SDNGuardian: Secure Your REST NBIs with API-Grained Permission Checking System

Abstract

REST NBI (REST Northbound API) is the mainstream NBI implementation method of current SDN controllers, but none of them has achieved authorization management, which leads to serious privilege abuse problems. In this paper, we propose SDNGuardian, an API-grained permission checking method based SDN REST NBI security defense system that achieves API level REST NBI authorization and effectively solves the problem of privilege abuse. Comparing with current authorization enhanced SDN controllers, our system is able to defend against attacks via REST NBIs within the same permission group.