A Proactive Stateful Firewall for Software Defined Networking

International audienceSecurity solutions in conventional networks are complex and costly because of the lack of abstraction, the rigidity and the heterogeneity of the network architecture. However, in Software Defined Networking (SDN), flexible, reprogrammable, robust and cost effective security solutions can be built over the architecture. In this context, we propose a SDN proactive stateful Firewall. Our solution is completely integrated into the SDN environment and it is compliant with the OpenFlow (OF) protocol. The proposed Firewall uses a proactive logic to mitigate some fingerprinting and DoS attacks. Furthermore, it improves the network performance by reducing the useless traffic and by driving network communications to stay compliant with TCP Finite State Machine. An orchestrator layer is integrated in the Firewall in order to manage the deployment of the Firewall applications. This integration empowers the interactions with the administrator and the data plane elements. Moreover, the orchestrator proposes a holistic network view by collecting network data. It offers also a high level of abstraction in order to express the security policies into OpenFlow rules. Our solution is the first implemented stateful SDN Firewall. It is designed in a flexible approach; in fact, it is able to process any stateful protocol without affecting the whole design or the code. We conduct two tests to prove the validity of our concept. In the first one, we simulate a fingerprinting attack; then, we show how the proactivity of the Firewall prevents the malicious behavior from succeeding. In the second test, we run a performance experiment to evaluate the performance and the scalability of our solution. The findings show that the proposed Firewall is efficient, performant and scalable