Flow Table Rules Research Articles

Measuring the Consistency Between Data and Control Plane in SDN

Software Defined Networking (SDN) simplifies network control and management by decoupling the control plane from the data plane. However, the actual packet behaviors, conforming to the rules in the data plane flow tables, may violate the original policies in the controller due to the inconsistency between the data plane and control plane. To address this problem, we propose 2MVeri, a framework for measuring the consistency between the Data and Control plane, defined as the consistency between the control plane policies and data plane rules. 2MVeri uses a modules, a Bloom filter and a two-dimensional vector as a tag which is inserted in the packet header and is updated in each switch that the packet traverses. By exploiting path information compressed in the tag, 2MVeri can verify the consistency between the data and control plane. Moreover, when verification fails, 2MVeri is able to localize the faulty switch. Experimental results show that in the k = 4 fat tree topology, the verification accuracy of 2MVeri is as high as 100%. In addition, when the actual path is inconsistent with the expected path, 2MVeri can locate the wrong switch with an accuracy of 99.8%.

SFTO-Guard: Real-time detection and mitigation system for slow-rate flow table overflow attacks

The simplified data plane of Software-Defined Network (SDN) should be able to process packets from the entire network. However, the flow table size constrains the data plane forwarding capacity and may cause malicious attacks. In this paper, we study the slow-rate flow table overflow (SFTO) attack, which causes flow table overflow by sending unmatched packets at a slow rate to trigger flow entry installation, occupying the flow table space. To protect the availability of flow tables and the forwarding efficiency of normal flows, we propose a real-time SFTO attack detection and mitigation system based on rule number prediction and adaptive eviction proportion called SFTO-Guard. The SFTO-Guard consists of three modules: rule prediction module, attack detection module and attack mitigation module. Rule prediction module monitors the rule number in the flow tables and makes real-time predictions. When the predicted value reaches the attack threshold, the module collects the rules in flow tables and extracts features, then starts the attack detection module. When SFTO attack is detected, the attack mitigation module adaptively calculates the rule eviction proportion based on the predicted rule number and the attack detection results, and evicts suspected flow entries to prevent flow table overflow. Experiments on SFTO-Guard show that the proposed system can mitigate SFTO attacks effectively with low system overhead and short response time, it can limit malicious rules in flow tables to less than 10% and it is practicable in SDN deployments.

Raze policy conflicts in SDN

Software Defined Networking (SDN) enables flexible network management with a well-defined abstraction between control and data plane. In this way, operators could issue the policies, e.g., forwarding path, flow counting and rate limiting, from the control plane, which will be enforced by the flow table rules in the data plane. However, multiple active policies with the same priority will potentially trigger conflicts among policies with overlapped flow space, causing the flow table explosion. In contrast to the local switch conflict resolution schemes proposed by previous works, this paper tackles the same problem from a different angle and resolves the policy conflict problem by coordinating all switches under a global centralized view. Specifically, we propose COnflict RAzor (CORA), which tremendously reduces the storage cost of conflicting policies leveraging the global network information obtained in the controller. The basic idea of CORA is migrating policies causing large explosions across the network if necessary, while keeping the semantics equivalence. We prove CORA’s NP hardness and propose a heuristic to efficiently search a near-optimal policy migration strategy. Our experiments demonstrate that, CORA can effectively reduce the flow table storage occupation by averagely 79.8% within less than 40 s, which is 47.9% more efficient than the state-of-the-art.

An Efficient Forensics Architecture in Software-Defined Networking-IoT Using Blockchain Technology

A Potential solution for solving forensic is the use of blockchain in software-defined networking (SDN). The blockchain is a distributed peer-to-peer network that can be utilized on SDN-based Internet of Things (IoT) environments for security provisioning. Hence, to meet some challenges in digital forensics such as data integrity, evidence deletion or alteration, blockchain is used. However, some problems such as poor attack detection and slow processing existed in previous works. To address these issues, an efficient forensics architecture is proposed in SDN-IoT that establishes the Chain of Custody (CoC) in blockchain technology. The proposed SDN-based IoT architecture is initiated with flow table rules on switches for the three different traffics Voice over Internet Protocol (VoIP), File Transfer Protocol (FTP), and Hyper Text Transfer Protocol (HTTP). In this work, overloaded switches migrate the packets to nearby switches to balance the packet flow. The packets disobeying flow rules will be discarded by switches. The blockchain-based distributed controller in this forensic architecture is designed to use the Linear Homomorphic Signature (LHS) algorithm for validating users. Each controller is fed with a classifier that uses the Neuro Multi-fuzzy to classify malicious packets based on packet features. The logs of events are used and stored on the blockchain in the proposed SDN-IoT architecture. We evaluated the performance of our forensic architecture and compared it to the existing model using various performance measures. Our evaluation results demonstrate performance improvement by reducing delay, response time and processing time, increasing throughput, accuracy, and security parameters.

NetEgg: A Scenario-Based Programming Toolkit for SDN Policies

Recent emergence of software-defined networks offers an opportunity to design domain-specific programming abstractions aimed at network operators. In this paper, we propose scenario-based programming, a framework that allows network operators to program network policies by describing example behaviors in representative scenarios. Given these scenarios, our synthesis algorithm automatically infers the controller state that needs to be maintained along with the rules to process network events and update state. We have developed the NetEgg scenario-based programming tool, which can execute the generated policy implementation on top of a centralized controller, but also automatically infers flow-table rules that can be pushed to switches to improve throughput. We evaluate the performance of NetEgg based on the computational requirements of our synthesis algorithm as well as the overhead introduced by the generated policy implementation, and we study the usability of NetEgg based on a user study. Our results show that our synthesis algorithm can generate policy implementations in less than a second for all policies we studied, and the automatically generated policy implementations have performance comparable to their hand-crafted implementations. Our user study shows that the proposed scenario-based programming approach can reduce the programming time by 50% and the error rate by 32% compared with an alternative programming approach.

On Fair Rule Caching in Software Defined Radio Access Networks

In software defined radio access networks, base stations (BSs) operate according to commands received from a centralized controller. To avoid asking the controller frequently, BSs store these commands as rules in flow tables with limited size. This limitation necessitates fetching rules of some users from the controller causing longer processing delays. In this letter, we formulate the fair allocation of flow table spaces to the users within a cell as a mixed integer linear program which is an NP-hard problem. Nonetheless, we propose an optimal low-complexity solution. Finally, we show superior performance of this strategy versus other possible schemes.

On network update problems for software defined networks

Designing network update algorithms is an important line of research in developing software for new-generation telecommunication networks—software defined networks (SDNs). A specific case of the network update problem is seamless recovery of network configurations after the loss of some forwarding rules, as can happen, e.g., due to expiry of their timeouts. This paper initiates a systematic study of this problem using a formal SDN model. As a result, two algorithms a presented for safe and correct insertion of lost forwarding rules in SDN flow tables and it is shown that in the general case, seamless recovery of network configurations cannot be achieved without forwarding rules with multiple priorities.

NOSIX

In spite of the standardization of the OpenFlow API, it is very difficult to write an SDN controller application that is portable (i.e., guarantees correct packet processing over a wide range of switches) and achieves good performance (i.e., fully leverages switch capabilities). This is because the switch landscape is fundamentally diverse in performance, feature set and supported APIs. We propose to address this challenge via a lightweight portability layer that acts as a rendezvous point between the requirements of controller application and the vendor knowledge of switch implementations. Above, applications specify rules in virtual flow tables annotated with semantic intents and expectations. Below, vendor specific drivers map them to optimized switch-specific rule sets. NOSIX represents a first step towards achieving both portability and good performance across a diverse set of switches.

A Survey on Software-Defined Network and OpenFlow: From Concept to Implementation

Software-defined network (SDN) has become one of the most important architectures for the management of largescale complex networks, which may require repolicing or reconfigurations from time to time. SDN achieves easy repolicing by decoupling the control plane from data plane. Thus, the network routers/switches just simply forward packets by following the flow table rules set by the control plane. Currently, OpenFlow is the most popular SDN protocol/standard and has a set of design specifications. Although SDN/OpenFlow is a relatively new area, it has attracted much attention from both academia and industry. In this paper, we will conduct a comprehensive survey of the important topics in SDN/OpenFlow implementation, including the basic concept, applications, language abstraction, controller, virtualization, quality of service, security, and its integration with wireless and optical networks. We will compare the pros and cons of different schemes and discuss the future research trends in this exciting area. This survey can help both industry and academia R&D people to understand the latest progress of SDN/OpenFlow designs.