Securing middlebox policy enforcement in SDN

Software Defined Networking (SDN) is disruptive networking technology which adopts a centralised framework to facilitate fine-grained network management. However security in SDN is still in its infancy and there is need for significant work to deal with different attacks in SDN. In this paper we discuss some of the possible attacks on SDN switches and propose techniques for detecting the attacks on switches. We have developed a Switch Security Application (SSA)for SDN Controller which makes use of trusted computing technology and some additional components for detecting attacks on the switches. In particular TPM attestation is used to ensure that switches are in trusted state during boot time before configuring the flow rules on the switches. The additional components are used for storing and validating messages related to the flow rule configuration of the switches. The stored information is used for generating a trusted report on the expected flow rules in the switches and using this information for validating the flow rules that are actually enforced in the switches. If there is any variation to flow rules that are enforced in the switches compared to the expected flow rules by the SSA, then, the switch is considered to be under attack and an alert is raised to the SDN Administrator. The administrator can isolate the switch from network or make use of trusted report for restoring the flow rules in the switches. We will also present a prototype implementation of our technique.

In this paper, we consider IP fast recovery from single-link failures in a given network topology. The basic idea is to replace some existing routers with a designated switch. When a link fails, the affected router will send all the affected traffic to the designated switch (through pre-configured IP tunnels), which will deliver the affected traffic to its destination without using the failed link. The goal of the approach is to achieve faster failure recovery than traditional routing protocols that employ reactive computing upon link failures. Software-Defined Networking (SDN) switches can serve as the designated switches because they can flexibly redirect affected traffic to other routes, instead of only to the shortest paths in the network. However, SDN switches are very expensive. Our objective is to minimize the number of SDN switches needed and to guarantee that the network can still recover from any single-link failure. For networks with uniform link costs, we show that using normal non-SDN switches with IP tunneling capability as designated switches can guarantee recovery from any single-link failure. For networks with general link costs, we find that not all single-link failures can be recovered by using non-SDN switches as designated switches; by using SDN switches only when necessary, we can reduce the total number of SDN switches needed compared to an existing work. We conduct extensive simulations to verify our proposed approaches.

<p>Software-Defined-Networking (SDN) simplifies the configuration complexity in the computer communication network by decoupling the control plane from the data plane in a switch. In SDN, the switch has the data plane only and is configured by the logically centralised controller which simplifies the forwarding of packets in the network. However, an SDN switch is sensitive to delay and loss of packets which significantly affects the network performance. This thesis uses queueing theory to conduct modelling and performance analysis of OpenFlow-based SDN switches. OpenFlow is the de-facto protocol for communication between an SDN switch and the controller. Using queueing theory, three aspects of packet processing in an SDN switch are explored. First, the existing research has primarily modelled the output buffer of an SDN switch using two buffer sharing mechanisms: the single shared buffer and the priority buffer. However, the effect of buffer dimensioning in these buffer sharing mechanisms has not been investigated. Buffer dimensioning helps in determining the minimum buffer capacity for a desired loss probability. The research in this thesis shows that the use of priority buffer in an SDN switch reduces the time to update flow tables than the shared buffer but at the cost of a higher buffer capacity. Second, much of the existing research has not investigated the impact of internal buffering of data packets whereby a fraction of a data packet header is sent to the controller instead of an entire data packet. To investigate the impact of internal buffering, the queueing model for an SDN switch with the internal buffer is developed. The investigation shows that at the time of congestion, the internal buffer in an SDN switch improves the network performance with lower delay and lower packet loss. Finally, existing research has focused on a software switch in SDN and very little research has studied the performance of a hardware switch. To characterise the performance of SDN-based hardware and software switches and identify the tradeoffs between them, a unified queueing model has been developed. The unified queueing model is an analytical tool for network engineers to predict delay and packet loss in their SDN deployments. The analysis shows the benefits of a hardware switch over a software switch. These benefits are lower delay and lower packet loss. However, the increasing involvement of the controller reduces the benefit of using a hardware switch, i.e. forwarding packets at the line speed rate. This research guides network designers and analysts in the selection of the shared or buffer model for an SDN switch for their desired Quality of Service (QoS). Furthermore, the developed queueing model for an SDN switch with the internal buffer studies the impact of internal buffering in an SDN switch. Finally, the unified queueing model helps in the selection of a software or hardware switch in SDN.</p>

Software Defined Networking (SDN) is the new promise towards an easily configured and remotely controlled network. Based on Centralized control, SDN technology has proved its positive impact on the world of network communications from different aspects. Security in SDN, as in traditional networks, is an essential feature that every communication system should possess. In this paper, we propose an SDN security design approach, which strikes a good balance between network performance and security features. We show how such an approach can be used to prevent DDoS attacks targeting either the controller or the different hosts in the network, and how to trace back the source of the attack. The solution lies in introducing a third plane, the security plane, in addition to the data plane, which is responsible for forwarding data packets between SDN switches, and parallel to the control plane, which is responsible for rule and data exchange between the switches and the SDN controller. The security plane is designed to exchange security-related data between a third party agent on the switch and a third party software module alongside the controller. Our evaluation shows the capability of the proposed system to enforce different levels of real-time user-defined security with low overhead and minimal configuration.

A longstanding problem in the context of computer networks is the issue of recovery from link failures. A promising solution to safeguard all single link failures (SLF) is through partial up gradation of certain IP routers (Internet Protocol(IP)) to Software Defined Networking (SDN) switches using CSA (Candidate Selection Algorithms). The resultant network comprises a combination of IP routers and SDN switches, forming a hybrid IP/SDN network. Most of the existing approaches primarily address SLFs, yet real-world scenarios may involve multiple link failures (MLF). Hence, it’s crucial to investigate CSA for Hybrid IP/SDN with MLF. In this paper, we first introduce four CSA strategies tailored for hybrid IP/SDN networks with MLF. Subsequently, we present a CSA designed to accommodate network scaling or expansion. We emphasize the advantage of CSAs based on non-shortest path approach. Additionally, we propose a budget constraint-based CSA to aid in selecting suitable candidate switches within a specified budget. We evaluate the performance of hybrid IP/SDN networks employing the proposed CSAs, considering average repair path length (AMLU) and average maximum link utilization (AMLU) in the post-recovery network across diverse real-world network topologies. It will be shown that the hybrid IP/SDN with proposed CSA for MLFs will reduce the ARPL by 31.37%, 22.15%, and 18.64%, respectively, for NSF, Attmpls, and Abilene networks.

Accurate traffic and latency measurements are the foundation of many network management tasks, including traffic engineering and network provision, network diagnosis and fault recovery. However, SNMP-based traffic measurement techniques in traditional IP networks only provide measurements for link loads, which cannot lead to accurate measurements. For link latency measurement, it has been shown that a traditional IP network needs to deploy a large number of monitors to achieve accurate measurements. The software-defined network (SDN) architecture opens up new opportunities to tackle the traffic matrix estimation and latency measurement problems. For the traffic estimation problem, the counter in a flow table entry of an SDN switch can directly measure the size of a matched flow. This dramatically increases the number and type of flows that can be measured accurately. For link latency measurement, SDN switches provide flexible routing and hence allow even non-shortest paths to be measured in the network. This routing flexibility can reduce the number of monitors deployed in the network to achieve a complete measurement of all the link latencies. But the additional measurement capabilities of SDNs also have limitations: the flow table entries added for measurements must be limited due to the high cost of ternary content-addressable memory (TCAM), and the amount of additional traffic for measurement should also be confined. Under these constraints, this research investigates the traffic matrix estimation and link latency measurement problems for a pure SDN network and a hybrid SDN network. A hybrid network, which consists of SDN switches and conventional routers, will exist for some time to come since it is economically impossible to replace every conventional router overnight. For the traffic matrix estimation problem, we propose a new estimation framework, which can be used in both SDNs and hybrid SDNs. Performance evaluation results show that the new framework can achieve highly accurate traffic measurement with a small number of TCAM entries. For the link latency measurement problem, we first present minimum monitor placement schemes in hybrid SDNs. It has been shown that our schemes not only reduce the number of required monitors but also guarantee full link measurements even when link weights change. We then present two time-stamp-based link latency measurement schemes for pure SDNs and show that the proposed schemes can minimize the number of consumed TCAM entries and the amount of traffic generated for measurement.

In a software-defined network (SDN), statistics information is of vital importance for different applications, such as traffic engineering, flow rerouting, and attack detection. Since some resources, e.g., ternary content addressable memory, SRAM, and computing capacity, are often limited in SDN switches, traffic measurements based on flow tables or sampling become infeasible. Sketch, a hash-based data structure, monitors every packet with fixed-size memory to provide a feasible approach of traffic measurement, but there exists a tradeoff between accuracy and memory. Currently, many efficient sketch algorithms have been designed to different purposes, but they focus on the performance and applications of one single sketch. In this paper, we present a scheme to reduce redundant flow statistics collected by sketches of different SDN switches. The proposed scheme could reduce measurement overhead in sketches, obtain more accurate estimate flow size, and find the elephant flow precisely.

The rapid advancement of wireless communication is forming a hyper-connected 5G network in which billions of linked devices generate massive amounts of data. The traffic control and data forwarding functions are decoupled in software-defined networking (SDN) and allow the network to be programmable. Each switch in SDN keeps track of forwarding information in a flow table. The SDN switches must search the flow table for the flow rules that match the packets to handle the incoming packets. Due to the obvious vast quantity of data in data centres, the capacity of the flow table restricts the data plane’s forwarding capabilities. So, the SDN must handle traffic from across the whole network. The flow table depends on Ternary Content Addressable Memorable Memory (TCAM) for storing and a quick search of regulations; it is restricted in capacity owing to its elevated cost and energy consumption. Whenever the flow table is abused and overflowing, the usual regulations cannot be executed quickly. In this case, we consider low-rate flow table overflowing that causes collision flow rules to be installed and consumes excessive existing flow table capacity by delivering packets that don’t fit the flow table at a low rate. This study introduces machine learning techniques for detecting and categorizing low-rate collision flows table in SDN, using Feed Forward Neural Network (FFNN), K-Means, and Decision Tree (DT). We generate two network topologies, Fat Tree and Simple Tree Topologies, with the Mininet simulator and coupled to the OpenDayLight (ODL) controller. The efficiency and efficacy of the suggested algorithms are assessed using several assessment indicators such as success rate query, propagation delay, overall dropped packets, energy consumption, bandwidth usage, latency rate, and throughput. The findings showed that the suggested technique to tackle the flow table congestion problem minimizes the number of flows while retaining the statistical consistency of the 5G network. By putting the proposed flow method and checking whether a packet may move from point A to point B without breaking certain regulations, the evaluation tool examines every flow against a set of criteria. The FFNN with DT and K-means algorithms obtain accuracies of 96.29% and 97.51%, respectively, in the identification of collision flows, according to the experimental outcome when associated with existing methods from the literature.

USAGE : Uncertain flow graph and spatio-temporal graph convolutional network-based saturation attack detection method

As a method for configuring firewalls, systems that combine Intrusion Detection Systems (IDS) with Software-Defined Networking (SDN) have attracted attention. However, in such systems, since the IDS is responsible only for attack detection and the blocking function is separated and handled by the SDN switch, there is a delay before malicious traffic is actually blocked. This delay consists of the time required for the IDS to detect the attack and to notify the SDN switch, allowing attacks to pass through during this period. This problem can be addressed by replacing the IDS with an Intrusion Prevention System (IPS), which integrates both attack detection and blocking. However, this change leads to a degradation in system performance due to the waiting time for traffic inspection by the IPS. In this research, we introduce two acceleration methods into the system to mitigate the performance degradation caused by replacing IDS with IPS: Benign Flow Bypass and DoS Blocking Offload. As a result of the evaluation, we confirmed the effectiveness of each proposed method. Furthermore, by combining the benign flow bypass and the DoS blocking offload, the system achieved 1.81 times higher performance under DoS attacks compared to the case without any acceleration methods.

Software-defined network (SDN) is the next generation of networking architecture that is dynamic, manageable, cost-effective, and adaptable, making it ideal for the high-bandwidth, dynamic nature of today's applications. In SDN, network management is facilitated through software rather than low-level device configurations. However, the centralized control plane introduced by SDN imposes a great challenge for the network security. In this paper, we present a secure SDN structure, in which each device is managed by multiple controllers rather than a single one as in a traditional manner. It can resist Byzantine attacks on controllers and the communication links between controllers and SDN switches. Furthermore, we design a cost-efficient controller assignment algorithm to minimize the number of required controllers for a given set of switches. Extensive simulations have been conducted to show that our proposed algorithm significantly outperforms random algorithms.

This paper proposes a Traffic Engineering (TE) scheme for routing in a target network topology that supports OpenFlow using a metric called congestion contribution and Software-Defined Networking (SDN). According to the network traffic volume has been increasing dramatically, it is clear that the congestion, which is caused by the imbalance of the traffic flow, can be occurred. Furthermore, an Interior Gateway Protocol (IGP) that is used for an Autonomous System (AS) also can cause congestion because it uses snapshot information of network topology to make the shortest path-based routing table. Due to the reasons mentioned above, much research on TE has been conducting to enhance the network performance. However, as an example of TE, the Multi-Protocol Label Switching (MPLS) using Resource Reservation Protocol (RSVP) is not flexible in reconfiguring the labeled path, and it has resource overhead that cannot be ignored. Thus, we propose a TE scheme using SDN to overcome the limitations in the target network. In order to show the feasibility of the proposed scheme, TE application predicts the bandwidth utilization for network devices in SDN networks. It also determines the near-optimized routing path for the maximization of the average bandwidth utilization with avoiding the congestion nodes. Our scheme can configure network devices (e.g., SDN switches) along the paths of traffic flows so that the SDN network can have maximum bandwidth utilization. Through experiments, it is shown that our proposed scheme can utilize the average bandwidth of the whole topology up to 66%.

Network modernization using software-defined networks (SDN) technology and network functions virtualization (NFV) involves the use of a unified physical infrastructure, based on which various applications that implement all possible network functions operate. The explosive growth of mobile devices and content, as well as virtualization and the emergence of cloud services, is forcing the network industry to rethink traditional architectures. In networks with SDN architecture, the network industry is actively developing OpenFlow Protocol to provide communication between the control layer (SDN controllers) and data transfer devices (SDN switches). This article offers possibilities for modernization optical networks using various options for implementing SDN/NFV technologies.

Legacy IP-upgraded SDN nodes tradeoff in energy-efficient hybrid IP/SDN networks

Cyber attacks are a major concern for network administrators as the occurrences of such events are continuously increasing on the Internet. Software-defined networks (SDN) enable many management applications, but they may also become targets for attackers. Due to the separation of the data plane and the control plane, the controller appears as a new element in SDN networks, allowing centralized control of the network, becoming a strategic target in carrying out an attack. According to reports generated by security labs, the frequency of the distributed denial of service (DDoS) attacks has seen an increase in recent years, characterizing a major threat to the SDN. However, few research papers address the prevention of DDoS attacks on SDN. Therefore, this work presents a Systematic Mapping of Literature, aiming at identifying, classifying, and thus disseminating current research studies that propose techniques and methods for preventing DDoS attacks in SDN. When answering these questions, it was determined that the SDN controller was vulnerable to possible DDoS attacks. No prevention methods were found in the literature for the first phase of the attack (when attackers try to deceive users and infect the host). Therefore, the security of software-defined networks still needs improvement over DDoS attacks, despite the evident risk of an attack targeting the SDN controller.