An Improved Flow Rule Verification Against the Priority-passing attack in SDN

Software-Defined Networking (SDN) is an emerging network architecture. Its property of network programmability makes the network technology more open and flexible. It is achievable by decoupling the data plane and control plane. The control plane has bridged the data plane and application plane by northbound interface and southbound interface, respectively. By using the interfaces of SDN controllers, different applications can enforce their own rules into the control. The controller applies the highest priority rules to the switches. The attacker can manipulate the SDN network by malicious rules with low priority. This paper discusses different scenarios of priority passing attack and proposes a security module. The proof of the proposed module explains that it nullifies the threat proposed by the attacker. Moreover, the Hashmap using Binary Search Tree (BST) is implemented in the security model to minimize the search time for matching flow rules. It is observed that the latency remains as low as 40ms even with 10 thousand rules.