Software Defined Network (SDN) offers a centralized, programmable and visible network that can dynamically evolve to the needs of businesses [1]. In comparison to a traditional network, the distinctive characteristics of SDN include the separation of control plane and data plane, a centralized view embodied in a simplified device acting as a controller, virtualization of all functions within the network, and the openness to change [2]. According to Google's report, the company has fully utilized its wide-area networks with SDN-based network management [3]. SDN shares close affiliations with Network Function Virtualization (NFV). NFV offers abstractions of hardware as key network functionalities, such as firewall, network connections, and load balancing [4]. Overwhelming management complexity, high costs, lack of scalability and slow market deployment rate are just a few notable drawbacks hardware-based network functions present [5]. The concept of server-less, built on the basics of NFV, is an emerging new paradigm in virtualization and has already significantly changed the economics of offloading computations to the cloud [6].
Significant granularity, visibility, flexibility, and elasticity are definite advantages that SDN and NFV bring to networking, but new security challenges are identified as well [5]. Several key security challenges in SDN have been identified and addressed, such as scanning attack prevention ( [7] [8]), distributed denial-of-service (DDoS) attack detection [9], saturation attack mitigation ( [10] [11]), topology poisoning attack prevention ( [12] [13]), and Manin-the-Middle (MITM) attacks ( [14] [15]).
The cloud platform has been an effective delivery approach for cybersecurity education. However, commercial cloud platforms, such as Amazon Web Services (AWS), are expensive and restrictive to certain security labs. To meet the high demands of cybersecurity educators, an open laboratory platform named CloudLab has been proposed to create hands-on labs in.
CloudLab is sponsored by the NSF for academic researchers to develop and experiment on new cloud architectures and new cloud computing applications [5]. CloudLab provides easy-to-setup experimental environments created on the cloud for scientific research purposes on cloud computing. CloudLab is built upon a distributed infrastructure with clusters at three sites: Clemson University, University of Utah, and University of Wisconsin-Madison. CloudLab combines an estimate of 5,000 cores and 500 Terabytes of storage in the latest virtualization technology. For every connected node, CloudLab supports SDN technology such as 2x10 Gbps network interfaces. A 100 Gbps full-mesh SDN interconnect lets researchers instantiate a wide range of in-cluster experimental topologies.
CloudLab supports OpenFlow standard, which is an open standard protocol that organizes and monitors flows. CloudLab can be easily used in a two-step process: step 1create a user profile to encapsulate every resource component needed for the experiment (hardware, storage, network resources and software artifacts); and step 2 -instantiate the created profile to setup a virtualized experiment environment within a few minutes, when contrasted with traditional methods, this reduces request and wait times, as well as 979-8-6425-4896-7/20/$26.00 ©2020 CISSE redeployment time. A profile can also be shared to make it accessible to a broader group of people.
A distinct gap exists between explanations of emerging SDN and NFV technologies and university course curricula across the nation [5]. This course introduces SDN and NFV, the attacks to the three main layers of SDN, and defense techniques shown in the current research. Students will complete hands-on labs that demonstrate the security issues of SDN/NFV and defense techniques.
The rest of the paper is organized as follows. Section II describes the labs used for this course. Section III describes how the course was managed and introduces our teaching methods. Section IV describes the teaching experience of this course. Section V concludes the paper. Labs 1, 2, 3, 4, 5, 6 were introduced and explicitly described in previous paper [5]. Lab manuals can be found online [30]. Labs 7, 8, and 9 are described below:
• Lab Description: The controller is responsible for flow settings in switches so that all flow processing in the data-path is based on instructions from the controller. The controller then sets the flow rules in switch flow tables to either forward the flow packets to a particular port or drop packets coming from that particular source. The flow rules change depending on different network topologies, various user requests, and network protocols. This lab demonstrates how an user/attacker can modify flow rules using static flow pusher. • Learning Objectives: The students will be able to conduct a MITM attack through simple flow rule manipulation through the Representational State Transfer (REST) API.
Lab Description: FlowVisor is a special purpose OpenFlow controller that acts as a transparent proxy between OpenFlow switches and multiple OpenFlow controllers. FlowVisor creates rich slices of network resources and delegates control of each slice to a different controller. Slices can be defined by any combination of switch ports (layer 1), src/ dst ethernet address or type (layer 2), src/dst IP address or type (layer 3), and src/dst TCP/ UDP port or ICMP code/type (layer 4). FlowVisor enforces isolation between each slice, i.e., one slice cannot control another's traffic. A slice is also a flow rule.
• Learning Outcomes: Students will be able to write flow rules to slice an OpenFlow network and have each slice be controlled by a separate controller.
• Lab Description: The switch acts as the first line of filter for flows (a series of packets behaving the same way) in the data plane of SDN before the flows are allowed to be forwarded to the controller in the control plane. However, if conflicting flows occur frequently and switch is unable to respond, the flows are forwarded to controller and remain idle for the duration of the connection, this may lead to potential serious DoS attacks. This lab demonstrates how to resolve such conflicts with priority approach. • Learning Outcomes: Students will be able to identify conflicting rules and segregate flows to ensure data packets are received by the intended users. Students will apply the rule priority approach to resolve flow conflicts and applying the common OpenFlow parameters.
III. COURSE ON SDN SECURITY This course was taught as a special topic graduate level course entitled "Advanced Security for Emerging Networks" at North Carolina A&T State University in the Spring 2019 semester. This course held face-to-face meetings twice a week. Fifteen students enrolled in the class.
Upon completion of this course, we expect students to be able to:
• Explain the key components of SDN/NFV architecture and concepts
• Explain the major security issues in different layers of SDN/NFV
• Identify defense techniques for attacks to SDN/NFV
• Conduct research, and give presentations/tutorials on their research
• Conduct implementation-oriented hands-on labs related to SDN/NFV security Almost every week of the semester, the students were asked to complete one of the nine listed labs. The students were then graded on completion of the lab. Each student submitted their work in the form of either screenshots or video recordings. Each student selected a SDN/NFV-related topic and developed a lab exercise that pertains to the topic. Each student was to present their final project in an approximate 10-minute span. The final projects were assessed based on the students' presentation skills, knowledge base, critical thinking and overall impressions. Then students were given a lab survey and a course survey. The results of labs and surveys are discussed in the next section.
This course was designed in seminar style, executed through guided inquiry collaborative learning ( [20] [21]). Each student was assigned to prepare materials to either teach one or several chapters of the selected textbook [22] or teach and demonstrate a lab. This style requires students to study, prepare and have adequate knowledge of the subject, as a result the students enhance their teaching skills while stimulating their fellow students to actively participate in discussions ( [16] [17]). The students demonstrated creativity and utilized many teaching methods and tools, including gamification tools such as Plickers, Kahoot, and multimedia tools such as YouTube videos and PowerPoint slides. Past research has indicated that the use of gamification tools significantly adds to project-based learning [18]. One student taught the class using a method similar to POGIL teaching. The student created the teaching material as handouts. Students first had to read material to build up knowledge, then discussed in groups before finally answering the assessment questions from the handouts. The mixing of these teaching methods increased learner's motivation, enhanced understanding of technical content and brought an upbeat atmosphere. Previous research shows that the use of gamification tools allow faculty to clearly identify whether the students have successfully mastered the concepts and allow instructors to further structure peer-to-peer active learning more effectively in class [19].
An anonymous student survey and a questionnaire on student reflection was conducted on the course module. This section presents some details from the results.
The survey results are shown in Table I.
A total of twelve students participated in the survey. Students' self-ranking on knowledge attained in learning objectives for the labs showed that eighty-three-point four percent (83.4%) strongly agreed or agreed that the learning objectives of the labs are met. The majority of labs requires working in terminal on Linux, which 100% of students responded that they have strong familiarity.
Even though eighty-three percent (83%) of students believe labs are somewhat difficult, seventy-five percent (75%) of students believe that they are more interested in computer security after taking this course. Seventy-five percent (75%) students expressed having either high or very high interests in the labs. Almost 70% of class was very motivated to learn the labs. Almost 100% of the students 979-8-6425-4896-7/20/$26.00 ©2020 CISSE found that the hands-on learning aspect of the class was the most valuable to their learning. Majority of students also commented they wish to apply the knowledge learned in this course to their own research areas. One hundred percent (100%) of students recognized SDN and NFV as easy to deploy and advantageous to any other methods they've experienced using.
The lab instructions were clear.
The labs are somewhat difficult. 33.33 41.67%
I clearly understand the objectives of the labs.
33.3% 66.7%
The labs were a valuable part of this course.
Approximately, I spent more than an average of 5 hours on each lab. 50% 16.66%
The most time-consuming part of the labs is instantiating and prerequisite installations.
A result of the labs, I am more interested in computer security
When answering the question "What changes could be made to the labs to enhance your learning," some students said that they expected to learn more mitigation methods for the problems posed by the labs, while some wished to have more demo videos available when they attempted the labs. When answering to the question "The most important thing learned from the lab experience," the class reached a consensus by identifying "learning SDN, NFV and many methods and tools to simulate attack and explore" as the most important learning outcome.
The class created several interesting labs, the following is a listing of several topics.
• Project 1 SDN controller NOX/POX Lab -introduce the basic steps in developing net apps using OpenFlow framework on NOX controller.
• This is a lab exercise that is split into two parts.
• Part 1 Description: In first half of the lab, the student will explore Round Robin load balancer for a VNF Snort application. Snort will be running as IDS on VNF1 and VNF2 and student will try to balance the load across the two VNF instances by directing each new flow request to one of the two VNF instances in a round robin fashion. Student will use the Netcat application to generate traffic between a source and destination.
• Part 2 Description: In second part of the lab, student will use a Proportional Integral approach to do load balancing. An overview of the system is shown in Fig. 3. In this approach, the load on VNF1 and VNF2 is monitored, and flow-forwarding decisions are made based on the load information retrieved from the hosting VMs. Student will run a RINA distributed application to get the state (load) of the VNFs to the controller VM. Once the Ryu controller has the IDS load information, it will use the Proportional Integral (PI) load balancer to balance the load across the VNF instances based on the load information. This load balancing information is then provided to the Ryu controller, which updates the OpenFlow rules on the OVS switch to balance the load.
979-8-6425-4896-7/20/$26.00 ©2020 CISSE • Learning Outcomes: Students will identify and learn two load-balancing approaches while utilizing NFV. Students will also be able to slice network using RYU controller and apply various API packages such as SNORT, LUAJIT, GHTTP2, DAQ and RINA.
When asked to "Describe how your experience with teaching a topic in this class helped you identify and develop professional qualities and skills" in the student reflection questionnaire, one student answered this way: V. CONCLUSION This paper describes a course designed to teach students about SDN security knowledge through hands-on labs in CloudLab, and how the SDN related security vulnerabilities can be exploited. The course consists of nine hands-on lab exercises simulating various attacks as well as delivering core foundation knowledge. Students learn and apply the concepts to NFV and the three main layers of SDN. Students were also asked to apply the acquired knowledge and create new labs. Student were required to present course topics under the supervision of the course instructor.
The course was taught in the Spring 2019 semester. Our teaching experience showed that students were highly interested in labs and ended the course with more interest in computer security. The hands-on labs on SDN security taught in this course may be adopted by instructors teaching network security, web security, and network functions.
Since students from the current course designed new labs for the subject, these labs may be included as part of the course in the future. More sophisticated labs can also be introduced for the course. Potential subjects that can be taught in the course are serverless [6], lightweight virtualization [28], and IoT management [29].