Floodlight Software Defined Network Controller Research Articles

Bootstrapped LARAC algorithm for fast delay‐sensitive QoS provisioning in SDN networks

SummaryIn today's networks, QoS provisioning becomes a major concern for service providers due to the massive increase in connected devices (e.g., mobile devices, servers, and Things), traffic in between, and the diverse service requirements (e.g., delay and bandwidth). Software‐Defined Networking (SDN) promises solution for such issues with its central network control flexibility compared to traditional networking; nonetheless, a design of a fast and QoS guaranteeing routing algorithm is still needed. Delay Constrained Least Cost (DCLC) is a well‐known NP‐hard problem. LAgrange Relaxation‐based Aggregated Cost (LARAC) algorithm is a Dijkstra‐based QoS‐aware algorithm and one of many heuristic algorithms proposed in the literature to solve the DCLC problem. Despite its outstanding performance over other algorithms in SDN, it still needs improvement. In this article, we present a modified version of LARAC, called MODLARAC, to improve the solution feasibility search state by exploiting LARAC's lower‐bound paths before the approximation process start. Also, we modify its stop condition to avoid extra non‐useful Dijkstra calls. We implement and evaluate MODLARAC using a realistic ISP network topology using Mininet and controlled by Floodlight SDN controller. We then compare MODLARAC against the original LARAC and BiLAD algorithms. The obtained results showed improvement up to 20% reduction in Dijkstra calls count compared to original LARAC and BiLAD algorithms without a significant increase in path's cost or delay metrics. It reached only 3% increase in path cost and 7% in path delay in its worst case with a safe distance of 11% lower than the delay demand.

Secure Software Defined Networks Controller Storage using Intel Software Guard Extensions

The SDN controller is the core of the software-defined network (SDN), which provides important network operations that needs to be protected from all type of threats. Many researches have been focusing on different layers of security regarding the SDN controller such as Anti-DDOS system or enforcement of TLS connection between the controller and the Open-vswitches. One of the major security threats targeting any program is the environment execution itself (e.g. Operating system and the hardware itself). Intel's Software Guard Extension (SGX) offers a sloid layer of security applied to applications by creating a Trusted execution environment. SDN controller relay on a storage module to keep sensitive data such as Flow Rules, users’ credentials and configuration files. Protecting this side of the SDN controller is a must in term of security. To date, no work has been conducted considering SDN controller storage security using Intel SGX. This paper introduces an SGX enabled SDN controller. The new controller ensures the integrity and the confidentiality in a trusted execution environment by leveraging a recent hardware technology called intel SGX. This technology provides a trusted and secure enclave. Enclaves are sealed and unsealed by intel SGX attestation mechanisms to protect the executed code and data inside live memory and disk from being altered by any unauthorized access. High privileged codes such as the OS itself is kept from altering data inside enclaves. We implemented the Intel SGX using the Floodlight SDN controller running a real enabled Intel SGX hardware. Our evaluation shows that the SGX enabled SDN controller introduces a slightly observable performance overhead to the floodlight controller compared to advantages in term of security.

A New Approach for Detecting and Resolving Anomalies in Security Policy of the External Firewall Module of the Floodlight SDN Controller

In this paper, the authors analyze the developed PreFirewall network application for the Floodlight software defined network (SDN) controller. This application filters rules, which are added into the firewall module of the Floodlight SDN controller in order to prevent the occurrence of anomalies among them. The rule filtering method is based on determining whether the addition of a new rule will not cause any anomalies with already added ones. If an anomaly was detected while adding the new rule, PreFirewall application should be able to resolve it and must report the detection of the anomaly. The developed network application PreFirewall passed a number of tests. As a result of the stress testing, it was found that the time of adding a new rule, when using PreFirewall, substantially increases with increase in the number of previously processed rules. Analysis of the network application PreFirewall showed that while adding a rule (the most frequent operation), in the worst case it is necessary to compare it with all existing rules, which are stored as a two-dimensional array. Thus, the operation of adding a new rule is the most time-consuming and has the greatest impact on the performance of the network application, which leads to an increase in response time. A possible way to of solving this problem is to select a data structure used to store the rules, in which the operation of adding a new rule would be simple. After analyzing the structure of the policy rules for the Floodlight SDN controller, the authors noted that a tree is the most adequate data structure for its storage. It provides optimization of memory used for storing the rules and, more important, it allows to achieve the constant complexity of the operation of adding a new rule and, consequently, solving the performance problem of the network application PreFirewall. The article is published in the authors’ wording.

Development of an active external network topology module for Floodlight software-defined network controller

Traditional network architecture is inflexible and complex. This observation has led to a paradigm shift toward software-defined networks (SDNs), in which the network control level is separated from the data link layer. This change became possible because of the control plane transfer from switching equipment to software modules that run on a dedicated server called a controller (or a network operating system) or to network applications that work with this controller. Methods of presentation, storage, and communication interfaces with network topology elements available to SDN controller users are the most important aspects of network operating systems because the operation of some key controller modules depends heavily on the internal representation of the network topology. Firewall and routing modules can be cited as examples of these modules. This paper considers the methods used to represent and store the network topology, as well as communication interfaces with corresponding modules of the Floodlight controller. An alternative algorithm for exchanging messages on the changes in the network topology between the controller and network applications has been proposed and developed. The algorithm makes it possible to issue notifications based on a subscription to relevant events. An API for the module of interacting with applied programs of the SDN controller has been developed. The Topology Tracker module has been designed based on this algorithm and API. In active mode, this module can inform network applications about the changes in the network topology and store its compact representation for the interaction acceleration.