@inproceedings{000b4c5bed104db8afdcbd471791efc3,
title = "Enabling dynamic access control for controller applications in software-defined networks",
abstract = "Recent findings have shown that network and system attacks in Software-Defined Networks (SDNs) have been caused by malicious network applications that misuse APIs in an SDN controller. Such attacks can both crash the controller and change the internal data structure in the controller, causing serious damage to the infrastructure of SDN-based networks. To address this critical security issue, we introduce a security framework called AEGIS to prevent controller APIs from being misused by malicious network applications. Through the run-Time verification of API calls, AEGIS performs a finegrained access control for important controller APIs that can be misused by malicious applications. The usage of API calls is verified in real time by sophisticated security access rules that are defined based on the relationships between applications and data in the SDN controller. We also present a prototypical implementation of AEGIS and demonstrate its effectiveness and efficiency by performing six different controller attacks including new attacks we have recently discovered.",
keywords = "Access control, API misuse, Network attacks, Security, Software-defined networks",
author = "Hitesh Padekar and Younghee Park and Hongxin Hu and Chang, \{Sang Yoon\}",
note = "Publisher Copyright: {\textcopyright} 2016 ACM.; 21st ACM Symposium on Access Control Models and Technologies, SACMAT 2016 ; Conference date: 06-06-2016 Through 08-06-2016",
year = "2016",
month = jun,
day = "6",
doi = "10.1145/2914642.2914647",
language = "English",
series = "Proceedings of ACM Symposium on Access Control Models and Technologies, SACMAT",
publisher = "Association for Computing Machinery ",
pages = "51--61",
booktitle = "SACMAT 2016 - Proceedings of the 21st ACM Symposium on Access Control Models and Technologies",
address = "United States",
}