Software Defined Networking (SDN) brings numbers of advantages along with many challenges. One particular concern is on the control-plane resilience, while the existing protection approaches proposed for SDN networks mainly focus on data-plane. In order to achieve the carrier-grade recovery from link failures, we adopt the dedicated protection scheme towards finding optimal protection routing for control-plane traffic. To this end, we study a weighted cost minimization problem, in which the traffic load balancing and flow table rule placement are jointly considered when selecting protection paths for controller-switch sessions. Because this problem is known as NP-hard, we propose a Markov approximation based combinatorial optimization approach for routing protection in SDN control-plane, which produces near-optimal solution in a distributed fashion. We then extend our solution to an on-line case that can handle the single-link failure one at a time. The induced performance fluctuation is also analyzed with theoretical derivation. Extensive experimental results show that our proposed algorithm has fast convergence and high efficiency in resource utilization.