Empowering Network Security With Programmable Switches: A Comprehensive Survey

Attack-aware Security Function Management

The discovery process of OPC Unified Architecture (OPC-UA) is well defined but lacks flexibility when implemented in large networks. While the standard provides concepts for local and global discovery services, the core assumption is that all clients and servers are aware of the discovery server(s) in the network. This dependency is a barrier for Plug-and-Play installations and is overcome by self announces via the multicast Domain Name System (mDNS), however, this scales badly with an increasing number of network nodes and deployed servers. We propose a discovery approach based on Software-Defined Networking (SDN) and Network Function Virtualization (NFV), that installs a plug-and-play mechanism for global OPC-UA discovery in modern virtualized networks.

Virtual Private LAN Services (VPLS) is an Ethernet based VPN (Virtual Private Network) service which provides protocol independent and high speed multipoint-to-multipoint connectivity. In this article, we discuss the possibility to use emerging networks concepts such as Software Defined Networking (SDN) and Network Function Virtualization (NFV) to improve the performance, flexibility and adaptability of VPLS networks. SDN and NFV based VPLS (SoftVPLS) architectures offer new features such as centralized control, network programmability and abstraction to improve the performance, flexibility and automation of traffic, security and network management functions for future VPLS networks.

Software Defined Networking (SDN) and Network Function Virtualization (NFV) are transforming Data Center (DC), Telecom, and enterprise networking. The programmability offered by P4 enables SDN to be more protocol-independent and flexible. Data Centers are increasingly adopting SmartNICs (sNICs) to accelerate packet processing that can be leveraged to support packet processing pipelines and custom Network Functions (NFs). However, there are several challenges in integrating and deploying P4 based SDN control as well as host and sNIC-based programmable NFs. These include configuration and management of the data plane components (Host and sNIC P4 switches) for the SDN control plane and effective utilization of data plane resources. P4NFV addresses these concerns and provides a unified P4 switch abstraction framework to simplify the SDN control plane, reducing management complexities, and leveraging a host-local SDN Agent to improve the overall resource utilization. The SDN agent considers the network-wide, host, and sNIC specific capabilities and constraints. Based on workload and traffic characteristics, P4NFV determines the partitioning of the P4 tables and optimal placement of NFs (P4 actions) to minimize the overall delay and maximize resource utilization. P4NFV uses Mixed Integer Linear Programming (MILP) based optimization formulation and achieves up to 2. 5X increase in system capacity while minimizing the delay experienced by flows. P4NFV considers the number of packet exchanges, flow size, and state dependency to minimize the delay imposed by data transmission over PCI Express interface.

The recent trends in software-defined networking (SDN) and network function virtualization (NFV) are boosting the advance of software-based packet processing and forwarding on commodity servers. Although performance has traditionally been the challenge of this approach, this situation changes with modern server platforms. High performance load balancers, proxies, virtual switches and other network functions can be now implemented in software and not limited to specialized commercial hardware, thus reducing cost and increasing the flexibility. In this paper we design a lossless software-based switch for high bandwidth data acquisition (DAQ) networks, using the ATLAS experiment at CERN as a case study. We prove that it can effectively solve the incast pathology arising from the many-to-one communication pattern present in DAQ networks by providing extremely high buffering capabilities. We evaluate this on a commodity server equipped with twelve 10 Gbps Ethernet interfaces providing a total bandwidth of 120 Gbps.

It is our great pleasure to welcome you to the 2018 ACM International Workshop on Security in Software Defined Networks & Network Function Virtualization - SDN-NFV Security'18. SDN-NFV Security'18 offers a unique opportunity by bringing together researchers from academic, industry, as well as government agencies to discuss security challenges faced by two emerging networking paradigms, Software-Defined Networking (SDN) and Network Function Virtualization (NFV). SDN-NFV Security'18 solicits the submission of original unpublished ideas in 6-page long papers and 4-page short papers that address the latest practices, experiences, and lessons learned on SDN and NFV security. The call for papers attracted submissions from Europe and the United States. SDN-NFV Security'18 accepted 3 full papers be presented in this workshop, after a rigorous review process (at least 4 reviews for each paper) and discussion phase. In addition, we have invited 8 papers (5 full papers and 3 short papers) from domain experts to be presented in the workshop.

In this era wireless technology gaining more popularity, people prefer wireless communication over wired communication due to mobility, scalability and ease of access. However, the traditional wireless network is complex, vendor dependent and inadequate feasibility to incorporate new services, protocols, and APIs. The rapid growth in wireless network raises many thoughtful challenges for network and telecom operators. On such grounds, Innovation of Software Defined Network (SDN) and network function virtualization (NFV) for mobile network opens a new arena of research. This research article presents future mobile Internet architecture (FMIA) with the integration of twin technologies, SDN and NFV that enable rapid access to Internet services. Moreover, the network manager can control services provided by ISPs through proposed architecture.

Software Defined Network (SDN) and Network Function Virtualization (NFV) are attracting the attention of telecom operators. The telecom environment requires a set of Carrier Grade requirements such as high availability, high throughput and low latency. SDN faces challenges to meet the Carrier Grade. Based on the JAIN SLEE component model and the Libfluid OpenFlow driver, this work proposes the CREDENCE SDN controller. Our evaluation shows that CREDENCE controller offers a higher throughput and a lower latency when is compared to ONOS and OpenDayLight.

The integration of software defined networking (SDN) and network function virtualization (NFV) is a promising approach to support flexible service deployment and provisioning. In particular, NFV enables a network service to be represented as one network service function chain, which is composed of several virtual network functions in a specific order. However, with regard to service provisioning in multidomain SDN networks, virtual network functions are deployed in several different SDN domains due to limited resource capacity of each SDN domain. It results in the network service deployment complexity increase and causes additional operating cost. On the other hand, most current network service deployment proposals are limited to static user request scenarios. How to effectively deploy network service across multiple SDN domains to satisfy dynamic service demands of end users is a challenging problem. To address the aforementioned challenge, in this paper, we study the problem of dynamic network service deployment across multiple SDN domains. Specifically, we first design a novel service deployment framework to support dynamic deployment and optimization of virtual network function in multidomain SDN networks. Then, we formulate the problem as a multiobjective optimization problem with the target of jointly minimizing resource consumption cost and operating cost. Furthermore, we transform the multiobjective optimization problem into a single objective optimization model and present an efficient heuristic service deployment approach to solve it by leveraging Dijkstra algorithm. The simulation results demonstrate that the proposed service deployment method is efficient and outperforms comparison methods in terms of service rejection ratio, resource cost, and operating cost.

5G networks represent a paradigm shift from their 4G predecessors, engineered to cater to the burgeoning demands of densely populated areas and the high data throughput requirements of the Internet of Things (IoT) and smart city infrastructures. Beyond enhancing fundamental network attributes such as reliability, availability, and security, 5G introduces architectural innovations to accommodate these advanced needs. This paper delves into the architectural nuances of 5G, focusing primarily on the Standalone (SA) deployment method, distinguished by its utilization of network slicing. This approach leverages cutting-edge virtual network technologies, including Software-Defined Networking (SDN) and Network Function Virtualization (NFV), to forge virtual network slices tailored to diverse consumer needs. Such customization is imperative for meeting the expansive and varied connectivity demands characteristic of 5G networks.To navigate the complexities of 5G architecture, this study advocates for the adoption of Reference Architectures (RAs), which provide a high-level abstraction framework for dissecting and understanding intricate systems. By proposing a model that outlines the standalone architecture of 5G networks, our research lays the groundwork for evolving this model into a comprehensive RA for 5G. This foundational work is instrumental in equipping system designers with the tools necessary for generalizing systems to manage design and deployment challenges effectively, as well as the heterogeneity inherent in system components. Additionally, our proposed model facilitates the establishment of a common vocabulary, promoting a coherent understanding of component interactions and offering a unified system perspective. Ultimately, this paper contributes a pivotal model that not only enhances our comprehension of 5G network architecture but also paves the way for future advancements in network design and deployment, promising to significantly impact the development of smart cities and IoT ecosystems.Keywords: 5G, 5G architecture, Reference architecture, patterns. Network slicing, Network Function Virtualization, Virtual Network Function.

Security functions are usually deployed on proprietary hardware, which makes the delivery of security service inflexible and of high cost. Emerging technologies such as software-defined networking and network function virtualization go in the direction of executing functions as software components in virtual machines or containers provisioned in standard hardware resources. They enable network to provide customized security service by deploying Security Service Chain (SSC), which refers to steering flow through multiple security functions in a particular order specified by individual user or application. However, SSC Deployment Problem (SSC-DP) needs to be solved. It is a challenging problem for various reasons, such as the heterogeneity of instances in terms of service capacity and resource demand. In this paper, we propose an SSC-based approach to deliver security service to users without worrying about physical locations of security functions. For SSC-DP, we present a three-phase method to solve it while optimizing network and security resource allocation. The presented method allows network to serve a large number of flows and minimizes the latency seen by flows. Comparative experiments on the fat-tree and Waxman topologies show that our method performs better than other heuristics under a wide range of network conditions.

The integration of software-defined networking (S-DN) and network function virtualization (NFV) is expected to achieve the convenient management and flexible deployment of various sophisticated network functions, and support user applications with guaranteed quality of service (QoS). In this paper, we jointly study route selection and network function placement problem. To stress the service sensitivity on delay, we formulate an optimization problem which minimizes the total end-to-end delay subject to data transmission, service requirement and various available resource constraints. As the formulated problem is an NP-hard problem, which cannot be solved easily, we transform it into three subproblems, i.e., route selection subproblem, network function placement subproblem and resource sharing subproblem of user flows, and solve the three subproblems by applying the K-shortest paths algorithm, Kuhn-Munkres (K-M) algorithm and Lagrangian dual method, respectively. Numerical results demonstrate the effectiveness of the proposed algorithm.

Multipath algorithms except Equal-Cost Multi-Path(ECMP) which has been widely used in networks are difficult to apply, because multipath provisioning is more complex at cross layers and multipath routing need to get all nodes' information. To address the dilemma, this paper proposes a multipath network virtualization implementation scheme with Software Defined Networking (SDN) and Network Function Virtualization (NFV). In this scheme, SDN schedules network resources in a global view for selecting multiple paths and computing weight of each path, and NFV provides computing and storage resources to split flow, add tag, recover flow, to name a few. This paper also proposes a multipath algorithm for elephant flow with network virtualization. Besides, we build an experimental platform based on OPNFV and SDN, and conduct experiments under this experimental platform. The results show that our proposed algorithm applied on multipath network virtualization experimental platform has superior performance than ECMP applied in networks without virtualization.

5G is raising high expectations, offering new avenues for research, and paving the way to a safer and highperforming set of innovative use-cases. For use-cases related for instance to Internet of Things (IoT), self-driving vehicles, or unmanned aerial vehicles (UAVs), the programming and management of the underlying network resources will be carried out in a dynamic and scalable manner. In this vein, many enabling technologies are adopted by service providers, cloud providers and enterprises, such as Software Defined Networking (SDN) and Network Function Virtualization (NFV).

Service Function Chaining (SFC) serves the traffic of a specific service along an ordered set of Service Functions (SFs). SFC uses Software Defined Networking (SDN) and Network Function Virtualization (NFV) technologies to reach the deployment and removal of SFC in an appropriate time with minimal costs. However, during the life time of deployed SFCs, the SFs are exposed to the risk of overloading, which results in an end-to-end packets drop and high delay at the application level. This paper presents the concept of a Scalable SFC Orchestrator capable of deploying SF Chains following the ETSI NFV architectural model, as well as orchestrating the runtime phase by rerouting the traffic to a different path in case of overload of certain SF instances. Moreover, a selection algorithm is presented to build the updated paths after scaling. The Scalable Orchestration feature is implemented and added as a main feature to an SFC Orchestrator. Furthermore, it is integrated into a current NFV architecture and evaluated in an NFV environment making use of the Fraunhofer FOKUS Open Baton toolkit in an OpenStack and Open Daylight based environment.