Constant-Size Credential-Based Packet Forwarding Verification in SDN

The emerging software-defined networking (SDN) technology lacks tools to proactively ensure that policies will be followed or to inspect the behavior of the network. The network is vulnerable to sophisticated attacks against packets, such as alteration, injection, dropping, and hijacking attacks. Accurate and efficient network packet forwarding verification is a critical issue to ensure the correctness of packet forwarding when confronting with malicious attacks, while most of the existing packet forwarding verification solutions were implemented by inserting linear-scale cryptographic tags that increased with path length, which introduced significant communication overhead. In this paper, we propose a constant-size credential based packet forwarding verification mechanism in SDN. In the scheme, the ingress switch of a flow embeds a tag credential of constant-size which is independent of the packet forwarding path, each downstream switch verifies packets basing on the constant-size credential, and the controller periodically acquires node forwarding statistics along the path and localizes anomaly. The header space communication overhead of the proposed scheme is less than existing linear-scale mechanisms. We further prototype and evaluate the proposed scheme. Experiments demonstrate that the scheme achieves efficient forwarding and effective anomaly localization with less than 11% of additional forwarding delays and no more than 10% of throughput degradation.