# A Security Assessment Mechanism for Software-Defined Networking-Based Mobile Networks
## 1 Introduction  
In recent years, Software-Defined Networking (SDN) has attracted great attention as an emerging future network architecture in fields such as 5G mobile networks, cloud services and so on. The most different thing about SDN compared to traditional network architectures is that its control plane is decoupled from the forwarding plane and the control plane is programmable. With these SDN features, the switches in SDN networks become simple forwarding devices. At the same time, the control plane is implemented in a logically centralized mode. All of these are helpful to simplify policy enforcement and make network configuration and evolution easy [1; 2; 3; 4; 5; 6]. On the other hand, today's mobile customers desire to remain connected anywhere, at any time, and using any device. This has triggered the investigation of 5G for the next generation of terrestrial mobile telecommunications. In this context, SDN-based Mobile Networks (SDN-MNs) have emergedas a future architecture for 5G [7; 8; 9; 10; 11]. SDN-MNs tend to connect all kinds of smart devices and interconnect other heterogeneous networks. More network devices, more types of network devices and more complex network connections are included in SDN-MN concept. This makes SDN-MNs more diverse and complicated than other networks. Along with the benefits of SDN-MNs, the centralized control and programmability properties also introduce some new properties into the network with new security challenges. Because SDN-MNs provide the ability to directly program the whole network and to create dynamic flow policies instantly according to the current network context, the virtual property is introduced into SDN-MNs and their dynamic property is a consequence. Moreover, SDN has triggered significant interest in network function virtualization (NFV) [10]. NFV also brings programmability into its application networks. The programmability of SDN and NFV makes SDN-MNs more dynamic than traditional networks. Besides the dynamic nature brought by SDN and NFV, the services and endpoint equipment are mobile in 5G networks. The connectivity is also context-aware depending on the applications in 5G networks and is thus not predicable. All of the characteristics of 5G networks make SDN-MNs very dynamic. The aforementioned dynamic nature and complexity of SDN-MNs lead to new challenges for security assessments in the SDN-MNs. To defend this type of network, the security methodology must address its dynamic nature and complexity. A number of security studies for SDN have recently been performed [12; 13; 14; 15; 16]. These works have found that the novel relationship among SDN elements in SDN networks introduces new vulnerabilities, and some of them are only present in SDN networks. For example, in the OpenFlow switch specification, Transport Layer Security (TLS) is used between the controllers and their switches with mutual authentication, but this security feature is not mandatory so it does not specify a standard for TLS. [PERSON] _et al._[14] found that OpenFlow is vulnerable to man-in-the-middle (MITM) attacks if TLS is not used, and due to its inherent centralized design property, OpenFlow is in the danger of Denial of Service (DoS). A high-level analysis of the overall security of SDN networks is discussed in [15]. They find that new threats are introduced and new response methods are needed, because of the inherent properties of the centralized design and programmability of SDN networks. A comprehensive security attack vectors map of SDN is illustrated in Figure 1. Several attack vectors exist in applications, controllers, network elements and the links or traffic between them. Some of the attacks are common to all types of networks, such as the attack vectors on applications and network elements, but some of them only exist in SDN, such as the attack vectors on the SDN controller and the control links between the controller and network elements. Figure 1: Security attack vectors of SDNs.