity of software defined networks (SDN) and OpenFlow increases, policy-driven network management has received more attention. Manual configuration of multiple devices is being replaced by an automated approach where a software-based, network-aware controller handles the configuration of all network devices. Software applications running on top of the network controller provide an abstraction of the topology and facilitate the task of operating the network. We propose OpenSec, an OpenFlow-based security framework that allows a network security operator to create and implement security policies written in human-readable language. Using OpenSec, the user can describe a flow in terms of OpenFlow matching fields, define which security services must be applied to that flow (deep packet inspection, intrusion detection, spam detection, etc) and specify security levels that define how OpenSec reacts if malicious traffic is detected. We implement OpenSec in the GENI testbed to evaluate the flexibility, accuracy and scalability of the framework. The experimental setup includes deep packet inspection, intrusion detection and network quarantining to secure a web server from network scanners. We achieve a constant delay when reacting to security alerts and a detection rate of 98%.

Type
Conference paper
Publication
2014 IEEE Global Communications Conference
Telecommunication Traffic Web Server Computer Network Management Intrusion Detection Security Telecommunication Network Topology Internet Software Defined Networking Ports(Computers) Switches Network Security Computer Network Security Communication Networks GENI Testbed Human-Readable Language Network-Aware Controller OpenFlow OpenFlow Matching Fields OpenFlow-Based Security Framework OpenSec Security Policies Software-Based Controller Deep Packet Inspection Inspection Malicious Traffic Network Quarantining Network Scanners Policy-Driven Network Managemnet Process Comtrol Software Applications Software-Defined Networks
Byrav Ramamurthy
Byrav Ramamurthy
Professor & PI

My research areas include optical and wireless networks, peer-to-peer networks for multimedia streaming, network security and telecommunications. My research work is supported by the U.S. National Science Foundation, U.S. Department of Energy, U.S. Department of Agriculture, NASA, AT&T Corporation, Agilent Tech., Ciena, HP and OPNET Inc.