TokenGuard: A novel framework for robust access management in SDN controllers

Abstract

Software-defined networks (SDNs) are increasingly popular due to their simplified network management and centralized control through an SDN controller. However, ensuring secure authentication and authorization for REST web services in SDN controllers is a critical challenge. This paper introduces TokenGuard, a novel security framework designed to enhance the protection of REST web services in SDN controllers. TokenGuard uses dynamic and unique access tokens for each REST request between network applications and the SDN controller. These tokens are generated using a specialized mathematical model, the Fractional Logistic Map (FLM), which incorporates a fixed memory length. This approach significantly improves the robustness of SDN controllers against REST replay attacks involving stolen access tokens. Extensive simulations demonstrate that TokenGuard outperforms standard and federated token-based authentication systems in terms of performance and security. Specifically, TokenGuard achieves approximately 10.5% faster response times than standard token-based systems and 78.1% faster than federated token-based systems. Additionally, TokenGuard’s content sizes are 1.95% smaller than standard token-based systems and 35.28% smaller than federated token-based systems. Moreover, TokenGuard handles requests per second 1.03 times more efficiently than standard token-based systems and 4.82 times more efficiently than federated token-based systems. By employing dynamic access token sequences, TokenGuard significantly mitigates the risks associated with token replay attacks and stolen access tokens, offering a substantial security advantage over the static single-token mechanisms used in traditional systems. This paper also addresses the challenges and limitations of current SDN controllers and highlights how TokenGuard fills these gaps. Practical aspects of deploying TokenGuard in real-world SDN environments are discussed, including its scalability, performance impact, and interoperability.