Cluster-Controller: A High Performance and Reliable SDN Architecture

Security on the Internet today is treated mostly as a data plane problem. IDS's, firewalls, and spam filters all operate on the simple principle of detecting malicious data plane behavior and erecting data plane filters. In this paper we explore how breaking down the barrier between the control and data plane can significantly enhance our understanding of how to detect and filter Internet threats like worms and botnets. Our investigation is guided by two specific goals: using information and anomalies detected on the data plane to inform control plane decision support and using anomalies detected on the control plane to inform data plane filtering. We begin by analyzing the source of persistent worms and other persistent malicious and misconfigured data plane traffic to understand the scope of this behavior on the control plane. We then analyze how anomalies on the control plane associated with poorly managed networks and are correlated with the sources of malicious and misconfigured traffic detected on the data plane. Our results show that malicious and misconfigured data plane behavior is widely spread across the control plane suggesting that constructing a few control plane filters to block the most infected organizations will not have a significant impact. We demonstrate that networks with data plane anomalies tend to exhibit more routing misconfigurations. Finally, we discuss how these correlations could be used to reject or filter routes and help stop recurring threats like persistent worms.

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

While Wireless Local Area Network (WLAN) gains growing popularity during the last two decades, it faces several new challenges in meeting the requirements of emerging applications due to spectrum shortage, complicated network management and inefficient radio resource allocation (RRA) in densely deployed scenarios. The operating band has evolved from microwave band (a.k.a. sub-6 GHz) to millimeter-wave band (mmWave for short) or even multi-band to provide higher data rates. However, the existing distributed WLAN architecture works in different bands separately and doesn't support the coordination among access points (APs), making it difficult for efficient network management and improved quality of service (QoS) provisioning. In overcoming these challenges, a centralized control architecture for WLAN with decoupled control and data planes can be used to orchestrate the RRA within the whole network while achieving improved communication performance. Therefore, a new control/data plane decoupled WLAN architecture is designed in this paper to realize efficient network management and optimized RRA by separating the control plane and data plane into sub-6 GHz and mmWave respectively. Then, we propose the sub-6 GHz assisted mmWave beamforming protocol, which can significantly reduce the overhead of beamforming training (BFT). Last, we investigate joint RRA for the control/data plane decoupled WLAN since the control plane affects the RRA in the data plane. Performance analysis and simulation show that the joint RRA mechanism in the control/data plane decoupled network can significantly improve the number of successfully scheduled users and the sum-rate compared with the traditional RRA.

Software Defined Networking (SDN) is a recently proposed networking pattern that facilitates a centralized system of computer networks where a controller maintains the management of a global view of the network. One of the characteristics of SDNs is that by decoupling the control and data plane from each other, the controllability and manageability of a network is improved. In this arrangement, the connections between the controller (control plane) and the switches (data plane) are established by either an in-band or an out-of-band control mechanism. Despite all the advantages of SDNs, new challenges arise regarding the connection availability between the data and control planes. A disconnection between the two planes could result in performance degradation. To achieve reliable control traffic between data and control planes, in this work, we design and implement an in-band control protection approach that finds a set of ideal paths for control channel, where as much control traffic as possible can be protected by the proposed protection mechanism. This design enables switches to locally react to failures without involving the controller. Through simulation experiments, we show that our proposed approach significantly improves the control reliability of an in-band control network.

Distributed denial of service (DDoS) attacks challenge software-defined networks (SDN), primarily due to vulnerabilities present in the separation between the control and data planes. The control plane maintains continuous communication with the data plane switches to direct traffic according to forwarding policies. Although the literature presents various solutions to detect DDoS attacks, most of them concentrate on the control plane. The controller facilitates automated network management, making it easier to integrate and administer applications. On the other hand, the development of security solutions on the control plane imposes an additional load on the controller’s duties. As an alternative to this problem, the research community proposed security solutions adapted to work on the data plane. However, due to the complexity of acting in this layer, the proposed solutions are restricted to statistical analysis of the network flow. This work proposes DataPlane-ML, a machine learning (ML) solution that acts on the data plane to detect DDoS attacks. To realize the use of ML techniques at the data plane, DataPlane-ML makes use of white box switches enhanced with P4 constructs to handle input flow and ML libraries to run ML models. This strategy allows the use of ML techniques on the data plane to provide more elaborated solutions that operate close to the input flow, reducing the impact on the SDN controller. The proposed DataPlane-ML was evaluated using the KNN, SVM and RF algorithms to detect DDoS attacks on real network traces. The experimental results show that DataPlane-ML is ≈23% faster than statistical-based solutions while providing better accuracy and similar CPU usage.

In software-defined networking (SDN), the control plane is separated from the data plane. For scalability and robustness reasons, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. The determination of the number and location of the SDN controllers is known as the controller placement problem (CPP). For given maximum switch-controller (SC) and controller-controller (CC) delays in the regular (failure-free) state, we aim to find a CPP solution that maximizes the control plane robustness against a given number of malicious node attacks. We describe an ILP-based method aiming to enumerate all CPP solutions that guarantee the existence of a data plane path from every switch to any controller if all other controller nodes are shut down (worst-case scenario). Then, for different malicious node attacks, based on node centrality metrics and corresponding to different attacker’s strategies, we evaluate the previous solutions to determine the ones that maximize the network robustness, considering the SDN control plane operating with or without split-brain. In the computational results, we compare the robustness and the average SC and CC delays of the best CPP solutions. Since a control plane with split-brain requires more controllers, the average SC and CC delays in the regular state of its CPP solutions are significantly better, on average. Concerning robustness, split-brain does not always provide the best robust CPP solutions due to its feature of requiring a minimum number of connected controllers (which must be over half of the total number of them) to be operational.

Network is dynamic and requires update in the operation. However, many confusions and problems can be caused by careless schedule in the update process. Although the problem has been investigated for many years in traditional networks where the control plane is distributed, software defined networking (SDN) brings new opportunities and solutions to this problem by the separation of control and data plane, as well as the centralized control. This paper makes a survey on the problems caused by network update, including forwarding loop, forwarding black hole, link congestion, network policy violation, etc., as well as the state-of-the-art SDN solutions to these problems. Furthermore, we summarize the network configuration strength and discuss the open issues of network update in the SDN paradigm.

Software-defined networking (SDN) nowadays is extensively being used in a variety of practical settings, provides a new way to manage networks by separating the data plane from its control plane. However, SDN is particularly vulnerable to Distributed Denial of Service (DDoS) attacks because of its centralized control logic. Many studies have been proposed to tackle DDoS attacks in an SDN design using machine-learning-based schemes; however, these feature-based detection schemes are highly resource-intensive and they are unable to perform reliably in such a large-scale SDN network where a massive amount of traffic data is generated from both control and data planes. This can deplete computing resources, degrade network performance, or even shut down the network systems owing to being exhausting resources. To address the above challenges, this paper proposes a big data framework to overcome traditional data processing limitations and to exploit distributed resources effectively for the most compute-intensive tasks such as DDoS attack detection using machine learning techniques, etc. We demonstrate the robustness, scalability, and effectiveness of our framework through practical experiments.

In large-scale software-defined networks (SDNs), multiple controllers are deployed. Each controller has a logically centralized vision of the network that is used to manage a set of switches. In SDN, a challenge known as controller placement problem arises which is very important to specify the number of controllers that are needed and where they should be deployed. These specifications affect the performance of the network. Meanwhile, the assignment of switches to the controllers plays key role in the quality of solution in this problem. However, recent studies focus more on simply assigning switches to their closest controllers based on propagation delay between controller and switches. In this paper, a new controller placement framework is designed which considers both control plane architecture and relation between control and data planes. This framework is considered as a multi-objective optimization model with two objective functions to minimize the flow setup time and inter-controller latency. Furthermore, we propose a new model for flow setup time function that considers all affected metrics in the placement. To solve the framework, a multi-objective algorithm called non-dominated sorting moth flame controller placement optimizer is designed. To this end, we adapt the best–worst multi-criteria decision-making method considering three metrics, namely hop count, propagation latency and link utilization, to assign switches to controllers. A heuristic approach is also used to assign a path between switch and its controller using above three metrics and path reliability. We run theses three models iteratively to find the best location for controllers, the best switch assignment to controller and also find the best route in the network. We compare our proposed framework with other models using expected path loss and link load balancing metrics. Our performance evaluations on real wide area network topologies show the efficiency of the proposed framework.

Software Defined Networking (SDN) is a new networking paradigm which decouples control plane from the forwarding plane. Even though the control plane is assumed to be logically centralized, multiple physical controllers are essential to handle the issues such as fault tolerance and load balancing, especially in wireless networks. However, the physical constraints restrict the control plane to have a global network view among the controllers, which leads to the generation of inconsistent flow-rules and, thereby, a flow-deadlock. In this paper, we identify the inconsistencies resulting from controller mismatch in a flow-path and resolve them using packet_in relay mechanism through east-west interface. We modify Optimized Link State Routing (OLSR) protocol to advertise the switch information to controllers. The performance of our scheme is tested using a wireless mesh network test-bed consisting of static and mobile nodes. The results show that our scheme provides delivery ratio greater than 0.8 in the presence of network view inconsistencies at the controller nodes, with a slight increase in controller response time.

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Simulation and emulation are popular approaches for experimentation in Computer Networks. However, due to their respective inherent drawbacks, existing solutions cannot perform both fast and realistic control plane experiments. To close this gap, we introduce Horse. Horse is a hybrid solution with an emulated control plane, for realism, and simulated data plane, for speed. Our decoupling of the control and data plane allows us to speed up the experiments without sacrificing control plane realism.

We present a control plane architecture to enable software-addressable optical acceleration from the application layer. The architecture is experimentally examined on a cluster-computing test-bed by enabling physical layer optical multicasting on-demand for the application layer to achieve non-blocking performance.

In this paper, we present a novel cell outage management (COM) framework for heterogeneous networks with split control and data planes—a candidate architecture for meeting future capacity, quality-of-service, and energy efficiency demands. In such an architecture, the control and data functionalities are not necessarily handled by the same node. The control base stations (BSs) manage the transmission of control information and user equipment (UE) mobility, whereas the data BSs handle UE data. An implication of this split architecture is that an outage to a BS in one plane has to be compensated by other BSs in the same plane. Our COM framework addresses this challenge by incorporating two distinct cell outage detection (COD) algorithms to cope with the idiosyncrasies of both data and control planes. The COD algorithm for control cells leverages the relatively larger number of UEs in the control cell to gather large-scale minimization-of-drive-test report data and detects an outage by applying machine learning and anomaly detection techniques. To improve outage detection accuracy, we also investigate and compare the performance of two anomaly-detecting algorithms, i.e., $k$ -nearest-neighbor- and local-outlier-factor-based anomaly detectors, within the control COD. On the other hand, for data cell COD, we propose a heuristic Grey-prediction-based approach, which can work with the small number of UE in the data cell, by exploiting the fact that the control BS manages UE-data BS connectivity and by receiving a periodic update of the received signal reference power statistic between the UEs and data BSs in its coverage. The detection accuracy of the heuristic data COD algorithm is further improved by exploiting the Fourier series of the residual error that is inherent to a Grey prediction model. Our COM framework integrates these two COD algorithms with a cell outage compensation (COC) algorithm that can be applied to both planes. Our COC solution utilizes an actor-critic-based reinforcement learning algorithm, which optimizes the capacity and coverage of the identified outage zone in a plane, by adjusting the antenna gain and transmission power of the surrounding BSs in that plane. The simulation results show that the proposed framework can detect both data and control cell outage and compensate for the detected outage in a reliable manner.

Operational, organizational and business challenges for network operators in the context of SDN and NFV