DABS: A Distributed Attribute-Based Access Control Mechanism for SD-WAN Controllers Based on Smart Contracts

Abstract

The architecture of SDN can be roughly divided into the application layer, the control plane, and the data plane. Applications at the application layer drive the controllers of the control plane through the northbound interface (NBI) to manage the network. Traditionally, there is usually only one controller to fulfill the management. However, in SD-WAN, the number of controllers in the control plane is no longer unique and may belong to different branches. For these distributed controllers to collaborate securely and effectively, an access control mechanism adapted to the distributed network environment is required. The network structure of SD-WAN is more complex and its network scale is larger than traditional SDN, which also puts forward new requirements for the design of access control mechanisms. Besides, in other scenarios such as the polymorphic network, multiple controllers are also required to achieve high availability and redundancy, which also brings in the access control issue among controllers. Attribute-based access control (ABAC) is a potential solution, which can provide higher fine-grained access control functions than traditional technologies such as role-based access control (RBAC), discretionary access control (DAC), etc. In addition, the blockchain can provide a practical environment for operating a decentralized and secure access control mechanism. Based on the combination of these two technologies, we designed and implemented a distributed access control mechanism using smart contracts, which is named DABS. Experimental results show that DABS is able to support the role of access control, whose performance and scalability are sufficient for the SD-WAN scenario.