Towards Secured Firewalls for Software Defined Networks

Software-Defined Networking (SDN) offers programmers network-wide visibility and direct control over the underlying switches from a logically-centralized controller. SDN provides a promising way for the future development of Internet. SDN, however, also has some new security challenges. A critical challenge among them is how to build a reliable firewall application for SDN. Due to the stateless property of SDN firewall based on OpenFlow, it lacks audit and tracking mechanisms, also the existing firewall applications in SDN can be easily bypassed by rewriting the flow entries in switches. Focusing at this threat, we introduced a novel solution for conflict detection and resolution in OpenFlow-based firewalls through checking flow space and firewall authorization space. Unlike FortNOX, our approach can check the conflicts between the firewall rules and flow policies based on the entire flow paths within an OpenFlow network. Finally we added intra-table dependency checking for flow tables and firewall rules. KeywordsSoftware Defined Networks, Firewalls, Header