Controller-proxy: Scaling network management for large-scale SDN networks

Cloud and parallel computing are fundamental components in the processing of large data sets. Deployments of distributed computers require network infrastructure that is fast, efficient, and secure. Software Defined Networking (SDN) separates the forwarding of network data by switches (data plane) from the setting and managing of network policies (control plane). While this separation provides flexibility for setting network policies affecting the establishment of network flows in the data plane, it provides little to no fault tolerance for failures, either benign or caused by corrupted/malicious applications. Such failures can cause network flows to be incorrectly routed through the network or stop such flows altogether. Without protection against faults, cloud network providers using SDN run the risk of inefficient allocation of network resources or even data loss. Furthermore, the asynchronous nature existing protocols for SDN does not provide a mechanism for consistency in network policy updates across multiple switches.In addition, cloud and parallel applications require an efficient means for accessing local system data (input data sets, temporary storage locations, etc.). While in many cases it may be possible for a process to access this data by making calls directly to a file system (FS) kernel driver, this is not always possible (e.g. when using experimental distributed FSs where the needed libraries for accessing the FS only exist in user space).This dissertation provides a design for fault tolerance of SDN and infrastructure for advancing the performance of user space FSs. It is divided into three main parts. The first part describes a fault tolerant, distributed SDN control plane framework. The second part expands upon the fault tolerant approach to SDN control plane by providing a practical means for dynamic control plane membership as well as providing a simple mechanism for controller authentication through threshold signatures. The third part describes an efficient framework for user space FS access.This research makes three contributions. First, the design, specification, implementation, and evaluation of a method for fault tolerant SDN control plane that is inter-operable with existing control plane applications involving minimal instrumentation of the data plane runtime. Second, the design, specification, implementation and evaluation of a mechanism for dynamic SDN control plane membership that all ensure consistency of network policy updates and minimizes switch overhead through the use of distributed key generation and threshold signatures. Third, the design, specification, implementation, and evaluation of a user space FS access framework that is correct to the Portable Operating System Interface (POSIX) specification with significantly better performance over existing user space access methods, while requiring no implementation changes for application programmers.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Software Defined Networking (SDN) and Network Function Virtualization (NFV) are transforming Data Center (DC), Telecom, and enterprise networking. The programmability offered by P4 enables SDN to be more protocol-independent and flexible. Data Centers are increasingly adopting SmartNICs (sNICs) to accelerate packet processing that can be leveraged to support packet processing pipelines and custom Network Functions (NFs). However, there are several challenges in integrating and deploying P4 based SDN control as well as host and sNIC-based programmable NFs. These include configuration and management of the data plane components (Host and sNIC P4 switches) for the SDN control plane and effective utilization of data plane resources. P4NFV addresses these concerns and provides a unified P4 switch abstraction framework to simplify the SDN control plane, reducing management complexities, and leveraging a host-local SDN Agent to improve the overall resource utilization. The SDN agent considers the network-wide, host, and sNIC specific capabilities and constraints. Based on workload and traffic characteristics, P4NFV determines the partitioning of the P4 tables and optimal placement of NFs (P4 actions) to minimize the overall delay and maximize resource utilization. P4NFV uses Mixed Integer Linear Programming (MILP) based optimization formulation and achieves up to 2. 5X increase in system capacity while minimizing the delay experienced by flows. P4NFV considers the number of packet exchanges, flow size, and state dependency to minimize the delay imposed by data transmission over PCI Express interface.

Software Defined Networking (SDN) is a new networking paradigm which decouples control plane from the forwarding plane. Even though the control plane is assumed to be logically centralized, multiple physical controllers are essential to handle the issues such as fault tolerance and load balancing, especially in wireless networks. However, the physical constraints restrict the control plane to have a global network view among the controllers, which leads to the generation of inconsistent flow-rules and, thereby, a flow-deadlock. In this paper, we identify the inconsistencies resulting from controller mismatch in a flow-path and resolve them using packet_in relay mechanism through east-west interface. We modify Optimized Link State Routing (OLSR) protocol to advertise the switch information to controllers. The performance of our scheme is tested using a wireless mesh network test-bed consisting of static and mobile nodes. The results show that our scheme provides delivery ratio greater than 0.8 in the presence of network view inconsistencies at the controller nodes, with a slight increase in controller response time.

Computer networks are the fundamental infrastructure of intelligent environments (IEs). Software defined network (SDN) is an emerging software-based network architecture that separates the control plane from data plane to facilitate dynamic network management and configuration; two important parameters which are essential in real-time IEs. This separation alleviates network administrators to implement efficient fault tolerance strategies and increasing reliability and quality of service (QoS). Hence, they can make their networks more reliable and as a result, decrease the adverse effects due to network failures. As a result, SDN is a candidate for using in new IEs such as internet of things (IoT). The control plane of SDN can be deployed on the IoT cloud server to manage the entire network. Link failure is one of the most common and critical failures in such computer networks which causes dropping of data packets and reduces network performance considerably. A survivable traffic engineering (TE) method can provide protection against link failures and heighten the reliability of data transmission. To this purpose, this paper proposes an efficient and survivable software-based TE model over SDN called EFSUTE to increase reliability in real-time IEs. EFSUTE leverages the capabilities of SDN to compute and install two disjoint paths between any source–destination pair in the network. EFSUTE models network routing as a Shared Risk Link Group problem which provides topological diversity. This policy increases the survivability by providing alternative paths between network hosts. To prove the effectiveness of EFSUTE, we conducted extensive simulations and compared it with restoration techniques. Experimental results confirm that EFSUTE can be practically used in SDN and efficiently protects the network traffics against link failures to increase safety and provides a reliable software based infrastructure with QoS for real-time IEs.

The proliferation of edge computing brings new challenges due to the complexity of decentralized edge networks. Software-defined networking (SDN) takes advantage of pro-grammability and flexibility in handling complicated networks. However, it remains a problem of designing a both trusted and scalable SDN control plane, which is the core component of the SDN architecture for edge computing. In this paper, we propose Curb, a novel group-based SDN control plane that seamlessly integrates blockchain and BFT consensus to ensure byzantine fault tolerance, verifiability, traceability, and scalability within one framework. Curb supports trusted flow rule updates and adaptive controller reassignment. Importantly, we leverage a group-based control plane to realize a scalable network where the message complexity of each round is upper bounded by O(N), where N is the number of controllers, to reduce overheads caused by blockchain consensus. Finally, we conduct extensive simulations on the classical Internet2 network to validate our design.

For Software Defined Network(SDN), security is an important factor which affects its large-scale deployment. The existing security solutions for SDN mainly focus on the controller itself, which has to handle all the security protection task by using the programmability of network. It will undoubtedly bring the heavy burden to the controller. More devastating, once the controller itself is attacked, the entire network will be paralyzed. Motivated by this, this paper proposes a novel security protection architecture for SDN. We design a security service orchestration center in the control plane of SDN. This center physically decouples from SDN controller, and thus constructs SDN security service to defense security threats. In particular, we set up a security meta-function base which can be used for security service composition in a rule engine. The rule engine can be realized by using the optimized rule composition algorithms. Finally, a series of experimental results show that the proposed security protection architecture for SDN can achieve effective security protection with small burden of controller.

In today’s networks, load balancing and priority queues in switches are used to support various quality-of-service (QoS) features and provide preferential treatment to certain types of traffic. Traditionally, network operators use ‘traceroute’ and ‘ping’ to troubleshoot load balancing and QoS problems. However, these tools are not supported by the common OpenFlow-based switches in software-defined networking (SDN). In addition, traceroute and ping have potential problems. Because load balancing mechanisms balance flows to different paths, it is impossible for these tools to send a single type of probe packet to find the forwarding paths of flows and measure latencies. Therefore, tracing flows’ real forwarding paths is needed before measuring their latencies, and path tracing and latency measurement should be jointly considered. To this end, FlowTrace is proposed to find arbitrary flow paths and measure flow latencies in OpenFlow networks. FlowTrace collects all flow entries and calculates flow paths according to the collected flow entries. However, polling flow entries from switches will induce high overhead in the control plane of SDN. Therefore, a passive flow table collecting method with zero control plane overhead is proposed to address this problem. After finding flows’ real forwarding paths, FlowTrace uses a new measurement method to measure the latencies of different flows. Results of experiments conducted in Mininet indicate that FlowTrace can correctly find flow paths and accurately measure the latencies of flows in different priority classes.

Distributed multi-controller deployment is a promising method to achieve a scalable and reliable control plane of Software-Defined Networking (SDN). However, it brings a new challenge for balancing loads on the distributed controllers as the network traffic dynamically changes. The unbalanced load distribution on the controllers will increase response delay for processing flows and reduce the controllers'throughput. Switch migration is an effective approach to solve the problem. However, existing schemes focus only on the load balancing performance but ignore migration efficiency, which may result in high migration costs and unnecessary control overheads. This paper proposes Efficiency-Aware Switch Migration (EASM) to balance the controllers'loads and improve migration efficiency. We introduce load difference matrix and trigger factor to measure load balancing on controllers. We also introduce the migration efficiency problem, which considers load balancing rate and migration cost simultaneously to optimally migrate switches. We propose EASM to efficiently solve to the problem. The simulation results show that EASM outperforms baseline schemes by reducing the controller response time by about 21.9%, improving the controller throughput by 30.4% on average, maintaining good load balancing rate, low migration costs and migration time, when the network scale changes.

Software-defined networking (SDN) has revolutionized the way networks are designed and managed, with the control plane being a critical component. The SDN control plane is responsible for managing and orchestrating network traffic flows, but its traditional static approach can be limiting in dynamic and complex network environments. This abstract explores the concept of a dynamic SDN control plane, which can adapt and respond to changing network conditions, leading to better network performance and efficiency. The dynamic control plane involves the use of machine learning algorithms, artificial intelligence, and network analytics to constantly monitor and adjust network policies in real-time. The dynamic SDN control plane empowers networks to move from a state of control to chaos, enabling greater flexibility, agility, and resilience in network management. This abstract provides insights into the potential benefits of a dynamic SDN control plane and highlights the challenges and opportunities in implementing this approach.

This paper explores the Quality of Service (QoS) performance of two widely used Software-Defined Networking (SDN) controllers, POX and Ryu, using Mininet for network simulation. SDN, a transformative approach to network architecture, separates the control and data planes, enabling centralized management, improved agility, and cost-effective solutions. The study evaluates key QoS parameters, including throughput, delay, and jitter, to understand the capabilities and limitations of the POX and Ryu controllers in handling traffic under diverse network topologies. The research employs a systematic methodology involving the design of custom network topologies, implementation of OpenFlow rules, and analysis of controller behavior under simulated conditions. Results reveal that while POX offers simplicity and ease of use, making it suitable for smaller-scale applications and experimentation, Ryu provides superior scalability and adaptability for more complex network environments. The findings highlight the strengths and challenges of each controller, providing valuable insights for organizations seeking to optimize SDN deployment. This study contributes to the growing body of knowledge on SDN technologies and their role in building scalable, efficient, and resilient network infrastructures.

Software Defined Network (SDN) is getting popularity both from academic and industry. Lot of researches have been made to combine SDN with future Internet paradigms to manage and control networks efficiently. SDN provides better management and control in a network through decoupling of data and control plane. Named Data Networking (NDN) is a future Internet technique with aim to replace IPv4 addressing problems. In NDN, communication between different nodes done on the basis of content names rather than IP addresses. Vehicular Ad-hoc Network (VANET) is a subtype of MANET which is also considered as a hot area for future applications. Different vehicles communicate with each other to form a network known as VANET. Communication between VANET can be done in two ways (i) Vehicle to Vehicle (V2V) (ii) Vehicle to Infrastructure (V2I). Combination of SDN and NDN techniques in future Internet can solve lot of problems which were hard to answer by considering a single technique. Security in VANET is always challenging due to unstable topology of VANET. In this paper, we merge future Internet techniques and propose a new scheme to answer timing attack problem in VANETs named as Timing Attack Prevention (TAP) protocol. Proposed scheme is evaluated through simulations which shows the superiority of proposed protocol regarding detection and mitigation of attacker vehicles as compared to normal timing attack scenario in NDN based VANET.

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

Software Defined Networking (SDN) is widely used in many practical contexts and provides a method for managing networks by separating the data plane from the control plane. However, because of its centralized control logic, SDN is particularly susceptible to Distributed Denial of Service (DDoS) attacks. In numerous studies, methods based on Machine Learning (ML) have been proposed to identify DDoS attacks in the context of SDN. However, the proposed methods are resource intensive and unreliable in a large-scale SDN where a huge amount of traffic data is produced from control and data planes. This may exhaust computational resources, deteriorate the performance of the network, or even result in the shutdown of network systems as a result of resource exhaustion. To deal with the above issues, this paper presents a real-time DDoS detection and mitigation method in a multi-controller SDN environment using cloud computing. We propose to run the Machine Learning development cycle on a secured server in a virtual machine. Then we deploy back the trained model into the SDN controllers. All the exchanges between the virtual machine and the controllers are secured. In this way, we configure these controllers to detect and mitigate DDoS in SDN in real-time. Through useful experiments, we demonstrate that our method is secure, reliable, and efficient.