Curb: Trusted and Scalable Software-Defined Network Control Plane for Edge Computing

Controller-proxy: Scaling network management for large-scale SDN networks

Cloud and parallel computing are fundamental components in the processing of large data sets. Deployments of distributed computers require network infrastructure that is fast, efficient, and secure. Software Defined Networking (SDN) separates the forwarding of network data by switches (data plane) from the setting and managing of network policies (control plane). While this separation provides flexibility for setting network policies affecting the establishment of network flows in the data plane, it provides little to no fault tolerance for failures, either benign or caused by corrupted/malicious applications. Such failures can cause network flows to be incorrectly routed through the network or stop such flows altogether. Without protection against faults, cloud network providers using SDN run the risk of inefficient allocation of network resources or even data loss. Furthermore, the asynchronous nature existing protocols for SDN does not provide a mechanism for consistency in network policy updates across multiple switches.In addition, cloud and parallel applications require an efficient means for accessing local system data (input data sets, temporary storage locations, etc.). While in many cases it may be possible for a process to access this data by making calls directly to a file system (FS) kernel driver, this is not always possible (e.g. when using experimental distributed FSs where the needed libraries for accessing the FS only exist in user space).This dissertation provides a design for fault tolerance of SDN and infrastructure for advancing the performance of user space FSs. It is divided into three main parts. The first part describes a fault tolerant, distributed SDN control plane framework. The second part expands upon the fault tolerant approach to SDN control plane by providing a practical means for dynamic control plane membership as well as providing a simple mechanism for controller authentication through threshold signatures. The third part describes an efficient framework for user space FS access.This research makes three contributions. First, the design, specification, implementation, and evaluation of a method for fault tolerant SDN control plane that is inter-operable with existing control plane applications involving minimal instrumentation of the data plane runtime. Second, the design, specification, implementation and evaluation of a mechanism for dynamic SDN control plane membership that all ensure consistency of network policy updates and minimizes switch overhead through the use of distributed key generation and threshold signatures. Third, the design, specification, implementation, and evaluation of a user space FS access framework that is correct to the Portable Operating System Interface (POSIX) specification with significantly better performance over existing user space access methods, while requiring no implementation changes for application programmers.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Computer networks are the fundamental infrastructure of intelligent environments (IEs). Software defined network (SDN) is an emerging software-based network architecture that separates the control plane from data plane to facilitate dynamic network management and configuration; two important parameters which are essential in real-time IEs. This separation alleviates network administrators to implement efficient fault tolerance strategies and increasing reliability and quality of service (QoS). Hence, they can make their networks more reliable and as a result, decrease the adverse effects due to network failures. As a result, SDN is a candidate for using in new IEs such as internet of things (IoT). The control plane of SDN can be deployed on the IoT cloud server to manage the entire network. Link failure is one of the most common and critical failures in such computer networks which causes dropping of data packets and reduces network performance considerably. A survivable traffic engineering (TE) method can provide protection against link failures and heighten the reliability of data transmission. To this purpose, this paper proposes an efficient and survivable software-based TE model over SDN called EFSUTE to increase reliability in real-time IEs. EFSUTE leverages the capabilities of SDN to compute and install two disjoint paths between any source–destination pair in the network. EFSUTE models network routing as a Shared Risk Link Group problem which provides topological diversity. This policy increases the survivability by providing alternative paths between network hosts. To prove the effectiveness of EFSUTE, we conducted extensive simulations and compared it with restoration techniques. Experimental results confirm that EFSUTE can be practically used in SDN and efficiently protects the network traffics against link failures to increase safety and provides a reliable software based infrastructure with QoS for real-time IEs.

Software Defined Networking (SDN) is a new networking paradigm which decouples control plane from the forwarding plane. Even though the control plane is assumed to be logically centralized, multiple physical controllers are essential to handle the issues such as fault tolerance and load balancing, especially in wireless networks. However, the physical constraints restrict the control plane to have a global network view among the controllers, which leads to the generation of inconsistent flow-rules and, thereby, a flow-deadlock. In this paper, we identify the inconsistencies resulting from controller mismatch in a flow-path and resolve them using packet_in relay mechanism through east-west interface. We modify Optimized Link State Routing (OLSR) protocol to advertise the switch information to controllers. The performance of our scheme is tested using a wireless mesh network test-bed consisting of static and mobile nodes. The results show that our scheme provides delivery ratio greater than 0.8 in the presence of network view inconsistencies at the controller nodes, with a slight increase in controller response time.

Distributed multi-controller deployment is a promising method to achieve a scalable and reliable control plane of Software-Defined Networking (SDN). However, it brings a new challenge for balancing loads on the distributed controllers as the network traffic dynamically changes. The unbalanced load distribution on the controllers will increase response delay for processing flows and reduce the controllers'throughput. Switch migration is an effective approach to solve the problem. However, existing schemes focus only on the load balancing performance but ignore migration efficiency, which may result in high migration costs and unnecessary control overheads. This paper proposes Efficiency-Aware Switch Migration (EASM) to balance the controllers'loads and improve migration efficiency. We introduce load difference matrix and trigger factor to measure load balancing on controllers. We also introduce the migration efficiency problem, which considers load balancing rate and migration cost simultaneously to optimally migrate switches. We propose EASM to efficiently solve to the problem. The simulation results show that EASM outperforms baseline schemes by reducing the controller response time by about 21.9%, improving the controller throughput by 30.4% on average, maintaining good load balancing rate, low migration costs and migration time, when the network scale changes.

Software Defined Networking (SDN) and Network Function Virtualization (NFV) are transforming Data Center (DC), Telecom, and enterprise networking. The programmability offered by P4 enables SDN to be more protocol-independent and flexible. Data Centers are increasingly adopting SmartNICs (sNICs) to accelerate packet processing that can be leveraged to support packet processing pipelines and custom Network Functions (NFs). However, there are several challenges in integrating and deploying P4 based SDN control as well as host and sNIC-based programmable NFs. These include configuration and management of the data plane components (Host and sNIC P4 switches) for the SDN control plane and effective utilization of data plane resources. P4NFV addresses these concerns and provides a unified P4 switch abstraction framework to simplify the SDN control plane, reducing management complexities, and leveraging a host-local SDN Agent to improve the overall resource utilization. The SDN agent considers the network-wide, host, and sNIC specific capabilities and constraints. Based on workload and traffic characteristics, P4NFV determines the partitioning of the P4 tables and optimal placement of NFs (P4 actions) to minimize the overall delay and maximize resource utilization. P4NFV uses Mixed Integer Linear Programming (MILP) based optimization formulation and achieves up to 2. 5X increase in system capacity while minimizing the delay experienced by flows. P4NFV considers the number of packet exchanges, flow size, and state dependency to minimize the delay imposed by data transmission over PCI Express interface.

In today’s networks, load balancing and priority queues in switches are used to support various quality-of-service (QoS) features and provide preferential treatment to certain types of traffic. Traditionally, network operators use ‘traceroute’ and ‘ping’ to troubleshoot load balancing and QoS problems. However, these tools are not supported by the common OpenFlow-based switches in software-defined networking (SDN). In addition, traceroute and ping have potential problems. Because load balancing mechanisms balance flows to different paths, it is impossible for these tools to send a single type of probe packet to find the forwarding paths of flows and measure latencies. Therefore, tracing flows’ real forwarding paths is needed before measuring their latencies, and path tracing and latency measurement should be jointly considered. To this end, FlowTrace is proposed to find arbitrary flow paths and measure flow latencies in OpenFlow networks. FlowTrace collects all flow entries and calculates flow paths according to the collected flow entries. However, polling flow entries from switches will induce high overhead in the control plane of SDN. Therefore, a passive flow table collecting method with zero control plane overhead is proposed to address this problem. After finding flows’ real forwarding paths, FlowTrace uses a new measurement method to measure the latencies of different flows. Results of experiments conducted in Mininet indicate that FlowTrace can correctly find flow paths and accurately measure the latencies of flows in different priority classes.

For Software Defined Network(SDN), security is an important factor which affects its large-scale deployment. The existing security solutions for SDN mainly focus on the controller itself, which has to handle all the security protection task by using the programmability of network. It will undoubtedly bring the heavy burden to the controller. More devastating, once the controller itself is attacked, the entire network will be paralyzed. Motivated by this, this paper proposes a novel security protection architecture for SDN. We design a security service orchestration center in the control plane of SDN. This center physically decouples from SDN controller, and thus constructs SDN security service to defense security threats. In particular, we set up a security meta-function base which can be used for security service composition in a rule engine. The rule engine can be realized by using the optimized rule composition algorithms. Finally, a series of experimental results show that the proposed security protection architecture for SDN can achieve effective security protection with small burden of controller.

Scalable multicasting with multiple shared trees in software defined networking

Software-defined networking (SDN) has revolutionized the way networks are designed and managed, with the control plane being a critical component. The SDN control plane is responsible for managing and orchestrating network traffic flows, but its traditional static approach can be limiting in dynamic and complex network environments. This abstract explores the concept of a dynamic SDN control plane, which can adapt and respond to changing network conditions, leading to better network performance and efficiency. The dynamic control plane involves the use of machine learning algorithms, artificial intelligence, and network analytics to constantly monitor and adjust network policies in real-time. The dynamic SDN control plane empowers networks to move from a state of control to chaos, enabling greater flexibility, agility, and resilience in network management. This abstract provides insights into the potential benefits of a dynamic SDN control plane and highlights the challenges and opportunities in implementing this approach.

Security elements of data communication networks such as packet filters, firewalls, intrusion detection and prevention systems are in first line of defense against cyber security threats and various attacks such as DDoS and many others. With constantly increasing demand of compute power and grow of various cloud services, complexity of traditional networks makes it more difficult to maintain security policies in fast and safe manner. To simplify management and overcome limitations of traditional networks concept of software-defined networking (SDN) was proposed. The main idea of SDN is separation of control and data planes of devices. Combined control plane into network controller brings intelligence into network and open wider possibilities for automation. Separated data plane makes it possible for devices to run in headless mode during critical situations when control plane is not functioning. SDN also simplifies managing of security policies, it helps to ensure intime deploying and minimize possibility of mistake. However, SDN architecture has some places which can be used as main point of cyber-attack. Purpose of this paper is to describe security benefits and drawbacks of software-defined network.

Artificial intelligence based load balancing in SDN: A comprehensive survey

Traditional networks are complex and hard to manage due to many reasons such as manual configuration requirements of dedicated devices, lack of flexibility and a non-dynamic approach. To overcome these limitations and to meet the challenges of modern networks a new networking paradigm Software Defined Networking (SDN) has been introduced. SDN presents a centralized and completely dynamic environment which provides flexibility and programmability in networks. It enables the network to be controlled centrally and intelligently using multiple software applications. SDN being in its infancy, brings along new challenges. Standardization of various interfaces, scalability, compatibility of contrasting or divergent networks, and vulnerability issues are few of them. This paper discusses various vulnerabilities and possible attacks on every layer of an SDN and focuses on control plane attacks. Further, it presents a comprehensive survey on numerous attacks on the brain of an SDN i.e. the control plane along with existing solutions. The study concludes that despite the challenges that are worth debating, SDN has many characteristics that make it an ideal candidate for future networks.