Privacy-Preserving Detection of Inter-Domain SDN Rules Overlaps

Arnaud Dethise, Marco Chiesa, Marco Canini

Research output: Chapter in Book/Report/Conference proceedingConference contribution

1 Scopus citations

Abstract

SDN approaches to inter-domain routing promise better traffic engineering, enhanced security, and higher automation. Yet, naïve deployment of SDN on the Internet is dangerous as the control-plane expressiveness of BGP is significantly more limited than the data-plane expressiveness of SDN, which allows fine-grained rules to deflect traffic from BGP's default routes. This mismatch may lead to incorrect forwarding behaviors such as forwarding loops and blackholes, ultimately hindering SDN deployment at the inter-domain level. In this work, we make a first step towards verifying the correctness of inter-domain forwarding state with a focus on loop freedom while keeping private the SDN rules, as they comprise confidential routing information. To this end, we design a simple yet powerful primitive that allows two networks to verify whether their SDN rules overlap, i.e., the set of packets matched by these rules is non-empty, without leaking any information about the SDN rules. We propose an efficient implementation of this primitive by using recent advancements in Secure Multi-Party Computation and we then leverage it as the main building block for designing a system that detects Internet-wide forwarding loops among any set of SDN-enabled Internet eXchange Points.
Original languageEnglish (US)
Title of host publicationProceedings of the SIGCOMM Posters and Demos on - SIGCOMM Posters and Demos '17
PublisherAssociation for Computing Machinery (ACM)
Pages6-8
Number of pages3
ISBN (Print)9781450350570
DOIs
StatePublished - Aug 24 2017

Fingerprint Dive into the research topics of 'Privacy-Preserving Detection of Inter-Domain SDN Rules Overlaps'. Together they form a unique fingerprint.

Cite this