Virtual Slicing: Achieving Control Plane Availability and Traffic Engineering Efficiency in Data Centers

Controller-proxy: Scaling network management for large-scale SDN networks

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

We present a control plane architecture to enable software-addressable optical acceleration from the application layer. The architecture is experimentally examined on a cluster-computing test-bed by enabling physical layer optical multicasting on-demand for the application layer to achieve non-blocking performance.

A survey on architectures and energy efficiency in Data Center Networks

Multi-tenancy is a key feature of modern data centers. It allows for the existence of multiple independent virtual infrastructures, called virtual slices, on top of the same physical infrastructure, each of them specially tailored to the tenants' needs. In such a scenario, an optimal mapping of the virtual slices plays a capital role toward an efficient utilization of the data center network resources, potentially saving costs for the data center owner. However, due to the increasing trend of bringing optics to data center networks, specific virtual slice mapping mechanisms accounting for the particularities of the optical medium (e.g., wavelength continuity constraint) have to be investigated. For this, we present an integer linear programming (ILP) model for optimally mapping a set of virtual slices from different tenants in a hybrid optical circuit switching (OCS)/optical packet switching (OPS) data center network with the aim to minimize the necessary optical transponders to be equipped in the network. Additionally, we also present a lightweight heuristic for the cases in which the ILP model scalability is compromised. The benefits of the proposals are highlighted by benchmarking them against a pure OCS solution through extensive simulations.

Software Defined Network (SDN) is getting popularity both from academic and industry. Lot of researches have been made to combine SDN with future Internet paradigms to manage and control networks efficiently. SDN provides better management and control in a network through decoupling of data and control plane. Named Data Networking (NDN) is a future Internet technique with aim to replace IPv4 addressing problems. In NDN, communication between different nodes done on the basis of content names rather than IP addresses. Vehicular Ad-hoc Network (VANET) is a subtype of MANET which is also considered as a hot area for future applications. Different vehicles communicate with each other to form a network known as VANET. Communication between VANET can be done in two ways (i) Vehicle to Vehicle (V2V) (ii) Vehicle to Infrastructure (V2I). Combination of SDN and NDN techniques in future Internet can solve lot of problems which were hard to answer by considering a single technique. Security in VANET is always challenging due to unstable topology of VANET. In this paper, we merge future Internet techniques and propose a new scheme to answer timing attack problem in VANETs named as Timing Attack Prevention (TAP) protocol. Proposed scheme is evaluated through simulations which shows the superiority of proposed protocol regarding detection and mitigation of attacker vehicles as compared to normal timing attack scenario in NDN based VANET.

In recent years, SDN has evolved as a promising alternative to the traditional networking paradigm. This is because the traditional network is decentralized, making it difficult to manage and provide trouble-shooting. SDN is an approach to network management whereby the forwarding process of the data plane (DP) is disassociated from the control plane (CP). The CP is responsible for decision-making. SDN centrally control the network infrastructure and make it programmable. Communication between the two planes (data and control) is carried out by the OpenFlow (OF) protocol. The deployment of SDN was initiated by Mr. Matrin Casado and his research team in 2008. The original projects developed at Stanford University were SANE and ETHANE. Security reports and web articles suggest that SDN (Software Defined Network) has the caliber to defend DDoS attacks. The year 2017 has been declared as the year of SDN adaption and DDoS mitigation. The initial effort in the direction of compiling the detection and mitigation approaches has been done in (Dayal et al., 2016). Recently a similar effort has been done in (Rochak et al., 2019). The CP of SDN has a complete visibility of the network which makes traffic monitoring feasible. Moreover, SDN open flow switches contain forwarding logic only; decision-making capability is softwarized at 58controller. This helps the controller to instruct and configure the switches with new flow rules which the switches follow. This facilitates the network admins to detect and mitigate these attacks easily. SDN have gained momentum among the possible solutions of DDoS attacks due to its decentralized nature of network management, but solutions come with its repercussions. The centralization and open architecture framework makes SDN difficult for widespread adaptation. The chapter begins with an introduction to DDoS attacks and its classification such as volumetric attack, protocol exploitation attack and application attack. In the next section, we discuss the possible DDoS attacks over SDN framework. We have categorized the vulnerability into three classes: DDoS attack on data, control, and application planes (APs). The DDoS attack on DP can further be classified into TCAM exhaustion, switch DDoS, ICMP flood, TCP flood, TCP_SYN flood, etc. We would discuss Resource depletion, OF bandwidth exhaustion, amplification attacks in DDoS attack over CP. HTTP flooding and Slowloris attack has been discussed in DDoS attack over AP. The next section highlights the working of attack tools used in performing DDoS attacks. Various DDoS tools have been widely exploited to render DDoS attacks and facilitate attackers to carry out dangerous attack on target; here target may be network resources, server resources, or applications. The fourth section focuses on the state-of-the-art for detection and mitigation approaches of DDoS attacks. Detection approaches are classified into statistical, policy, and machine learning-based approaches. DDoS mitigation OF switches, including Alcatel Lucent’s OmniSwitch, Brocade’s MLXe series routers, and applications such as DefensePro by Radware that are available in market; also depend on the statistical threshold to detect the DDoS attack. In addition, this section also incorporates a brief analysis of the previous defense mechanism of the last 10 years and analyzes and compares the products of different security vendors like Cloudflare, Radware, Akamai, Arbor, Nexusguard, etc.

Computer networks are the fundamental infrastructure of intelligent environments (IEs). Software defined network (SDN) is an emerging software-based network architecture that separates the control plane from data plane to facilitate dynamic network management and configuration; two important parameters which are essential in real-time IEs. This separation alleviates network administrators to implement efficient fault tolerance strategies and increasing reliability and quality of service (QoS). Hence, they can make their networks more reliable and as a result, decrease the adverse effects due to network failures. As a result, SDN is a candidate for using in new IEs such as internet of things (IoT). The control plane of SDN can be deployed on the IoT cloud server to manage the entire network. Link failure is one of the most common and critical failures in such computer networks which causes dropping of data packets and reduces network performance considerably. A survivable traffic engineering (TE) method can provide protection against link failures and heighten the reliability of data transmission. To this purpose, this paper proposes an efficient and survivable software-based TE model over SDN called EFSUTE to increase reliability in real-time IEs. EFSUTE leverages the capabilities of SDN to compute and install two disjoint paths between any source–destination pair in the network. EFSUTE models network routing as a Shared Risk Link Group problem which provides topological diversity. This policy increases the survivability by providing alternative paths between network hosts. To prove the effectiveness of EFSUTE, we conducted extensive simulations and compared it with restoration techniques. Experimental results confirm that EFSUTE can be practically used in SDN and efficiently protects the network traffics against link failures to increase safety and provides a reliable software based infrastructure with QoS for real-time IEs.

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Software Defined Networking (SDN) is the more reliable and flexible networking architecture. Due to its programmable nature, it is getting more popular in every research domain of Computing. Moreover, Named Data Networking (NDN) architecture is also more beneficial and emerging technology of Internet. NDN focuses on the content name instead of its location and replaces the usage of IP addresses. Lot of research has been made to integrate SDN and NDN due to their benefits of better management-ability, flexibility, less complexity, centralized control, decoupled control and data planes etc. Mobile Ad Hoc Network (MANET) is also getting more popular due to huge advancement in Mobile communication devices. Combining SDN and NDN in MANET will resolve lots of problems (i.e. forwarding, mobility, management etc.) which are difficult to tackle with single architecture. Broadcast Storm is always a challenging issue in Ad Hoc networks like MANET. In this paper, we proposed a Controller based Selective Forwarding (CSF) scheme by merging SDN, NDN and MANET to overcome the Broadcast Storm Problem (BSP) and other issues caused by BSP. CSF is evaluated using different simulation parameters which shows superiority over the Native ND-MANET in reference to BSP.

New and emerging use cases, such as the interconnection of geographically distributed data centers (DCs), are drawing attention to the requirement for dynamic end-to-end service provisioning, spanning multiple and heterogeneous optical network domains. This heterogeneity is, not only due to the diverse data transmission and switching technologies, but also due to the different options of control plane techniques. In light of this, the problem of heterogeneous control plane interworking needs to be solved, and in particular, the solution must address the specific issues of multi-domain networks, such as limited domain topology visibility, given the scalability and confidentiality constraints. In this article, some of the recent activities regarding the Software-Defined Networking (SDN) orchestration are reviewed to address such a multi-domain control plane interworking problem. Specifically, three different models, including the single SDN controller model, multiple SDN controllers in mesh, and multiple SDN controllers in a hierarchical setting, are presented for the DC interconnection network with multiple SDN/ OpenFlow domains or multiple OpenFlow/ Generalized Multi-Protocol Label Switching (GMPLS) heterogeneous domains. In addition, two concrete implementations of the orchestration architectures are detailed, showing the overall feasibility and procedures of SDN orchestration for the end-to-end service provisioning in multi-domain data center optical networks.

Cloud and parallel computing are fundamental components in the processing of large data sets. Deployments of distributed computers require network infrastructure that is fast, efficient, and secure. Software Defined Networking (SDN) separates the forwarding of network data by switches (data plane) from the setting and managing of network policies (control plane). While this separation provides flexibility for setting network policies affecting the establishment of network flows in the data plane, it provides little to no fault tolerance for failures, either benign or caused by corrupted/malicious applications. Such failures can cause network flows to be incorrectly routed through the network or stop such flows altogether. Without protection against faults, cloud network providers using SDN run the risk of inefficient allocation of network resources or even data loss. Furthermore, the asynchronous nature existing protocols for SDN does not provide a mechanism for consistency in network policy updates across multiple switches.In addition, cloud and parallel applications require an efficient means for accessing local system data (input data sets, temporary storage locations, etc.). While in many cases it may be possible for a process to access this data by making calls directly to a file system (FS) kernel driver, this is not always possible (e.g. when using experimental distributed FSs where the needed libraries for accessing the FS only exist in user space).This dissertation provides a design for fault tolerance of SDN and infrastructure for advancing the performance of user space FSs. It is divided into three main parts. The first part describes a fault tolerant, distributed SDN control plane framework. The second part expands upon the fault tolerant approach to SDN control plane by providing a practical means for dynamic control plane membership as well as providing a simple mechanism for controller authentication through threshold signatures. The third part describes an efficient framework for user space FS access.This research makes three contributions. First, the design, specification, implementation, and evaluation of a method for fault tolerant SDN control plane that is inter-operable with existing control plane applications involving minimal instrumentation of the data plane runtime. Second, the design, specification, implementation and evaluation of a mechanism for dynamic SDN control plane membership that all ensure consistency of network policy updates and minimizes switch overhead through the use of distributed key generation and threshold signatures. Third, the design, specification, implementation, and evaluation of a user space FS access framework that is correct to the Portable Operating System Interface (POSIX) specification with significantly better performance over existing user space access methods, while requiring no implementation changes for application programmers.

Software Defined Networking (SDN) and Network Function Virtualization (NFV) are transforming Data Center (DC), Telecom, and enterprise networking. The programmability offered by P4 enables SDN to be more protocol-independent and flexible. Data Centers are increasingly adopting SmartNICs (sNICs) to accelerate packet processing that can be leveraged to support packet processing pipelines and custom Network Functions (NFs). However, there are several challenges in integrating and deploying P4 based SDN control as well as host and sNIC-based programmable NFs. These include configuration and management of the data plane components (Host and sNIC P4 switches) for the SDN control plane and effective utilization of data plane resources. P4NFV addresses these concerns and provides a unified P4 switch abstraction framework to simplify the SDN control plane, reducing management complexities, and leveraging a host-local SDN Agent to improve the overall resource utilization. The SDN agent considers the network-wide, host, and sNIC specific capabilities and constraints. Based on workload and traffic characteristics, P4NFV determines the partitioning of the P4 tables and optimal placement of NFs (P4 actions) to minimize the overall delay and maximize resource utilization. P4NFV uses Mixed Integer Linear Programming (MILP) based optimization formulation and achieves up to 2. 5X increase in system capacity while minimizing the delay experienced by flows. P4NFV considers the number of packet exchanges, flow size, and state dependency to minimize the delay imposed by data transmission over PCI Express interface.

One of the main control tasks in a computer network is to organize an effective system of information delivery; this task is of particular relevance in the software defined network. Conventional routing tools do not meet the requirements to service quality and the requirements for equitable distribution of congestion along communication channels. Routing in conventional networks is performed by the shortest path search based on a specified parameter, but these tools do not provide sufficient agility when changing routes in the network. Another drawback is the need to transmit regular updates of routing information by passing the service traffic, thereby dramatically increasing the congestion and reducing the throughput. At present, the most effective way to ensure the assigned quality of service parameters, as well as a promising solution to organize efficient routing under conditions of uncertainty, is a software defined network. This new networking paradigm makes it possible to simplify the process of managing the network, to significantly enhance the use of network resources, and to reduce operating costs. One of the main advantages of such a network is control at the upper levels of the reference model, which makes it possible to simplify both the process of network management and the process to manage traffic in corporate networks and data center networks. A new approach to traffic design in a software defined network has been proposed that employs the making-decision theory oriented towards routing exactly in such networks. If there is a «problematic area» and there is the need to overcome it, the decision-making theory under conditions of uncertainty is used, since the probability of selecting the best way to circumvent it accounts for the patterns in transmitted traffic. Such a method makes it possible to reduce the loss of inelastic traffic that is an important component of the overall amount of transmitted information. From a practical point of view, the algorithm constructed in this work, when compared to known algorithms for traffic engineering, improves the quality of service in software defined networks

Software-Defined Networking (SDN) is a networking design approach, which separates the data plane from the control plane, providing the network with certain benefits due to centralized programmatic control. SDN provides a centralized view and enables management of the entire network. It offers flexibility in configuration, reduces time to deploy, provides automation and facilitates building a network without requiring the knowledge of any vendor-specific software/hardware. SDN offers the datacenter network benefits such as improving traffic and security management as well as providing a scalable infrastructure. Load balancing enhances the performance of the network by distributing traffic among servers and therefore preventing congestion and server underutilization. This paper aims to explore SDN and test its implementation and demonstrate how to implement its concepts within a datacenter network. The experiment considers the datacenter network implemented in Sudan University of Science and Technology as a case study. The edited network topology is made up of a Demilitarize Zone (DMZ) having three servers, a Local Area Network (LAN) and a main switch. The Hub, Switch and Load balancer scenarios are implemented using Mininet emulator. In addition, the three scenarios are tested using external devices and analyzed using Wireshark. Moreover, the connectivity of HTTP and FTP is verified.