SDFW: SDN-based Stateful Distributed Firewall
This addresses the problem of preventing lateral attacks in data center networks for cloud operators, offering a practical solution to a known bottleneck in SDN security.
The paper tackles the challenge of implementing stateful firewalls in SDN-based cloud networks, where existing solutions are impractical due to the separation of control and data planes. It proposes SDFW, an SDN-based Stateful Distributed Firewall, which achieves scalable security with only a 1.6% reduction in network bandwidth.
SDN provides a programmable command and control networking system in a multi-tenant cloud network using control and data plane separation. However, separating the control and data planes make it difficult for incorporating some security services (e.g., firewalls) into SDN framework. Most of the existing solutions use SDN switches as packet filters and rely on SDN controllers to implement firewall policy management functions, which is impractical for implementing stateful firewalls since SDN switches only send session's initial packets and statistical data of flows to their controllers. For a data center networking environment, applying a Distributed FireWall (DFW) system to prevent attacker's lateral movements is highly desired, in which designing and implementing an SDN-based Stateful DFW (SDFW) demand a scalable distributed states management solution at the data plane to track packets and flow states. Our performance results show that SDFW achieves scalable security against data plane attacks with a marginal performance hit ~ 1.6% reduction in network bandwidth.