Byzantine-resilient secure software-defined networks with multiple controllers

In this paper, we consider IP fast recovery from single-link failures in a given network topology. The basic idea is to replace some existing routers with a designated switch. When a link fails, the affected router will send all the affected traffic to the designated switch (through pre-configured IP tunnels), which will deliver the affected traffic to its destination without using the failed link. The goal of the approach is to achieve faster failure recovery than traditional routing protocols that employ reactive computing upon link failures. Software-Defined Networking (SDN) switches can serve as the designated switches because they can flexibly redirect affected traffic to other routes, instead of only to the shortest paths in the network. However, SDN switches are very expensive. Our objective is to minimize the number of SDN switches needed and to guarantee that the network can still recover from any single-link failure. For networks with uniform link costs, we show that using normal non-SDN switches with IP tunneling capability as designated switches can guarantee recovery from any single-link failure. For networks with general link costs, we find that not all single-link failures can be recovered by using non-SDN switches as designated switches; by using SDN switches only when necessary, we can reduce the total number of SDN switches needed compared to an existing work. We conduct extensive simulations to verify our proposed approaches.

Software Defined Networking (SDN) is disruptive networking technology which adopts a centralised framework to facilitate fine-grained network management. However security in SDN is still in its infancy and there is need for significant work to deal with different attacks in SDN. In this paper we discuss some of the possible attacks on SDN switches and propose techniques for detecting the attacks on switches. We have developed a Switch Security Application (SSA)for SDN Controller which makes use of trusted computing technology and some additional components for detecting attacks on the switches. In particular TPM attestation is used to ensure that switches are in trusted state during boot time before configuring the flow rules on the switches. The additional components are used for storing and validating messages related to the flow rule configuration of the switches. The stored information is used for generating a trusted report on the expected flow rules in the switches and using this information for validating the flow rules that are actually enforced in the switches. If there is any variation to flow rules that are enforced in the switches compared to the expected flow rules by the SSA, then, the switch is considered to be under attack and an alert is raised to the SDN Administrator. The administrator can isolate the switch from network or make use of trusted report for restoring the flow rules in the switches. We will also present a prototype implementation of our technique.

Software Defined Networking (SDN) is the new promise towards an easily configured and remotely controlled network. Based on Centralized control, SDN technology has proved its positive impact on the world of network communications from different aspects. Security in SDN, as in traditional networks, is an essential feature that every communication system should possess. In this paper, we propose an SDN security design approach, which strikes a good balance between network performance and security features. We show how such an approach can be used to prevent DDoS attacks targeting either the controller or the different hosts in the network, and how to trace back the source of the attack. The solution lies in introducing a third plane, the security plane, in addition to the data plane, which is responsible for forwarding data packets between SDN switches, and parallel to the control plane, which is responsible for rule and data exchange between the switches and the SDN controller. The security plane is designed to exchange security-related data between a third party agent on the switch and a third party software module alongside the controller. Our evaluation shows the capability of the proposed system to enforce different levels of real-time user-defined security with low overhead and minimal configuration.

<p>Software-Defined-Networking (SDN) simplifies the configuration complexity in the computer communication network by decoupling the control plane from the data plane in a switch. In SDN, the switch has the data plane only and is configured by the logically centralised controller which simplifies the forwarding of packets in the network. However, an SDN switch is sensitive to delay and loss of packets which significantly affects the network performance. This thesis uses queueing theory to conduct modelling and performance analysis of OpenFlow-based SDN switches. OpenFlow is the de-facto protocol for communication between an SDN switch and the controller. Using queueing theory, three aspects of packet processing in an SDN switch are explored. First, the existing research has primarily modelled the output buffer of an SDN switch using two buffer sharing mechanisms: the single shared buffer and the priority buffer. However, the effect of buffer dimensioning in these buffer sharing mechanisms has not been investigated. Buffer dimensioning helps in determining the minimum buffer capacity for a desired loss probability. The research in this thesis shows that the use of priority buffer in an SDN switch reduces the time to update flow tables than the shared buffer but at the cost of a higher buffer capacity. Second, much of the existing research has not investigated the impact of internal buffering of data packets whereby a fraction of a data packet header is sent to the controller instead of an entire data packet. To investigate the impact of internal buffering, the queueing model for an SDN switch with the internal buffer is developed. The investigation shows that at the time of congestion, the internal buffer in an SDN switch improves the network performance with lower delay and lower packet loss. Finally, existing research has focused on a software switch in SDN and very little research has studied the performance of a hardware switch. To characterise the performance of SDN-based hardware and software switches and identify the tradeoffs between them, a unified queueing model has been developed. The unified queueing model is an analytical tool for network engineers to predict delay and packet loss in their SDN deployments. The analysis shows the benefits of a hardware switch over a software switch. These benefits are lower delay and lower packet loss. However, the increasing involvement of the controller reduces the benefit of using a hardware switch, i.e. forwarding packets at the line speed rate. This research guides network designers and analysts in the selection of the shared or buffer model for an SDN switch for their desired Quality of Service (QoS). Furthermore, the developed queueing model for an SDN switch with the internal buffer studies the impact of internal buffering in an SDN switch. Finally, the unified queueing model helps in the selection of a software or hardware switch in SDN.</p>

Accurate traffic and latency measurements are the foundation of many network management tasks, including traffic engineering and network provision, network diagnosis and fault recovery. However, SNMP-based traffic measurement techniques in traditional IP networks only provide measurements for link loads, which cannot lead to accurate measurements. For link latency measurement, it has been shown that a traditional IP network needs to deploy a large number of monitors to achieve accurate measurements. The software-defined network (SDN) architecture opens up new opportunities to tackle the traffic matrix estimation and latency measurement problems. For the traffic estimation problem, the counter in a flow table entry of an SDN switch can directly measure the size of a matched flow. This dramatically increases the number and type of flows that can be measured accurately. For link latency measurement, SDN switches provide flexible routing and hence allow even non-shortest paths to be measured in the network. This routing flexibility can reduce the number of monitors deployed in the network to achieve a complete measurement of all the link latencies. But the additional measurement capabilities of SDNs also have limitations: the flow table entries added for measurements must be limited due to the high cost of ternary content-addressable memory (TCAM), and the amount of additional traffic for measurement should also be confined. Under these constraints, this research investigates the traffic matrix estimation and link latency measurement problems for a pure SDN network and a hybrid SDN network. A hybrid network, which consists of SDN switches and conventional routers, will exist for some time to come since it is economically impossible to replace every conventional router overnight. For the traffic matrix estimation problem, we propose a new estimation framework, which can be used in both SDNs and hybrid SDNs. Performance evaluation results show that the new framework can achieve highly accurate traffic measurement with a small number of TCAM entries. For the link latency measurement problem, we first present minimum monitor placement schemes in hybrid SDNs. It has been shown that our schemes not only reduce the number of required monitors but also guarantee full link measurements even when link weights change. We then present two time-stamp-based link latency measurement schemes for pure SDNs and show that the proposed schemes can minimize the number of consumed TCAM entries and the amount of traffic generated for measurement.

A longstanding problem in the context of computer networks is the issue of recovery from link failures. A promising solution to safeguard all single link failures (SLF) is through partial up gradation of certain IP routers (Internet Protocol(IP)) to Software Defined Networking (SDN) switches using CSA (Candidate Selection Algorithms). The resultant network comprises a combination of IP routers and SDN switches, forming a hybrid IP/SDN network. Most of the existing approaches primarily address SLFs, yet real-world scenarios may involve multiple link failures (MLF). Hence, it’s crucial to investigate CSA for Hybrid IP/SDN with MLF. In this paper, we first introduce four CSA strategies tailored for hybrid IP/SDN networks with MLF. Subsequently, we present a CSA designed to accommodate network scaling or expansion. We emphasize the advantage of CSAs based on non-shortest path approach. Additionally, we propose a budget constraint-based CSA to aid in selecting suitable candidate switches within a specified budget. We evaluate the performance of hybrid IP/SDN networks employing the proposed CSAs, considering average repair path length (AMLU) and average maximum link utilization (AMLU) in the post-recovery network across diverse real-world network topologies. It will be shown that the hybrid IP/SDN with proposed CSA for MLFs will reduce the ARPL by 31.37%, 22.15%, and 18.64%, respectively, for NSF, Attmpls, and Abilene networks.

Software-defined networking (SDN) is an emerging network architecture that decouples the control plane from the data plane, enabling centralized programmability and management of networks. While SDN offers benefits like flexibility, scalability, and automation, it also introduces new security vulnerabilities. This literature review analyzes the current state of research on SDN security in three key domains – Internet of Things (IoT) environments, cloud computing, and traditional enterprise networks. A systematic review methodology was followed to search, select, and review 53 relevant studies published in the past 5 years. The analysis focuses on identifying common SDN threat vectors, security solutions proposed leveraging SDN programmability and evaluating their effectiveness based on results from simulations, testbed experiments, and initial real-world implementations. Key findings of the review include lack of authentication, susceptibility to DDoS attacks, and flow rule conflicts as major security issues in SDN across domains. Dynamic traffic monitoring, access control, policy orchestration, and virtualized security functions are commonly proposed techniques to enhance SDN security. However, limitations exist in robustness testing at scale, emerging paradigms like fog computing, and quantitatively comparing SDN security with legacy networks. As SDN adoption expands, focused efforts are needed to address these research gaps through innovations in data-driven security, coordinated security policy, and emphasizing SDN controller security. This review provides valuable insights into the current state of SDN security research and informs future efforts needed in this important area

Arising of IoT(Internet of Things) and Big data, rapid increasing of Information Technology utilization on various fields and spreading of services such as SNS(Social Networking Service) and Cloud Computing led to increase in demand for a various network equipment. device, protocol and policy. This kind of changes needs new generation of network. Correspond with this, the needs for new format of internet is arise and this makes interest in the SDN(Software Defined Network) which is one of the future internet technology. Originally, SDN consist in centralized environment. To solve the problems occurred in this kinds of format, the concept of Multiple Controllers based SDN is appeared. To dealing with the important synchronization issues in Multiple Controllers based SDN, In This paper, we propose an adaptation of the Firefly Algorithm for the Synchronization between Multiple Controllers.

This paper presents in the area of software defined networking. Our aim is to identify limitations of current networking technologies and how software-defined networks (SDN) could reduce cost, and improve the performance of campus Networks for their network management. We pursue to identify solutions in this paper to enable possible customers to assess that SDN may be preferable over Current network and also SDN introduces new options and configuration methods. In this paper, we identify problems with the current state of the art network configuration and management mechanisms and introduce new mechanisms to improve various aspects of network management. The technologies we describe enable network operators to implement a wide range of network policies in a high-level policy language and easily determine sources of performance problems. In addition to the systems themselves. Here we refer a various prototype arrangements in campus networks that demonstrate how SDN can improve common network management tasks. In addition to that, we explains therotically that, how SDN can improve the network management performance in network.

Software defined networking (SDN) is becoming increasingly prevalent for its programmability that enables centralized network configuration and management. With the growth of SDNs, a cluster of controllers cooperatively manages more and more switches/flows in a network to avoid the single-controller congestion/failure and improve the control-plane robustness. Under the architecture with multiple controllers, it is expected to minimize the maximum response time on these controllers to provide better QoS for users. To achieve this target, two previous methods are mainly used, the static scheme and the dynamic scheme. However, these methods may lead to an increase of the control-plane communication overhead/delay. In this paper, we propose to minimize the maximum response time on controllers through flow redirecting, which is implemented by installing wildcard rules on switches. We formulate the minimum controller response time problem, which takes the flow-table size and link capacity constraints into account, as an integer linear program, and prove its NP-Hardness. Two algorithms with bounded approximation factors are designed to solve this problem. We implement the proposed methods on our SDN testbed. The testing results and extensive simulation results show that our proposed algorithm can reduce the maximum controller response time by about 50%–80% compared with the static/dynamic methods under the same controller cost, or reduce the number of controllers by 30% compared with the dynamic method while preserving almost the same controller response time.

In this era wireless technology gaining more popularity, people prefer wireless communication over wired communication due to mobility, scalability and ease of access. However, the traditional wireless network is complex, vendor dependent and inadequate feasibility to incorporate new services, protocols, and APIs. The rapid growth in wireless network raises many thoughtful challenges for network and telecom operators. On such grounds, Innovation of Software Defined Network (SDN) and network function virtualization (NFV) for mobile network opens a new arena of research. This research article presents future mobile Internet architecture (FMIA) with the integration of twin technologies, SDN and NFV that enable rapid access to Internet services. Moreover, the network manager can control services provided by ISPs through proposed architecture.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

A survey on software defined networking with multiple controllers

Software-defined networking (SDN) is one of the most prevailing networking paradigms in current and next-generation networks. Basically, the highly featured separation of control and data planes makes SDN a proper solution towards many practical problems that challenge legacy networks, for example, energy efficiency, dynamic network configuration, agile network measurement, and flexible network deployment. Although the SDN and its applications have been extensively studied for several years, the research of SDN security is still in its infancy. Typically, the SDN suffers from architecture defect and OpenFlow protocol loopholes such as single controller problem, deficiency of communication verification, and network resources constraint. Hence, network measurement is a fundamental technique of protecting SDN against the above security threats. Specifically, network measurement aims to understand and quantify a variety of network behaviors to facilitate network management and monitoring, anomaly detection, network troubleshooting, and the establishment of security mechanisms. In this paper, we present a systematic survey on security-aware measurement technology in SDN. In particular, we first review the basic architecture of SDN and corresponding security challenges. Then, we investigate two performance measurement techniques in SDN, namely, link latency and available bandwidth measurements. After that, we further provide a general overview of topology measurement in SDN including intradomain and interdomain topology discovering techniques. Finally, we list three interesting future directions of security-aware measurement in SDN followed by giving conclusion remarks.

USAGE : Uncertain flow graph and spatio-temporal graph convolutional network-based saturation attack detection method