Software Defined Networking Switches Research Articles

Latency control in service chaining using P4-based data plane programmability

Service chaining is becoming one of the most considered service deployment frameworks in the context of Network Function Virtualization (NFV) in edge and data center environments, conveniently supported by automatic connectivity configurations offered by Software Defined Networking (SDN). Current research on the topic is focusing on how to guarantee Quality of Service (QoS) in terms of guaranteed end-to-end latency for time critical services. Indeed, latency issues may depend on intra-server virtualization inefficiencies, leading to Virtual Network Function (VNF) delivery delays, or by congestion events occurring at intermediate network elements connecting VNFs. Latency control requires stateful information such as flow delay measurements at a per-packet level, typically not available at traditional SDN switches or inside the VNF. This paper proposes the adoption of SDN data plane programmability exploiting the P4 language and presents two P4 pipeline solutions, suitable for both intra-rack and inter-rack service chain deployments, to automatically check the path latency experienced by selected high priority flows, also resorting to the recent in-band telemetry applications. The programmable pipelines enforce proactive in-network functions, such as priority change or drop actions, in order to guarantee a bound SFC segment latency delivery, including both the network and the segment VNFs. The proposed solutions are implemented and evaluated in a network testbed employing programmable software switches showing their effectiveness in guaranteeing the configured end-to-end latency, and the limited effort in terms of additional processing at the P4 switch. The evaluation is carried out using the reference P4 software switch, i.e., BMv2. The aim is to validate the full P4 capabilities and the code feasibility in terms of scalability, load and resource impact and added intra-switch latency. The experimental results show the proposed approach scales with the number of forwarded flows and achieves per-segment latency control enforcement in both congested and non-congested scenarios with a very limited impact on the switch extra-latency, exploiting finer per-packet tuning of drop and priority change simply applicable through flow entry configuration. Applicability analysis on hardware switches guaranteeing line rate performance are provided.

SliceBlock: Context-Aware Authentication Handover and Secure Network Slicing Using DAG-Blockchain in Edge-Assisted SDN/NFV-6G Environment

Network slicing in a 6G environment is an important research area in the current years. However, satisfying the demands of network slice requests is a challenging task. Energy-efficient, secure, and Quality of Service (QoS) aware network slicing is important since network slices must share fewer amounts of resources. Further, implementing secure network slicing for software-defined networks (SDNs)/network function virtualization (NFV) is crucial. In this article, we tackle the issues, such as security, QoS, and resource consumption issues through network slicing and load balancing mechanisms in SDN/NFV assisted 6G environments. First, deep network slicing is implemented using generative adversarial network (GAN) for network slicing and management. Based on the slice capacity, slice priority, and QoS demands of network slices, GAN predicts the appropriate slice and links for data transmission. For each slice, the directed acyclic graph (DAG)-based blockchain technology is used in which traditional consensus is replaced by the Proof of Space (PoS) algorithm. A limitation of scalability and high resource consumption in the traditional blockchain is addressed in DAG-blockchain. To improve security, context-based authentication, and secure handover schemes are presented using the Markov decision making (MDM) and weighted product model, respectively. Then, higher load faced at the SDN controllers and switches are addressed by intruder packets classification and packets migration through hybrid neural decision tree (HyDNT) and Hybrid Political optimizer with a Heap-based Optimizer (HPoHO), respectively. To predict the load accurately, environment learning is implemented using the soft actor-critic (SAC) algorithm. Finally, the performance of the proposed SliceBlock model is evaluated.

SCOPE: Cost-Efficient QoS-Aware Switch and Controller Placement in Hybrid SDN

This article addresses the joint switch and controller placement problem in a hybrid software-defined network (SDN), which is an intermediate step of transforming a traditional backbone network into a pure SDN. For a hybrid SDN, the quality of service (QoS) is a primary concern for ensuring service guarantee of a traditional network, while providing additional benefits of softwarization. In the SDN, the positions of SDN controllers determine the QoS parameters, such as network throughput and flow processing delays. Many existing solutions determine the controller locations to optimize the latency of network links and control plane load. However, there is a need to address the problem considering additional aspects of the hybrid SDN, such as SDN switch placement and incremental upgrades. In this article, we propose a priority-based SDN switch placement approach and an incremental controller placement approach for the hybrid SDN. Simulation results depict that the proposed scheme increases programmable traffic by 9.90% compared to the existing MapFirst scheme when the switch upgrade budget is <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"><tex-math notation="LaTeX">${\$}$</tex-math></inline-formula> 400 K. The proposed scheme decreases QoS violation by 20.89% compared to the Greedy approach with 0.3 million flows.

Modeling and optimization of the data plane in the SDN-based DCN by queuing theory

Complicated management tasks and various functions of traditional Data Center Network (DCNs) motivate the research on Software-Defined Networking (SDN). However, the limited flow table space in the SDN switch has a significant impact on the data plane especially the availability. In this paper, we propose a theoretical model based on queuing theory to estimate the flow table states of SDN switches, providing operators insights into the requirements of flow table resources and guaranteeing the performance of the data plane. First, we analyze the lifecycle of a flow table entry and construct a queuing theory based estimation model to estimate flow table states in the data plane. Second, we observe the real workloads of DCNs and figure out the probability characteristics of routing strategies to calculate the key parameters in our model. Third, for achieving an optimally latency-aware data plane, we propose an auxiliary method, Amora, to maintain the availability of the data plane by improving routing decisions with the consideration of the optimal flow table states obtained by our model. Comprehensive experiments show that the relative estimation error of flow table states in our model is around 10%, which exposes the actual flow table states and benefits the selection of proper switches. Moreover, Amora efficiently eliminates the failure cases of establishing routing paths in the data plane, which further demonstrates the precision and practicability of our estimation model.

Path selection for link failure protection in hybrid SDNs

During the transition from traditional networks to pure Software-Defined Networks (SDNs), hybrid SDNs are derived to provide flexible services. Furthermore, developing effective failure protection algorithms is significantly urgent to improve the robustness and resilience of networks. In this paper, we propose several algorithms, including Straightforward Protection Path Selection with the Source and Destination-based Tunneling mechanism (S-PPSSDT), its simplification PPSSDT and Protection Path Selection with Load-Balancing (PPSLB) algorithms. Considering that the Protection Path Length (PPL) will affect the transmission delay of rerouted packets, S-PPSSDT leverages the source and destination-based tunneling mechanism to select optimum protection paths with the shortest length. Based on classification idea and optimization search, PPSSDT prunes unnecessary path searches in S-PPSSDT. Combining the tunneling mechanism with the priority-based Maximum Link Utilization (MLU) minimization approach, PPSLB also focuses on load balancing during failure protection to achieve potential congestion avoidance simultaneously. Besides, these algorithms redirect the traffic through various tunnels for affected paths by the non-shortest path routing capability of SDN switches. Extensive simulation results indicate that our proposed algorithms can effectively reduce the PPL and MLU of hybrid SDNs during failure protection, and have excellent performance under various network parameters compared with the state-of-the-art algorithms.

Automatic, verifiable and optimized policy-based security enforcement for SDN-aware IoT networks

The pervasiveness of Internet of Things (IoT) has made the management of computer networks more troublesome. The softwarized control provided by Software-Defined Networking (SDN) is not sufficient to overcome the problems raising in this context. An increasing number of attacks can, in fact, occur in SDN-aware IoT networks if the security configuration enforced on the SDN switches is manually computed and not formally verified. To mitigate this problem, this paper proposes a novel methodology which leverages Maximum Satisfiability Modulo Theories (MaxSMT) to automatically compute a formally correct and optimized allocation scheme and configuration of SDN switches by refining security policies, user-defined or derived from detected attacks. This mechanism is compliant with the main characteristics of virtualized IoT-based networks, such as the simultaneous presence of numerous interconnected devices and strict latency requirements. The feasibility and the performance of the framework developed to implement this methodology have been validated in a realistic use case.

Fault-Tolerant Controller Placement Model by Distributing Switch Load among Multiple Controllers in Software-Defined Network

One of the features of a software-defined network (SDN) is a logically centralized control plane hosting one or more SDN controllers. As SDN controller placement can impact network performance, it is widely studied as the controller placement problem (CPP). For a cost-effective network design, network providers need to minimize the number of SDN controllers used in the network since each SDN controller incurs installation and maintenance costs. Moreover, the network providers need to deal with the failure of SDN controllers. Existing studies that consider SDN controller failures use the scheme of connecting each SDN switch to one Master controller and one or more Slave controllers. The problem with this scheme is that the computing capacity of each SDN controller cannot be used efficiently since one SDN controller handles the load of all SDN switches connected to it. The number of SDN controllers required can be reduced by distributing the load of each SDN switch among multiple SDN controllers. This paper proposes a controller placement model that allows the distribution against SDN controller failures. The proposed model determines the ratios of computing capacity demanded by each SDN switch on the SDN controllers connected to it. The proposed model also determines the number and placement of SDN controllers and the assignment of each SDN switch to SDN controllers. Controller placement is determined so that a network provider can continue to manage all SDN switches if no more than a certain number of SDN controller failures occur. We develop two load distribution methods: split and even-split. We formulate the proposed model with each method as integer linear programming problems. Numerical results show that the proposed model reduces the number of SDN controllers compared to a benchmark model; the maximum reduction ratio is 38.8% when the system latency requirement between an SDN switch and an SDN controller is 100[ms], the computing capacity of each SDN controller is 6 × 106[packets/s], and the maximum number of SDN controllers that can fail at the same time is one.

An efficient packet parser architecture for software-defined 5G networks

Software-defined networks (SDN) has emerged with the capability to program in order to enhance flexibility, management, and testing of new ideas in the next generation of networks by removing current network limitations. Network virtualization and functionalization are critical elements supporting the delivery of future network services, especially in 5G networks. With the integration of virtualization and functionalization, network resources can be provisioned on-demand, and network service functions can be composed and chained dynamically to cater to various requirements. 5G networks are expected to rely heavily on SDN, which has been widely applied in core network design. To have a software-defined 5G network, not only is new spectrum and interface needed from SDN, but also a programmable and efficient hardware infrastructure is required. Admittedly, hardware components and infrastructure play an important role in supporting 5G networks. In other words, the software-defined 5G network data plane must have the required flexibility and programmability to support upcoming needs and technologies. Technological solutions need to respond to actual requests in infrastructure. Packet parsers in the data plane of software-defined 5G networks are one of the most important components because of the variation in the type of network headers and protocols. Each SDN switch needs to identify headers for processing input packets in the data plane, where the packet parser operates. Multiple implementations of packet parsers have been done on different substrates that occupy large hardware resources and areas on chip. However, they are not suitable for software-defined 5G networks. Certain architectures have been presented for packet parsing, aimed at accelerating the process of header parsing, however no attention has been paid toward reducing the area and the volume of the needed hardware resources and programmability in the data plane. This paper presents a new and efficient architecture for packet parsers on Field Programmable Gate Arrays (FPGA), called Efficient FPGA Packet Parser (EFPP) in a designed software-defined 5G network. This architecture emphasizes the removal of Ternary Content Addressable Memory (TCAM) to decrease hardware resources and efficiency in the data plane. Moreover, this architecture uses the chip’s processing speed and reconfiguration capabilities to support new protocols and network headers while maintaining flexibilities on software-defined 5G networks. EFPP is applied to chips on FPGA Xilinx ZedBoard Zynq, and the resources consumed around 7.5% LookUp Table, 1.9% Flip-Flops, and 5.8% of the memory. EFPP was also more area efficient. According to our results, EFPP would reduce the area and volume of hardware compared to other peer works.

Virtualizing Packet-Processing Network Functions Over Heterogeneous OpenFlow Switches

The network function virtualization paradigm replaces dedicated hardware appliances with software running on virtual machines in commodity servers. However, to overcome performance and scalability issues on virtual network functions (VNFs) demanding intensive packet processing, we propose implementing these VNFs as programmable rules distributed among software-defined networking (SDN) switches. Our approach allows infrastructure providers to combine hardware-based and software-based SDN switches, exploring the tradeoff between the packet processing speed and instantiation flexibility. Our proposal includes a scalable mechanism, which decides the type and number of switches to meet network demand, along with a load balancing mechanism to distribute flows among switches, considering their singularities. We first evaluate our proposal in a small testbed with real equipment, confirming its effectiveness. Then, we evaluate our proposal with simulations to further investigate its scalability. Our results show that, even under high traffic loads, the joint operation of both mechanisms improves VNF capacity and saves virtualization resources.

SplitTrie: A Fast Update Packet Classification Algorithm with Trie Splitting

Software Defined Network (SDN) currently is widely used in the implementation of new network technologies owing to its distinctive advantages. In changeable SDN environments, the update performance of SDN switches has significant importance for the overall network performance because packet processing could be interrupted by ruleset updating in SDN switches. In order to guarantee high update performance, we propose a new classification algorithm, SplitTrie, based on trie structures and trie splitting. SplitTrie splits rulesets according to the field type vectors of rules. The splitting can improve the update performance because it reduces the trie structure sizes. Experimental results demonstrated that SplitTrie could achieve 20 times of update speed in the complex rulesets comparing the method without trie splitting.

Enabling Resilient Quantum-Secured Microgrids Through Software-Defined Networking

Quantum key distribution (QKD) has been considered a potent and mature approach to secure communication in the quantum era. However, there exist resilience gaps that hinder the practical usefulness of QKD. This paper improves the resilience of a QKD-based microgrid by leveraging software-defined networking (SDN). Specifically, the following contributions have been made: 1) a novel QKD- and SDN-based communication framework is devised for microgrids; 2) an enhanced QKD simulator (QKDS+) is developed, which can simulate both the number of generated keys and the amount of classical data required, providing a more accurate QKD study in microgrids; 3) an SDN-based resilience enhancement strategy, which incorporates three practical SDN applications, is developed to improve the system's resilience; and 4) a QKD- and SDN-enabled cyber-physical microgrid prototype is built in an RTDS environment using real whitebox SDN switches. Extensive case studies validate the effectiveness and excellent performance of SDN to improve the resilience of QKD-based microgrids in various situations.

A Review of P4 Programmable Data Planes for Network Security

Network attacks show a trend of increased attack intensity, enhanced diversity, and more concealed attack methods, which put forward higher requirements for the performance of network security equipment. Unlike the SDN (software defined network) switch with a fixed-function data plane, switches with programmable data planes can help users realize more network protocols. Programming Protocol-independent Packet Processors (P4) is proposed to define the operations of the data plane and to implement user’s applications, e.g., data center networks, security, or 5G. This paper provides a review of research papers on solving network security problems with P4-based programmable data plane. The work can be organized into two parts. In the first part, the programming language P4, P4 program, architectures, P4 compilers, P4 Runtime, and P4 target are introduced according to the workflow model. The advantages of P4-based programmable switching in solving network security are analyzed. In the second part, the existing network security research papers are divided into four parts according to the perspectives of passive defense, active defense, and combination of multiple technologies. The schemes in each category are compared, and the core ideas and limitations are clarified. In addition, a detailed comparison is made for the research on the performance of P4 targets. Finally, trends and challenges related to the P4-based programmable data plane are discussed.

DPLBAnt: Improved load balancing technique based on detection and rerouting of elephant flows in software-defined networks

Traffic management in software-defined networks (SDNs) is critical for efficient bandwidth utilization and resource provisioning. Recent works on SDN load balancing (LB) have focused on identifying and rerouting elephant flows (EFs) for effective bandwidth usage. These techniques have some limitations, such as using source-to-destination hop count as the primary rerouting metric and not differentiating the types of flow that result in frequent resource conflicts when handling EF with long-lived bandwidth. Besides, current EF detection techniques use predefined bandwidth-use thresholds that cannot adapt to the ever-changing traffic condition. Also, detecting EF on switches results in high controller-switch bandwidth and high EF detection time. This study presents an ant colony optimization-based technique for rerouting EFs while considering load-balancing in the SDN links. This technique, called DPLBAnt, is formulated as a shortest-path problem in SDN that can alleviate the high controller-switch load. The proposed technique first detects EF by using a pair of classifiers on both SDN controller and switches. Most EF candidates are sifted on the switches, resulting in accurate and efficient detection of EF. Then, DPLBAnt obtains the global state of the SDN from which the most optimal paths for congested links are retrieved, and EF are redirected accordingly. The performance of the proposed DPLBAnt has been extensively simulated. Results indicate its superior performance over Equal-Cost Multi-Path (ECMP) and FlowSeer techniques in terms of average end-to-end delay (54% and 7.9% better), average network throughput (3.5× and 1.5× better), and average packet loss (18% and 10% better) respectively. The overall performance indicates that the proposed LB technique based on detection and rerouting of EFs can improve SDN’s overall performance.

ADVICE: Towards adaptive scheduling for data collection and DDoS detection in SDN

Distributed Denial of Service (DDoS) is one of the most rampant attacks which threaten network security. To overcome DDoS in Software-Defined Networking (SDN), many DDoS detection methods have been presented, among which periodic detection approaches with a specific interval are widely utilized. However, periodic data collection and DDoS detection may result in high network load occupancy between SDN controller and switches, high overhead of SDN controller, and long response time to DDoS attacks. Hence, in order to address those issues above, an ADaptiVe schedulIng for data Collection and DDoS dEtection (ADVICE) mechanism is proposed in this work, to flexibly adjust the data collection and detection interval and decrease the workload of the SDN controller. Instead of detects all flow entries at one period, ADVICE collects the flow statistic information with dynamic intervals and finely-grained initiate DDoS detection for each flow entry. Based on the survival time and credence degree of each flow entry, ADVICE can reduce the network load occupancy and assure the rapid detection of DDoS. Experimental results indicate that ADVICE can effectively minimize the controller's workload and optimize the usage of the limited switch-controller connection bandwidth, shorten the response time of DDoS attacks compared with state-of-the-art methods, and thus protect the network from various DDoS attacks.

Detecting Malicious Switches for a Secure Software-defined Tactile Internet

The rapid development of the Internet of Things has led to demand for high-speed data transformation. Serving this purpose is the Tactile Internet, which facilitates data transfer in extra-low latency. In particular, a Tactile Internet based on software-defined networking (SDN) has been broadly deployed because of the proven benefits of SDN in flexible and programmable network management. However, the vulnerabilities of SDN also threaten the security of the Tactile Internet. Specifically, an SDN controller relies on the network status (provided by the underlying switches) to make network decisions, e.g., calculating a routing path to deliver data in the Tactile Internet. Hence, the attackers can compromise the switches to jeopardize the SDN and further attack Tactile Internet systems. For example, an attacker can compromise switches to launch distributed denial-of-service attacks to overwhelm the SDN controller, which will disrupt all the applications in the Tactile Internet. In pursuit of a more secure Tactile Internet, the problem of abnormal SDN switches in the Tactile Internet is analyzed in this article, including the cause of abnormal switches and their influences on different network layers. Then we propose an approach that leverages the messages sent by all switches to identify abnormal switches, which adopts a linear structure to store historical messages at a relatively low cost. By mapping each flow message to the flow establishment model, our method can effectively identify malicious SDN switches in the Tactile Internet and thus enhance its security.

SPRM: Source Path Routing Model and Link Failure Handling in Software-Defined Networks

Software Defined Networking (SDN) has emerged as a promising paradigm with the key idea of separating control and data planes. However, this separation causes various scalability issues (e.g., increased response time, overhead on the controller and core SDN switches) in Wide Area Networks (WANs). While addressing such scalability issues, it is important to maintain the performance gains of the Reactive SDN and also to handle link failures. To jointly address scalability, performance, and link failure issues, we propose a new <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Source-Path Routing Model (SPRM)</i> by combining the best of proactive and reactive approaches along with a simple packet programming mechanism. Specifically, SPRM pre-calculates and pre-installs multiple paths (proactive part) but then selects/assigns one of these paths for an incoming flow based on the available dynamic network state information (NSI) (reactive part). We also utilize SPRM to effectively cope with the link failures by using multiple paths as backup to each other. Our simulation results show that SPRM performs much better than the pure Reactive SDN in terms of path establishment delay and flow table size while (a) maintaining its performance gains in terms of link utilization and load balancing, and (b) quickly recovering from a link failure without causing extra memory overhead on the data plane.

Multi-Objective Control Plane Dimensioning in Hybrid SDN/Legacy Networks

Software defined networking (SDN) is gaining the confidence of network operators, who are increasingly motivated to introduce it in their networks. However, since SDN is based on centralized control plane (decoupled from the data plane), it is incompatible with distributed control plane of legacy networks. As adopting SDN by complete overhaul of existing legacy networks is infeasible, several solutions propose to incrementally adopt SDN in legacy networks, resulting in hybrid SDN/legacy networks during the transition phase. While strategies to effectively introduce SDN switches in legacy networks have received significant attention in the literature, the same is not true for the associated SDN controller placement in hybrid SDN networks. In this paper, we introduce and formulate the multi-objective control plane dimensioning problem in hybrid SDN/legacy networks, considering network resilience, flow-setup latency and controller load balancing as objectives. We propose optimization models for both the single-objective as well as the multi-objective controller placements. We model both controller processing latency (based on queueing theory) and inter-controller network state synchronization latency (based on Steiner trees) without compromising linearity of the optimization formulations. A genetic algorithm-based heuristic is presented to efficiently deduce the approximate Pareto frontier for our problem. Extensive simulations over a large number of real networks establish the effectiveness of our approach in terms of several single-objective and multi-objective performance metrics.

Convergence Time Monitoring Algorithm in Hybrid Software Defined Networks

Network consummation especially dependent on traffic monitoring. Therefore, Software Defined Network (SDN) technology is submitted to support the flow control suitable monitoring by providing a global view of the network. Unfortunately, replacing the entire traditional network to SDN is complex, which leads to the need of SDN switches deployment to the current network. Thus, a hybrid network environment has emerged which consists of centralized controller, SDN switch and legacy routers. Hence, the advantage of the integration of traditional network and SDN will take place. The controller can collect SDN data instantly, while it waits for a long time to obtain the legacy network data. On the other hand, the rest of paths cannot be processed directly by the controller. Therefore, legacy path load data is estimated for the past time to support the controller for obtaining the current data. The convergence time of the proposed algorithm takes more convergence time than the full SDN by only 12%. Therefore, the proposed algorithm provides installing the minimum possible number of SDN switches that reduce the infrastructure cost.

Flow Installation Mechanisms in SDN

Software Defined Networking (SDN) has developed tremendously in the recent years. This paper addresses different flow installation mechanisms. The idea of a programmable network which is the foundation of SDN ensures dynamic network management by separating the control plane from data and management planes. In SDN the control plane resides in SDN Controller, which is responsible for the installation of flows on the data plane. Whenever a flow enters into an SDN switch, flow tables are generated for those flows and installed at data plane from the control plane. These flows have their own properties because of their relevant protocols which are attached to them. A flow consists of a matching pattern, actions, and counter. Based on the respective flow, data communication takes place. This paper investigates three kinds of flow installation mechanisms, reactive, proactive and hybrid. Based on these three flow installation mechanisms, we have analysed the performance of SDN by using different performance metrics. We have used the Mininet and POX controller to evaluate the performance analysis in Ubuntu and Windows-based environments. Finally, we have drawn conclusions

Network cost optimization-based capacitated controller deployment for SDN

As a novel network paradigm, software-defined networking (SDN) is capable of simplifying network management and offering flexible support to various user services. In order to meet the rapidly increasing transmission demands of SDN switches, the controller deployment strategy in an SDN scenario should be designed. In this paper, we investigate the capacitated controller deployment problem for SDN. Consider the signaling transmission and processing performance of switches and address the worst-case performance, we define network response time (NRT) as the maximum control plane response time of switches. Then aiming to achieve the tradeoff between NRT and the cost of controllers, we introduce the concept of network cost which is defined as the weighted sum of NRT and controller cost. The capacitated controller deployment problem is formulated as a constrained network cost minimization problem. To solve the optimization problem, we propose a two-stage heuristic algorithm, which first tackles the controller deployment subproblem under the unlimited capacity constraint, and then solves controller-type matching subproblem. Specifically, during the first stage, a minimum eccentricity-based controller deployment algorithm is designed to determine the number and location of controllers as well as the association strategy between controllers and switches. During the second stage, a greedy method-based controller-type matching strategy is proposed to determine the types of deployed controllers. Extensive simulations are performed and the results certify the effectiveness of the proposed algorithm.