Software Defined Networking Infrastructure Research Articles

EFraS: Emulated framework to develop and analyze dynamic Virtual Network Embedding strategies over SDN infrastructure

The integration of Software-Defined Networking (SDN) into Network Virtualization (NV) significantly enhances network management, isolation, and troubleshooting capabilities. However, it brings forth the intricate challenge of allocating Substrate Network (SN) resources for various Virtual Network Requests (VNRs), a process known as Virtual Network Embedding (VNE). It encompasses solving two intractable sub-problems: embedding Virtual Machines (VMs) and embedding Virtual Links (VLs). While the research community has focused on formulating embedding strategies, there has been less emphasis on practical implementation at a laboratory scale, which is crucial for comprehensive design, development, testing, and validation policies for large-scale systems. However, conducting tests using commercial providers presents challenges due to the scale of the problem and associated costs. Moreover, current simulators lack accuracy in representing the complexities of communication patterns, resource allocation, and support for SDN-specific features. These limitations result in inefficient implementations and reduced adaptability, hindering seamless integration with commercial cloud providers. To address this gap, this work introduces EFraS (Emulated Framework for Dynamic VNE Strategies over SDN). The goal is to aid developers and researchers in iterating, testing, and evaluating VNE solutions seamlessly, leveraging a modular design and customized reconfigurability. EFraS offers various functionalities, including generating real-world SN topologies and VNRs. Additionally, it integrates with a diverse set of evaluation metrics to streamline the testing and validation process. EFraS leverages Mininet, Ryu controller, and OpenFlow switches to closely emulate real-time setups. Moreover, we integrate EFraS with various state-of-the-art VNE schemes, ensuring the effective validation of embedding algorithms.

A trust-aware openflow switching framework for software defined networks (SDN)

Software Defined Networks (SDN) and Network Function Virtualisation (NFV) are prime driving technologies behind 5G and Beyond 5G (B5G) communications. The network control intelligence segregation in the SDN infrastructure enables dynamic network features (such as dynamic end-to-end management of security and quality of service (QoS)) offering significantly improved network performance. Even if one assumes that the centralised SDN controller can be security hardened and hence can be trusted, a fundamental challenge in such networks is that the data plane and switching devices are susceptible to cyberattacks. A malicious adversary can compromise them during run-time making them unreliable for secure and trusted communications. Furthermore, the controller communicating with OpenFlow switching devices is unable to accurately assess the state of the switching devices, which serves as the communication base for NFVs in 5G networks. Vulnerable switching devices can put the whole 5G network infrastructure at risk. Hence, there is a clear need for the controller and the management layer to determine the trustworthiness of the switching devices at run-time. The current trend is for many such devices to deploy trusted computing functionality such as Trusted Platform Module (TPM) or Software Guard Extension (SGx) to achieve local as well as remote attestation. In this paper, we present a dynamic trust management framework for evaluating the trustworthiness of the OpenFlow switching devices deployed in the SDN based networks. We formulate device properties that need to be assessed to determine the trust status of the device. We develop a trust enhanced security architecture which can be used to evaluate the trustworthiness of devices and determine their deployment in the provision of network services. The proposed framework uses subjective logic based techniques to derive trust levels of the switching devices at run-time, which are then used by the architecture to make trust enhanced decisions on the provision of network services. A prototype implementation of the proposed architecture is described, which demonstrates how the trustworthiness of the OpenFlow devices are assessed at run-time. The paper concludes with the performance and security analysis of the implemented trust enhanced architecture services.

IQR-based approach for DDoS detection and mitigation in SDN

Software-defined networking (SDN) is a trending networking paradigm that focuses on decoupling of the control logic from the data plane. This decoupling brings programmability and flexibility for the network management by introducing centralized infrastructure. The complete control logic resides in the controller, and thus it becomes the intellectual and most important entity of the SDN infrastructure. With these advantages, SDN faces several security issues in various SDN layers that may prevent the growth and global adoption of this groundbreaking technology. Control plane exhaustion and switch buffer overflow are examples of such security issues. Distributed denial-of-service (DDoS) attacks are one of the most severe attacks that aim to exhaust the controller's CPU to discontinue the whole functioning of the SDN network. Hence, it is necessary to design a quick as well as accurate detection scheme to detect the attack traffic at an early stage. In this paper, we present a defense solution to detect and mitigate spoofed flooding DDoS attacks. The proposed defense solution is implemented in the SDN controller. The detection method is based on the idea of an statistical measure — Interquartile Range (IQR). For the mitigation purpose, the existing SDN-in-built capabilities are utilized. In this work, the experiments are performed considering the spoofed SYN flooding attack. The proposed solution is evaluated using different performance parameters, i.e., detection time, detection accuracy, packet_in messages, and CPU utilization. The experimental results reveal that the proposed defense solution detects and mitigates the attack effectively in different attack scenarios.

Cross-Plane DDoS Attack Defense Architecture Based on Flow Table Features in SDN

Software-Defined Networking (SDN) actualizes the separation of control and forwarding and innovates network functionalities with a logically centralized controller. Contemporary SDN infrastructure exposes the potential bottlenecks which are prone to engage in distributed denial of service attack (DDoS) thus posing an ever-increasing threat. This paper adopts the idea of “cross-plane collaboration” accomplishing DDoS attack defense and incorporates a two-phase project deploying the lightweight detection mechanism in data layer and the fine-grained filtering model in control layer. The coadjutant detection mechanism introduces a novel three-dimensional entropy consisting of five flow table features performing real-time feature detection; the defense strategy schedules an attack classification algorithm based on neural network by means of extracting four flow rule features designed to locate compromised interfaces occupied by malicious traffic. Extensive experiments are implemented to demonstrate the method we proposed brings excellent superiority. The detection rate of the classification filtering model is 99.4%, and it is real-time, with a detection time of 0.51s. In addition, the method of cross-layer defense reduces the CPU utilization of the controller.

A Network Federation Scheme for Inter-Domain SDN Communications

Recently, a variety of the integrated service platforms demand the innovative network technologies such as software-defined networking (SDN). However, it is problematic and complicated to provide interconnectivity and reachability between inter-domain SDNs. Thus, this paper proposes a scheme for the inter-SDN federation and communication based on the abstracted network information exchange and automated peer network configuration for the integrated network services. The proposed scheme is implemented and verified over the de-facto wide-area SDN infrastructure (KREONET-S) which is deployed on Korea Research Environment Open Network (KREONET), a representative national research network in Korea. The proposed method is implemented and experimented based on the distributed and layer-2 oriented network architecture by using the abstracted message exchanges between local SDN controllers in order to provide low message overheads and high federation scalability. Our research work contributes to more efficient inter-SDN communications by means of the data modeling abstraction of the local SDN network information and the simplified interactions between individual controllers by the automated configurations through the specific application interfaces. The proposed scheme also contributes to the development of the integrated service platforms which are demanded to provide IoT, Big Data, AI, and cloud services in the tightly coupled manner over the inter-SDN domains.

Unprecedented Smart Algorithm for Uninterrupted SDN Services During DDoS Attack

In the design and planning of next-generation Internet of Things (IoT), telecommunication, and satellite communication systems, controller placement is crucial in software-defined networking (SDN). The programmability of the SDN controller is sophisticated for the centralized control system of the entire network. Nevertheless, it creates a significant loophole for the manifestation of a distributed denial of service (DDoS) attack straightforwardly. Furthermore, recently a Distributed Reflected Denial of Service (DRDoS) attack, an unusual DDoS attack, has been detected. However, minimal deliberation has given to this forthcoming single point of SDN infrastructure failure problem. Moreover, recently the high frequencies of DDoS attacks have increased dramatically. In this paper, a smart algorithm for planning SDN smart backup controllers under DDoS attack scenarios has proposed. Our proposed smart algorithm can recommend single or multiple smart backup controllers in the event of DDoS occurrence. The obtained simulated results demonstrate that the validation of the proposed algorithm and the performance analysis achieved 99.99% accuracy in placing the smart backup controller under DDoS attacks within 0.125 to 46508.7 s in SDN.

Early DDoS Detection and Prevention with Traced-Back Blocking in SDN Environment

The flow of information is a valuable asset for every company and its consumers, and Distributed Denial-of-Service (DDoS) assaults pose a substantial danger to this flow. If we do not secure security, hackers may steal information flowing across a network, posing a danger to a business and society. As a result, the most effective ways are necessary to deal with the dangers. A DDoS attack is a well-known network infrastructure assault that prevents servers from servicing genuine customers. It is necessary to identify and block a DDoS assault before it reaches the server in order to avoid being refused services. This prompted us to develop a unique way for detecting and preventing DDoS attacks at the router level in a Software-Defined Network (SDN) environment. This study demonstrates how the method efficiently integrates the first and second signatures in SDN infrastructure domains to identify and prevent DDoS attacks. It also proposes an Early DDoS Detection and Prevention (EDDDeP)-based approach for detecting and blocking malicious traffic in an SDN context. This article covers the EDDDeP, which assists in identifying and preventing DDoS in SDN to prevent malicious traffic from reaching its intended target. As a consequence, the DDoS assault is ultimately contained inside the environment, eliminating superfluous traffic in the DDoS network architecture. This method offers a unique technique to detect a DDoS assault and notify nearby neighbours in order to avert server damage.

A Novel DDoS Attack-aware Smart Backup Controller Placement in SDN Design

Security issues like Distributed Denial of Service (DDoS) attacks are becoming the main threat for Software-Defined Networking (SDN). Controller placement is a fundamental factor in the design and planning of SDN infrastructure. The controller could be seen as a single dot of failure for the whole SDN and it's the alluring point for DDoS attack. Single controller placement implies a single point of SDN control. So, there is a very high chance to fail the entire network topology as the controller associated with all switches. As a result, legitimate clients won't have the capacity to use SDN services. This is the reason why the controller is the suitable center dot of attack for the aggressor. To protect SDN from this type of single purpose of failure, it is essential to place multiple smart backup controllers to guarantee the SDN operation. In this paper, we propose a novel Integer Linear Programming (ILP) model to optimize the security issue by placing powerful smart backup controller. Result obtained from the simulation shows that our proposed novel ILP model can suggest single or multiple smart backup controller placement to support several ordinary victim controllers which has the capacity to save the cost of multiple ordinary controllers by sharing link, maximum new flows per second of controller and port, etc.

HomeCloud Framework for Priority aware VM Allocation and Network Bandwidth Provisioning

Various applications in a multi-tenant architecture based cloud computing comprises various requirements and priorities. Severe failure of a critical application may result if the network is congested in a data center. Hence, it is an important to use an efficient resource provisioning technique for ensuring transfer of high priority data to the other traffics still when the network is congested. Therefore, a new framework of Home Cloud architecture is proposed in this paper to provide an effective and flexible delivery of new applications in an edge-cloud architecture which integrates the two complementary technologies of Software-Defined Networking (SDN) and Network Function Virtualization (NFV). In SDN infrastructure, this presents a priority aware resource placement algorithms by taking into consideration of both host and network resources. The Virtual Machines (VMs) of high priority applications are placed at the strongly connected hosts by introducing the priority aware VM allocation (PAVA) algorithm for reducing the possibility of causing network congestion by other tenants. It also guarantees the critical applications for a required bandwidth by means of allocating bandwidth through the setting of priority queues for each network connection within the network of data center handled by SDN controller. The simulation result of the proposed system shows that the combination of proposed approaches will allocate sufficient resources for high-priority applications within a Home Cloud data centre to meet the QoS requirements.

Application-Aware SDN-Based Iterative Reconfigurable Routing Protocol for Internet of Things (IoT).

The central intelligence offered by Software Defined Networking (SDN) promise the smart and reliable reconfiguration which enables the scalability of dynamic enterprise networks. The decoupled forwarding plane and control plane of SDN infrastructure is a key feature that supports the SDN controller to extract the physical network topology information at runtime to formulate network reconfigurations. This SDN-based network reconfiguration enables application-aware routing capability for Internet of Thing (IoT). However, these IoT enabled SDN-based routing protocols face some performance limitations in iterative reconfiguration process due to complete centralized path selection mechanism To this end, in this paper, we propose SDN-Based Application-aware Distributed adaptive Flow Iterative Reconfiguring (SADFIR) routing protocol. The proposed routing protocol enables the distributed SDN iterative solver controller to maintain the load-balancing between flow reconfiguration and flow allocation cost. In particular, the proposed routing protocol of SADFIR implements multiple SDN controllers that collaborate with network devices at forwarding plane to develop appropriate clustering strategy for routing the sensed information. This distributed SDN controllers are assisted to clustering topology that successfully map the residual network resources and also enable unique multi-hop application-aware data transmission. In addition, the proposed SADFIR monitor the iterative reconfiguration settings according to the network traffic of heterogeneity-aware network devices. The simulation experiments are conducted in comparison with the state-of-the-art routing protocols which demonstrates that SADFIR is heterogeneity-aware which is able to adopt the different scales of network with maximum network lifetime.

Node to Node Performance Evaluation through RYU SDN Controller

Over the last few years, networks became more innovative for constructing and managing with the support of Software Defined Networking (SDN). The inflexibility of typical network architecture gives a great challenge to researchers. SDN is replacing current inflexible and complex networks with an innovative way where the control plane is decoupled from the data plane and fixing some limitations, including manual configuration, debugging, security, scalability, and mobility. Therefore, SDN controllers (e.g., NOX, POX, ONOS, OpenDaylight, Floodlight, Beacon, RYU, etc.) have emerged as a brain to manage such networks. SDN controller’s performance study provides an excellent impact on enhancing the flexibilities and capabilities of an underlying SDN infrastructure network. This paper contextualizes the performance test analysis on the SDN controller is carried out through criterion (e.g., Throughput, Round-Trip Time, etc.). To implement an SDN architecture, this work uses a Mininet emulator containing a controller RYU with switching hub component, one OpenFlow switch, and three nodes. The aim is to evaluate the performance parameters such as Bandwidth, Throughput, Round-Trip Time, Jitter, and Packet loss between nodes using the RYU controller.

Monitoring and Physical-Layer Attack Mitigation in SDN-Controlled Quantum Key Distribution Networks

Quantum key distribution (QKD) has been identified as a secure method for providing symmetric keys between two parties based on the fundamental laws of quantum physics, making it impossible for a third party to copy the quantum states exchanged without being detected by the sender (Alice) and receiver (Bob) and without altering the original states. However, when QKD is applied in a deployed optical network, physical-layer intrusions may occur in the optical links by injecting harmful signals directly into the optical fiber. This can have a detrimental effect on the key distribution and eventually lead to its disruption. On the other hand, network architectures with software-defined networking (SDN) benefit from a homogeneous and unified control plane that can seamlessly control a QKD-enabled optical network end-to-end. There is no need for a separate QKD control, a separate control for each segment of an optical network, and an orchestrator to coordinate between these parts. Furthermore, SDN allows customized and application-tailored control and algorithm provisioning, such as QKD-aware optical path computation, to be deployed in the network, independent of the underlying infrastructure. Therefore, in this paper, we investigate the integration of the application, SDN, and QKD infrastructure layers and confirm capability for flexible supervision and uninterrupted key service provisioning in the event of link level attacks. An experimental demonstrator is used, for the first time, to verify the architecture proposed, considering real-time monitoring of quantum parameters and fiberoptic link intruders to emulate real-world conditions. Furthermore, attacks on a standard single-mode fiber (via a 3 dB coupler) and a multicore fiber (via an adjacent core) are undertaken to explore different connectivity between QKD units. Results show additional attacker identification and switching time of less than 60 ms for the link cases investigated, being negligible compared to the total (re-)initialization time of 14 min of the QKD units.

Attack on SDN Infrastructure and Security Measures

Software Defined Networking (SDN) decouples the network control and network forwarding elements. The centralized controller manages the network and controls the data flow in the network elements. It has received significant attention from industry and researchers, and it has been deploying in different scenarios and environments. A centralized network plane supports programmable network management and flexibility. However, it introduces a single point of failure and scalability issues. SDN security has become a concern and many security challenges are introduced. The control plane still suffers from the number of threats such as a distributed denial of service (DDoS), man in the middle (MITM), and information modification attacks. To address these limitations, we propose a robust, secure, collaborative agent-based SDN infrastructure to detect and mitigate the attacks. We simulate and evaluate the performance of the proposed system when SDN control plan is compromised at build and run time. Simulation results show that security solutions are effective to mitigate the attacks.

GREEN SDN — An enhanced paradigm of SDN: Review, taxonomy, and future directions

SummaryNetwork architectures nowadays are not able to address the requirements of future Internet, as they are not sufficient, ossified, and are power hungry on the TCP/IP paradigm. Therefore, to promote the realizable progression toward the new paradigms and modern protocols, modern routers are required to become programmable for the flexible control and dynamic management of both power states and traffic flows. In this scenario, Software Defined Networking (SDN) is considered as an exemplary approach for providing the support of dynamic traffic flows of each node on a network. Besides the benefits that SDN brought to the networking area, there are still crucial challenges such as to design an effective, lightweight API, rich algorithms, and traffic forwarding rules for SDN layers along with the adoption of an energy efficient infrastructure that could have the least effect on the environment. The aim of this research is to drive the attention toward environment friendly adoption and implementation of SDN that could deal with the growing number of users and network equipment. For this purpose, in this research, a comprehensive review on SDN while mapping the characteristics of green computing with SDN is provided. In addition to that, the research stressed on the benefits of Green SDN through a proposed G‐SDN framework. Some well‐defined case studies are presented to highlight the need of greening an SDN infrastructure. Finally, various research directions are presented to the wide adoption of SDN technology for academia and industry alike.

A stochastic reward net-based assessment of reliability, availability and operational cost for a software-defined network infrastructure

The networking infrastructure of a software-defined network (SDN) requires further study to achieve continuity and high availability of data transactions for cloud computing services. However, various types of failures on links or system components are encountered because of high-speed and complicated structures of hosts and network devices. This study examines the specific characteristics and impact of various failures on a typical SDN infrastructure. We propose a stochastic model using stochastic reward net by incorporating hardware failures (of hosts, switches, storage, and links) and software failures [virtual machines (VMs)]. The system model is analyzed based on steady-state availability under default parameters. Comprehensive sensitivity analyses are conducted to study the system behaviors with respect to different major factors of impact. A reliability analysis is also conducted to pinpoint the role of VM migration in extending the system lifetime. Furthermore, operational cost is analyzed in detail to identify the main sources and to observe the effect of major system parameters on costs over time. The analytical results are verified by a developed discrete-event simulation module based on CloudSim Plus simulation open-source package. This study provides a helpful basis for network design and implementation in SDN infrastructures.

Towards full virtualization of SDN infrastructure

With the emerging multi-tenant virtual networks in the cloud data center and the network slicing in wide-area network, full virtualization of the hardware network infrastructure is required. In this work, we propose SVirt, a full virtualization architecture of the software defined networking (SDN) infrastructure, which can flexibly support multiple virtual networks (tenants) to simultaneously run SDN on top of the same physical network. In order to simultaneously run multiple virtual SDN switches with different processing logics on the same physical switch, we redesign the physical switch’s processing pipeline with a “late-binding key extractor (LBX)”. In the control plane, SVirt enables “many-to-one” and “one-to-many” mapping when allocating the physical resource for a virtual network, which embraces arbitrary topology and ternary content-addressable memory (TCAM) resource demanded by a virtual network. In the data plane, SVirt explicitly carries the forwarding context information in the packets, overcoming the “context-loss problem” in a virtual network. We develop a NetFPGA prototype of SVirt switch. Event-driven simulations and prototype-based experiments demonstrate that, compared with traditional approaches, SVirt significantly enhances the cloud’s capability to accept various virtual SDN requests with resource utilization ratio of more than 90% and improves the network’s throughput by around 236%. Besides, SVirt can hold more flows than traditional approaches, thus reducing two-order more table misses.

Self-Healing Attack-Resilient PMU Network for Power System Operation

In this paper, we propose a self-healing phasor measurement unit (PMU) network that exploits the features of dynamic and programmable configuration in a software-defined networking infrastructure to achieve resiliency against cyber-attacks. After a cyber-attack, the configuration of network switches is changed to isolate the compromised PMUs/phasor data concentrators to prevent further propagation of the attack; meanwhile, the disconnected yet uncompromised PMUs will be reconnected to the network to “self-heal” and thus restore the observability of the power system. Specifically, we formulate an integer linear programming model to minimize the overhead of the self-healing process (e.g., the recovery latency), while considering the constraints of power system observability, hardware resources, and network topology. We also propose a heuristic algorithm to decrease the computational complexity. Case studies of a PMU network based on the IEEE 30-bus and 118-bus systems are used to validate the effectiveness of the self-healing mechanism.

Applying software-defined networking to minimize the end-to-end delay of network services

There is a grand challenge to transfer the gigantic volume of data generated from a variety of smart cities applications. It is an urgent need to efficiently and effectively transmit such time-sensitive data in a wide-area communication. In this paper, we propose an approach by leveraging Software-Defined Networking (SDN) to develop a communication solution for data transfers in smart city applications. Our approach is Quality of Service (QoS)-aware that minimizes the end-to-end delay for data transmission in an SDN infrastructure by using a Timestamp Recording method to compare the arrival and departure of flows and packets over a period. Finally, we evaluate our solution on the Global Environment for Network Innovations (GENI), a real-world federated testbed. We first compare the Timestamp Recording to other common delay measurement techniques. Our analysis demonstrates its effectiveness at scale. Additionally, we carefully examine the accuracy and efficiency in minimizing end-to-end delay delivered by our SDN solution with contrast to a non-optimized SDN environment. Our experiments demonstrate the proposed solution effective and efficient in delivering data with an optimal delay. Particularly, our solution reduces about 22% in end-to-end-delay compared to a non-optimized SDN environment.

Bootstrapping trust in software defined networks

Software-Defined Networking (SDN) is a novel architectural model for cloud network infrastructure, improving resource utilization, scalability and administration. SDN deployments increasingly rely on virtual switches executing on commodity operating systems with large code bases, which are prime targets for adversaries attacking the network infrastructure. We describe and implement TruSDN, a framework for bootstrapping trust in SDN infrastructure using Intel Software Guard Extensions (SGX), allowing to securely deploy SDN components and protect communication between network endpoints. We introduce ephemeral flow-specific preshared keys and propose a novel defense against cuckoo attacks on SGX enclaves. TruSDN is secure under a powerful adversary model, with a minor performance overhead. (Less)

Global State, Local Decisions: Decentralized NFV for ISPs via Enhanced SDN

The network functions virtualization paradigm is rapidly gaining interest among Internet service providers. However, the transition to this paradigm on ISP networks comes with a unique set of challenges: legacy equipment already in place, heterogeneous traffic from multiple clients, and very large scalability requirements. In this article we thoroughly analyze such challenges and discuss NFV design guidelines that address them efficiently. Particularly, we show that a decentralization of NFV control while maintaining global state improves scalability, offers better per-flow decisions and simplifies the implementation of virtual network functions. Building on top of such principles, we propose a partially decentralized NFV architecture enabled via an enhanced software-defined networking infrastructure. We also perform a qualitative analysis of the architecture to identify advantages and challenges. Finally, we determine the bottleneck component, based on the qualitative analysis, which we implement and benchmark in order to assess the feasibility of the architecture.