OpenDaylight Software-Defined Networking Controller Research Articles

FedAAA-SDN: Federated Authentication, Authorization and Accounting in SDN controllers

Modern technology advancements such as Software Defined Networking (SDN) have been employed in distinct scenarios such as cloud computing and wireless networks, and have made network administration simpler since it gives greater flexibility in centralizing the configurations of a network and its data. Several SDN controllers have started to offer Authorization, Authentication, and Accounting (AAA) services to improve user management and security, including support for OAuth2.0. However, basic authentication schemes using the tuple username and password are not considered secure nowadays (prone to brute force attacks), or the use of basic tokens in OAuth 2.0 is propitious to security vulnerabilities not meeting the security requirements in current and future use cases dealing with authentication. Therefore, the main objective of this work is the design and evaluation of the FedAAA-SDN framework enabling authentication, authorization, and accounting mechanisms in SDN controllers controlling different types of networks. In particular, the FedAAA-SDN framework enables federated authentication and authorization processes for network functions by enabling the conveyance of identity and authentication information across heterogeneous domains/networks, allowing also network operators to enforce authorization policies for network functions in wired and wireless networks. A FedAAA-SDN proof of concept is implemented with OpenDaylight as the SDN controller, OpenID Connect as the authentication and authorization mechanism, and Keycloak as the OpenID Provider. FedAAA-SDN also includes the concept of trust levels and trust policies that rely on the context information of a user’s device and associated connected access networks. The implementation of the FedAAA-SDN framework proof of concept involves modifications in the OpenDaylight AAA filter component to secure all the interactions with the several network applications/subcomponents of the OpenDaylight SDN controller. STRIDE security analysis demonstrates that the FedAAA-SDN framework is able to reduce the number of threats.

Brew: A Security Policy Analysis Framework for Distributed SDN-Based Cloud Environments

The ease of programmability in Software-Defined Networking (SDN) makes it a great platform implementation of various initiatives that involve application deployment, dynamic topology changes, and decentralized network management in a multi-tenant data center environment. However, implementing security solutions in such an environment is fraught with policy conflicts and consistency issues with the hardness of this problem being affected by the distribution scheme for the SDN controllers. In this paper we present Brew, a security policy analysis framework implemented on an OpenDaylight SDN controller, that has comprehensive conflict detection and resolution modules to ensure that no two flow rules in a distributed SDN-based cloud environment have conflicts at any layer; thereby assuring consistent conflict-free security policy implementation and preventing information leakage. We present techniques for global prioritization of flow rules in a decentralized environment, extend firewall rule conflict classification from a traditional environment to SDN flow rule conflicts by recognizing and classifying conflicts stemming from cross-layer conflicts and provide strategies for unassisted resolution of these conflicts. Alternately, if administrator input is desired to resolve conflicts, a novel visualization scheme is implemented to help the administrators view the conflicts graphically. We demonstrate the correctness, feasibility and scalability of our framework through a proof-of-concept prototype.

Response Time and Availability Study of RAFT Consensus in Distributed SDN Control Plane

Software defined networking (SDN) promises unprecedented flexibility and ease of network operations. While flexibility is an important factor when leveraging advantages of a new technology, critical infrastructure networks also have stringent requirements on network robustness and control plane delays. Robustness in the SDN control plane is realized by deploying multiple distributed controllers, formed into clusters for durability and fast-failover purposes. However, the effect of the controller clustering on the total system response time is not well investigated in current literature. Hence, in this work we provide a detailed analytical study of the distributed consensus algorithm RAFT, implemented in OpenDaylight and ONOS SDN controller platforms. In those controllers, RAFT implements the data-store replication, leader election after controller failures and controller state recovery on successful repairs. To evaluate its performance, we introduce a framework for numerical analysis of various SDN cluster organizations w.r.t. their response time and availability metrics. We use Stochastic Activity Networks for modeling the RAFT operations, failure injection and cluster recovery processes, and using real-world experiments, we collect the rate parameters to provide realistic inputs for a representative cluster recovery model. We also show how a fast rejuvenation mechanism for the treatment of failures induced by software errors can minimize the total response time experienced by the controller clients, while guaranteeing a higher system availability in the long-term.

Mobile Cloud-Based Interactive 3D Rendering and Streaming System Over Heterogeneous Wireless Networks

This paper presents an effective mobile cloud-based interactive 3D rendering and streaming system with data-service cost constraints over heterogeneous wireless networks. The proposed system contains software-defined networking (SDN)-enabled adaptive cloud resource management module and context-aware 3D rendering and streaming module to enhance the quality-of-service of interactive 3D rendering and streaming services. The first module is designed to efficiently control the limited cloud resources, such as server computing power and available backbone link bandwidth, and the second module is implemented to pursue an effective tradeoff between 3D rendering quality and compressed image quality. The system is implemented using Mininet network emulator with an OpenDaylight SDN controller, and VirtualGL with an online open-source 3D game, PlaneShift. Finally, the system is examined at a mobile device connected to real long-term evolution and WiFi networks.

Multi-Tenant Software-Defined Hybrid Optical Switched Data Centre

We introduce a holistic solution for software-defined optical data centres (DC). Hybrid optical circuit/packet switching technologies are employed in the data plane, while a software-defined networking (SDN) controller based on OpenDaylight with significant extensions is adopted for the data centre network (DCN) control and management. Novel functional modules in the SDN controller together with its northbound (NBI) and southbound interfaces (SBI) are designed and developed. The OpenFlow protocol is extended at the SBI to support communication between the extended OpenDaylight SDN controller and the optical DCN devices. Over the NBIs, DC applications and the cloud management system directly interact with the optical DCN. A virtual data centre (VDC) application is designed and developed that dynamically creates and provisions multiple coexisting but isolated VDCs. An optical network-aware virtual machine (VM) placement method is proposed and implemented for a single-step deployment of both network and IT (VM) resources to accommodate the VDC requests. The VDC deployment process is extensively simulated and experimentally demonstrated.