TY - GEN
T1 - Privacy-Preserving Detection of Inter-Domain SDN Rules Overlaps
AU - Dethise, Arnaud
AU - Chiesa, Marco
AU - Canini, Marco
N1 - KAUST Repository Item: Exported on 2020-10-01
Acknowledgements: This research is (in part) supported by European Union’s Horizon 2020 research and innovation programme under the ENDEAVOUR project (grant agreement 644960).
PY - 2017/8/24
Y1 - 2017/8/24
N2 - SDN approaches to inter-domain routing promise better traffic engineering, enhanced security, and higher automation. Yet, naïve deployment of SDN on the Internet is dangerous as the control-plane expressiveness of BGP is significantly more limited than the data-plane expressiveness of SDN, which allows fine-grained rules to deflect traffic from BGP's default routes. This mismatch may lead to incorrect forwarding behaviors such as forwarding loops and blackholes, ultimately hindering SDN deployment at the inter-domain level. In this work, we make a first step towards verifying the correctness of inter-domain forwarding state with a focus on loop freedom while keeping private the SDN rules, as they comprise confidential routing information. To this end, we design a simple yet powerful primitive that allows two networks to verify whether their SDN rules overlap, i.e., the set of packets matched by these rules is non-empty, without leaking any information about the SDN rules. We propose an efficient implementation of this primitive by using recent advancements in Secure Multi-Party Computation and we then leverage it as the main building block for designing a system that detects Internet-wide forwarding loops among any set of SDN-enabled Internet eXchange Points.
AB - SDN approaches to inter-domain routing promise better traffic engineering, enhanced security, and higher automation. Yet, naïve deployment of SDN on the Internet is dangerous as the control-plane expressiveness of BGP is significantly more limited than the data-plane expressiveness of SDN, which allows fine-grained rules to deflect traffic from BGP's default routes. This mismatch may lead to incorrect forwarding behaviors such as forwarding loops and blackholes, ultimately hindering SDN deployment at the inter-domain level. In this work, we make a first step towards verifying the correctness of inter-domain forwarding state with a focus on loop freedom while keeping private the SDN rules, as they comprise confidential routing information. To this end, we design a simple yet powerful primitive that allows two networks to verify whether their SDN rules overlap, i.e., the set of packets matched by these rules is non-empty, without leaking any information about the SDN rules. We propose an efficient implementation of this primitive by using recent advancements in Secure Multi-Party Computation and we then leverage it as the main building block for designing a system that detects Internet-wide forwarding loops among any set of SDN-enabled Internet eXchange Points.
UR - http://hdl.handle.net/10754/626101
UR - https://dl.acm.org/citation.cfm?doid=3123878.3131967
UR - http://www.scopus.com/inward/record.url?scp=85029717340&partnerID=8YFLogxK
U2 - 10.1145/3123878.3131967
DO - 10.1145/3123878.3131967
M3 - Conference contribution
AN - SCOPUS:85029717340
SN - 9781450350570
SP - 6
EP - 8
BT - Proceedings of the SIGCOMM Posters and Demos on - SIGCOMM Posters and Demos '17
PB - Association for Computing Machinery (ACM)
ER -