# A Robust Security Architecture for SDN-Based 5G Networks
## 2 Background
### Security Problems in SDN-Based 5G Networks  
Although the SDN architecture can greatly improve the scalability of the traditional 5G network, the same attributes of centralized control and programmability associated with the SDN platform introduce network security challenges. The communication channel of SDN channel is vulnerable due to the following six reasons [18]:  
1. The absence of trust and weak authentication between the applications and the controller, which may lead to a spoofing attack by spoofing northbound API messages.
2. Inappropriate authorization may cause inappropriate or malicious access on the application.
3. The absence of encryption of the traffic between the controller and switches leads to eavesdropping and spoofed southbound communications.
4. The absence of trust and weak authentication at this level may lead to Man-In-The-Middle and spoofing attacks, which makes it easier for the attacker to eavesdrop on flows to see what flows are in use and what traffic is being permitted across the network.
5. Inappropriate authorization that may cause unauthorized access. In fact, if a user requests a service that triggers the controller to create a route and cause packets to traverse that route, it must be ensured that the user is authorized to do so and that the environment can account for that activity.
6. Southbound communication affected by attacks on flow rules mainly in In-band deployments  
The security flaw of SDN architecture brings a lot of security problems. In the following, we list three classical attacks [19] to show how a malicious attacker leverages these security flaws to attack the SDN-based network. The first type is IP spoofing. The IP spoofing refers to the progress of using forged IP addresses to inject packets into the SDN networks. This technique is mainly used in the DDOS attacks. In a DDOS attack, the attacker will send the flood of TCP SYN messages  
Figure 2: SDN-based architecture.  
or UDP SYN messages or ICMP messages to the victim host using the IP address which can be found using IP spoofing. It causes a table-miss in the flow table in the switch, making the controller become unavailable for other nodes to make routing decisions, reducing the performance of the SDN networks. The second type is the man-in-the-middle (MITM) attack. In a MITM attack, the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. By eavesdropping on the communication messages in the SDN network, the attacker can obtain all details required in conducting a MITM attack since the communication channel in SDN is lack of authentication. The last type of attack is replay attacks. Similar to the MITM attack, the attacker first eavesdrops on the communication channel. With the valid data transmission, the attacker then maliciously or fraudulently repeats or delays it, thereby fooling the honest participant(s) into thinking they have successfully completed the protocol run. Given the bad security condition in SDN architecture, it is urgent to adapt it for practical use.