Policy Management in Software-Defined Networks

Operational, organizational and business challenges for network operators in the context of SDN and NFV

Currently, from the customer's opinion, the establishment and monitoring of Service Level Agreements (SLA) between cloud service consumers (CSC) and cloud service providers (CSP) is far to be ideal. This contacts require crucial importance for consumers having companies whose success is conditioned by the announced Quality of Service (QoS) that the service provider delivers. Inflexible term and price conditions, nontransparent verification of advertised service quality, and inflexible expression of SLAs represent today the most gap in terms of SLAs on the cloud market. This paper presents an approach of an autonomous framework based Agreement-Broker as a third party in the cloud market that provides a way to source out tasks regarding the management of SLAs. Thus the Agreement-Broker adds an additional transitive connection between consumers and providers without affecting any existing one. The Agreement-Broker's main purposes are: –Registering declarations in the form of established SLAs; –Giving customers the opportunity to discover provided SLAs and to easily compare them; –Notifying participating parties about agreementrelated events like creation, violation or termination Thus, the overhead for managing SLAs which causes congestion between consumers and providers is minimized for both and a higher trust is established by broker of an external entity.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

Service level agreement (SLA) is a formal contract between a service provider and a service consumer to guarantee the Quality of service (QoS) expectations, it is used in all areas of information technology, such as Cloud Computing, Internet of Things (IoT), networks and Web services. For IoT applications, the main challenges are: (1) how to describe the SLA terms, such as QoS properties, service levels, penalties in SLA violation, (2) how to monitor these terms, and (3) how to integrate an SLA into all the IoT application layers. Therefore, in this paper, we propose ML-SLA-IoT, a framework for SLA specification and monitoring. It covers the entire layers of an IoT application. It describes precisely QoS levels, provided services, and obligations. It differs from other SLA specification languages in the specification of user preferences, the use of microservices (for reusability, dynamism and ease of integration) and ML-SLA (multi-level metrics and QoS according to existing constraints and user preferences). Furthermore, ML-SLA-IoT monitors SLA terms in an automatic and decentralised manner using smart contracts and blockchain technologies without the intervention of the third-party. Finally, we present a comparative study and experiments with existing solutions regarding to some criteria for SLA specification and monitoring. Our results show that ML-SLA-IoT gives better performance in terms of dynamic pricing, obligation combination, and SLA monitoring.

The emerging networking standards such as 5G and 6G, coupled with technologies like Software Defined Networks (SDN) and Network Function Virtualization (NFV), are increasingly moving towards a multi-tenant and multi-vendor deployment model. Under these circumstances, the hardware vendors rent their networking and computation resources to multiple service providers and application developers. Such a deployment model lets various vendors collaboratively offer networking services to the tenants and the end-users at far greater efficiency and better affordability. However, the issues around trust, ownership, and data security become a concern for tenants and vendors in such multi-tenant and multi-vendor setting. In particular, the centralized nature of SDN controllers, together with the limitations of the contemporary authentication and access control mechanisms, make multi-stakeholder SDN deployments susceptible to several Sybil and trust-related exploits. We present EDISON, a blockchain-based authentication and access control framework, for multi-stakeholder SDN infrastructure that adheres to the Zero-trust security model. It allows the network vendors and third-party service providers to securely set up a service-level agreement while enabling the concerned stakeholders to audit the network operations through an end-to-end encrypted tamper-proof ledger. EDISON creates an ecosystem structured on smart contracts, wherein the network elements rented and used by the tenants interact with the services deployed in the form of contracts to enable decentralized and transparent orchestration.

The nature of computer network flash crowd traffic, which is generated by legitimate users accessing servers or other network resources are similar to the traffic generated by Distributed Denial of Service (DDoS) like attacks. With advancement in spoof packet generation tools, attacker may generate Multi-source Multi-destination Multi-protocol (MMM) traffic; characteristics of such traffic are very similar to on-going genuine/ flash crowd traffic in the network. In the case of Software Defined Network (SDN), attacker’s target is controller plane. Controller plane in SDN is a centralized processing unit of the underlying network, which manages several data planes. Controller plane frames the policies and pushes forwarding rules to the data planes. Data planes just maintain the forwarding rules. Thus by overloading the SDN controller, functionality of complete computer network will be hampered. In this paper, we have proposed Media Access Control (MAC) address based Model to Differentiate Flash crowd and Malicious traffic in SDN (MDFMS). Novelty of the proposed model is to detect, locate and mitigate the source of Traditional DDoS (T-DDoS) and MMMDDoS traffic. MDFSM has been implemented on separate machine to avoid any additional computing load on SDN controller. It also preserves the original design of the SDN architecture. Proposed model has been evaluated under various scenarios and encouraging results have been obtained to differentiate T-DDoS and MMM-DDoS from benign flash crowd traffic.

Software Defined Network (SDN) Technology made tremendous changes in networking field by controlling the hardware with remote software by decoupling data plane and control plane. The focus here is on the controller which is part of control plane. A controller is a central part of SDN; it is an intermediary between Data plane and Forwarding plane. It takes prime place in SDN architecture like Operating System in Computers. SDN Controller is a software which directs the packets using flow rules and also contains statistical information of network. The controller orchestrates the networking devices such as switches and routers by channelizing the packets. SDN controller has different flavor based on the commercial requirement achieved by including new pluggable module. This paper discusses some of the SDN Controller with their feature; the controllers are POX, NOX, Floodlight, ODL, Open Contrail. This paper also compares the characteristic of centralized and distributed controller by focusing on performance, bandwidth and round-trip time of Floodlight and Open Daylight (ODL) controller. The simulation is conducted using Mininet.

A comprehensive survey of service function chain provisioning approaches in SDN and NFV architecture

This paper introduces a model that provides reduced resource waste. A resource waste is main issue of performance of mobile grid. To solve this issue, we utilize new type network system. That is Software Defined Network(SDN). In traditional network environment, there are various network technologies on Internet. People enjoy a high speed Internet service by advanced network technologies now. However, this advanced network becomes a hurdle that the new network technology is hard to be applied. Many researchers try to overcome this problem. They introduce a new network concept that is called SDN. SDN divides a switch into a control plane and a data plane. SDN provides network administrators with more comfortable management. In addition, SDN is a variety of other benefits. These benefits are used to the mobile grid. Mobile grid has an issue of management that resources of a node are freely controlled due to unstable mobile network environment. SDN overcomes this problem using additional tag of a switch and programmable controller of own networks. In this paper, we introduce a model of mobile grid with SDN. Also, we assert benefits of mobile grid with SDN.KeywordsSoftware Defined NetworkMobile GridOptimizationResource Waste

Software middlebox-based services can be flexibly managed by software defined networking (SDN) and network function virtualization (NFV). Meanwhile, traffic routing can be simplified and the number of routing rules in the SDN-enabled switches can be reduced through the consolidated middlebox model. However, different network functions in middleboxes may alter the volume of processed traffic, so high congestion may occur in specific bottleneck links if middlebox selection and traffic routing are not well jointly planned. Besides, in a statically switch-controller configured SDN, traffic dynamics will not only affect the link load in the data plane, but also pose a challenge to controller load balancing. Therefore, it’s necessary to achieve better quality-of-service (QoS) performance in both control and data planes. In this article, we first formulate this problem as a joint traffic-aware consolidated middleboxes selection and routing (JTMSR) problem and prove its NP-hardness. Then, we design a two-phase algorithm to achieve the controller and link load balancing where the first phase is to redirect selected flows by applying wildcard rules and the second phase is to find fine-grained routing path by a rounding-based algorithm with bounded approximation factor. Finally, compared with the existing algorithms through extensive simulations, it demonstrates that our method has near-optimal controller load balancing and link load balancing performance and can improve response time by 9.7% compared with static scheme.

Software-defined networks (SDNs) are novel networking architectures that decouple the network control and forwarding functions from the data plane. Unlike traditional networking, the control logic of SDNs is implemented in a logically centralized controller which provides a global network view and open programming interface to the applications. While SDNs have become a hot topic among both academia and industry in recent years, little attention has been paid on the security aspect. In this paper, we introduce a novel attack, namely, packet injection attack, in SDNs. By maliciously injecting manipulated packets into SDNs, attackers can affect the services and networking applications in the control plane, and largely consume the resources in the data plane. The consequences could be the disruption of applications built on the top of the topology manager service and rest API, as well as a huge consumption of network resources, such as the bandwidth of the OpenFlow channel. To defend against the packet injection attack, we present PacketChecker, a lightweight extension module on SDN controllers to effectively detect and mitigate the flooding of falsified packets. We implement a prototype of PacketChecker in floodlight controller and conduct experiments to evaluate the efficiency of the defense mechanism. The evaluation shows that the PacketChecker module can effectively mitigate the attack with a minor overhead to the SDN controller.

Attack-aware Security Function Management

5G is raising high expectations, offering new avenues for research, and paving the way to a safer and highperforming set of innovative use-cases. For use-cases related for instance to Internet of Things (IoT), self-driving vehicles, or unmanned aerial vehicles (UAVs), the programming and management of the underlying network resources will be carried out in a dynamic and scalable manner. In this vein, many enabling technologies are adopted by service providers, cloud providers and enterprises, such as Software Defined Networking (SDN) and Network Function Virtualization (NFV).

In the last few years, Software Defined Networks (SDN) and Network Functions Virtualization (NFV) have been introduced in the telecommunications world as a new way to design, deploy and manage networking services. Working together, they are able to consolidate and deliver networking components using standard IT virtualization technologies making, in such a way, Telco infrastructures more flexible and adaptive in respect to the needs of both end-users, Telco operators and service providers.

Software Defined Networking (SDN) and Network Function Virtualization (NFV) are transforming Data Center (DC), Telecom, and enterprise networking. The programmability offered by P4 enables SDN to be more protocol-independent and flexible. Data Centers are increasingly adopting SmartNICs (sNICs) to accelerate packet processing that can be leveraged to support packet processing pipelines and custom Network Functions (NFs). However, there are several challenges in integrating and deploying P4 based SDN control as well as host and sNIC-based programmable NFs. These include configuration and management of the data plane components (Host and sNIC P4 switches) for the SDN control plane and effective utilization of data plane resources. P4NFV addresses these concerns and provides a unified P4 switch abstraction framework to simplify the SDN control plane, reducing management complexities, and leveraging a host-local SDN Agent to improve the overall resource utilization. The SDN agent considers the network-wide, host, and sNIC specific capabilities and constraints. Based on workload and traffic characteristics, P4NFV determines the partitioning of the P4 tables and optimal placement of NFs (P4 actions) to minimize the overall delay and maximize resource utilization. P4NFV uses Mixed Integer Linear Programming (MILP) based optimization formulation and achieves up to 2. 5X increase in system capacity while minimizing the delay experienced by flows. P4NFV considers the number of packet exchanges, flow size, and state dependency to minimize the delay imposed by data transmission over PCI Express interface.