OpenFlow Network Research Articles

A cognitive model‐based approach for autonomic fault management in OpenFlow networks

SUMMARYAutonomic network management is an approach to the management of complex networks and services that incorporates the detection, diagnosis and reconfiguration, as well as optimization, of their performance. A control loop is fundamental as it facilitates the capture of the current state of the networks and the reconfiguration of network elements without human intervention. For new networking architectures such as software‐defined networking and OpenFlow networks, in which the control plane is moved onto a centralized controller, an efficient control loop and decision making are more crucial. In this paper, we propose a cognitive control loop based on a cognitive model for efficient problem resolving and accurate decision making. In contrast to existing control loops, the proposed control loop provides reactive, deliberative and reflective loops for managing systems based on analysis of current status. In order to validate the proposed control loop, we applied it to fault management in OpenFlow networks and found that the protection mechanism provides fast recovery from single failures in OpenFlow networks, but it cannot cover multiple‐failure cases. We therefore also propose a fast flow setup (FFS) algorithm for our control loop to manage multiple‐failure scenarios. The proposed control loop adaptively uses protection and FFS based on analysis of failure situations. We evaluate the proposed control loop and the FFS algorithm by conducting failure recovery experiments and comparing its recovery time to those of existing methods. Copyright © 2013 John Wiley & Sons, Ltd.

Programmable virtual network as a service: towards a future Internet testbed based on IaaS cloud

During recently years, several OpenFlow-enabled testbeds have been deployed in world-wide research community. Typically, these OpenFlow-enabled testbeds need to stitch to other testbeds to link to virtual servers and immit experimentation traffic. From the view point of researchers, these OpenFlow-enabled testbeds only provide OpenFlow networking resource, and they have to resort to other experiment infrastructure to provide computing and storage resource. Due to the OpenFlow networking and other resource belongs to different infrastructure provider and is managed by their own control software, it is difficult to coordinate these partners to provide a full programmable experiment environment. Meanwhile, the control software of these testbeds are tight coupling with their substrate resources, which means that these substrate resources, together with virtualization technologies, are permanently dedicated to the control software and difficult to be used by other services. In this paper, a new future Internet testbed architecture based on the open Infrastructure-as-a-service cloud and software defined network (SDN) paradigm is proposed. It extends the current virtual network service by adding programmable virtual switch and controller resources that can be controlled by the researcher. Its loose coupling model allows the testbed operator decouple the experiment service from the infrastructure provider, which is a more flexible way to build the testbed. The initial prototype implementation in this paper shows that this new testbed architecture built on IaaS cloud and SDN is feasible and flexible to provide programmable virtual network service.

NICE: Network Intrusion Detection and Countermeasure Selection in Virtual Network Systems

Cloud security is one of most important issues that has attracted a lot of research and development effort in past few years. Particularly, attackers can explore vulnerabilities of a cloud system and compromise virtual machines to deploy further large-scale Distributed Denial-of-Service (DDoS). DDoS attacks usually involve early stage actions such as multistep exploitation, low-frequency vulnerability scanning, and compromising identified vulnerable virtual machines as zombies, and finally DDoS attacks through the compromised zombies. Within the cloud system, especially the Infrastructure-as-a-Service (IaaS) clouds, the detection of zombie exploration attacks is extremely difficult. This is because cloud users may install vulnerable applications on their virtual machines. To prevent vulnerable virtual machines from being compromised in the cloud, we propose a multiphase distributed vulnerability detection, measurement, and countermeasure selection mechanism called NICE, which is built on attack graph-based analytical models and reconfigurable virtual network-based countermeasures. The proposed framework leverages OpenFlow network programming APIs to build a monitor and control plane over distributed programmable virtual switches to significantly improve attack detection and mitigate attack consequences. The system and security evaluations demonstrate the efficiency and effectiveness of the proposed solution.

Simulative Comparison of Multiprotocol Label Switching and OpenFlow Network Technologies for Transmission Operations

Utility companies are integrating multiprotocol label switching (MPLS) technologies into existing backbone networks, including networks between substations and control centers. MPLS has mechanisms for efficient overlay technologies as well as mechanisms to enhance security: features essential to the functioning of the smart grid. However, with MPLS routing and other switching technologies innovation is restricted to the features enclosed “in the box.” More specifically, there is no practical way for utility operators or researchers to test new ideas such as alternatives to IP or MPLS on a realistic scale to obtain the experience and confidence necessary for real world deployments. As a result, novel ideas go untested. Conversely, the OpenFlow framework has enabled significant advancements in network research. OpenFlow provides utility operators and researchers the programmability and flexibility necessary to enable innovation in next-generation communication architectures for the smart grid. This level of flexibility allows OpenFlow to provide all features of MPLS and also allows OpenFlow devices to co-exist with existing MPLS devices. The simulation results in this paper demonstrate that OpenFlow performs as well as MPLS, and may therefore be considered an alternative to MPLS for smart grid applications.

Quality of Transmission Awareness in Converged Electronic and Optical Networks with OpenFlow

OpenFlow, as a unified operator-friendly manageable network control approach, has benefits of supporting the convergence of electronic packet and optical circuit networks as well as quality-of-transmission (QoT) awareness. We experimentally present the QoT-awareness in converged OpenFlow networks with (i) QoT-aware wavelength reassignment (ii) QoT-aware path re-routing if the QoT is below the requirement. The experimental work validates efficient networking approach and provides a key direction for next generation software defined networks.

An Optimization Framework for QoS-Enabled Adaptive Video Streaming Over OpenFlow Networks

OpenFlow is a programmable network protocol and associated hardware designed to effectively manage and direct traffic by decoupling control and forwarding layers of routing. This paper presents an analytical framework for optimization of forwarding decisions at the control layer to enable dynamic Quality of Service (QoS) over OpenFlow networks and discusses application of this framework to QoS-enabled streaming of scalable encoded videos with two QoS levels. We pose and solve optimization of dynamic QoS routing as a constrained shortest path problem, where we treat the base layer of scalable encoded video as a level-1 QoS flow, while the enhancement layers can be treated as level-2 QoS or best-effort flows. We provide experimental results which show that the proposed dynamic QoS framework achieves significant improvement in overall quality of streaming of scalable encoded videos under various coding configurations and network congestion scenarios.

Design and Implementation of Automatic Network Topology Discovery System for International Multi-Domain Future Internet Testbed

In part because of the limitations of the TCP/IP protocols used by the current Internet, the Future Internet has become an attractive network research topic. Recently, several projects focused on the Future Internet have been launched around the globe based on the OpenFlow platform, such as those that are part of the GENI project in the U.S., the OFELIA project of FP7 in the E.U., and the FIRST project in Korea. Because OpenFlow allows researchers to design and develop innovative protocols, it could be applied in different situations for constructing desired network environments. OpenFlow is not limited to single controller environment within a single network domain. It allows network engineers to construct a multi-controller environment across various network domains. In this paper, we design and implement an automatic network topology discovery mechanism based on a multi-controller OpenFlow network. The result has been applied to a large-scale OpenFlow testbed implemented across research institutes at different sites for path-finding and management.

RISE: A Wide-Area Hybrid OpenFlow Network Testbed

The deployment of hybrid wide-area OpenFlow networks is essential for the gradual integration of OpenFlow technology into existing wide-area networks. Integration is necessary because it is impractical to replace such wide-area networks with OpenFlow-enabled ones at once. On the other hand, the design, deployment, and operation of such hybrid OpenFlow networks are often conducted intuitively without in-depth technical considerations. In this paper, we systematically discuss the technical aspects of the hybrid architecture for OpenFlow networks based on our experience so far in developing wide-area hybrid OpenFlow networks on JGN2plus and JGN-X, which are nation-wide testbed networks in Japan. We also describe the design and operation of RISE (Research Infrastructure for large-Scale network Experiments) on JGN-X, whose objective is to support a variety of OpenFlow network experiments. key words: OpenFlow, NWGN, testbed networks, operation

A Power Saving Scheme for Open Flow Network

A Power Saving Scheme for Open Flow Network

Secure Intrusion Detection and Attack Measure Selection in Virtual Network Systems

Cloud security is one of most important issues that has attracted a lot of research and development effort in past few years. Particularly, attackers can explore vulnerabilities of a cloud system and compromise virtual machines to deploy further large-scale Distributed Denial-of-Service (DDoS). DDoS attacks usually involve early stage actions such as multi-step exploitation, low frequency vulnerability scanning, and compromising identified vulnerable virtual machines as zombies, and finally DDoS attacks through the compromised zombies. Within the cloud system, especially the Infrastructure-as a-Service (IaaS) clouds, the detection of zombie exploration attacks is extremely difficult. This is because cloud users may install vulnerable applications on their virtual machines. To prevent vulnerable virtual machines from being compromised in the cloud, we propose a multi phase distributed vulnerability detection, measurement, and countermeasure selection mechanism called NICE, which is built on attack graph based analytical models and reconfigurable virtual network-based countermeasures. The proposed framework leverages Open Flow network programming APIs to build a monitor and control plane over distributed programmable virtual switches in order to significantly improve attack detection and mitigate attack consequences. The system and security evaluations demonstrate the efficiency and effectiveness of the proposed solution.

Veriflow

Networks are complex and prone to bugs. Existing tools that check configuration files and data-plane state operate offline at timescales of seconds to hours, and cannot detect or prevent bugs as they arise. Is it possible to check network-wide invariants in real time , as the network state evolves? The key challenge here is to achieve extremely low latency during the checks so that network performance is not affected. In this paper, we present a preliminary design, VeriFlow, which suggests that this goal is achievable. VeriFlow is a layer between a software-defined networking controller and network devices that checks for network-wide invariant violations dynamically as each forwarding rule is inserted. Based on an implementation using a Mininet OpenFlow network and Route Views trace data, we find that VeriFlow can perform rigorous checking within hundreds of microseconds per rule insertion.

OpenFlow: Meeting carrier-grade recovery requirements

OpenFlow, initially launched as a technology-enabling network and application experimentation in a campus network, has a disruptive potential in designing a flexible network, fostering innovation, reducing complexity and delivering the right economics. This paper focuses on fault tolerance of OpenFlow to deploy it in carrier-grade networks. The carrier-grade network has a strict requirement that the network should recover from the failure within a 50ms interval. We apply two well-known recovery mechanisms to OpenFlow networks: restoration and protection, and run extensive emulation experiments. In OpenFlow, the controlling software is moved to one or more hardware modules (controllers) which can control many switches. For fast failure recovery, the controller must notify all the affected switches about the recovery action within ms interval. This leads to a significant load on the controller. We show that OpenFlow may not be able to achieve failure recovery within a 50ms interval in this situation. We add the recovery action in the switches themselves so that the switches can do recovery without contacting the controller. We show that this approach can achieve recovery within 50ms in a large-scale network serving many flows.

Abstractions for network update

Configuration changes are a common source of instability in networks, leading to outages, performance disruptions, and security vulnerabilities. Even when the initial and final configurations are correct, the update process itself often steps through intermediate configurations that exhibit incorrect behaviors. This paper introduces the notion of consistent network updates---updates that are guaranteed to preserve well-defined behaviors when transitioning mbetween configurations. We identify two distinct consistency levels, per-packet and per-flow, and we present general mechanisms for implementing them in Software-Defined Networks using switch APIs like OpenFlow. We develop a formal model of OpenFlow networks, and prove that consistent updates preserve a large class of properties. We describe our prototype implementation, including several optimizations that reduce the overhead required to perform consistent updates. We present a verification tool that leverages consistent updates to significantly reduce the complexity of checking the correctness of network control software. Finally, we describe the results of some simple experiments demonstrating the effectiveness of these optimizations on example applications.

KREONET 기반의 광역 규모 오픈플로우 네트워크 구축 및 성능 분석

최근 네트워크 가상화 기능 및 망에 대한 프로그래밍의 용이성을 제공해 줄 수 있는 기반 기술로 오픈플로우 기술이 주목 받고 있다. 국내에서는 캠퍼스 실험실 수준의 로컬 망에서 오픈플로우 기술의 적용 및 Layer 3을 경유한 캠퍼스 망 간의 연동이 이뤄지고 있지만 IP 계층에서의 네트워크 지연 등으로 인한 성능 저하가 문제되고 있다. 본 논문에서는 로컬 망 수준이 아닌 국가과학기술연구망 기반의 광역 규모 오픈플로우 망을 순수 Layer 2상에서 설계 및 구축하고 종단간 Round-trip Time 측정, TCP/UDP 성능 테스트를 통해 오픈플로우 망과 오픈플로우 적용 전 일반 망의 성능을 비교 분석한다. 분석 결과, 광역 규모의 오픈플로우 망은 일반 망과 비교할 때, UDP 스트림에 대한 초반 패킷 손실 문제를 제외하고 대등한 수준의 성능을 보였다. 또한, 초반 UDP 패킷 손실로 인한 성능 저하 현상은 컨트롤러 상에 반복 유입되는 동일한 "Packet_in" 이벤트에 대한 예외 처리를 구현함으로써 개선시킬 수 있었다. Recently, OpenFlow has been paid attention to as a fundamental technology which provides a function of virtualization and programmability in network. In Korea, deployment of OpenFlow networks in campuses and the interconnection between them through tunneling in layer 3 has been performed. However, the performance of the interconnected networks is decreased due to delay in IP layer. In this paper, we design and deploy nation-wide, not local, OpenFlow networks in a pure layer 2 environment over KREONET. After that, we do end-to-end Round-trip Time measurements and TCP/UDP performance tests in OpenFlow and normal networks, and do comparison and analysis on the test results. The results show that the nation-wide OpenFlow networks provide equal performance to normal networks except for the initial packet loss for UDP streaming. In regards to the performance decrease due to early UDP packet loss, we can mitigate it by implementing exceptional procedures in a controller which deal with the same continuous "Packet_in" events.

Distant Location Selection Using Genetic Algorithm for Live Migration Method in OpenFlow Networks

In the last decade, the massive undersea earthquake and Tsunami occurred in Taiwan on Tuesday December 26, 2006 and Japan on Friday March 11, 2011. Those natural disasters had affected the telecommunication in the worldwide. They disrupted the infrastructures including not only Internet services but also business and financial transactions. Thus, keeping the system and functions alive are particularly crucial to many organizations relying on them. Migration is one of the solutions to keep the systems alive. This paper introduces a migration technique to migrate network systems from origin sites to other remote sites. We propose a Genetic Algorithm (GA) approach to solve shortest path problems for selecting the best possible remote site prior to initiate a migration. Network virtualization in OpenFlow technology is particularly valuable in the implementation to relocate the systems by using network segmentation technique.

Demonstrating generalized virtual topologies in an openflow network

Network Virtualization (NV) is one of the most promising approaches to enable innovation in today’s network. Generally speaking, NV refers to the possibility of pooling together low–level hardware and software resources belonging to a networked system into a single administrative entity. In such a way network resources could be effectively shared in a transparent way among different logical network instances corresponding to different virtual network topologies. A recent approach toward Network Virtualization has been proposed through FlowVisor [1], whose aim is to leverage on the specific features of an OpenFlow–controlled network [2] to share the same hardware forwarding plane among multiple logical networks. As highlighted by the authors in [1], one of the major limitations of FlowVisor is the inability to establish virtual topologies not restricted by the underpinning physical topology. As a consequence, FlowVisor is unable to provide researchers flexibility in designing their experiments with arbitrary network topologies on a defined physical infrastructure. The architecture presented in Chapter 2 of this paper, called ADVisor (ADvanced FlowVisor), provides the functionalities to overcome the above-mentioned FlowVisor’s limitation by allowing the instantiation of generalized virtual topologies in a OpenFlow network through the implementation of virtual links as aggregation of multiple physical links and OpenFlow-enabled switches. In this demo we will show the configuration of a simple virtual topology performed through a Web-based control framework which allows the reservation of network resources (nodes, links and bandwidth) and the management of virtual resources (virtual links and virtual ports). We will also demonstrate the effective instantiation of the virtual topology by running a synthetic traffic generator application.

Virtual networks: isolation, performance, and trends

Currently, there is a strong effort of the research community in rethinking the Internet architecture to cope with its current limitations and support new requirements. Many researchers conclude that there is no one-size-fits-all solution for all of the user and network provider needs and thus advocate for a pluralist network architecture, which allows the coexistence of different protocol stacks running at the same time over the same physical substrate. In this paper, we investigate the advantages and limitations of the virtualization technologies for creating a pluralist environment for the Future Internet. We analyze two types of virtualization techniques, which provide multiple operating systems running on the same hardware, represented by Xen, or multiple network flows on the same switch, represented by OpenFlow. First, we define the functionalities needed by a Future Internet virtual network architecture and how Xen and OpenFlow provide them. We then analyze Xen and OpenFlow in terms of network programmability, processing, forwarding, control, and scalability. Finally, we carry out experiments with Xen and OpenFlow network prototypes, identifying the overhead incurred by each virtualization tool by comparing it with native Linux. Our experiments show that OpenFlow switch forwards packets as well as native Linux, achieving similar high forwarding rates. On the other hand, we observe that the high complexity involving Xen virtual machine packet forwarding limits the achievable packet rates. There is a clear trade-off between flexibility and performance, but we conclude that both Xen and OpenFlow are suitable platforms for network virtualization.

Carving research slices out of your production networks with OpenFlow

No abstract available.

Data reconciliation of an open channel flow network using modal decomposition

This article presents a method to estimate flow variables for an open channel network governed by the linearized Saint-Venant equations and subject to periodic forcing. The discharge at the upstream end of the system and the stage at the downstream end of the system are defined as the model inputs; the flow properties at selected internal locations, as well as the other external boundary conditions, are defined as the outputs. Both inputs and outputs are affected by noise and we use the model to improve the data quality. A spatially dependent transfer matrix in the frequency domain is constructed to relate the model input and output using modal decomposition. A data reconciliation technique is used to incorporate the error in the measured data and results in a set of reconciliated external boundary conditions; subsequently, the flow properties at any location in the system can be accurately estimated from the input measurements. The applicability and effectiveness of the method is demonstrated with a case study of the river flow subject to tidal forcing in the Sacramento-San Joaquin Delta, in California. We used existing USGS sensors in place in the Delta as measurement points, and deployed our own sensors at selected locations to produce data used for the validation. The proposed method gives an accurate estimation of the flow properties at intermediate locations within the channel network.

OpenFlow

This whitepaper proposes OpenFlow: a way for researchers to run experimental protocols in the networks they use every day. OpenFlow is based on an Ethernet switch, with an internal flow-table, and a standardized interface to add and remove flow entries. Our goal is to encourage networking vendors to add OpenFlow to their switch products for deployment in college campus backbones and wiring closets. We believe that OpenFlow is a pragmatic compromise: on one hand, it allows researchers to run experiments on heterogeneous switches in a uniform way at line-rate and with high port-density; while on the other hand, vendors do not need to expose the internal workings of their switches. In addition to allowing researchers to evaluate their ideas in real-world traffic settings, OpenFlow could serve as a useful campus component in proposed large-scale testbeds like GENI. Two buildings at Stanford University will soon run OpenFlow networks, using commercial Ethernet switches and routers. We will work to encourage deployment at other schools; and We encourage you to consider deploying OpenFlow in your university network too