Forwarding Plane Research Articles

Guest Editorial: Managing Next-Generation Networks for Intelligent Services and Applications

Next-generation networks (NGNs) integrate the functionalities of a plethora of established and emerging technologies such as 5G, artificial intelligence (AI), edge intelligence, network softwarization, and data plane programmability. NGNs promise to achieve ultra-fast data rates and minimal latency in wireless communication and networking. They enable smart and autonomous services and applications through AI and machine learning (ML). Coupled with advances in end-user devices, NGNs enable a plethora of smart services and user-defined applications. Given the rise in system complexity and the exponential increase in the amount of data exchanged through networks, new state-of-the-art NGN management solutions are needed. By adapting cooperative and distributed management solutions, more reliable and efficient services and applications are conveyed to end users. Moreover, with distributed learning solutions, NGNs could be optimized to support the dynamic nature of network configuration and enable end-to-end system automation. For instance, the integration of federated learning (FL), deep reinforcement learning (DRL), and blockchain to NGNs can support scalable, secure, and diversified services and applications. Furthermore, through data plane programmability, network intelligence could be implemented directly on programmable devices in the network core. An intelligent forwarding plane would enable faster reaction to network events without depending on time-consuming exchange between the data and control planes.

Smart Name Lookup for NDN Forwarding Plane via Neural Networks

Name lookup is a key technology for the forwarding plane of content router in Named Data Networking (NDN). To realize the efficient name lookup, what counts is deploying a highperformance index in content routers. So far, the proposed indexes have shown good performance, most of which are optimized for or evaluated with URLs collected from the current Internet, as the large-scale NDN names are not available yet. Unfortunately, the performance of these indexes is always impacted in terms of lookup speed, memory consumption and false positive probability, as the distributions of URLs retrieved in memory may differ from those of real NDN names independently generated by content-centric applications online. Focusing on this gap, a smart mapping model named Pyramid-NN via neural networks is proposed to build an index called LNI for NDN forwarding plane. Through learning the distributions of the names retrieved in the static memory, LNI can not only reduce the memory consumption and the probability of false positive, but also ensure the performance of real NDN name lookup. Experimental results show that LNI-based FIB can reduce the memory consumption to 58.258 MB for 2 million names. Moreover, as it can be deployed on SRAMs, the throughput is about 177 MSPS, which well meets the current network requirement for fast packet processing.

Grafnet: Using Graph Neural Networks to Create Table-Less Routers

Grafnet, a Graph Neural-Network (GNN)-based scheme learns IP-address-to-port mapping, leading to forwarding table-less routers. GNNs allow mapping network-wide features like adjacencies and addresses to generate new representations. Grafnet converts network-wide IP addresses to a feature space using GNNs. GNNs extrapolate node adjacencies onto a feature matrix, whose output tells which address/subnet is connected to a node and port. To do so, we use a GNN in conjunction with an Artificial Neural Network (ANN), whose output transforms graph adjacencies to address-based adjacencies. We exploit the fact that IP addresses are present in contiguous groups (subnets) or ‘ranges’. Large range sizes imply a better likelihood of Grafnets’ approximation, though with <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">enough</i> learning Grafnet learns just about all network-wide IP addresses, irrespective of range sizes. Grafnet is evaluated as an SDN scheme on (1) 75-node US-core network and (2) 2000-node, 5 million IP address-based random WAN topology. Analytically, we show equivalence between Grafnet and a Feed-forward neural network implying exhaustiveness and correctness. The proposed Grafnet model is able to work as a direct address translator without the need for tables in the forwarding plane of a router. Engineering considerations to implement Grafnet are also discussed.

Managing Virtual Programmable Switches: Principles, Requirements, and Design Directions

Virtualization is a key enabler of various networking concepts, like virtual networks, cloud computing, and network function virtualization. With the advent of software-defined networks and programmable forwarding planes, researchers began investigating solutions to support the creation of virtual switches that one can program using emerging domain-specific languages like P4. This article covers the current state of affairs in programmable switch virtualization and highlights key principles, challenges, and opportunities related to operations and management of virtual switches whose behavior can be redefined on the fly and independently. We also introduce PvS, a proof-of-concept management layer that focuses on secure and independent management of programmable virtual switches.

Software Defined Networking Automation Using OpenDaylight and Network Virtualization for security and scalability: a network enterprise case

Software Defined Network SDN is a technique that centralized the control plane in one device and the data plane (forward plane) in the other devices connected and communicated via SDN protocols, so these devices will get instructions from a central entity called a controller to manage the network efficiently. The controller generally has a global view of the network topologies and can broadcast any management policy to all devices in the network easily. SDN makes the recent network more responsive and flexibly managed by delivering interoperable and programmable network services to network organizations all around the world. In this work, two real critical scenarios were investigated against other scenarios to manifest the SDN ability to deal with them. Finally, results show that the opted implementation features are better than the others in term of testing parameters.

Mobile Fog Computing by Using SDN/NFV on 5G Edge Nodes

Fog computing provides quality of service for cloud infrastructure. As the data computation intensifies, edge computing becomes difficult. Therefore, mobile fog computing is used for reducing traffic and the time for data computation in the network. In previous studies, software-defined networking (SDN) and network functions virtualization (NFV) were used separately in edge computing. Current industrial and academic research is tackling to integrate SDN and NFV in different environments to address the challenges in performance, reliability, and scalability. SDN/NFV is still in development. The traditional Internet of things (IoT) data analysis system is only based on a linear and time-variant system that needs an IoT data system with a high-precision model. This paper proposes a combined architecture of SDN and NFV on an edge node server for IoT devices to reduce the computational complexity in cloud-based fog computing. SDN provides a generalization structure of the forwarding plane, which is separated from the control plane. Meanwhile, NFV concentrates on virtualization by combining the forwarding model with virtual network functions (VNFs) as a single or chain of VNFs, which leads to interoperability and consistency. The orchestrator layer in the proposed software-defined NFV is responsible for handling real-time tasks by using an edge node server through the SDN controller via four actions: task creation, modification, operation, and completion. Our proposed architecture is simulated on the EstiNet simulator, and total time delay, reliability, and satisfaction are used as evaluation parameters. The simulation results are compared with the results of existing architectures, such as software-defined unified virtual monitoring function and ASTP, to analyze the performance of the proposed architecture. The analysis results indicate that our proposed architecture achieves better performance in terms of total time delay (1800 s for 200 IoT devices), reliability (90%), and satisfaction (90%).

On the Prefix Granularity Problem in NDN Adaptive Forwarding

One unique architectural benefit of Named Data Networking (NDN) is adaptive forwarding, i.e., the forwarding plane is able to observe past data retrieval performance and use it to adjust forwarding decisions for future Interests. To be effective, adaptive forwarding assumes that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Interest Routing Locality</i> is related to Interests’ common name prefix, meaning that Interests sharing the same prefix are likely to follow a similar forwarding path within a short period of time. Since Interests can have multiple common prefixes with different lengths, the real challenge is determining which prefix length should be used in adaptive forwarding to record path performance measurements - we refer to this as the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Prefix Granularity Problem</i> . The longer the common prefix is, the better the Interest Routing Locality, and the larger the forwarding table. Given the limited FIB size, route names are designed to be considerably shorter than Interest names. Existing adaptive forwarding designs use route names to record path performance measurements, which looses forwarding adaptability as it promises in the event of partial network failures. In this work, we propose to dynamically aggregate and de-aggregate name prefixes in the forwarding table in order to use the prefixes that are the most appropriate given current network situation. In addition, to reduce the overhead of adaptive forwarding, we propose mechanisms to minimize the use of the longest prefix matching in Data packet processing. Simulations demonstrate that the proposed techniques can result in better forwarding decisions in the event of partial network failures with significantly reduced overhead.

On-the-fly (D)DoS attack mitigation in SDN using Deep Neural Network-based rate limiting

Software Defined Networking (SDN) has emerged as a promising paradigm offering an unprecedented programmability, scalability and fine-grained control over forwarding elements (FE). Mainly, SDN decouples the forwarding plane from the control plane which is moved to a central controller that is in charge of taking routing decisions in the network. However, SDN is rife with vulnerabilities so that several network attacks, especially Distributed Denial of Service (DDoS), can be launched from compromised hosts connected to switches. DDoS attacks can easily overload the controller processing capacity and flood switch flow-tables. This paper deals with the security issue in SDN. It proposes a real-time protection against DDoS attacks that is based on a controller-side sliding window rate limiting approach which relies on a weighted abstraction of the underlying network. A weight defines the allowable amount of data that can be transmitted by a node and is dynamically updated according to its contribution to: (1) the queueing capacity of the controller, and (2) the number of flow-rules in the switch. Hence, a new deep learning algorithm, denoted the Parallel Online Deep Learning algorithm (PODL), is defined in order to update weights on the-fly according to both aforementioned constraints simultaneously. Furthermore, the behavior of each host and each switch is evaluated through a measure of trustworthiness which is used to penalize mis-behaving ones by prohibiting new flow requests or PacketIn messages for a period of time. Host trustworthiness is based on their weights while switch trustworthiness is achieved through a computation of the Average Nearest-Neighbor Degree (ANND). Realistic experiments show that the proposed solution succeeds in minimizing the impact of DDoS attacks on both the controllers and the switches regarding the PacketIn arrival rate at the controller, the rate of accepted requests and the flow-table usage.

In-Network Neural Networks: Challenges and Opportunities for Innovation

The quest for self-driving networks poses growing pressure to manage network events at a nano-second scale. In this article, we make a case for leveraging programmable forwarding planes to achieve self-driving networks and respond to their dynamism in real time by in-network intelligence and without performing traffic steering/mirroring to centralized management solutions (intelligent or not). We briefly cover throughout the article preliminary ideas in the in-network neural networks field and discuss the technical challenges of running machine learning techniques entirely in the forwarding plane. We also highlight potential use cases of having an autonomous intelligent network capable of self-adapting to dynamic network behavior changes with minimal to no human intervention, including smart network telemetry, smart traffic engineering, real-time flow classification, and network tomography. We close with a roadmap of research opportunities enabled by distributed in-network intelligence in programma-ble forwarding planes.

Application of Three-Dimensional Animation in Mechanical Control Mechanism

With the development of the times and the advancement of science and technology, the development of 3D animation has gradually been applied in various fields. In the field of mechanical control, three-dimensional animation has gradually become a very important application. In the actual application process, the use of three-dimensional animation effects cannot be applied in the field of mechanical control only by imagination. It must be applied in practice from the perspective of mechanical control. Analyze from its own stability and external factors to realize its application value. The purpose of this paper is to study the application of 3D animation in mechanical control mechanism. This article will take mechanical control as an entry point to discuss the application of three-dimensional animation in its mechanism. The research is carried out from two aspects. The first is the application of the robot arm. Based on the kinematic path planning of the shortest time priority strategy, the shorter the motion time of the robot arm, the faster the speed, and the vibration is more difficult to avoid. This is the vibration of the flexible arm. Improve its work efficiency, lay the foundation for more complex path planning problems; create conditions for lighter and faster robotic arm applications. The second is the application of the mechanical foot. The proposed ankle joint control strategy based on the lateral and forward cycle matching can be combined with the forward plane walking control strategy under the stable initial gait of the robot to realize the humanlike virtual prototype of the biped robot. Dynamic walking for analysis. Experimental investigations have shown that in the process of normal walking, there is a dynamic swing process and a static support process. The swing process refers to the lifting of the foot to move forward or backward, and the supporting process refers to the immobilization of one foot to the other. One fulcrum on each foot allows it to move forwards and backwards. Among them, the dynamic swing process accounts for 40% of the whole process, and the static support process accounts for 60%. In general, based on these data, the three-dimensional robotic arm and three-dimensional robotic foot can be better studied.

Serving at the Edge: An Edge Computing Service Architecture Based on ICN

Different from cloud computing, edge computing moves computing away from the centralized data center and closer to the end-user. Therefore, with the large-scale deployment of edge services, it becomes a new challenge of how to dynamically select the appropriate edge server for computing requesters based on the edge server and network status. In the TCP/IP architecture, edge computing applications rely on centralized proxy servers to select an appropriate edge server, which leads to additional network overhead and increases service response latency. Due to its powerful forwarding plane, Information-Centric Networking (ICN) has the potential to provide more efficient networking support for edge computing than TCP/IP. However, traditional ICN only addresses named data and cannot well support the handle of dynamic content. In this article, we propose an edge computing service architecture based on ICN, which contains the edge computing service session model, service request forwarding strategies, and service dynamic deployment mechanism. The proposed service session model can not only keep the overhead low but also push the results to the computing requester immediately once the computing is completed. However, the service request forwarding strategies can forward computing requests to an appropriate edge server in a distributed manner. Compared with the TCP/IP-based proxy solution, our forwarding strategy can avoid unnecessary network transmissions, thereby reducing the service completion time. Moreover, the service dynamic deployment mechanism decides whether to deploy an edge service on an edge server based on service popularity, so that edge services can be dynamically deployed to hotspot, further reducing the service completion time.

Learning-based hybrid routing for scalability in software defined networks

Software Defined Network is an emerging paradigm in computer networks. The separation of the control plane from the forwarding plane in this arrangement has different aspects. This splitting provides many advantages like easy manageability and configuration. Along with benefits, various issues specific to this paradigm also arise. Routing management in such a paradigm deals with diverse concerns, objectives, and parameters before selecting the best route. Reinforcement Learning has already proven its strength in distinct fields like business, industry automation, gaming, algorithms, etc. Even routing in a network can also be made efficient using concepts defined in reinforcement learning. In this paper, routing within a controller's area is modeled, keeping scalability in mind; and an optimal solution is provided using learning. Both proactive and reactive approaches are used for flow installation, and the link load is utilized optimally. The area under a particular controller is efficiently routed, and it tweaks the network. Q-learning model helps to learn the optimal path and provide the best route in case of a failure. Once the learning completes, the model works on it. Preliminary evaluation depicts that improvement of 78%, 58%, and 47 % is achieved for the number of messages generation when compared with other already exiting solutions for routing in Software Defined Networks.

Diagnostic and troubleshooting of OpenFlow‐enabled switches using kernel and userspace traces

SummaryAlthough software‐defined networking (SDN) provides a flexible way to provision and control networks, it also makes network debugging and troubleshooting more complex. In SDN, the network is fully managed by software programs that increase flexibility and sophistication but are prone to bugs. Pinpointing those bugs is challenging because they can occur at multiple locations, such as the forwarding plane, the controller OS, and the network services running on top of the controller. Compared to functional bugs, performance bugs are particularly irritating due to their non‐failure semantics. They can lead to performance loss (reduced throughput, increased latency, and wasted resources) while maintaining the network connectivity. The literature reports several tools and techniques to diagnose SDN bugs, but, unfortunately, they are mostly ineffective against performance bugs. In this paper, we propose a novel monitoring and diagnostic framework capable of diagnosing performance bugs in the SDN data plane. The proposed tool works within Open vSwitch (OVS), a popular software switch, albeit it can easily be adapted to any OpenFlow switch. Tracing techniques are used to collect low‐level performance data from monitored switches. Our tool derives adapted performance metrics from kernel and userspace traces, and then displays them in time‐synchronized graphical views. These views provide valuable insights into OVS operation. They also enable practitioners to discover performance‐related issues and analyze their root causes. A few use cases are presented to demonstrate the efficiency of our tool in optimizing OVS performance and diagnosing its performance bugs.

A new optimization technique to solve the latency aware controller placement problem in software defined networks

AbstractSoftware defined networking (SDN) is a modern and upcoming standard in today's network as it centralizes the network intelligence by separating the control plane from the forwarding plane. Placing a controller in an appropriate location and minimizing the switch to controller (SC) latency are important factors in SDN. In this article, we proposed a mathematical algorithm to form the clusters and placed one controller in each cluster to shorten the worst‐case SC latency. We have proposed a technique called the “$‐method” by using the distance matrix of the network nodes and placed a “$” whenever we have found the matrix element is greater than a given maximum distance. Initially, the maximum distance is calculated using the center of mass method that we have developed for minimizing the average SC latency. Our method guarantees that it will generate the minimum worst‐case SC latency efficiently that one could ever achieve for a different number of controller placement. Simulation has been done under some real‐world network topologies from the dataset of Internet Topology Zoo. Our result shows that the “$‐method” performs better compared with other existing algorithms in terms of worst‐case SC latency minimization with less number of controllers. Further, we have analyzed our method for the failure mode of a controller by assigning the switches of that failed controller to its nearest controllers which shows that our method also performs better in terms of network fault tolerance and improves network resilience.

A systematic review on distributed denial of service attack defense mechanisms in programmable networks

SummaryDesign flaws and vulnerabilities inherent to network protocols, devices, and services make Distributed Denial of Service (DDoS) a persisting threat in the cyberspace, despite decades of research efforts in the area. The historical vertical integration of traditional IP networks limited the solution space, forcing researchers to tweak network protocols while maintaining global compatibility and proper service to legitimate flows. The advent of Software‐Defined Networking (SDN) and advances in Programmable Data Planes (PDP) changed the state of affairs and brought novel possibilities to deal with such attacks. In summary, the ability of bringing together network intelligence to a control plane, and offloading flow processing tasks to the forwarding plane, opened up interesting opportunities for network security researchers unlike ever. In this article, we dive into recent research that relies on SDN and PDP to detect, mitigate, and prevent DDoS attacks. Our literature review takes into account the SDN layered view as defined in RFC7426 and focuses on the data, control, and application planes. We follow a systematic methodology to capture related articles and organize them into a taxonomy of DDoS defense mechanisms focusing on three facets: activity level, deployment location, and cooperation degree. From the analysis of existing work, we also highlight key research gaps that may foster future research in the field.

TOTP Moving Target Defense for sensitive network services

Edge computing is crucial for many of the new 5G business vertical use-cases, such as Industry 4.0 robots, safety-critical communications, and highly-efficient smart grids. However, the tighter integration of such impactful businesses into previously core network operations raises significant security, trustworthiness, and reliability issues. A business vertical must not compromise the Edge platform to other business verticals. Likewise, the vertical Network Services (NSs) entrusted to the Edge should not be compromisable by adversary action. Inspired by the existing Internet Services Two-Factor Authentication (2FA) systems, we propose a Moving Target Defense (MTD) mechanism that protects sensitive NSs using a port mutation akin to a seamless Time-based One-Time Password (TOTP) authentication. Our architecture leverages Software-Defined Networking (SDN) to perform the mutations, having the option of working exclusively as a Virtual Network Function (VNF) that can be instantiated on-demand, or in conjunction with OpenFlow hardware-accelerated switches for smarter resource usage. The straightforward Proof-of-Concept implementation showed the approach was viable, with good forwarding plane performance (exceeding the current Network Interface Controllers capabilities), and effective at stopping the unauthorized interactions with the NS being protected. Because the TOTP approach depends on time and there is commonly occurring jitter (e.g., network), the Threat Detection must make a trade-off between minimizing false-positives (too many alarms) and having false-negatives (attempts that go unreported). We have struck a balance that reduces the probability of a rogue probe reaching the NS to nearly 0.0045%, while the probability of stopping an attack but not generating the alarm is approximately 2%. Future work, such as adaptive delay compensation or the use of AI/ML, may further improve the effectiveness of the solution.

An efficient and DoS-resilient name lookup for NDN interest forwarding

As a novel Internet architecture focused on data contents, Named Data Networking (NDN) has been proven to be of great value in supporting the Internet of Things, Edge computing, Blockchain, and other popular topics. They can benefit mainly from NDN's intrinsic properties, such as flexible multicasting, in-network caching, among several others. However, once NDN's forwarding plane suffers Denial of Service (DoS) attacks, the overall system performance would be affected significantly. In NDN data transmission, interest forwarding is the most time-consuming operation and thus opens a possible vector of DoS attacks. It is proposed in this paper a fast name lookup algorithm for NDN interest forwarding, which selects feature prefixes instead of lengths to filter out interest packets in NDN interest forwarding. Due to the excellent filtration with feature prefixes, the algorithm accelerates NDN forwarding processes. Compared with other existing solutions, the proposed algorithm shows more than 70% of time improvement in forwarding malicious interests, while remaining at the same performance level in standard cases.

Asynchronous Time-Sensitive Networking for 5G Backhauling

Fifth Generation (5G) phase 2 rollouts are around the corner to make mobile ultra-reliable and low-latency services a reality. However, to realize that scenario, besides the new 5G built-in Ultra-Reliable Low-Latency Communication (URLLC) capabilities, it is required to provide a substrate network with deterministic Qual-ity-of-Service support for interconnecting the different 5G network functions and services. Time-Sensitive Networking (TSN) appears as an appealing network technology to meet the 5G connectivity needs in many scenarios involving critical services and their coexistence with Mobile Broadband traffic. In this article, we delve into the adoption of asynchronous TSN for 5G backhauling and some of the relevant related aspects. We start motivating TSN and introducing its mainstays. Then, we provide a comprehensive overview of the architecture and operation of the Asynchronous Traffic Shaper (ATS), the building block of asynchronous TSN. Next, a management framework based on ETSI Zero-touch network and Service Management (ZSM) and Abstraction and Control of Traffic Engineered Networks (ACTN) reference models is presented for enabling the TSN transport network slicing and its interworking with Fifth Generation (5G) for backhauling. Then we cover the flow allocation problem in asynchronous TSNs and the importance of Machine Learning techniques for assisting it. Last, we present a simulation-based proof-of-concept (PoC) to assess the capacity of ATS-based forwarding planes for accommodating 5G data flows.

SmartDetour: Defending Blackhole and Content Poisoning Attacks in IoT NDN Networks

Named data networking (NDN) recently arises as a promising networking paradigm to support the Internet of Things (IoT) due to its data-centric architecture. However, NDN integrates application-layer semantics into the packet forwarding plane, which presents new attack faces. In this article, we aim to handle two attacks that exploit such vulnerabilities, namely the blackhole attack and the content poisoning attack. The two attacks are not handled efficiently by existing approaches due to the challenge in minimizing routers that need to be detoured to isolate attackers. Therefore, in this article, we propose a novel method named SmartDetour to tackle the challenge in a distributed manner. SmartDetour contains two components: 1) a proactive reputation updating algorithm and 2) a reputation-based probabilistic forwarding strategy. The former updates the reputation of forwarding candidates based on whether they must be detoured upon packet failures. The latter selects the next-hop router for interest packets probabilistically based on the reputations of forwarding candidates. The two components work together to isolate attackers with minimal detouring needed. Extensive ndnSIM-based simulation shows that SmartDetour can effectively identify and isolate attackers.

Traffic Engineering in Software-defined Networks using Reinforcement Learning: A Review

With the exponential increase in connected devices and its accompanying complexities in network management, dynamic Traffic Engineering (TE) solutions in Software-Defined Networking (SDN) using Reinforcement Learning (RL) techniques has emerged in recent times. The SDN architecture empowers network operators to monitor network traffic with agility, flexibility, robustness and centralized control. The separation of the control and the forwarding plane in SDN has enabled the integration of RL agents in the networking architecture to enforce changes in traffic patterns during network congestions. This paper surveys major RL techniques adopted for efficient TE in SDN. We reviewed the use of RL agents in modelling TE policies for SDNs, with agents’ actions on the environment guided by future rewards and a new state. We further looked at the SARL and MARL algorithms the RL agents deploy in forming policies for the environment. The paper finally looked at agents design architecture in SDN and possible research gaps.