Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Ambusher: Exploring the Security of Distributed SDN Controllers Through Protocol State Fuzzing

Jinwoo Kim, Minjae Seo, Eduard Marin, Seungsoo Lee, Jaehyun Nam, Seungwon Shin

TL;DR

Ambusher addresses the security of East-West interfaces in distributed SDN controllers by automatically learning a simplified cluster-wide state machine and performing state-aware fuzzing to uncover vulnerabilities. It uses automata learning (Mealy machines) with a node-to-cluster abstraction, a proxy to generate concrete messages, and a DFS-based fuzzing approach to exhaustively explore reachable sequences. The framework is instantiated on ONOS with an Atomix-backed cluster and validated on a private SD-WAN testbed, uncovering six CVE-relevant vulnerabilities across storage, leadership, membership, and mastership pathways. This work provides a practical, automated testing tool for securing distributed SDN deployments in SD-WAN environments and highlights key architectural and authentication gaps that need reinforcement.

Abstract

Distributed SDN (Software-Defined Networking) controllers have rapidly become an integral element of Wide Area Networks (WAN), particularly within SD-WAN, providing scalability and fault-tolerance for expansive network infrastructures. However, the architecture of these controllers introduces new potential attack surfaces that have thus far received inadequate attention. In response to these concerns, we introduce Ambusher, a testing tool designed to discover vulnerabilities within protocols used in distributed SDN controllers. Ambusher achieves this by leveraging protocol state fuzzing, which systematically finds attack scenarios based on an inferred state machine. Since learning states from a cluster is complicated, Ambusher proposes a novel methodology that extracts a single and relatively simple state machine, achieving efficient state-based fuzzing. Our evaluation of Ambusher, conducted on a real SD-WAN deployment spanning two campus networks and one enterprise network, illustrates its ability to uncover 6 potential vulnerabilities in the widely used distributed controller platform.

Ambusher: Exploring the Security of Distributed SDN Controllers Through Protocol State Fuzzing

TL;DR

Ambusher addresses the security of East-West interfaces in distributed SDN controllers by automatically learning a simplified cluster-wide state machine and performing state-aware fuzzing to uncover vulnerabilities. It uses automata learning (Mealy machines) with a node-to-cluster abstraction, a proxy to generate concrete messages, and a DFS-based fuzzing approach to exhaustively explore reachable sequences. The framework is instantiated on ONOS with an Atomix-backed cluster and validated on a private SD-WAN testbed, uncovering six CVE-relevant vulnerabilities across storage, leadership, membership, and mastership pathways. This work provides a practical, automated testing tool for securing distributed SDN deployments in SD-WAN environments and highlights key architectural and authentication gaps that need reinforcement.

Abstract

Distributed SDN (Software-Defined Networking) controllers have rapidly become an integral element of Wide Area Networks (WAN), particularly within SD-WAN, providing scalability and fault-tolerance for expansive network infrastructures. However, the architecture of these controllers introduces new potential attack surfaces that have thus far received inadequate attention. In response to these concerns, we introduce Ambusher, a testing tool designed to discover vulnerabilities within protocols used in distributed SDN controllers. Ambusher achieves this by leveraging protocol state fuzzing, which systematically finds attack scenarios based on an inferred state machine. Since learning states from a cluster is complicated, Ambusher proposes a novel methodology that extracts a single and relatively simple state machine, achieving efficient state-based fuzzing. Our evaluation of Ambusher, conducted on a real SD-WAN deployment spanning two campus networks and one enterprise network, illustrates its ability to uncover 6 potential vulnerabilities in the widely used distributed controller platform.
Paper Structure (23 sections, 16 figures, 2 tables, 1 algorithm)

This paper contains 23 sections, 16 figures, 2 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Background
  3. Distributed SDN Controllers
  4. Cluster Internal Architecture
  5. Problem Statement
  6. Motivation
  7. Technical Challenges
  8. Our Approach
  9. Ambusher Design
  10. System Overview
  11. Learning State Machine
  12. State Machine Fuzzing
  13. Detection Criteria
  14. Experimental Environment
  15. Attack Case Studies
  16. ...and 8 more sections

Figures (16)

  • Figure 1: Distributed SDN controllers deployed in geographically different areas for building SD-WAN.
  • Figure 2: A general architecture of distributed SDN controllers.
  • Figure 3: A sequence diagram of SWIM protocol das2002swim.
  • Figure 4: Ambusher system overview and workflow.
  • Figure 5: The workflow of the learning procedure in the state machine builder.
  • ...and 11 more figures