Achieving Efficient Multipath Validation in Software-Defined Networks

The programmability of Software-Defined Networks (SDN) enables multipath routing through dynamic adjustments and optimizations of network resources. However, a compromised switch can violate packet forwarding rules, creating serious security vulnerability. While path validation ensures packets follow designated paths, mainstream methods impose excessive computational burden on the controller and significant storage overhead on switches due to the uncertainty and potentially large number of packet forwarding paths. To address these issues, we propose a Naive Packet-level MultiPath Validation Scheme (NPM-PVS) as the first attempt to verify multiple forwarding paths in SDN. Building on NPM-PVS, we introduce an Enhanced Packet-level MultiPath Validation Scheme (EPM-PVS), which uses a Supplementary Validation Information (SVI) generation method to reduce the controller's load by ensuring consistent validation for packets of a network flow across various forwarding paths. To further improve the efficiency of EPM-PVS, we propose a Flow-level MultiPath Validation Scheme (FM-PVS) and implement a validation information compression method to minimize data plane storage overhead. Additionally, we introduce an anomaly switch identification method to locate compromised switches when path validation fails at the controller. Evaluation results demonstrate that the proposed FM-PVS achieves low switch storage overhead and reduces the computational burden on the controller.