Handling malicious switches in software defined networks

Traffic flowing through a software defined network is vulnerable to disruptions caused by malicious switches. The malicious behaviors are diverse such as dropping traffic, adding traffic or modifying it. A switch could be malicious or otherwise dysfunctional or misconfigured. A lot of work in SDN has addressed the problem by securing the control plane and having it validate network wide properties and policy compliance, e.g., loop-freedom, reachability and resolution of conflicting rules. In this paper, we argue that it is imperative as well to ensure the correctness of traffic forwarding itself. Therefore we define a threat model for the security and correctness of forwarding in an SDN switch. We describe several malicious behaviors that could be encountered at an SDN switch and propose possible solutions to each fault type. The capabilities of the SDN paradigm to detect and deter such attacks are analyzed.