Software-Defined Networking Switches for Fast Single-Link Failure Recovery

A longstanding problem in the context of computer networks is the issue of recovery from link failures. A promising solution to safeguard all single link failures (SLF) is through partial up gradation of certain IP routers (Internet Protocol(IP)) to Software Defined Networking (SDN) switches using CSA (Candidate Selection Algorithms). The resultant network comprises a combination of IP routers and SDN switches, forming a hybrid IP/SDN network. Most of the existing approaches primarily address SLFs, yet real-world scenarios may involve multiple link failures (MLF). Hence, it’s crucial to investigate CSA for Hybrid IP/SDN with MLF. In this paper, we first introduce four CSA strategies tailored for hybrid IP/SDN networks with MLF. Subsequently, we present a CSA designed to accommodate network scaling or expansion. We emphasize the advantage of CSAs based on non-shortest path approach. Additionally, we propose a budget constraint-based CSA to aid in selecting suitable candidate switches within a specified budget. We evaluate the performance of hybrid IP/SDN networks employing the proposed CSAs, considering average repair path length (AMLU) and average maximum link utilization (AMLU) in the post-recovery network across diverse real-world network topologies. It will be shown that the hybrid IP/SDN with proposed CSA for MLFs will reduce the ARPL by 31.37%, 22.15%, and 18.64%, respectively, for NSF, Attmpls, and Abilene networks.

<p>Software-Defined-Networking (SDN) simplifies the configuration complexity in the computer communication network by decoupling the control plane from the data plane in a switch. In SDN, the switch has the data plane only and is configured by the logically centralised controller which simplifies the forwarding of packets in the network. However, an SDN switch is sensitive to delay and loss of packets which significantly affects the network performance. This thesis uses queueing theory to conduct modelling and performance analysis of OpenFlow-based SDN switches. OpenFlow is the de-facto protocol for communication between an SDN switch and the controller. Using queueing theory, three aspects of packet processing in an SDN switch are explored. First, the existing research has primarily modelled the output buffer of an SDN switch using two buffer sharing mechanisms: the single shared buffer and the priority buffer. However, the effect of buffer dimensioning in these buffer sharing mechanisms has not been investigated. Buffer dimensioning helps in determining the minimum buffer capacity for a desired loss probability. The research in this thesis shows that the use of priority buffer in an SDN switch reduces the time to update flow tables than the shared buffer but at the cost of a higher buffer capacity. Second, much of the existing research has not investigated the impact of internal buffering of data packets whereby a fraction of a data packet header is sent to the controller instead of an entire data packet. To investigate the impact of internal buffering, the queueing model for an SDN switch with the internal buffer is developed. The investigation shows that at the time of congestion, the internal buffer in an SDN switch improves the network performance with lower delay and lower packet loss. Finally, existing research has focused on a software switch in SDN and very little research has studied the performance of a hardware switch. To characterise the performance of SDN-based hardware and software switches and identify the tradeoffs between them, a unified queueing model has been developed. The unified queueing model is an analytical tool for network engineers to predict delay and packet loss in their SDN deployments. The analysis shows the benefits of a hardware switch over a software switch. These benefits are lower delay and lower packet loss. However, the increasing involvement of the controller reduces the benefit of using a hardware switch, i.e. forwarding packets at the line speed rate. This research guides network designers and analysts in the selection of the shared or buffer model for an SDN switch for their desired Quality of Service (QoS). Furthermore, the developed queueing model for an SDN switch with the internal buffer studies the impact of internal buffering in an SDN switch. Finally, the unified queueing model helps in the selection of a software or hardware switch in SDN.</p>

Software Defined Networking (SDN) is disruptive networking technology which adopts a centralised framework to facilitate fine-grained network management. However security in SDN is still in its infancy and there is need for significant work to deal with different attacks in SDN. In this paper we discuss some of the possible attacks on SDN switches and propose techniques for detecting the attacks on switches. We have developed a Switch Security Application (SSA)for SDN Controller which makes use of trusted computing technology and some additional components for detecting attacks on the switches. In particular TPM attestation is used to ensure that switches are in trusted state during boot time before configuring the flow rules on the switches. The additional components are used for storing and validating messages related to the flow rule configuration of the switches. The stored information is used for generating a trusted report on the expected flow rules in the switches and using this information for validating the flow rules that are actually enforced in the switches. If there is any variation to flow rules that are enforced in the switches compared to the expected flow rules by the SSA, then, the switch is considered to be under attack and an alert is raised to the SDN Administrator. The administrator can isolate the switch from network or make use of trusted report for restoring the flow rules in the switches. We will also present a prototype implementation of our technique.

This paper proposes a Traffic Engineering (TE) scheme for routing in a target network topology that supports OpenFlow using a metric called congestion contribution and Software-Defined Networking (SDN). According to the network traffic volume has been increasing dramatically, it is clear that the congestion, which is caused by the imbalance of the traffic flow, can be occurred. Furthermore, an Interior Gateway Protocol (IGP) that is used for an Autonomous System (AS) also can cause congestion because it uses snapshot information of network topology to make the shortest path-based routing table. Due to the reasons mentioned above, much research on TE has been conducting to enhance the network performance. However, as an example of TE, the Multi-Protocol Label Switching (MPLS) using Resource Reservation Protocol (RSVP) is not flexible in reconfiguring the labeled path, and it has resource overhead that cannot be ignored. Thus, we propose a TE scheme using SDN to overcome the limitations in the target network. In order to show the feasibility of the proposed scheme, TE application predicts the bandwidth utilization for network devices in SDN networks. It also determines the near-optimized routing path for the maximization of the average bandwidth utilization with avoiding the congestion nodes. Our scheme can configure network devices (e.g., SDN switches) along the paths of traffic flows so that the SDN network can have maximum bandwidth utilization. Through experiments, it is shown that our proposed scheme can utilize the average bandwidth of the whole topology up to 66%.

Software Defined Networking (SDN) is the new promise towards an easily configured and remotely controlled network. Based on Centralized control, SDN technology has proved its positive impact on the world of network communications from different aspects. Security in SDN, as in traditional networks, is an essential feature that every communication system should possess. In this paper, we propose an SDN security design approach, which strikes a good balance between network performance and security features. We show how such an approach can be used to prevent DDoS attacks targeting either the controller or the different hosts in the network, and how to trace back the source of the attack. The solution lies in introducing a third plane, the security plane, in addition to the data plane, which is responsible for forwarding data packets between SDN switches, and parallel to the control plane, which is responsible for rule and data exchange between the switches and the SDN controller. The security plane is designed to exchange security-related data between a third party agent on the switch and a third party software module alongside the controller. Our evaluation shows the capability of the proposed system to enforce different levels of real-time user-defined security with low overhead and minimal configuration.

The rapid advancement of wireless communication is forming a hyper-connected 5G network in which billions of linked devices generate massive amounts of data. The traffic control and data forwarding functions are decoupled in software-defined networking (SDN) and allow the network to be programmable. Each switch in SDN keeps track of forwarding information in a flow table. The SDN switches must search the flow table for the flow rules that match the packets to handle the incoming packets. Due to the obvious vast quantity of data in data centres, the capacity of the flow table restricts the data plane’s forwarding capabilities. So, the SDN must handle traffic from across the whole network. The flow table depends on Ternary Content Addressable Memorable Memory (TCAM) for storing and a quick search of regulations; it is restricted in capacity owing to its elevated cost and energy consumption. Whenever the flow table is abused and overflowing, the usual regulations cannot be executed quickly. In this case, we consider low-rate flow table overflowing that causes collision flow rules to be installed and consumes excessive existing flow table capacity by delivering packets that don’t fit the flow table at a low rate. This study introduces machine learning techniques for detecting and categorizing low-rate collision flows table in SDN, using Feed Forward Neural Network (FFNN), K-Means, and Decision Tree (DT). We generate two network topologies, Fat Tree and Simple Tree Topologies, with the Mininet simulator and coupled to the OpenDayLight (ODL) controller. The efficiency and efficacy of the suggested algorithms are assessed using several assessment indicators such as success rate query, propagation delay, overall dropped packets, energy consumption, bandwidth usage, latency rate, and throughput. The findings showed that the suggested technique to tackle the flow table congestion problem minimizes the number of flows while retaining the statistical consistency of the 5G network. By putting the proposed flow method and checking whether a packet may move from point A to point B without breaking certain regulations, the evaluation tool examines every flow against a set of criteria. The FFNN with DT and K-means algorithms obtain accuracies of 96.29% and 97.51%, respectively, in the identification of collision flows, according to the experimental outcome when associated with existing methods from the literature.

Accurate traffic and latency measurements are the foundation of many network management tasks, including traffic engineering and network provision, network diagnosis and fault recovery. However, SNMP-based traffic measurement techniques in traditional IP networks only provide measurements for link loads, which cannot lead to accurate measurements. For link latency measurement, it has been shown that a traditional IP network needs to deploy a large number of monitors to achieve accurate measurements. The software-defined network (SDN) architecture opens up new opportunities to tackle the traffic matrix estimation and latency measurement problems. For the traffic estimation problem, the counter in a flow table entry of an SDN switch can directly measure the size of a matched flow. This dramatically increases the number and type of flows that can be measured accurately. For link latency measurement, SDN switches provide flexible routing and hence allow even non-shortest paths to be measured in the network. This routing flexibility can reduce the number of monitors deployed in the network to achieve a complete measurement of all the link latencies. But the additional measurement capabilities of SDNs also have limitations: the flow table entries added for measurements must be limited due to the high cost of ternary content-addressable memory (TCAM), and the amount of additional traffic for measurement should also be confined. Under these constraints, this research investigates the traffic matrix estimation and link latency measurement problems for a pure SDN network and a hybrid SDN network. A hybrid network, which consists of SDN switches and conventional routers, will exist for some time to come since it is economically impossible to replace every conventional router overnight. For the traffic matrix estimation problem, we propose a new estimation framework, which can be used in both SDNs and hybrid SDNs. Performance evaluation results show that the new framework can achieve highly accurate traffic measurement with a small number of TCAM entries. For the link latency measurement problem, we first present minimum monitor placement schemes in hybrid SDNs. It has been shown that our schemes not only reduce the number of required monitors but also guarantee full link measurements even when link weights change. We then present two time-stamp-based link latency measurement schemes for pure SDNs and show that the proposed schemes can minimize the number of consumed TCAM entries and the amount of traffic generated for measurement.

Software-defined network (SDN) is the next generation of networking architecture that is dynamic, manageable, cost-effective, and adaptable, making it ideal for the high-bandwidth, dynamic nature of today's applications. In SDN, network management is facilitated through software rather than low-level device configurations. However, the centralized control plane introduced by SDN imposes a great challenge for the network security. In this paper, we present a secure SDN structure, in which each device is managed by multiple controllers rather than a single one as in a traditional manner. It can resist Byzantine attacks on controllers and the communication links between controllers and SDN switches. Furthermore, we design a cost-efficient controller assignment algorithm to minimize the number of required controllers for a given set of switches. Extensive simulations have been conducted to show that our proposed algorithm significantly outperforms random algorithms.

USAGE : Uncertain flow graph and spatio-temporal graph convolutional network-based saturation attack detection method

In a distributed Software Defined Networking (SDN) architecture, the Quality of Service (QoS) experienced by a traffic flow through an SDN switch is primarily dependant on the SDN controller to which that switch is mapped. We propose a new controller-quality metric known as the Quality of Controller (QoC) which is defined based on the controller's reliability and response time. We model the controller reliability based on Bayesian inference while its response time is modelled as a linear approximation of the M/M/1 queue. We develop a QoC-aware approach for solving (i) the switch-controller mapping problem and, (ii) control traffic distribution among the mapped controllers. Each switch is mapped to multiple controllers to enable resilience with the switch-controller mapping and control traffic distribution based on the QoC metric which is the combined cost of controller reliability and response time. We first develop an optimization programming formulation that maximizes the minimum QoC among the set of controllers to solve the above problem. Since the optimization problem is computationally prohibitive for large networks, we develop a heuristic algorithm - Qoc-Aware switch-coNTroller Mapping (QuANTuM) - that solves the problem of switch-controller mapping and control traffic distribution in two stages such that the minimum of the controller QoC is maximized. Through simulations, we show that the heuristic results are within 18% of the optimum while achieving a fair control traffic distribution with a QoC min-max ratio of up to 95%.

Network modernization using software-defined networks (SDN) technology and network functions virtualization (NFV) involves the use of a unified physical infrastructure, based on which various applications that implement all possible network functions operate. The explosive growth of mobile devices and content, as well as virtualization and the emergence of cloud services, is forcing the network industry to rethink traditional architectures. In networks with SDN architecture, the network industry is actively developing OpenFlow Protocol to provide communication between the control layer (SDN controllers) and data transfer devices (SDN switches). This article offers possibilities for modernization optical networks using various options for implementing SDN/NFV technologies.

Legacy IP-upgraded SDN nodes tradeoff in energy-efficient hybrid IP/SDN networks

In a software-defined network (SDN), statistics information is of vital importance for different applications, such as traffic engineering, flow rerouting, and attack detection. Since some resources, e.g., ternary content addressable memory, SRAM, and computing capacity, are often limited in SDN switches, traffic measurements based on flow tables or sampling become infeasible. Sketch, a hash-based data structure, monitors every packet with fixed-size memory to provide a feasible approach of traffic measurement, but there exists a tradeoff between accuracy and memory. Currently, many efficient sketch algorithms have been designed to different purposes, but they focus on the performance and applications of one single sketch. In this paper, we present a scheme to reduce redundant flow statistics collected by sketches of different SDN switches. The proposed scheme could reduce measurement overhead in sketches, obtain more accurate estimate flow size, and find the elephant flow precisely.

In today’s networks, load balancing and priority queues in switches are used to support various quality-of-service (QoS) features and provide preferential treatment to certain types of traffic. Traditionally, network operators use ‘traceroute’ and ‘ping’ to troubleshoot load balancing and QoS problems. However, these tools are not supported by the common OpenFlow-based switches in software-defined networking (SDN). In addition, traceroute and ping have potential problems. Because load balancing mechanisms balance flows to different paths, it is impossible for these tools to send a single type of probe packet to find the forwarding paths of flows and measure latencies. Therefore, tracing flows’ real forwarding paths is needed before measuring their latencies, and path tracing and latency measurement should be jointly considered. To this end, FlowTrace is proposed to find arbitrary flow paths and measure flow latencies in OpenFlow networks. FlowTrace collects all flow entries and calculates flow paths according to the collected flow entries. However, polling flow entries from switches will induce high overhead in the control plane of SDN. Therefore, a passive flow table collecting method with zero control plane overhead is proposed to address this problem. After finding flows’ real forwarding paths, FlowTrace uses a new measurement method to measure the latencies of different flows. Results of experiments conducted in Mininet indicate that FlowTrace can correctly find flow paths and accurately measure the latencies of flows in different priority classes.

Securing middlebox policy enforcement in SDN