CWT-DPA: Component-wise waiting time for BC-enabled data plane authentication

Abstract

Software-Defined Networking (SDN) is a promising networking paradigm that brings central management and network programmability to improve existing networking systems. However, SDN has several security threats due to its untrusted control and data planes. Blockchain (BC) technology has recently provided a fault-tolerant, decentralized, and immutable ledger among untrusted parties. While the integration between SDN and BC enhances the security, it suffers from performance degradation when applied to SDN's data plane. In traditional BC-SDN approaches, such as our previous work DPSEC (Latah and Kalkan, 2020), every switch has to wait for the final commitment of each submitted transaction, which significantly decreases the performance of the BC-SDN model. In this work, we enhance the performance of BC-SDN data plane approaches by separating switch-related and host-related transactions and propose a different waiting strategy for each type of data plane transaction. We also propose a batching technique to enhance the average latency for high-load scenarios. In addition, SDN switches and controllers utilize lattice-based signatures and Key Encapsulation Methods (KEMs) to protect against quantum adversaries. We compare the performance of CWT-DPA with existing solutions such as SSL/TLSv1.3, DPSEC (Latah and Kalkan, 2020), and AuthFlow (Mattos and Duarte, 2016).