UNISAFE: A Union of Security Actions for Software Switches

Abstract

As Software-defined architectures, such as Software-Defined Networking (SDN) and Network Function Virtualization (NFV), are getting popular, the necessity of software-based switch (a.k.a., software switch) is also increasing because it can adopt new functions/features without much difficulty compared with hardware-based switches. Nowadays we can easily observe that researchers devise new network functions and embed them into a software switch. However, most those proposals are highly biased at network communities, and thus it is hard to find some trials of leveraging the abilities of a software switch for security. In this paper, we consider that how we can enrich security functions/features in software-defined environments, and in this context we propose a new software switch architecture - with the name of UNISAFE - that can enable diverse security actions. Furthermore, UNISAFE provides action clustering which joins UNISAFE actions of multiple-flows together. It makes that UNISAFE can check flows synthetically, and thus a user can establish effective security policies and save system resources. In addition, we describe the design and implementation of UNISAFE and suggest some use-cases for how UNISAFE works.