Software-defined Control Plane Research Articles

Intrusion prevention with attack traceback and software-defined control plane for campus networks

As traditional networks, the software-defined campus network also suffers from intrusion attacks. Current solutions for intrusion prevention cannot meet the requirements of the campus network. Existing methods of attack traceback are either limited to specific protocols or incur high overhead. To protect the data center (DC) of the campus network from internal and external attacks, we propose an Intrusion Prevention System (IPS) based on the coordinated control between the detection engine, the attack traceback agent, and the software-defined control plane. Our solution includes a novel algorithm to infer the best switch port for defending different attacks of varied scales based on the inverse HSA (Header Space Analysis) and the global view of the software-defined controller. The proposed scheme can effectively and timely block the malicious traffic not only protecting victim hosts from attacks but also preventing the whole network from suffering unwanted transmission burden. The proposed IPS is deployed on the bypass of the DC switch and collects network traffic by port mirroring. Compared with the traditional serial deployment, the new design helps defend the DC internal attacks, reduce the probability of network congestion, and avoid the single point of failure. The experimental results show that the overhead of our IPS is very low, which enables it to meet the real-time requirements. The average defense time is between 10 and 14 ms for the data center internal attacks of different scales. For external attacks, the maximum defense time is about 76 ms for a large-scale network with 100 switches.

Blockchain-Assisted Spectrum Trading Between Elastic Virtual Optical Networks

in communication networks, network virtualization can usually provide better capacity utilization and quality of service (QoS) than what can be achieved otherwise. Under this operation, once the capacity of a virtual optical network (VON) is allocated, it will be static for a certain period, for example, a service contract period. However, in reality, the actual traffic demand of a VON always fluctuates, which would lead to a mismatch between the capacity assigned and the actual traffic demand carried. This mismatch would further cause degradation of provisioned network services and inefficiency in assigned network capacity. To overcome this issue, we propose a new scheme, called spectrum trading (ST), to trade spectrum resources between VONs in the context of an elastic optical network (EON). The key idea is to allow different VONs to trade their spectrum resources according to their actual capacity requirement at different time instants. A VON with unused spectra can trade away its unused spectra to other VONs that are short of spectrum resources at that time. in exchange, it is rewarded with some credit for its contribution to the ST community, which it can then use later to obtain extra capacity, if needed. The trust-worthiness of the trading records between the VONs is ensured in a distributed fashion through a blockchain- assisted ledger that is updated whenever a new trade occurs. A software-defined control plane is also developed to enable spectrum trading with the support of the blockchain-assisted ledger. The performance of the ST scheme is evaluated and compared with the scenario without such trading. Results show that the proposed ST scheme is efficient in improving the QoS of each VON and significantly improves overall network capacity utilization.

RETRACTED ARTICLE: Bayesian trust analysis of flooding attacks in distributed software defined networking nodes

As the networking infrastructure is becoming complex, there is a parallel increase in the networking scenario to become more vulnerable to various types of sophisticated malicious attacks. This leads to the data and information loss. The most feasible way to reduce the vulnerable and malicious attacks is by evaluating trust of the interacting agents in a network. The primary objective of this paper is to analyze the flooding attacks caused due to the communication protocols like TCP and UDP in software defined spine leaf topology. The trust analysis is done using Bayesian networks for a reliable communication network. The probability and the causal effect of the denial of service in the proposed distributed networking scenario are reasoned out. The trust analysis will help to increase the confidence over a dedicated communication at the time of malicious attack over the distributed network. This analysis will enable the software defined control plane to make a crucial and needed decision over its communication with other nodes during compromised security attack through communication protocols.

P4VBox: Enabling P4-Based Switch Virtualization

Virtualization has become the powerhouse for several networking concepts, from local area networks (VLANs) to software switches, software-defined control plane, etc. Recent proposals like HyPer4, HyperVDP, and P4Visor brought the concept to the forwarding plane, by enabling emulation of several network contexts and/or composing several functions through a single program. In spite of the progress achieved, the real power of forwarding plane virtualization remains untapped. In this letter, we present P4VBox, a reconfigurable architecture for data plane virtualization. P4VBox provides parallel execution and hot-swapping of virtual switch instances, without requiring switch source code (for either emulation or program composition). We experimented P4VBox on a NetFPGA-SUME board with three virtual switches: a layer-2 switch, a simple router, and a firewall. Area occupation measurements evidence the feasibility of running up to 13 virtual switches in parallel. Compared to existing work, performance data show an improvement of up to two orders of magnitude for bandwidth and six orders for latency.

5G-XHaul: A Novel Wireless-Optical SDN Transport Network to Support Joint 5G Backhaul and Fronthaul Services

The increased carrier bandwidth and the number of antenna elements expected in 5G networks require a redesign of the traditional IP-based backhaul and CPRI-based fronthaul interfaces used in 4G networks. We envision future mobile networks to encompass these legacy interfaces together with novel 5G RAN functional splits. In this scenario, a consistent transport network architecture able to jointly support backhaul and 4G/5G fronthaul interfaces is of paramount importance. In this article we present 5G-XHaul, a novel transport network architecture featuring wireless and optical technologies and a multi-technology software defined control plane, which is able to jointly support backhaul and fronthaul services. We have deployed and validated the 5G-XHaul architecture in a city-wide testbed in Bristol.

Software-defined networking control plane for seamless integration of multiple silicon photonic switches in Datacom networks.

Silicon photonics based switches offer an effective option for the delivery of dynamic bandwidth for future large-scale Datacom systems while maintaining scalable energy efficiency. The integration of a silicon photonics-based optical switching fabric within electronic Datacom architectures requires novel network topologies and arbitration strategies to effectively manage the active elements in the network. We present a scalable software-defined networking control plane to integrate silicon photonic based switches with conventional Ethernet or InfiniBand networks. Our software-defined control plane manages both electronic packet switches and multiple silicon photonic switches for simultaneous packet and circuit switching. We built an experimental Dragonfly network testbed with 16 electronic packet switches and 2 silicon photonic switches to evaluate our control plane. Observed latencies occupied by each step of the switching procedure demonstrate a total of 344 µs control plane latency for data-center and high performance computing platforms.

Wireless Resource Scheduling in Virtualized Radio Access Networks Using Stochastic Learning

How to allocate the limited wireless resource in dense radio access networks (RANs) remains challenging. By leveraging a software-defined control plane, the independent base stations (BSs) are virtualized as a centralized network controller (CNC). Such virtualization decouples the CNC from the wireless service providers (WSPs). We investigate a virtualized RAN, where the CNC auctions channels at the beginning of scheduling slots to the mobile terminals (MTs) based on bids from their subscribing WSPs. Each WSP aims at maximizing the expected long-term payoff from bidding channels to satisfy the MTs for transmitting packets. We formulate the problem as a stochastic game, where the channel auction and packet scheduling decisions of a WSP depend on the state of network and the control policies of its competitors. To approach the equilibrium solution, an abstract stochastic game is proposed with bounded regret. The decision making process of each WSP is modeled as a Markov decision process (MDP). To address the signalling overhead and computational complexity issues, we decompose the MDP into a series of single-agent MDPs with reduced state spaces, and derive an online localized algorithm to learn the state value functions. Our results show significant performance improvements in terms of per-MT average utility.

Software-defined Naming, Discovery and Session Control for IoT Devices and Smart Phones in the Constraint Networks

This paper suggests the naming for Internet of Things (IoT) devices where a Fully Qualified Domain Name (FQDN) is assigned to each device instead of the IP address. This naming method enables the user equipments (UEs) to reach IoT devices easily. Nowadays, one of the main challenges in IoT is the discovery scheme. This paper explores the discovery scheme that can operate under the current DNS and its legacy Resource Record (RR) format. The IoT device with the group name of GrpN, the domain of example.com and the device name of IoT77 can be discovered by means of the URL: GrpN.example.com/IoTD77. This paper explores how the UE behind the Network Address Translation (NAT) device discovers the destination IoT devices and establishes IoT Device-to-User Equipment (D2U) data session under the condition that IoT access networks tend to be constraint networks. Here, the discovery and session establishment processes are controlled by the software-defined control plane controller.

On control plane algorithms for Carrier Ethernet networks: Unicast, multicast provisioning and control traffic reduction

Carrier Ethernet systems are actively replacing SONET/SDH networks for transport of provider data. After much standardization in both the IEEE and the IETF, Carrier Ethernet has evolved as a rich carrier-class technology. The standards do not focus on specific implementation aspects of providing guaranteed service-oriented features that are intrinsic towards successful replacement of SONET/SDH by Carrier Ethernet solutions. In this paper, we consider the engineering aspects of the Carrier Ethernet software defined control plane for provisioning, managing and maintaining services. Specifically, we propose methods for provisioning guaranteed unicast services considering the underlying network state. The problem is difficult due to the complex nature of admission control coalesced with subjective user requirement that is not easy to rationalize across a network. We also investigate the problem of sub-50ms protection of multicast connections and propose a unique, tractable algorithm within the control plane for enabling carrier-class multicast services. Finally, we focus on overall control traffic reduction schemes. An intuitive merging algorithm is proposed that minimizes control traffic in Carrier Ethernet domains. A simulations study extensively evaluates the proposed techniques.

Lightness: A Function-Virtualizable Software Defined Data Center Network With All-Optical Circuit/Packet Switching

Modern high-performance data centers are responsible for delivering a huge variety of cloud applications to the end-users, which are increasingly pushing the limits of the currently deployed computing and network infrastructure. All-optical dynamic data center network (DCN) architectures are strong candidates to overcome those adversities, especially when they are combined with an intelligent software defined control plane. In this paper, we report the first harmonious integration of an optical flexible hardware framework operated by an agile software and virtualization platform. The LIGHTNESS deeply programmable all-optical circuit and packet switched data plane is able to perform unicast/multicast switch-over on-demand, while the powerful software defined networking (SDN) control plane enables the virtualization of computing and network resources creating a virtual data center and virtual network functions (VNF) on top of the data plane. We experimentally demonstrate realistic intra DCN with deterministic latencies for both unicast and multicast, showcasing monitoring, and database migration scenarios each of which is enabled by an associated network function virtualization element. Results demonstrate a fully functional complete unification of an advanced optical data plane with an SDN control plane, promising more efficient management of the next-generation data center compute and network resources.

On the Design, Implementation, Analysis, and Prototyping of a 1- μs, Energy-Efficient, Carrier-Class Optical-Ethernet Switch Router

The integration of layer-2 carrier-class packet technologies with optical transport network is termed as packet-optical integration and is being deployed by service providers for migration from legacy SONET/SDH systems. We present a state-of-the-art carrier-class switch router that facilitates packet-optical integration, thereby achieving best of both the optical and packet worlds. The premise of this switch router is the use of carrier ethernet technology as a packet enabler for achieving statistical multiplexing at fine granularities, while maintaining rich operations, administration, maintenance, and provisioning features. To this end, we proposed the omnipresent ethernet concept that uses binary routing and source routing to support: 1) layer 2 and layer 3 switching and routing, 2) low latency of the order of 1–5 μs even for layer 3 processing, and 3) low-energy consumption. The omnipresent ethernet framework leads to a software defined networking solution, whereby a centralized controller admits services and configures nodes based on homogenous networking parameters. In this paper, we report a commercial implementation of a packet-optical network demonstrated by our designed, fabricated, developed carrier ethernet switch router (CESR). We discuss the architectural considerations, design, and implementation of both the hardware and the control software. A switch architecture achieving 1-μs port-to-port delay across layers 1, 2, and 2.5 based on an opportunistic principle of virtual output queuing is showcased. The novelty is a scalable 96-Gbps cross connect fabric implemented in a field programmable gate array using a two-stage buffer system. A multistate software defined control plane is also reported. An exact analysis of the switch architecture using a combinatorial G/G/1 model is developed. An energy audit of the CESR is showcased. A test bed in the lab replicating a field deployment is presented. An exhaustive set of test cases are developed to test our designed CESR. Results are shown for latency, throughput, service support, frame-size stability, power, and bit error rate, thus validating our design.