OpenFlow Network Research Articles

Mechanism to prevent the abuse of IPv6 fragmentation in OpenFlow networks.

OpenFlow makes a network highly flexible and fast-evolving by separating control and data planes. The control plane thus becomes responsive to changes in topology and load balancing requirements. OpenFlow also offers a new approach to handle security threats accurately and responsively. Therefore, it is used as an innovative firewall that acts as a first-hop security to protect networks against malicious users. However, the firewall provided by OpenFlow suffers from Internet protocol version 6 (IPv6) fragmentation, which can be used to bypass the OpenFlow firewall. The OpenFlow firewall cannot identify the message payload unless the switch implements IPv6 fragment reassembly. This study tests the IPv6 fragmented packets that can evade the OpenFlow firewall, and proposes a new mechanism to guard against attacks carried out by malicious users to exploit IPv6 fragmentation loophole in OpenFlow networks. The proposed mechanism is evaluated in a simulated environment by using six scenarios, and results exhibit that the proposed mechanism effectively fixes the loophole and successfully prevents the abuse of IPv6 fragmentation in OpenFlow networks.

Moving target defense controller of mobile system based on Openflow sensor security scheme

This paper introduces a sensor security and defense scheme based on Openflow in mobile Internet of Things system. Adopting the flexible network characteristics of the Openflow network structure, at the network level of the mobile internet of things system, the goal of protecting the sensor devices, routers, switches and other devices in the mobile internet of things system is achieved by simultaneously carrying out the double random digital transformation of the network IP address and the data transmission ports of the cross-region Openflow exchange equipment through each sensor device in the mobile internet of things system and each router device in the data transmission process. Compared with the existing security defense technology of mobile IoT system, this technical solution is compatible and relatively easy to deploy, and can protect the whole system data transmission of mobile IOT system. In the initial stage of network system sniffing, such as hacker attack, the maximum extent of active security protection is provided to the mobile Internet of Things system carrying public network data by hiding sensor information.

Naïve Bayes Anomaly Detection System Design On Openflow Network

One of the generally launched attacks is Distributed Denial of Service that renders its target unable to provide its service. Gaussian Naïve Bayes Classifier is one out of several techniques used in detecting those attacks by classifying network traffic in a window as an attack or a normal traffic based on normal distribution previously calculated from normal and attack traffic datasets. This research focuses on mitigating SYN Flood Type DDoS attacks on OpenFlow Network using Zodiac FX as a switch. The developed system utilizes OpenFlow Protocol to apply flow rule in switch’s flow table in order to detect and mitigate SYN Flood attacks in real-time. Applied mitigation procedure is to divert incoming packets into SYN Proxy so that only legitimate TCP packets are able to reach the server. The results show that the system has a bandwidth of up to 60Mbps under normal condition and 5,03Mbps under attack. Maximum malicious packets that could reach server before it is diverted to SYN Proxy is estimated to be 400 packets and not affected by the number of attacks, assuming that the flow rule sent by the controller are enacted immediately.

A MapReduce Approach for Traffic Matrix Estimation in SDN

A traffic matrix (TM) is a source of critical traffic throughput information for traffic engineering activities and network management tasks such as traffic prediction, capacity planning, network provisioning, and anomaly detection. However, estimating TM poses several challenges for network engineers. One of the challenges is that traffic data statistics are constantly changing, and their aggregation for real-time monitoring becomes a difficult task. This paper presents a near real-time TM estimation approach for OpenFlow (OF) networks. It makes use of Big Data techniques based on MapReduce operations to tackle the aggregation problem. The proposed method uses traffic data statistics collected from OF switches through an SDN controller as input and aggregates these data in a Big Data streaming processing environment. This paper explores the benefits of the distributed MapReduce computing model to provide an estimate of the TM for all origin-destination (OD) pairs of hosts in the network in two ways: 1) the accumulated throughput and 2) the throughput between two sequential TM estimates. This procedure enables network engineers to monitor the behavior and evolution of the throughput on each OD pair in the network and on each link in the path between each OD pair. The generated TM is persisted in a NoSQL database and can be made available for a variety of network traffic monitoring applications. The results of the simulations show the potential of the proposed MapReduce approach for TM estimation.

The network OS: Carrier-grade SDN control of multi-domain, multi-layer networks

Driven by the growth of cloud and virtualization technologies, telecom services are under pressure to become increasingly dynamic. Cloud services can be instantiated in a matter of minutes on computing platforms, which can rapidly schedule and allocate virtualized physical resources. A similar flexibility to adapt to dynamic service requests remains a challenge with network resources. Recently, centralized controllers have been deployed in data center networks to adapt network connectivity to computational needs. However, due to the complexity and variety of carrier networking technologies, carrier networks have been slow to move towards centralized control. More recently, carriers are evolving to address network complexity by pushing for the disaggregation of network elements and the introduction of equipment with more control flexibility. Carriers require a new control paradigm to benefit from this new flexibility, which extends far beyond today's OpenFlow network controllers. The lack of a global network controller with a consistent network view slows down the development and deployment of the more dynamic network services required by extensive cloud technologies. To address the scaling requirements of the carrier environment, the envisioned network controller would be implemented as a distributed system. In this article, we describe a global network controller designed to function as a network operating system with multi-domain, multi-layer capabilities that will transform carrier-grade telecom services. We define the requirements for a carrier-grade network operating system (OS) and describe a prototype system (NetUNIX) that can control heterogeneous networks at large scale and ensure high service reliability. We highlight the advantages of the NetUNIX platform in the context of other open source platforms and illustrate the use of the NetUNIX platform with two use cases: a metro-distributed data center and 5G next-generation fronthaul.

Instant Detection of Host in SDN (IDH-SDN)

SDN features are making it more popular day by day: centralized monitoring, control of network equipments, increased performance and flexibility in designing network policies as per organization requirements. The SDN controller deals with data & control plane separately. The SDN switches are simply data forwarding devices and controller decides control over forwarding data through them. Controller has a technique to identify the network switch and router nodes; but it does not identify the presence of hosts before they generated network traffic and is not able to create the packet forwarding rules, security policies. The objective of this paper is to detect connected host before they generate any traffic and store host details at controller level for future researches in area of development of new network tools, applications, optimizations techniques and security. Here, we propose Instant Detection of Host in SDN (IDH-SDN) to detect host before transmission of any data packet and store host details in a HostTable at controller level. In our experiment, various network topologies have been used to test host detection and data collection algorithm and results of all experiments verified with Wireshark network packet analyzer. The HostTable data may be used for various purposes such as development of new network tools, policies, security approaches in OpenFlow network.

Towards a reliable firewall for software-defined networks

Software-Defined Networking (SDN) is an emerging paradigm in networking where network control plane is decoupled from forwarding plane through programmable control. OpenFlow – the most popular SDN platform – introduces significant granularity, visibility and flexibility to networking, but at the same time brings forth new security challenges. One of the fundamental challenges is to build a reliable firewall for protecting OpenFlow networks where network states and traffic are frequently changed. To address this challenge, we introduce FlowMon, an OpenFlow-based firewall, to support network-wide access control by facilitating not only accurate violation detection but also effective violation resolution in dynamic OpenFlow networks. FlowMon detects firewall policy violations by checking flow path space against firewall authorization space when a flow entry or firewall rule is inserted, modified, or deleted. In particular, FlowMon conducts automatic and real-time violation resolutions with the help of several innovative resolution strategies applied to diverse network update situations. We also implement a prototype of FlowMon in Floodlight. Our experimental results demonstrate FlowMon effectively addresses violations in a real-world network topology, and produces manageable performance overhead with effective violation detection and resolution.

Decoupled delay and bandwidth centralized queue-based QoS scheme in OpenFlow networks

There are an increasing of scenarios that require the independent bandwidth and delay demands. For instance, in a data center, the interactive message would not occupy much bandwidth, but it requires the rigorous demands for the delay. However, the existing QoS approaches are mainly bandwidth based, which are inappropriate for these scenarios. Hence, we propose the decoupled scheme in the OpenFlow networks to provide the centralized differential bandwidth and delay control. We leverage the mature HTB to manage the bandwidth. And we design the Queue Delay Management Scheme (QDMS) for queuing delay arrangement, as well as the Comprehensive Parameters based Dijkstra Route algorithm (CPDR) for the propagation delay control. The evaluation results verify the decoupling effectiveness. And the decoupled scheme can reduce the delay for high priority flows.

Efficient Recovery Path Computation for Fast Reroute in Large-Scale Software-Defined Networks

With an increasing demand for resilience in software-defined networks (SDN), it becomes critical to minimize service recovery delay upon route failures. Fast reroute (FRR) mechanisms are widely used in IP and MPLS networks by computing the recovery path before a failure occurs. The centralized control plane in SDN can potentially enhance path computation, so that FRR path computation can better scale in SDN than in traditional networks. However, the traditional FRR path computation algorithms could lead to a poor performance in large-scale SDN. The problem can become more severe for a highly dynamic network, which often sees dozens of failures or configuration changes in any single day. We propose a new algorithm that exploits pruned searching to quickly compute recovery paths for all-pair switches/hosts upon a link failure. For applications requiring stringent path robustness levels, we also extend this algorithm to quickly find the shortest guaranteed-cost path, which ensures that the recovery path used upon on-path link failures has the minimum cost. Compared with traditional solutions, our evaluations show that our algorithm is about 8 ~ 81 times faster than the practical implementation, 1.93 ~ 3.11 times faster than the state-of-the-art solution. Our results also show that the shortest guaranteed-cost path can reduce the cost of the recovery path significantly. Moreover, we design a prototype to show how to deploy our algorithm in an OpenFlow network.

Decoupled delay and bandwidth centralized queue-based QoS scheme in OpenFlow networks

Decoupled delay and bandwidth centralized queue-based QoS scheme in OpenFlow networks

Modeling collective attention in online and flexible learning environments

ABSTRACTUnderstanding how collective attention flow circulates amid an over-abundance of knowledge is a key to designing new and better forms of online and flexible learning experiences. This study adopted an open flow network model and the associated distance metrics to gain an understanding of collective attention flow using clickstream data in a massive open online course. Various patterns and dynamics of attention flow were identified and are discussed here in relation to learning performance. The results show that the effective accumulation, circulation, and dissipation of attention flow are important contributors to academic attainment. Understanding the patterns and dynamics of attention flow will allow us to design cost-effective learning resources to prevent learners from becoming overloaded.

Imitation Reinforcement Learning-Based Remote Rotary Inverted Pendulum Control in OpenFlow Network

Rotary inverted pendulum is an unstable and highly nonlinear device and has been used as a common application model in nonlinear control engineering field. In this paper, we use a rotary inverted pendulum as a deep reinforcement learning environment. The real device is composed of a cyber environment and physical environment based on the OpenFlow network, and the MQTT protocol is used on the Ethernet connection to connect the cyber environment and the physical environment. The reinforcement learning agent is learned to control the real device located remotely from the controller, and the classical PID controller is also utilized to implement the imitation reinforcement learning and facilitate the learning process. From our CPS-based experimental system, we verify that a deep reinforcement learning agent can successfully control the real device located remotely from the agent, and our imitation learning strategy can make the learning time reduced effectively.

An Active Defense Solution for ARP Spoofing in OpenFlow Network

As an emerging network technology, Software-defined network (SDN), has been rapidly developing for recent years due to its advantage in network management and updating. There are still a lot of open problems while applying this novel technology in reality, especially for meeting security demands. The Address resolution protocol (ARP) spoofing, a representative network attack in traditional networks is investigated. We implement the ARP spoofing in SDN network firstly and find that the threat of ARP attack still exists and has big impact on the network. We propose a novel mechanism as defense solution for ARP spoofing oriented to OpenFlow platform. Theoretical analyzation is given, and the mechanism is implemented as a module of POX controller. Experiment results and performance evaluations show that our solution can reduce the security threat of ARP spoofing remarkably on OpenFlow platform and related SDN platforms.

MigrateSDN: efficient approach to integrate OpenFlow networks with STP-enabled networks

Software defined networking (SDN) is a paradigm-shifting technology in networking. However, in current network infrastructures, removing existing networks to build pure SDN networks or replacing al...

MigrateSDN: efficient approach to integrate OpenFlow networks with STP-enabled networks

Software defined networking (SDN) is a paradigm-shifting technology in networking. However, in current network infrastructures, removing existing networks to build pure SDN networks or replacing al...

Controller Based Proxy for Handling NDP in OpenFlow Network

A significant method should be deployed in OpenFlow environment for reducing the complexity during the implementation of IPv6 neighbor discovery protocol (NDP) in multicast manner. This paper was performed for deploying reactive-based application in controller’s northbound layer for handling as well as cutting the Neighbor solicitation packet’s journey. The application had a capability for storing each of the incoming Neighbor Solicitation (NS) and Neighbor Advertisement (NA) packet information. Therefore, the controller could reply the NS packet directly by using OFPT_PACKET_OUT message that contained the NA packet extracted from the reactive application. The experiment’s result showed that the proposed approach could reduce the NS response time up to 71% than the normal result produced by the traditional/learning switch application.

OrchFlow: An Architecture for Orchestration of Multiple Controllers in OpenFlow Networks

Since the emergence of software defined networking (SDN) and from the development of the OpenFlow protocol, it is possible to observe that this new paradigm of networks is revolutionizing the networks based on the IP protocol, allowing the creation of new mechanisms for provisioning of services, guaranteeing scalability and reducing costs. Although this new paradigm has been created for the centralization of the control logic, it is possible to decentralize it. In this scenario, subdividing the administrative domain into smaller subdomains and having each subdomain controlled by a controller has been an alternative to ensure scalability in SDN. This article proposes an architecture, here called OrchFlow, capable of receiving requests from applications and orchestrating them in order to provide the requested services in an OpenFlow network with multiple controllers. OrchFlow acts hierarchically and provides access to the network infrastructure in three distinct ways: Proactive, Reactive, and Hybrid. This article presents the architecture, implementation, and an extensive benchmarking using two of today’s leading OpenFlow controllers, Ryu and Floodlight.

A Dynamical and Load-Balanced Flow Scheduling Approach for Big Data Centers in Clouds

Load-balanced flow scheduling for big data centers in clouds, in which a large amount of data needs to be transferred frequently among thousands of interconnected servers, is a key and challenging issue. The OpenFlow is a promising solution to balance data flows in data center networks through its programmatic traffic controller. Existing OpenFlow based scheduling schemes, however, statically set up routes only at the initialization stage of data transmissions, which suffers from dynamical flow distribution and changing network states in data centers and often results in poor system performance. In this paper, we propose a novel dynamical load-balanced scheduling (DLBS) approach for maximizing the network throughput while balancing workload dynamically. We first formulate the DLBS problem, and then develop a set of efficient heuristic scheduling algorithms for the two typical OpenFlow network models, which balance data flows time slot by time slot. Experimental results demonstrate that our DLBS approach significantly outperforms other representative load-balanced scheduling algorithms Round Robin and LOBUS; and the higher imbalance degree data flows in data centers exhibit, the more improvement our DLBS approach will bring to the data centers.

Advanced Authentication Protocol for Software-Defined Networks

Software-Defined Networking (SDN) is being widely implemented by critical infrastructure networks, however providing security features still a challenge. In this work, we present SafeFlow an Automatic Trust Negotiation Protocol for SDN, a first line of defense and fine-grained authentication protocol, in order to deny the access of OpenFlow switches without valid digital credentials. Traditional security approaches based on identity or capabilities do not solve the problem of establishing trust between strangers. One alternative approach to mutual trust establishment is Trust Negotiation, the bilateral exchange of digital credentials to establish trust gradually. The proposed protocol describes Trust Negotiation in OpenFlow protocol, probable extension to the OpenFlow handshake protocol. In this paper, we describe the implementation of SafeFlow. The proposed protocol ensures the security of the infrastructure itself, as there are also other proposals for developing security application on OpenFlow network infrastructure.

Design and implementation of an adaptive feedback queue algorithm over OpenFlow networks

The concurrent presence of different types of traffic in multimedia applications might aggravate a burden on the underlying data network, which is bound to affect the transmission quality of the specified traffic. Recently, several proposals for fulfilling the quality of service (QoS) guarantees have been presented. However, they can only support coarse-grained QoS with no guarantee of throughput, jitter, delay or loss rate for different applications. To address these more challenging problems, an adaptive scheduling algorithm for Parallel data Processing with Multiple Feedback (PPMF) queues based on software defined networks (SDN) is proposed in this paper, which can guarantee the quality of service of high priority traffic in multimedia applications. PPMF combines the queue bandwidth feedback mechanism to realise the automatic adjustment of the queue bandwidth according to the priority of the packet and network conditions, which can effectively solve the problem of network congestion that has been experienced by some queues for a long time. Experimental results show PPMF significantly outperforms other existing scheduling approaches in achieving 35–80% improvement on average time delay by adjusting the bandwidth adaptively, thus ensuring the transmission quality of the specified traffic and avoiding effectively network congestion.