CloudLab is an NSF-sponsored project that enables the academic research community to develop and experiment with novel cloud architectures and to develop new cloud computing applications.
Some specific advantages of using CloudLab for building our open laboratory are worthy of mention:
SDN architecture allows networks to actively control traffic due to the centralization of network intelligence in the controller and enhances network resource visibility. The widespread use of SDN in recent years has brought a
number of new security issues involving the three main layers of SDN: the application layer, the control plane
(controller), and the data plane.
This lab aims to let students understand the basic SDN by using Floodlight in CloudLab. Based on the topology that students create in the first lab (Lab 1), students can push flow rules through Floodlight, one of open-source SDN controllers
Learning Outcomes: Students will learn how to install flow rules by understanding Openflow
Problem Definition: An attacker can produce a large amount of table-miss flow entries in messages to consume
resources in the data plane . The impact of this data-to-control plane saturation attack differs for various
target applications. For example, a load balancing application is more vulnerable than a hub application since
it requires high programming complexity to handle complicated computations for load balancing. The controller
installs flow rules in the switch flow table. The flow rules can be installed proactively or retroactively. Since the
switch has a limited number of flow tables, the data plane is vulnerable to saturation attacks.
Learning Objectives: Students will learn different attack techniques to saturate data plane resources and understand
the different characteristics of SDN applications that can affect flow rules proactively or reactively.
Students will be able to understand the internal architecture of the data plane.
Learning Outcomes: Students understand the packet processing policies for different types of SDN applications. They can generate UDP or ICMP based flood attacks to launch saturation attacks in the data plane . They can identify table-miss cases.
Challenging Questions:Students will brainstorm ways to keep the major functionalities of the SDN infrastructure working under a saturation attack in the data plane.
Problem Definition: Networking functionalities can be implemented in software as applications on top of the
control plane in SDN. Each application has its own distinct functional requirements for accessing the controller.
Fallacious network applications that misuse APIs in the controller can cause serious security threats to network
resources, services, and functions through the control plane due to lack of authentication and authorization for
applications and lack of standard open APIs. Students will explore how these unprivileged applications can
crash the controller and launch memory leakage attacks .
Learning Objectives: Students will learn the internal structure of the controller and understand how applications
can misuse APIs to cause attacks.
Learning Outcomes:Students can implement SDN applications and understand the architecture for interaction between applications and controller APIs. Students will be able to identify additional software vulnerabilities by investigating the internal code space.
Challenging Questions: Students will brainstorm security requirements for SDN applications. Different applications must have different privileges to access network information and resources. For example, a load balancing application needs network statistics while Intrusion Detection Systems (IDS) need to scrutinize packet header fields.
Problem Definition: The controller has a vast amount of important data, such as topological information, device information, and link information, all of which can be compromised by attackers. To accomplish this, attackers exploit the host tracking service in the controller. They can tamper with host location information to break through the controller and impersonate the target host. In that case, all traffic on the target host will be route to the attacker’s host. TopoGuard  was the first to demonstrate network poisoning attacks designed to compromise the network topology information based on the LLDP (Link Layer Discovery Protocol) protocol. It is but one example of many possible network poisoning attacks in SDN.
Copyright © Dr. Park, San Jose State University