A Fine-Grained Multi-Tenant Permission Management Framework for SDN and NFV

Although software defined network (SDN) has been widely recognized for several years, it still has not addressed security issues regarding permission management on SDN controller, one lack of which is the effective permission allocation of application programming interfaces (APIs) for multitenant requirements. Besides, the tendency of integrating SDN and network function virtualization (NFV) introduces a new problem about permission management on both SDN and NFV APIs. This paper presents a fine-grained permission management for secure sharing of APIs in multi-tenant networks. We propose a permission policy language, which provides three-level permission abstraction to define available APIs for multiple tenants to access both OpenFlow switches and network functions. We introduce a permission management framework to effectively enforce permissions and ensure user isolation. A prototype of the proposed framework is implemented on top of the RYU controller. Extensive experiments show that our system is effective for reducing API abuse and only introduces negligible overhead.