[Paper Review] The KISS principle in Software-Defined Networking: An architecture for Keeping It Simple and Secure

Diego Kreutz, Jiangshan Yu+3 more|arXiv (Cornell University)|Feb 14, 2017

Energy Harvesting in Wireless Networks4 citations

TL;DR

This paper proposes KISS, a lightweight, modular SDN control plane security architecture that replaces complex TLS/PKI with a decentralized, high-performance solution based on the iDVV (integrated device verification value) protocol and the NaCl cryptographic library. By enabling per-message key generation with minimal overhead, KISS achieves 30% better performance than OpenSSL while reducing code footprint by an order of magnitude, enhancing both speed and robustness without sacrificing security properties like authenticity, integrity, and confidentiality.

ABSTRACT

Security is an increasingly fundamental requirement in Software-Defined Networking (SDN). However, the pace of adoption of secure mechanisms has been slow, which we estimate to be a consequence of the performance overhead of traditional solutions and of the complexity of the support infrastructure required. As a first step to addressing these problems, we propose a modular secure SDN control plane communications architecture, KISS, with innovative solutions in the context of key distribution and secure channel support. A comparative analysis of the performance impact of essential security primitives guided our selection of basic primitives for KISS. We further propose iDVV, the integrated device verification value, a deterministic but indistinguishable-from-random secret code generation protocol, allowing the local but synchronized generation/verification of keys at both ends of the channel, even on a per-message basis. iDVV is expected to give an important contribution both to the robustness and simplification of the authentication and secure communication problems in SDN. We show that our solution, while offering the same security properties, outperforms reference alternatives, with performance improvements up to 30% over OpenSSL, and improvement in robustness based on a code footprint one order of magnitude smaller. Finally, we also prove and test randomness of the proposed algorithms.

Motivation & Objective

• To address the slow adoption of security mechanisms in SDN due to performance overhead and infrastructure complexity.
• To reduce the computational and code complexity of secure control plane communications in resource-constrained SDN switches.
• To design a decentralized, robust key management mechanism that avoids reliance on centralized PKI or TLS handshakes.
• To evaluate the performance, security, and randomness of the proposed iDVV protocol and its integration with cryptographic primitives.
• To demonstrate that simplified, secure SDN communication is feasible without compromising security or scalability.

Proposed method

• Design and formalization of iDVV, a deterministic yet indistinguishable-from-random secret code generation protocol for per-message key derivation.
• Adaptation of one-time password-like techniques to enable synchronized, decentralized key generation and verification at both ends of a communication channel.
• Benchmarking of cryptographic primitives (e.g., Poly1305, SHA512, AES) to select the most performant and secure combination for the KISS architecture.
• Integration of iDVV with the NaCl cryptographic library to replace traditional TLS components, minimizing code size and cyclomatic complexity.
• Implementation and evaluation of the KISS architecture in a realistic SDN setup with 128 switches, measuring latency and throughput under real control traffic.
• Formal proof of indistinguishability and security properties of iDVV, including perfect forward secrecy and resistance to replay and impersonation attacks.

Experimental results

Research questions

• RQ1 Why is the adoption of secure communication mechanisms in SDN still slow despite growing security needs?
• RQ2 Can a decentralized, lightweight key generation mechanism outperform traditional TLS-based solutions in terms of performance and robustness?
• RQ3 To what extent can the choice of cryptographic primitives and their implementations impact the performance of SDN control plane communications?
• RQ4 Is it possible to achieve strong security guarantees with a codebase an order of magnitude smaller than traditional TLS-PKI implementations?
• RQ5 Can iDVV enable secure, per-message keying without introducing significant latency or resource overhead on commodity switches?

Key findings

• The KISS architecture achieves a 30% performance improvement over OpenSSL-based implementations when using AES256-SHA, even when generating a new iDVV per packet.
• The proposed solution reduces the codebase footprint by an order of magnitude compared to traditional TLS-PKI solutions, significantly lowering cyclomatic complexity.
• iDVV generation latency is faster than standard key derivation functions, enabling efficient per-message keying without performance degradation.
• The iDVV protocol provides strong security guarantees, including perfect forward secrecy and resistance to replay and impersonation attacks, while remaining computationally lightweight.
• The randomness of the iDVV algorithm was formally proven and empirically tested, confirming its cryptographic strength and unpredictability.
• The integration of iDVV with NaCl ensures end-to-end security with authenticity, integrity, and confidentiality, matching or exceeding the security of TLS while being simpler and faster.