Cloud architecture has become a valuable solution for different applications, such as big data analytics, due to its high-degree of availability, scalability and strategic value. However, there still remain challenges in managing cloud architecture, in areas such as cloud security. In this paper, we exploit software-defined networking (SDN) and blockchain technologies to secure cloud management platforms from a networking perspective. We develop a blockchain-powered SDN-enabled networking infrastructure in which the integration between blockchain-based security and autonomy management layer and multi-controller SDN networking layer is defined to enhance the integrity of the control and management messages. Furthermore, our proposed networking infrastructure also enables the autonomous bandwidth provisioning to enhance the availability of cloud architecture. In the simulation section, we evaluate the performance of our proposed blockchain-powered SDN-enabled networking infrastructure by considering different scenarios.
In a fully interconnected world where even network-related services are becoming more dependent on software, the management of license agreements is critical for the business of any software vendor and communication provider. Building, managing and protecting the infrastructure to handle software license validation and scalability for the provider and, on the other hand, assessing the correct use of the software licenses for the vendor can become an expensive part of the relationship costs. We propose a novel approach for decentralized software licensing that leverages blockchain and smart contracts as fundamental enabling technologies. Our proposal guarantees a secure and inexpensive system with no central point of failure that can regulate the relations among untrusted parties. We describe the main design choices and present a prototype experimentation that demonstrates the benefits of the proposal in the context of virtualized network infrastructures.
Driven by the increasing number of stationary and portable devices, Distributed Denial-of-Service (DDoS) attacks pose a major threat to Internet availability. While advantages of cooperative defenses have been widely recognized over traditional on-premise defenses, there is not a widespread deployment of such cooperative defenses. This work demonstrates the Blockchain Signaling System (BloSS), a modular, network-agnostic and cooperative DDoS defense system consisting of independent instances working together to mitigate attacks targeted at any member of this alliance.
Raja Majid Ali Ujjan, Zeeshan Pervez, Keshav Dahal
Due to the rapid increment of the cyber attacks, intrusion detection system (IDS) is shifting towards collaborative approaches. There is a huge demand for securing larger networking environments for providing a safeguard against threats. In order to optimize the feasible detection performance, Collaborative Intrusion Detection Networks (CIDN) approaches have been adopted in practical scenarios, which enables a group of IDS nodes to mutually share and exchange mandatory information with each other, for example, IDS-signatures, attacks alarms. However, CIDN networks are distributed in nature, such networks still face plenty of implementation problems, especially, insider intruder can easily dominate any of security node and leave the entire security system vulnerable. To achieve the trust-based communication between each of IDS node, the recent advancement in blockchain applications is considered as a good fit to create trust-based communication in CIDN networks. This work converges CIDN network and blockchain in SDN context. Firstly, we investigated existing related work and highlighted challenges and research gap towards blockchain in CIDN networks. Secondly, we utilised three collaborated Snort IDS to receive the latest signature update from Ryu and then to securely share such signatures updates to all other Snort nodes within test-bed. Our work is motivated to detect seven types of common attacks with collaborated signature-based IDS, which feasibly processes more packets to achieve satisfactory detection results. Overall the evaluation results show that with the adoption of blockchain protocols, the proposed CIDN network achieves 96% of TP rate detection rate for TCP, UDP and ICMP packets.
Aug 1, 2019·2019 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech)
Software defined networking (SDN) is one of the most popular network technologies which provides an adaptive, agile and flexible network management and visibility. Although SDN architecture provides manifold benefits but on the same time its dependence on a logically centralized controller lead to the single point of failure. An attacker can easily capture the any forwarding device and restrict the availability of the controller using different prevalent attacks. Distributed denial of service (DDoS) is one of the most popular attack of this category which is quiet prevalent in SDN. Here, the aim of the attackers is to inject false script in the open flow tables through malicious switches which multiply exponentially. Therefore, in this paper, a blockchain as a service framework has been presented wherein BlockSDSec model is designed to provide security as a separate service for the SDN architecture. This work provides a mechanism to prevent the threats of DDoS at the switch level by embedding an security using blockchain onto the interaction channels of data and control planes. The load balancing at the controller level is achieved using a virtual controller. The proposed scheme is simulated using MiniNet Emulator to analyze the delay originating from usage of blockchain.
The industrial control systems are facing an increasing number of sophisticated cyber attacks that can have very dangerous consequences on humans and their environments. In order to deal with these issues, novel technologies and approaches should be adopted. In this paper, we focus on the security of commands in industrial IoT against forged commands and misrouting of commands. To this end, we propose a security architecture that integrates the Blockchain and the Software-defined network (SDN) technologies. The proposed security architecture is composed of: (a) an intrusion detection system, namely RSL-KNN, which combines the Random Subspace Learning (RSL) and K-Nearest Neighbor (KNN) to defend against the forged commands, which target the industrial control process, and (b) a Blockchain-based Integrity Checking System (BICS), which can prevent the misrouting attack, which tampers with the OpenFlow rules of the SDN-enabled industrial IoT systems. We test the proposed security solution on an Industrial Control System Cyber attack Dataset and on an experimental platform combining software-defined networking and blockchain technologies. The evaluation results demonstrate the effectiveness and efficiency of the proposed security solution.
Software-Defined Networking (SDN) separates the network control plane and data plane, which provides a network-wide view with centralized control (in the control plane) and programmable network configuration for data plane injected by SDN applications (in the application plane). With these features, a number of drawbacks of the traditional network architectures such as static configuration, non-scalability and low efficiency can be effectively avoided. However, SDN also brings with it some new security challenges, such as single-point failure of the control plane, malicious flows from applications, exposed network-wide resources and a vulnerable channel between the control plane and the data plane. In this paper, we design a monolithic security mechanism for SDN based on Blockchain. Our mechanism decentralizes the control plane to overcome single-point failure while maintaining a network-wide view. The mechanism also guarantees the authenticity, traceability, and accountability of application flows, and hence secures the programmable configuration. Moreover, the mechanism provides a fine-grained access control of network-wide resources and a secure controller-switch channel to further protect resources and communication in SDN.
Software Defined Networking (SDN) technology increases the evolution of Internet and network development. SDN, with its logical centralization of controllers and global network overview changes the network's characteristics, on term of flexibility, availability and programmability. However, this development increased the network communication security challenges. To enhance the SDN security, we propose the BCFR solution to avoid false flow rules injection in SDN data layer devices. In this solution, we use the blockchain technology to provide the controller authentication and the integrity of the traffic flow circulated between the controller and the other network elements. This work is implemented using OpenStack platform and Onos controller. The evaluation results show the effectiveness of our proposal.
Software defined optical networking (SDON) is a critical technology for the next generation network with the advantages of programmable control and etc. As one of the key issues of SDON, the security of control plane has also received extensive attention, especially in certain network scenarios with high security requirement. Due to the existence of vulnerabilities and heavy overhead, the existing firewalls and distributed control technologies cannot solve the control plane security problem well. In this paper, we propose a distributed control architecture for SDON using the blockchain technique (BlockCtrl). The proposed BlockCtrl model introduces the advantages of blockchain into SDON to achieve a high-efficiency fault tolerant control. We have evaluated the performance of our proposed architecture and compared it to the existing models with respect to various metrics including processing rate, recovery latency and etc. The numerical results show that the BlockCtrl is capable of attacks detection and fault tolerant control in SDON with high performance on resource utilization and service correlation.
A specific number of transaction confirmation blocks determines average time of receiving and accepting payments at cryptocurrencies, and the shortest confirmation time for the same level of blockchain security provides the best user properties. Existing papers on transaction confirmation blocks for Bitcoin use implicit assumption of prompt spreading of Bitcoin blocks over the network (that is not always the case for the real world conditions). The newer publications with rigorous analysis and proofs of Bitcoin blockchain properties that take into account network delays provide asymptotic estimates, with no specific numbers for transaction confirmation blocks. We propose three methods for determination of required number of confirmation blocks for Bitcoin and GHOST on networks with delayed message delivery with different models that take into account the possibility of faster adversarial node syncronization. For the GHOST we propose the first (to our knowledge) strict theoretical method that allows to get required number of confirmation blocks for a given attacker’s hashrate and attack success probability.
Yixin Li, Bin Cao, Mugen Peng, Long Zhang · 7 authors
Direct Acyclic Graph (DAG)-based ledger and the corresponding consensus algorithm has been identified as a promising technology for Internet of Things (IoT). Compared with Proof-of-Work (PoW) and Proof-of-Stake (PoS) that have been widely used in blockchain, the consensus mechanism designed on DAG structure (simply called as DAG consensus) can overcome some shortcomings such as high resource consumption, high transaction fee, low transaction throughput and long confirmation delay. However, the theoretic analysis on the DAG consensus is an untapped venue to be explored. To this end, based on one of the most typical DAG consensuses, Tangle, we investigate the impact of network load on the performance and security of the DAG-based ledger. Considering unsteady network load, we first propose a Markov chain model to capture the behavior of DAG consensus process under dynamic load conditions. The key performance metrics, i.e., cumulative weight and confirmation delay are analysed based on the proposed model. Then, we leverage a stochastic model to analyse the probability of a successful double-spending attack in different network load regimes. The results can provide an insightful understanding of DAG consensus process, e.g., how the network load affects the confirmation delay and the probability of a successful attack. Meanwhile, we also demonstrate the trade-off between security level and confirmation delay, which can act as a guidance for practical deployment of DAG-based ledgers.
Muriel Figueredo Franco, Eder J. Scheid, Lisandro Zambenedetti Granville, Burkhard Stiller
Network Functions Virtualization (NFV) is transforming the way in which network operators acquire and manage network services. By using virtualization technologies to move packet processing from dedicated hardware to software, NFV has introduced a new market focused on the offer and distribution of Virtual Network Functions (VNF). Infrastructure Providers (InP) can benefit from an NFV market by providing their infrastructures to fulfill demands of end-users that, in turn, acquire VNFsas- a-Service (VNFaaS). In this context, solutions that promote the competition between InPs can lead to lower prices, while increasing VNF performance to accommodate specific demands of end-users. In this paper, BRAIN, a blockchain-based reverse auction is presented to introduce an auditable solution in which InPs can compete to host VNFs taking into account the demands of each particular end-user. Such a solution helps reduce costs involved in VNF's commercialization and also monetize NFVenabled infrastructures. BRAIN is supported by a case study that provides evidence of the solution's feasibility and effectiveness. A discussion regarding blockchain advantages and drawbacks in this use-case (e.g., , additional costs and time) concludes this paper.
The existing LTE mobile system uses the vertical model to handle the session-based security management. However, the goal of this paper is to propose a packet key-based security management scheme on the blockchain control plane to enhance the existing session key-based security scheme and overcome the limitation that the existing vertical model, as well as the Software-Defined Networking (SDN) based horizontal model, confronts within solving end-to-end security management. The proposed blockchain-based security management (BSM) scheme enables each peer to easily obtain the necessary parameters required to manage the packet key-based security system. The important features of the BSM scheme include the renewal process, which enables the different packet data streams to use completely different security parameters for the security management. In addition, because even blind values cannot be exposed to the possible attackers, our BSM scheme guarantees very secure end-to-end data transfer against active attacks such as falsification of data and transactions. Finally, this paper compares the BSM scheme with the existing vertical model to prove the advantageous effects on latency.
Wireless Virtualization (WiVi) is emerging as a new paradigm to provide high speed communications and meet Quality-of-Service (QoS) requirements of users while reducing the deployment cost of wireless infrastructure for future wireless networks. In WiVi, Wireless Infrastructure Providers (WIPs) sublease their RF channels through slicing to Mobile Virtual Network Operators (MVNOs) based on their Service Level Agreements (SLAs) and the MVNOs independently provide wireless services to their end users. This paper investigates the wireless network virtualization by leveraging both Blockchain technology and machine learning to optimally allocate wireless resources. To eliminate double spending (aka over-committing) of WIPs' wireless resources such as RF channels, Blockchain - a distributed ledger - technology is used where a reputation is used to penalize WIPs with past double spending habit. The proposed reputation based approach helps to minimize extra delay caused by double spending attempts and Blockchain operations. To optimally predict the QoS requirements of MVNOs for their users, linear regression - a machine learning approach - is used that helps to minimize the latency introduced due to (multiple wrong) negotiations for SLAs. The performance evaluation of the proposed approach is carried out by using numerical results obtained from simulations. Results have shown that the joint Blockchain and machine learning based approach outperforms the other approaches.
Abbas Yazdinejad, Reza M. Parizi, Ali Dehghantanha, Kim-Kwang Raymond Choo
5G mobile networks provide additional benefits in terms of lower latency, higher data rates, and more coverage, in comparison to 4G networks, and they are also coming close to standardization. For example, 5G has a new level of data transfer and processing speed that assures users are not disconnected when they move from one cell to another; thus, supporting faster connection. However, 5G comes with its own technical challenges, such as those relating to authentication handover and user privacy protection. In 5G, for example, the frequent displacement of the users among the cells as a result of repeated authentication handovers often lead to a delay, contradicting the 5G objectives. Using inefficient authentication handover could also cause performance degradation among heterogeneous 5G cells, and increases the possibility of occurring user privacy and security issues. In this paper, we propose a new authentication approach that utilizes blockchain and software defined networking (SDN) techniques to remove the unnecessary re-authentication in repeated handover among heterogeneous cells. The proposed approach is designed to assure the low delay, appropriate for the 5G network in which users are replaced with the least delay among heterogeneous cells using their public and private keys provided by the devised blockchain component while protecting their privacy. In our comparison between Proof-of-Work (POW)-based and network-based models, the delay of our authentication handover is shown to be less than 1 ms. Also, our approach demonstrates less signaling overhead and energy consumption compared to peer models.
Boubakr Nour, Adlen Ksentini, Nicolas Herbaut, Pantelis A. Frangoudis · 5 authors
With advent of 5G, the classical mobile network business model is shifting from a network-operator-oriented business to a more open system with several actors. In this context, the network slice provider will play the role of an intermediate entity between the vertical service provider and the resource provider. To deploy a network slice, the network slice provider will require a brokering mechanism, which allows it to lease resources from different providers in a secure and private way. In this letter, we propose a broker design based on blockchain technology, providing a mechanism that secures and ensures anonymous transactions.
With the rapid proliferation of Internet of Thing (IoT) devices, many security challenges could be introduced at low-end routers. Misbehaving routers affect the availability of the networks by dropping packets selectively and rejecting data forwarding services. Although existing Reputation Management (RM) systems are useful in identifying misbehaving routers, the centralized nature of the RM center has the risk of one-point failure. The emerging blockchain techniques, with the inherent decentralized consensus mechanism, provide a promising method to reduce this one-point failure risk. By adopting the distributed consensus mechanism, we propose a blockchain-based reputation management system in IoT networks to overcome the limitation of centralized router RM systems. The proposed solution utilizes the blockchain technique as a decentralized database to store router reports for calculating reputation of each router. With the proposed reputation calculation mechanism, the reliability of each router would be evaluated, and the malicious misbehaving routers with low reputations will be blacklisted and get isolated. More importantly, we develop an optimized group mining process for blockchain technique in order to improve the efficiency of block generation and reduce the resource consumption. The simulation results validate the distributed blockchain-based RM system in terms of attacks detection and system convergence performance, and the comparison result of the proposed group mining process with existing blockchain models illustrates the applicability and feasibility of the proposed works.
Gabriel Antonio F. Rebello, Gustavo F. Camilo, Leonardo G. C. Silva, Lucas C. B. Guimarães · 7 authors
Network slicing, network function virtualization (NFV), and software defined network (SDN) technologies provide agile on-demand end-to-end services. The identification of a faulty virtual function becomes mandatory because services allocate resources across a distributed and trustless environment composed by multi-tenant competing service providers. In this paper, we propose and develop a blockchain-based architecture to provide auditability to orchestration operations of network slices and to provide secure VNF configuration updates while ensuring isolation and privacy between network slices. A proof of concept prototype using the Hyperledger Fabric platform was developed in which network slice runs on an isolated channel. The results show that we can secure a network slice creation, but that the consensus and the number of transaction required by the slices are a great challenge.
Gabriel Antonio F. Rebello, Igor D. Alvarenga, Igor Jochem Sanz, Otto Carlos M. B. Duarte
Network Function Virtualization (NFV) and Service Function Chaining (SFC) offer flexible end-to-end services that deploy virtual network functions in clouds of competing providers. Orchestration of virtual network functions occurs in a distributed and trustless environment that must tolerate byzantine failures and collusion attacks. This paper proposes BSec-NFVO, a blockchain-based system that secures orchestration operations in virtualized networks, ensuring auditability, non-repudiation and integrity. We propose an NFV-tailored blockchain and a transaction model. BSec-NFVO provides a modular architecture to secure orchestration in a simple and agile way. We develop a prototype of BSec-NFVO for the Open Platform for Network Function Virtualization (OPNFV) with an adaptation of the normal-case of a collusion-resistant consensus protocol. The results show BSec-NFVO incurs low overhead to the cloud orchestrator and presents stable performance as the number of consensus participants increases.
The software-defined network implements the separation of software and hardware, as well as a programmable network. however, the lack of consistent records of network data poses difficulties for network management, and heterogeneous device heterogeneity poses a hindrance to software-defined network interoperability. This paper summarizes the development status and existing problems of software-defined network, proposes a softwaredefined network data chain based on blockchain, realizes distributed consistent record of software-defined network data, and breaks the multi-vendor device isolation for fault recovery. Reduce the cost of network failure recovery and achieve unified scheduling of business capabilities.
The Internet of Things (IoT) carries a big promise, to improve our lives through numerous connected devices that interact with one another. Unfortunately, some of these devices are of questionable security, becoming targets of choice for numerous exploits. This can result in compromising the home network, as well as large scale attacks such as the recent Mirai network of botnets that was used in a DDoS attack. The problem is that end users have a hard time assessing the risks induced by connected devices, and often lack the skills and time to administrate their home network. We answer the above challenge by proposing STewARD, a solution that allows users to easily request from their intelligent home network controller the creation of isolated software-defined network slices, to which they assign a required trust level using very simple risk assessment. We build a global trust assessment framework that computes a trust score for each class of devices, based on reported history stored in a blockchain. Network controllers can then leverage this information to connect to slices only those devices that meet the expected trust levels, and can contribute to the crowd-sourced reporting by monitoring the devices' behaviors compared to an expected baseline.
David Chen, Zhiyue Zhang, Ambrish Krishnan, Bhaskar Krishnamachari
We present PayFlow, a fine-granularity QoS micro-payment system that allows end devices in a software-defined network to make and pre-pay for guaranteed bandwidth reservations for their flows within the network for an arbitrary period of time. PayFlow combines payments using digital currency and storage of transaction records in a distributed ledger with queue-based QoS management using software-defined networks. While the PayFlow architecture is agnostic to the choice of digital currency, ledger technology and SDN platform used, we present a proof of concept implementation of PayFlow using OpenFlow and the IOTA cryptocurrency and distributed ledger, that we evaluate using the Mininet emulator.