Security-aware data provenance for multi-domain software-defined networks

As interconnectivity increases, Software-defined Networking (SDN) offers a centralized, dynamic, and programmable approach to network management. However, a significant concern lies in the transparency of network devices and data propagation, which contribute to security awareness gaps in SDN domains. Documenting and aggregating network metadata is therefore crucial to detect anomalies and linked events, which is related to the concept of data provenance. However, existing provenance solutions merely collect data without validating it, focus mainly on single-domain SDNs, and overlook supposedly-benign aspects such as switch authentication states, flow rules, and network paths. This paper explores how integrating security metadata into provenance graphs with predefined security policies increases security awareness. With this goal, we propose PRISM-Prov, a security-aware provenance framework for distributed SDNs. To the best of our knowledge, this work is the first of its kind. We identify and discuss the metadata required to enable security awareness, implementing a proof-of-concept for the popular ONOS controller. Our method is tested against six attack scenarios, confirming real-time detection capabilities, and adding only 0.021 ms to 0.102 ms to average packet processing times $-$ an overhead of 4.89% to 13.4% for small and large topologies, respectively $-$ demonstrating low performance costs. Finally, this study promotes security awareness in SDNs to enhance data transparency, as well as risk and trust-based decision-making systems.