# A Robust Security Architecture for SDN-Based 5G Networks
## 2 Background
### Related Work  
The methods of SDN security architecture generally fall into four categories. The first type is Denial of Service Mitigation: the key point in protecting networks from being a DOS attack is the recognition of what flows of traffics are malicious as soon as possible because malicious packets are very similar. Traditional methods include preprocessing of traffic log files and sequentially captured packets. Now, this high-overhead practice is not required in SDN because Counters are embedded in each network device in the data. The DOS detection loop consists of three components: streams Collectors, feature extractors, and classifiers. Ref. [9] presents a lightweight method for DDoS attack detection based on traffic flow features, in which the extraction of such information is made with a very low overhead compared to traditional approaches.  
The second type is Cloud Security: Cloud computing is becoming a popular paradigm. Many recent new services are based on cloud environments, and a lot of people are using cloud networks.Since many diverse hosts and network configurations coexist in a cloud network, it is essential to protect each of them in the cloud network from threats. Ref. [20] propose a new framework, CLOUDWATCHER, which provides monitoring services for large and dynamic cloud networks. The framework automatically detours network packets to be inspected by pre-installed network security devices. In addition, all these operations can be implemented by writing a simple policy script; thus, a cloud network administrator is able to protect his cloud network easily.  
The third type is Topology Protection: protecting network topology is crucial in SDNs since all popular SDN controllers are all subjected to network topology attacks. Any changes to flow behaviors should be flagged for immediate remedy. Ref. [21] proposes a mitigation method for network topology poisoning attacks, and a new SDN controller security extension TopoGuard is demonstrated, which can detect network topology poisoning attacks automatically and in real time. One solution is SPHINX [22], which leverages the novel abstraction of flow graphs. It is very close to the actual network operation to enable incremental verification of all network updates and constraints.  
The last type is Policy Enforcement. [PERSON] et al. propose a reference implementation of an Elastic IP and Security Group service--the OpenFlow. The core of the implementation relies on the integration of an OpenFlow controller (NOX) with the EC2 server. One example is LiveSec. Ref. [23] presents LiveSec, a scalable and flexible security management architecture, which achieves holistic security protection with good scalability and flexibility in large-scale networks. They can apply different sets of policies onto different types of VMs being created dynamically on the cloud, providing protection services similar to firewalls as well as elastic IP service.  
Ref. [9] focuses on protecting networks from being DDOS attacks; Ref. [20] focuses on protecting many diverse hosts and network configurations in a cloud network from threats; Refs. [21; 22] focuses on protecting network topology is crucial in SDNs since all popular SDN controllers are subjected to network topology attacks. Our solution falls into the fourth category. Ref. [23] focuses on establishing a scalable and flexible security management architecture, which achieves holistic security protection with good scalability and flexibility in large-scale networks. Our solution is different from Ref. [23]. We propose a robust security architecture for SDN-based 5G Networks. To find the illegal request from malicious attackers, we add extra cryptographic authentication, termed as synchronize secret. The basic idea of our scheme is leveraging preload secrets to differ attacks from regular network communications.