HARMLESS: Cost-Effective Transitioning to SDN for Small Enterprises

Software-Defined Networking (SDN) offers a new way to operate, manage, and deploy communication networks and to overcome many long-standing problems of legacy networking. However, widespread SDN adoption has not occurred yet due to the lack of a viable incremental deployment path and the relatively immature present state of SDN-capable devices on the market. While continuously evolving software switches may alleviate the operational issues of commercial hardware-based SDN offerings, namely lagging standards-compliance, performance regressions, and poor scaling, they fail to match the cost-efficiency and port density. In this paper, we propose HARMLESS, a new SDN switch design that seamlessly adds SDN capability to legacy network gear, by emulating the OpenFlow switch OS in a separate software switch component. This way, HARMLESS enables a quick and easy leap into SDN, combining the rapid innovation and upgrade cycles of software switches with the port density and cost-efficiency of hardware-based appliances into a fully dataplane-transparent and vendor-neutral solution. HARMLESS incurs an order of magnitude smaller initial expenditure for an SDN deployment than existing turnkey vendor SDN solutions while, at the same time, yields matching, or even better, data plane performance for smaller enterprises.

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Software Defined Networking (SDN) has a potential to address a number of networking challenges, but still presents other financial and business challenges such as budget constraints, acceptability and trust amongst network operators. A hybrid SDN deployment is a conceivable solution, because it offers the benefits of SDN and traditional network capabilities, including budget constraints adaptability, falling back on time-tested traditional tools, central network programmability and will offer an organization a smooth transition to SDN. As modern-day communication has become an imperative feature of day to day business functions, there is a need to balance the network load to achieve improved network performance, minimizing delay and reduce the time taken for network response. In this paper, we develop and study multi-path load balancing in a hybrid SDN data plane. The load balancer’s performance is tested using four different hybrid SDN topologies, namely, Fat Tree, Ring, Mesh and Torus topology with the OpenDayLight controller. The main contribution of this work is a data plane congestion and link overloading load balancing testing and analysis for deployment (before or after network failure) in hybrid SDN environments. The obtained results display an improved overall network performance and reduced network delay.

<p>Software-Defined-Networking (SDN) simplifies the configuration complexity in the computer communication network by decoupling the control plane from the data plane in a switch. In SDN, the switch has the data plane only and is configured by the logically centralised controller which simplifies the forwarding of packets in the network. However, an SDN switch is sensitive to delay and loss of packets which significantly affects the network performance. This thesis uses queueing theory to conduct modelling and performance analysis of OpenFlow-based SDN switches. OpenFlow is the de-facto protocol for communication between an SDN switch and the controller. Using queueing theory, three aspects of packet processing in an SDN switch are explored. First, the existing research has primarily modelled the output buffer of an SDN switch using two buffer sharing mechanisms: the single shared buffer and the priority buffer. However, the effect of buffer dimensioning in these buffer sharing mechanisms has not been investigated. Buffer dimensioning helps in determining the minimum buffer capacity for a desired loss probability. The research in this thesis shows that the use of priority buffer in an SDN switch reduces the time to update flow tables than the shared buffer but at the cost of a higher buffer capacity. Second, much of the existing research has not investigated the impact of internal buffering of data packets whereby a fraction of a data packet header is sent to the controller instead of an entire data packet. To investigate the impact of internal buffering, the queueing model for an SDN switch with the internal buffer is developed. The investigation shows that at the time of congestion, the internal buffer in an SDN switch improves the network performance with lower delay and lower packet loss. Finally, existing research has focused on a software switch in SDN and very little research has studied the performance of a hardware switch. To characterise the performance of SDN-based hardware and software switches and identify the tradeoffs between them, a unified queueing model has been developed. The unified queueing model is an analytical tool for network engineers to predict delay and packet loss in their SDN deployments. The analysis shows the benefits of a hardware switch over a software switch. These benefits are lower delay and lower packet loss. However, the increasing involvement of the controller reduces the benefit of using a hardware switch, i.e. forwarding packets at the line speed rate. This research guides network designers and analysts in the selection of the shared or buffer model for an SDN switch for their desired Quality of Service (QoS). Furthermore, the developed queueing model for an SDN switch with the internal buffer studies the impact of internal buffering in an SDN switch. Finally, the unified queueing model helps in the selection of a software or hardware switch in SDN.</p>

Software-Defined-Network now a days prove to be a paradigm for Network industry. A legacy network is ruling the computer networks from decades. Legacy network's technologies and techniques are combined to secure network and making it more efficient for users. The SDN now a days emerging as replacing entity for traditional networks. SDN facilitates in terms of security to its attached appliance, traffic, policies, traffic flows and mainly its architecture. SDN provides a central management for its manageability. Security challenges in SDN Architecture attracts various stakeholders for migrating to it. Legacy network have been used with multiplatform (hardware, software) for attaining desired performance, task, security. The multiplatform hardware and software needs to be managed quite often for stability. This research work will explains how to migrate from Legacy Network to Software-Defined-Network (SDN) considering all its security perspective and how to eliminate Multiplatform of legacy network to SDN based architecture.

Software-defined networking (SDN) is an emerging network architecture that decouples the control plane from the data plane, enabling centralized programmability and management of networks. While SDN offers benefits like flexibility, scalability, and automation, it also introduces new security vulnerabilities. This literature review analyzes the current state of research on SDN security in three key domains – Internet of Things (IoT) environments, cloud computing, and traditional enterprise networks. A systematic review methodology was followed to search, select, and review 53 relevant studies published in the past 5 years. The analysis focuses on identifying common SDN threat vectors, security solutions proposed leveraging SDN programmability and evaluating their effectiveness based on results from simulations, testbed experiments, and initial real-world implementations. Key findings of the review include lack of authentication, susceptibility to DDoS attacks, and flow rule conflicts as major security issues in SDN across domains. Dynamic traffic monitoring, access control, policy orchestration, and virtualized security functions are commonly proposed techniques to enhance SDN security. However, limitations exist in robustness testing at scale, emerging paradigms like fog computing, and quantitatively comparing SDN security with legacy networks. As SDN adoption expands, focused efforts are needed to address these research gaps through innovations in data-driven security, coordinated security policy, and emphasizing SDN controller security. This review provides valuable insights into the current state of SDN security research and informs future efforts needed in this important area

Background & Objective: Detecting and mitigating Distributed Denial of Service (DDoS) attacks is a serious problem. In addition, new features and network deployments such as Software- Defined Networking (SDN) may open the door for new threats that did not previously exist. : Recent publications and patent are reviewed to find new techniques developed for integrating different mechanisms to secure networks against DDoS. Methods: This work presents a simple model for integrating different mechanisms to secure both SDN and legacy network in a hybrid cloud environment, it is called FocusON. It aims at mitigating DDoS attacks of a victim network. In addition, separating network monitoring from its control aims at mitigating DDoS attacks of a victim network. Traffic pattern analysis is apart from attack detection mechanism that gives a conceptual representation of a specific kind of DDoS attacks. DDoS detection is a completely automated process. Once called, for the reaction, the active response will be taken against the real IP source of the attacker. : The communication time overhead was tested in order to evaluate the remote server response time in case of deploying our proposed model mechanisms and without our proposed model. : Here we introduce a response mechanism that consists of an analysis of event logs, traffic patterns, and IP traceback. The proposed model categorizes the underlying network according to the location into a victim network and the source of attack (public cloud). Results & Conclusion:: The proposed model implemented in a hybrid cloud environment using the network of SDN and legacy network. The experimental setup was built using our network lab connected to the Amazon public cloud.

In this paper, we present a traffic engineering scheme for sustainable hybrid Software-Defined Networks (SDN) to reduce the overall energy consumption of the network and increase the amount of programmable traffic. Hybrid SDN involves both legacy and SDN switches because of the migration from a legacy network to an SDN. The primary reason for this migration is to increase the amount of programmable traffic and add flexibility to network management operations such as network monitoring, load distribution, and energy management. The energy management solutions in SDN include dynamic activation or deactivation of network elements and traffic rerouting. However, there exists a trade-off between energy-aware routing and programmable traffic, as unplanned traffic rerouting may transform programmable traffic into a non-programmable one. In this paper, we propose a scheme for dynamic activation of SDN links and optimal route selection of existing flows. In contrast to the previous works, we focus on reducing energy consumption, while maximizing the programmable traffic, as it serves the primary intent of transforming a legacy network into an SDN. The simulation results show that the proposed scheme, ETHoS, increases the energy savings by <inline-formula><tex-math notation="LaTeX">$28.91\%$</tex-math></inline-formula> compared to SENEtoR, an existing scheme.

Software defined networking (SDN), a new attempt in addressing the existing challenges in the legacy network architecture, is lime-lighted due to its simplified approach in managing the networks and its capability of programmability. In progressing with software defined networks implementation, security remains a high priority focus. The advantage of SDN itself opens a wide ground in posing new security threats and challenges. Focusing on the security of the SDN is a prime factor as it reflects on the growth of SDN technology implementation. This article focuses on the various existing security solutions available for SDN and the real challenge in securing the SDN providing the researchers a paved platform to work on further securing the networks. This article is designed with an introduction on SDN, its architecture, the available security solutions for the network, the leveraging threats and type of attack possibilities in SDN. This article concludes with the requirements of security factors and schemes in SDN.

Software defined networking (SDN) decouples the control plane from the data plane of forwarding devices. This separation provides several benefits, including the simplification of network management and control. However, due to a variety of reasons, such as budget constraints and fear of downtime, many organizations are reluctant to fully deploy SDN. Partially deploying SDN through the placement of a limited number of SDN devices among legacy (traditional) network devices, forms a so called hybrid SDN network. While hybrid SDN networks provide many of the benefits of SDN and have a wide range of applications, they also pose several challenges. These challenges have recently been addressed in a growing body of literature on hybrid SDN network structures and protocols. This paper presents a comprehensive up-to-date survey of the research and development in the field of hybrid SDN networks. We have organized the survey into five main categories, namely hybrid SDN network deployment strategies, controllers for hybrid SDN networks, protocols for hybrid SDN network management, traffic engineering mechanisms for hybrid SDN networks, as well as testing, verification, and security mechanisms for hybrid SDN networks. We thoroughly survey the existing hybrid SDN network studies according to this taxonomy and identify gaps and limitations in the existing body of research. Based on the outcomes of the existing research studies as well as the identified gaps and limitations, we derive guidelines for future research on hybrid SDN networks.

Software-defined networking (SDN) is one of the most prevailing networking paradigms in current and next-generation networks. Basically, the highly featured separation of control and data planes makes SDN a proper solution towards many practical problems that challenge legacy networks, for example, energy efficiency, dynamic network configuration, agile network measurement, and flexible network deployment. Although the SDN and its applications have been extensively studied for several years, the research of SDN security is still in its infancy. Typically, the SDN suffers from architecture defect and OpenFlow protocol loopholes such as single controller problem, deficiency of communication verification, and network resources constraint. Hence, network measurement is a fundamental technique of protecting SDN against the above security threats. Specifically, network measurement aims to understand and quantify a variety of network behaviors to facilitate network management and monitoring, anomaly detection, network troubleshooting, and the establishment of security mechanisms. In this paper, we present a systematic survey on security-aware measurement technology in SDN. In particular, we first review the basic architecture of SDN and corresponding security challenges. Then, we investigate two performance measurement techniques in SDN, namely, link latency and available bandwidth measurements. After that, we further provide a general overview of topology measurement in SDN including intradomain and interdomain topology discovering techniques. Finally, we list three interesting future directions of security-aware measurement in SDN followed by giving conclusion remarks.

Hybrid networks contain both legacy and programmable network switches and allow operators to reap the benefits of Software-defined networking (SDN) without upgrading the entire network. Previous research shows that adding SDN capabilities to switches at strategic places in a network and ensuring that each flow traverses at least one such switch is sufficient to achieve many SDN control paradigms, such as routing or access control. However, the control points are still limited to the SDN-enabled devices and operators cannot enforce fine-grained policies on the legacy paths between SDN switches.We present Telekinesis, a network controller that enables finer-grained routing control over legacy paths in hybrid networks using OpenFlow. To update routing entries in legacy switches, we introduce a new flow control primitive, LegacyFlowMod. LegacyFlowMod uses OpenFlow's PacketOut function to send a special packet on a specific interface of a legacy switch and remotely manipulate the forwarding entry associated with the source of the packet. Using simulations on random network topologies with varying degrees of OpenFlow deployment, we show that Telekinesis can provide more diverse path control than an OpenFlow-only controller: even when only 20% of switches are OpenFlow-enabled, we can update 70% of the paths.

The maturity of Software Defined Network (SDN) and network virtualization has inspired the development of software switch. This paper studies the behavior of soft switch in network virtualization environment. We investigate main performance factors and evaluate their impacts. Based on these measurements, we extend resource allocation among multiple soft switch instances with consideration of topology design. Simulation results show that proper coordination between resource allocation and topology greatly improves performance.

InfiniBand is the de facto networking technology for commodity HPC clusters and has been widely deployed. However, most production large-scale InfiniBand clusters use simple routing schemes such as the destination-mod-k routing to route traffic, which may result in degraded communication performance. In this work, we investigate using the OpenFlow-style Software-Defined Networking (SDN) technology to overcome the routing deficiency in InfiniBand. We design an enhanced InfiniBand with OpenFlow-style SDN capability and demonstrate a use case that illustrates how the SDN capability can be exploited in HPC clusters to improve the system and application performance. Finally, we quantify the potential benefits of InfiniBand with OpenFlow-style SDN capability in balancing the network load by simulating job traces from production HPC clusters. The results indicate that InfiniBand with SDN capability can achieve much better network load balancing than traditional InfiniBand for HPC clusters.

This article addresses the joint switch and controller placement problem in a hybrid software-defined network (SDN), which is an intermediate step of transforming a traditional backbone network into a pure SDN. For a hybrid SDN, the quality of service (QoS) is a primary concern for ensuring service guarantee of a traditional network, while providing additional benefits of softwarization. In the SDN, the positions of SDN controllers determine the QoS parameters, such as network throughput and flow processing delays. Many existing solutions determine the controller locations to optimize the latency of network links and control plane load. However, there is a need to address the problem considering additional aspects of the hybrid SDN, such as SDN switch placement and incremental upgrades. In this article, we propose a priority-based SDN switch placement approach and an incremental controller placement approach for the hybrid SDN. Simulation results depict that the proposed scheme increases programmable traffic by 9.90% compared to the existing MapFirst scheme when the switch upgrade budget is <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">${\$}$</tex-math></inline-formula> 400 K. The proposed scheme decreases QoS violation by 20.89% compared to the Greedy approach with 0.3 million flows.