Software Defined Networking Switches Research Articles

Multicast Routing Model to Minimize Number of Flow Entries in Software-Defined Network

Software-defined network (SDN) is a network that the centralized SDN controller stores flow entries in the flow table of each SDN switch and controls packet flows as instructed by the stored flow entries. When a multicast service is provided in an SDN, the SDN controller stores a multicast entry dedicated for a multicast group in each SDN switch. It is necessary to suppress the number of flow entries required to set up a multicast tree due to the limited capacity of the flow table. In a conventional research, a multicast routing model that suppresses the number of multicast entries in one multicast request by replacing a part of them with unicast entries has been devised. However, since this conventional model individually determines a multicast tree route for each request, unicast entries configured for the same receiver are distributed in various SDN switches when multiple multicast services are requested. As a result, there is still the possibility of improving the reduction of the number of flow entries. In this paper, we propose a multicast routing model for multiple multicast requests that minimizes the number of flow entries. This proposed model determines multiple multicast tree routes simultaneously so that a unicast entry configured for the same receiver and stored in the same SDN switch is shared by multicast trees. We formulate the proposed model as an Integer Linear Programming (ILP) problem. Numerical results show that the proposed model reduces the required number of flow entries compared to the conventional model.

Network-Wide Forwarding Anomaly Detection and Localization in Software Defined Networks

A crucial requirement for Software Defined Network (SDN) is that data plane forwarding behaviors should always agree with control plane policies. Such requirement cannot be met when there are <i>forwarding anomalies</i>, where packets deviate from the paths specified by the controller. Most anomaly detection methods for SDN install dedicated rules to collect statistics of each flow, and check whether the statistics conform to the &#x201C;flow conservation principle&#x201D;. We find these methods have a limited detection scope: they look at one flow each time, thus can only check a small number of flows simultaneously. In addition, dedicated rules for statistics collection can impose a large overhead on flow tables of SDN switches. To this end, this paper presents FOCES, a network-wide forwarding anomaly detection and localization method in SDN. Different from previous methods, FOCES applies a new kind of flow conservation principle at network wide, and can check forwarding behaviors of <i>all</i> flows in the network simultaneously, without installing any dedicated rules. Finally, FOCES applies a voting-based method to localize malicious switches when anomalies are detected. Experiments with four network topologies show that FOCES can achieve a detection precision higher than 90&#x0025;, when the packet loss rate is no larger than 10&#x0025;, and a localization accuracy of around 80&#x0025; when the packet loss rate is no larger than 5&#x0025;.

Flow aggregation for large-scale SDNs with scattered address space allocation

Software-Defined Networking (SDN) has obtained a lot of attention in the last decade and has played a significant role in the development of next-generation networks (NGN). IP networks can also benefit from the SDN evolution to fulfill the data traffic booming. However, the transition of the traditional networking model to SDN architectures poses scalability issues due to the possible flow entry explosion in SDN switches. The limited size of flow-table of SDN switches is not sufficient to handle thousands upon thousands of flows in a large-scale IP network. On the other hand, the interleaved allocation of non-contiguous IP addresses also leads to inefficient routing aggregation and reduces the feasibility of the serious implementation of SDN severely. Therefore, we propose an aggressive flow aggregation scheme—Destination Address Translation and Source-Port Translation on Demand (DATSPToD), which is based on the modified address and port rewriting. DATSPToD enables the aggregation of flow entries in SDNs by translating the destination addresses of multiple same-destination flows with different-source into one flow entry, thus significantly reducing the volume of flow-table occupancy of core-layer SDN switches, even in freely scattered IP address space environments. Simulation results show that DATSPToD outperforms non-aggregation and both wildcard aggregation schemes for a significant reduction of the flow-table occupancy under varied traffic patterns and topologies, especially in large-scale SDNs such as the Internet during the SDN migration period. Compared to the competed schemes under varied traffic patterns and topologies, the simulation results of the DATSPToD could significantly reduce flow-table occupancies by at least1 13%, and by up to 52%. The table-miss rates could be reduced from 11% to 66%.

Minimize the delays in software defined network switch controller communication

SummarSoftware Defined Networks (SDN) is now the leading framework for the existing network infrastructure. Increasing Internet traffic leads to attract SDN infrastructure in large networks like enterprise or data centers by using logical centralize control concept. This abstraction, flexibility, and agility enable the network managers to view the global picture of the network and flow the traffic in an efficient way to avoid congestion and traffic delay issues. However, besides the benefits, the internal mechanism of SDN has some serious challenges, which leads flow table overflow, congestions, controller and switch overloading, link failure and latency issues. This research focus on the delays produced during communication between control plane and data plane due to the parameters like rule formation, mismatches, buffer/queue constraints, flow entries, controller resource utilization or duplicate flow packets, and unordered packets. These delays become more critical in large networks especially in‐case of reactive modes. Furthermore, the frequent rule composition and installation causes extra burden at the controller, this control communication needs prompt reply to forward the traffic in a stipulated time. This article presents the Efficient Resource Management Scheme (ERMS), which efficiently handle the inter‐communication delay and minimize the network overheads. The experiment results depict the better performance of ERMS during the communication between controller and switch by efficient packet handling and flow rules management while minimizes the overheads on controller. The proposed solution enhances the performance of SDN networks by improving the quality of services parameters.

Fine-grained flow classification using deep learning for software defined data center networks

in a data center network, accurately classifying flow is the key to optimal schedule flow. However, the existing classification methods cannot meet the demand of real networks in terms of classification performance, detection latency, and control overhead. Thus, by combining the ability of deep learning to describe the multi-dimensional features, and the advantage of software-defined networking (SDN) in centrally controlling the network from a global viewpoint, this paper proposes a fine-grained flow classification method. This paper uses random forest technology to select eight important features in three dimensions—time distribution feature of flow, real-time feature of flow and packet header feature—for the classification model. First, this paper proposes a 2-classification scheme with a two-level architecture of pre-classification and exact-classification to detect elephant/mice flows. The pre-classification model using deep residual learning + A-Softmax with cost-sensitive is deployed on a SDN switch at the network edge to filter out a large number of mice flows. The exact-classification model using deep residual learning + AM-Softmax is deployed on the SDN controller to accurately identify the elephant flows. Second, this paper proposes a 4-classification scheme based on gated recurrent unit (GRU) to detect elephant/cheetah/tortoise/porcupine flows. Finally, the experiment results show that, when the 5th packet of a flow arrives, the 2-classification scheme can achieve a recall of up to 97.31%, an accuracy of up to 93.6%, a control overhead of 0.1kbps, and a detection latency of 7 ms. At the same time, the 4-classification scheme can achieve a recall, an accuracy, a false positive rate (FPR), a Kappa, a control overhead, and a detection latency of 83.58%, 86.53%, 5.02%, 0.797, 0.61kbps and 7.5 ms on an average, respectively. Compared with the existing methods (FlowSeer, NELLY and ESCA), all performance measures are improved to different degrees. At the same time, we also confirm the generalization of selected features and of the designed flow classification model.

Towards distributed emergency flow prioritization in software‐defined networks

SummaryEmergency services must be able to transfer data with high priority over different networks. With 5G, slicing concepts at mobile network connections are introduced, allowing operators to divide portions of their network for specific use cases. In addition, Software‐Defined Networking (SDN) principles allow to assign different Quality‐of‐Service (QoS) levels to different network slices.This paper proposes a microservices‐based framework, able to run both centralized and distributed, that guarantees the required bandwidth for the emergency flows and maximizes the best‐effort flows over the remaining bandwidth based on their priority. The proposed framework consists of an offline linear model, allowing to optimize the problem for a batch of flow requests. For dynamic situations, an online approach is also required in the framework to handle new incoming flows by calculating the path with a shortest path algorithm and utilizing a greedy approach in assigning bandwidth to the intermediate flows.In this article, the linear model is evaluated through simulation, the distributed architecture is evaluated through emulation while the online approach is validated through physical experiments with SDN switches. The results show that the linear model is able to guarantee the resource allocation for the emergency flows while optimizing the best‐effort flows with a sub‐second execution time. The distributed architecture is able to split up the managed network into different parts, allowing division of work between controllers. As a proof‐of‐concept, a prototype with Zodiac switches validates the feasibility of the centralized framework.

PopFlow: a novel flow management scheme for SDN switch of multiple flow tables based on flow popularity

Pipeline processing is applied to multiple flow tables (MFT) in the switch of software-defined network (SDN) to increase the throughput of the flows. However, the processing time of each flow increases as the size or number of flow tables gets larger. In this paper we propose a novel approach called PopFlow where a table keeping popular flow entries is located up front in the pipeline, and an express path is provided for the flow matching the table. A Markov model is employed for the selection of popular entries considering the match latency and match frequency, and Queuing theory is used to model the flow processing time of the existing MFT-based schemes and the proposed scheme. Computer simulation reveals that the proposed scheme substantially reduces the flow processing time compared to the existing schemes, and the difference gets more significant as the flow arrival rate increases.

FlowMan: QoS-Aware Dynamic Data Flow Management in Software-Defined Networks

In this paper, we study the problem of data flow management in the presence of heterogeneous flows — elephant and mice flows — in software-defined networks (SDNs). Most of the researchers considered the homogeneous flows in SDN in the existing literature. The optimal data flow management in the presence of heterogeneous flows is NP-hard. Hence, we propose a game theory-based heterogeneous data flow management scheme, named FlowMan. In FlowMan, initially, we use a generalized Nash bargaining game to obtain a sub-optimal problem, which is NP-complete in nature. By solving it, we get the Pareto optimal solution for data-rate associated with each switch. Thereafter, we use a heuristic method to decide the flow-association with the switches, distributedly, which, in turn, helps to get a Pareto optimal solution. Extensive simulation results depict that FlowMan is capable of ensuring quality-of-service (QoS) for data flow management in the presence of heterogeneous flows. In particular, FlowMan is capable of reducing network delay by 77.8–98.7%, while ensuring 24.6–47.8% increase in network throughput, compared to the existing schemes such as FlowStat and CURE. Additionally, FlowMan ensures that per-flow delay is reduced by 27.7% with balanced load distribution among the SDN switches.

PrePass: Load balancing with data plane resource constraints using commodity SDN switches

Software Defined Networks (SDN) enables the network control logic to be designed and operated on a global network view by decoupling the control plane from the data plane. Due to versatility and universality of network applications, network layer load balancing is crucial to ensure operational efficiency in a network with a variety of workloads. However, limited resources (e.g., TCAM and computing capacity) on SDN switches bring critical challenges for load balancing. On one hand, though some solutions satisfy resource constraints, these methods do not work well especially for network asymmetry and traffic dynamics. On the other hand, most previous works achieve load balancing with additional hardware or software resources, which increase the system cost and limit the applicability. Thus, this paper tries to deal with the following challenge: how to achieve load balancing without additional device and software on commodity switches while dealing with network/traffic uncertainties? To this end, we design and implement PrePass, which uses wildcard entries for some aggregate flows to satisfy the flow table size constraint, and performs reactive routing for newly arrived flows to achieve load balancing even with network/traffic uncertainties. We define the problem of load balancing with flow table size constraint, and prove its NP-hardness. We then present an efficient algorithm based on randomized rounding, and analyze that our algorithm can achieve constant bi-criteria approximation under most practical situations. To make our problem more robust, an extended version without traffic size knowledge is also studied. We implement PrePass on a real SDN testbed. The experimental results and extensive simulation results show that our proposed method can satisfy different resource constraints on switches, and only increase the link load ratio by about 5%-10% compared with per-flow routing scheme under various traffic scenarios.

Flow aggregation through dynamic routing overlaps in software defined networks

There are huge amounts of flows in a Software Defined Network (SDN) sharing limited flow table space in the Ternary Content Addressable Memory (TCAM) at each SDN switch. To improve TCAM efficiency for serving as many flows as possible, flow aggregation serves as a good method to overlap a set of flow routings onto a common link, such that those flows can be simultaneously handled by the same TCAM at a single SDN switch. This however leads to a larger transmission delay of the flows. To achieve a good tradeoff between flow table space and average transmission delay, in this paper we first propose an Integer Linear Program (ILP) to minimize the total cost based on proper cost definitions of those two conflicting factors. The proposed ILP assigns predefined weights to different flows for aggregation, where a weight gives the priority of a unique flow. Since the ILP method is not scalable for large network scenarios, we further propose a fast heuristic ORWFA (Overlapping Routing with Weighted Flow Aggregation) to achieve a near-optimal solution. Under the principle of High Weight Flow First (HWFF), ORWFA builds multiple spanning trees with flow destinations as the roots, and flows with different destinations are aggregated based on the corresponding spanning trees. Numerical results demonstrate the correctness of the proposed ILP and the good performance of ORWFA.

Enabling Packet Classification with Low Update Latency for SDN Switch on FPGA

Field Programmable Gate Array (FPGA) is widely used in real-time network processing such as Software-Defined Networking (SDN) switch due to high performance and programmability. Bit-Vector (BV)-based approaches can implement high-performance multi-field packet classification, on FPGA, which is the core function of the SDN switch. However, the SDN switch requires not only high performance but also low update latency to avoid controller failure. Unfortunately, the update latency of BV-based approaches is inversely proportional to the number of rules, which means can hardly support the SDN switch effectively. It is reasonable to split the ruleset into sub-rulesets that can be performed in parallel, thereby reducing update latency. We thus present SplitBV for the efficient update by using several distinguishable exact-bits to split the ruleset. SplitBV consists of a constrained recursive algorithm for selecting the bit positions that can minimize the latency and a hybrid lookup pipeline. It can achieve a significant reduction in update latency with negligible memory growth and comparable high performance. We implement SplitBV and evaluate its performance by simulation and FPGA prototype. Experimental results show that our approach can reduce 73% and 36% update latency on average for synthetic 5-tuple rules and OpenFlow rules respectively.

Routing optimization for cloud services in SDN-based Internet of Things with TCAM capacity constraint

Distributed in-network cloud architecture is a promising solution to efficiently host next generation internet-of-things (IoT) services. With the rapid increase of IoT devices and applications, the backhaul or backbone networks, which transmit IoT traffic to various in-network clouds, will experience a predicted explosion in the volume of carried traffic. To guarantee the QoS of IoT cloud services and improve the network performance, it is crucial for network operator to implement efficient routing optimization strategies for IoT traffic. As a promising networking paradigm, software-defined networking (SDN) has flexible and programmable control capability for fine-grained flows. The emergence of SDN paves a way for implementing high-performance routing optimization in networks. In SDN networks, the routing strategies are realized through flow rules, which are usually stored in TCAM with very limited capacity. However, the number of IoT flows are enormous. Thus, in this paper, we address the routing optimization problem in SDN-based IoT with TCAM capacity constraint. We first formulate the problem as a mixed integer linear programming problem and prove the problem is NP-hard. Then to solve the problem efficiently, we propose several approximate algorithms, which solve the problem in two stages. In the first stage, the algorithms calculate the routing strategies for flows without considering the TCAM capacity constraint. To meet the TCAM capacity constraint, the algorithms using different strategies to adjust the paths of some flows in the second stage. Extensive simulations are conducted on both real ISP and synthetic topologies to evaluate the performance of the algorithms. The simulation results verify that the algorithms can achieve promising load balancing performance in SDN-based IoT, where the capacity of TCAM in SDN switches is very limited.

Monitor Placement for Link Latency Measurement in Hybrid SDNs

Accurate link latency information is essential for various traffic engineering problems, such as routing design and network diagnosis. However, due to the routing constraints, link latency measurement is still a challenging problem in hybrid software-defined networks (SDNs) and little literature has been found in this field. Due to cost, a hybrid SDN composed of conventional routers and SDN switches will exist for some time to come, which shows the necessity and the urgency to address this problem. In this paper, we investigate this link latency measurement problem in two different scenarios: 1) the conventional routers can only support the shortest path routing protocol, and 2) the conventional routers can support source routing protocol. For both of these scenarios, we show how to deploy a minimum number of monitors and how to construct measurement paths between monitors to measure all the link latencies. Several algorithms are presented to solve these problems and the evaluations on different topologies prove the superiority of the proposed methods.

Slow denial-of-service attacks on software defined networks

Software Defined Networking (SDN) is a network paradigm that decouples the network’s control plane, delegated to the SDN controller, from the data plane, delegated to SDN switches.For increased efficiency, SDN switches use a high-performance Ternary Content-Addressable memory (TCAM) to install rules. However, due to the TCAM’s high cost and power consumption, switches have a limited amount of TCAM memory. Consequently, a limited number of rules can be installed. This limitation has been exploited to carry out Distributed Denial of Service (DDoS) attacks, such as Saturation attacks, that generate large amounts of traffic. Inspired by slow application layer DDoS attacks, this paper presents and investigates DDoS attacks on SDN that do not require large amounts of traffic, thus bypassing existing defenses that are triggered by traffic volume.In particular, we offer two slow attacks on SDN. The first attack, called Slow TCAM Exhaustion attack (Slow-TCAM), is able to consume all SDN switch’s TCAM memory by forcing the installation of new forwarding rules and maintaining them indeterminately active, thus disallowing new rules to be installed to serve legitimate clients.The second attack, called Slow Saturation attack, combines Slow-TCAM attack with a lower rate instance of the Saturation attack. A Slow Saturation attack is capable of denying service using a fraction of the traffic of typical Saturation attacks. Moreover, the Slow Saturation attack can also impact installed legitimate rules, thus causing a greater impact than the Slow-TCAM attack. In addition, it also affects the availability of other network’s components, e.g., switches, even the ones not being directly targeted by the attack, as has been proven by our experiments. We propose a number of variations of these attacks and demonstrate their effectiveness by means of an extensive experimental evaluation. The Slow-TCAM is able to deny service to legitimate clients requiring only 38 s and sending less than 40 packets per second without abruptly changing network resources, such as CPU and memory. Moreover, besides denying service as a Slow-TCAM attack, the Slow Saturation attack can also disrupt multiple SDN switches (not only the targeted ones) by sending a lower-rate traffic when compared to current known Saturation attacks.

SDN Controller Placement and Switch Assignment for Low Power IoT

Software defined networking (SDN) complements low power Internet of Things (IoT), since the former offers dynamicity and the latter is susceptible to environmental changes. The SDN controller placement refers to the selection of the IoT sensors running the controllers, while the switch assignment is the process of mapping each sensor to a controller. Both choices affect the volume of the control traffic, a significant metric in low power wireless IoT networks where bandwidth is scarce or energy consumption is important. In this paper, we model an optimization problem for minimum control traffic, assess its complexity and devise a set of heuristic algorithms for expediting its solution. We initially present a fast and simple heuristic algorithm, which is then extended to two iterative algorithms with even better performance at the cost of time complexity. Our simulations and testbed experimentation reveal close to optimal performance of all heuristic solutions with significantly less computation time than explicitly solving the optimization problem. At the end, we provide insights for further enhancements of these heuristics with a bias for minimum control delay.

Transition to SDN is HARMLESS: Hybrid Architecture for Migrating Legacy Ethernet Switches to SDN

Software-Defined Networking (SDN) offers a new way to operate, manage, and deploy communication networks and to overcome many long-standing problems of legacy networking. However, widespread SDN adoption has not occurred yet due to the lack of a viable incremental deployment path and the relatively immature present state of SDN-capable devices on the market. While continuously evolving software switches may alleviate the operational issues of commercial hardware-based SDN offerings, namely lagging standards-compliance, performance regressions, and poor scaling, they fail to match the cost-efficiency and port density. In this paper, we propose HARMLESS, a new SDN switch design that seamlessly adds SDN capability to legacy network gear, by emulating the OpenFlow switch OS in a separate software switch component. This way, HARMLESS enables a quick and easy leap into SDN, combining the rapid innovation and upgrade cycles of software switches with the port density and cost-efficiency of hardware-based appliances into a fully dataplane-transparent and vendor-neutral solution. HARMLESS incurs an order of magnitude smaller initial expenditure for an SDN deployment than existing turnkey vendor SDN solutions while, at the same time, yields matching, or even better, data plane performance for smaller enterprises.

Topic-Oriented Bucket-Based Fast Multicast Routing in SDN-Like Publish/Subscribe Middleware

In traditional IP-based publish/subscribe middlewares, a detour to overlay network is demanded to match events with defined filters, which introduces more latency overhead for delivering events from publishers to subscribers. The emerging Software Defined Networking (SDN) creates boundless possibilities to improve the efficiency of event delivery because of its centralized control and customized programmability. In this paper, we propose a topic-oriented bucket-based fast multicast routing to improve the efficiency of delivering events in SDN-like publish/subscribe middlewares. First, we design an SDN-like publish/subscribe middleware hierarchical architecture with an implementation framework in SDN controller to deliver events. Topic encoding, topic prefix matching, and the subscription coverage relationships between topics are considered to reduce the number of flow entries and improve the matching abilities of SDN switches. Then, a topic-oriented multicast tree construction algorithm is proposed to build publish/subscribe overlay networks with the minimal total link delay of event transmission and minimal switches in SDN controllers to deliver events fast. A topic-oriented bucket-based multicast forwarding algorithm is designed to achieve efficient multicast forwarding in SDN switches. Finally, experiments are conducted to verify that our construction algorithm has the minimal total delay of event transmission and our bucket-based multicast forwarding algorithm is effective.

DDoS Flooding Attack Mitigation in Software Defined Networks

Distributed denial of service (DDoS) attacks which have been completely covered by the security community, today pose a potential new menace in the software defined networks (SDN) architecture. For example, the disruption of the SDN controller could interrupt data communication in the whole SDN network. DDoS attacks can produce a great number of new and short traffic flows (e.g., a series of TCP SYN requests), which may launch spiteful flooding requests to overcharge the controller and cause flow-table overloading attacks at SDN switches. In this research work, we propose a lightweight and practical mitigation mechanism to protect SDN architecture against DDoS flooding threats and ensure a secure and efficient SDN-based networking environment. Our proposal extends the Data Plane (DP) with a classification and mitigation module to analyze the new incoming packets, classify the benign requests from the SYN flood attacks, and perform the adaptive countermeasures. The simulation results indicate that the proposed defending mechanism may efficiently tackle the DDoS flood attacks in the SDN architecture and also in the downstream servers.

Recovery and Reconstruction of Multicast Tree in Software-Defined Network: High Speed and Low Cost

Multicast is an efficient tool to transfer the same data from a publisher to multiple subscribers, and its performance relies critically on the resiliency. Compared with traditional networks, the centralized control and flexible programmability of the Software Defined Network (SDN) is more beneficial for solving the failure recovery problem. This paper presents a design of an OpenFlow controller which can recover and reconstruct a multicast tree rapidly, while reducing the Ternary Content Addressable Memory (TCAM) consumption simultaneously. We choose the protection mechanism, and calculate all the backup paths after the topology information is mastered by the controller. When a failure occurs, affected switches can enable the use of backup paths to continue forwarding multicast packets. As duplicate packets may exist after the failure recovery, the reconstruction of a tree is required by modifying only a small fraction of forwarding rules. The performance evaluations demonstrate that our proposed method recovers a multicast tree with a high speed and low cost. On one hand, the maximum failure recovery time of two protection-based methods including our proposed method is less than 11 ms, while that of two restoration-based methods is 44 ms and 30 ms, respectively. On the other hand, the amount of backup forwarding entries required by another protection-based method exceed our proposed method as long as 3 or more multicast groups exist in the network. Moreover, when our proposed method is adopted, the amount of backup forwarding entries per switch is less than 30, which can be ignored when compared with the capacity of SDN switches (a switch can support a few thousand forwarding rules).

An Approach to the Translation of Software-Defined Network Switch Flow Table into Network Processing Unit Assembly Language

This paper considers the OpenFlow 1.3 switch based on a programmable network processing unit (NPU). OpenFlow switch performs flow entry lookup in a flow table by the values of packet header fields to determine actions to apply to incoming packet (classification). In the considered NPU assembly language, lookup operation may be implemented on the basis of search trees. But these trees cannot be directly used for OpenFlow classification because of compared operands width limitation. In this paper, we propose flow table representation designed for easy translation into NPU search trees. Another goal was to create a compact program that fits in NPU memory. Another NPU limitation requires program updating after each flow table modification. Consequently, the switch must maintain the current flow table state to provide a fast NPU program update. We developed algorithms for incremental update of flow table representation (flow addition and removal). To evaluate the proposed flow table translation approach, a set of flow tables was translated into NPU assembly language using a simple algorithm (based on related work) and an improved algorithm (our proposal). Evaluation was performed on the NPU simulation model and showed that our approach effectively reduces program size.