Software Defined Networking Data Plane Research Articles

Providing cyber resilience in software-defined networks by secure routing means

This paper is devoted to solving the technical task of providing cyber resilience utilizing secure routing means in Software-Defined Networks (SDN). The work analyzes the SDN architecture and its main components, the concept of cyber resilience and its means, as well as security issues in SDN. Particular attention is paid to the use of secure routing in software-defined networks. Numerical research of the model of secure multipath routing of fragmented confidential messages in the SDN data plane was conducted. The calculation of the message compromise probability for different values of links compromise probabilities was performed. The obtained results showed that the model of secure multipath routing of fragmented confidential messages with redundancy provides a better balancing of message parts by routes. Results of the numerical study proved the adequacy of the selected secure multipath routing model.

Detection and Classification of Malicious Flows in Software-Defined Networks Using Data Mining Techniques.

The increasing availability of mobile devices and applications, the progress in virtualisation technologies, and advances in the development of cloud-based distributed data centres have significantly stimulated the growing interest in the use of software-defined networks (SDNs) for both wired and wireless applications. Standards-based software abstraction between the network control plane and the underlying data forwarding plane, including both physical and virtual devices, provides an opportunity to significantly increase network security. In this paper, to secure SDNs against intruders’ actions, we propose a comprehensive system that exploits the advantages of SDNs’ native features and implements data mining to detect and classify malicious flows in the SDN data plane. The architecture of the system and its mechanisms are described, with an emphasis on flow rule generation and flow classification. The concept was verified in the SDN testbed environment that reflects typical SDN flows. The experiments confirmed that the system can be successfully implemented in SDNs to mitigate threats caused by different malicious activities of intruders. The results show that our combination of data mining techniques provides better detection and classification of malicious flows than other solutions.

Generation and collection of data for normal and conflicting flows in software defined network flow table

<a name="_Hlk31039004"></a><span lang="EN-US">In terms of network simplification and regulation, Software Defined Networking (SDN) is a new form of infrastructure that offers greater adaptability and flexibility. SDN, however, is an invention that is logically centralized. </span><span>In addition, the optimization of the control plane and data plane in SDN has become an area deserving of more attention. The flow in OpenFlow has been one of the essential parameters in the SDN standards, in which every individual flow includes packet matching fields, flow priority, separate counters, instructions for packet forwarding, flow timeouts and a cookie. This research work is conducted in order to produce and collect flows from the OpenFlow switch in two scenarios; in normal flows and when conflict policy rules are enforced in the network. In this article, the throughput is required to review and evaluate the conflict impact on two protocols as a performance metric; the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP) that flows via a forwarded plane. During the simulation of the SDN OpenFlow network, the metrics are tested using MININET. The results demonstrate that the existence of SDN conflict rules allows TCP and UDP to have a significant average change in bandwidth that eventually affects the network and operations performance.</span>

Mitigating DDoS Attacks in SDN-Based IoT Networks Leveraging Secure Control and Data Plane Algorithm

Software-Defined Networking (SDN) and Internet of Things (IoT) are the trends of network evolution. SDN mainly focuses on the upper level control and management of networks, while IoT aims to bring devices together to enable sharing and monitoring of real-time behaviours through network connectivity. On the one hand, IoT enables us to gather status of devices and networks and to control them remotely. On the other hand, the rapidly growing number of devices challenges the management at the access and backbone layer and raises security concerns of network attacks, such as Distributed Denial of Service (DDoS). The combination of SDN and IoT leads to a promising approach that could alleviate the management issue. Indeed, the flexibility and programmability of SDN could help in simplifying the network setup. However, there is a need to make a security enhancement in the SDN-based IoT network for mitigating attacks involving IoT devices. In this article, we discuss and analyse state-of-the-art DDoS attacks under SDN-based IoT scenarios. Furthermore, we verify our SDN sEcure COntrol and Data plane (SECOD) algorithm to resist DDoS attacks on the real SDN-based IoT testbed. Our results demonstrate that DDoS attacks in the SDN-based IoT network are easier to detect than in the traditional network due to IoT traffic predictability. We observed that random traffic (UDP or TCP) is more affected during DDoS attacks. Our results also show that the probability of a controller becoming halt is 10%, while the probability of a switch getting unresponsive is 40%.

Configuration and Governance of Dynamic Secure SDN

Abstract Software Defined Networks (SDN) is a networking paradigm that separates the control plane from the forwarding plane. There is little research on structuring the SDN data plane for security. The Robust Network and Segmentation Algorithm (RNS) is an algorithm based on Product Family Algebra (PFA) that implements layered defence and segmentation strategies to segment resources towards designing secure networks. In this paper, we present an additional plane in charge of the configuration and governance of SDN data planes that we call Dynamic Configuration and Governance (DCG) plane. It is intended to give agility to dynamic networks. It implements the RNS algorithm in SDN environment. Moreover, we propose and suggest three architectures that use DCG plane. Then we assess the three architectures. The assessment results identify an architecture that is suitable for dynamic networks and another for networks that are more stable regarding changes to policy and network topology.

Improving the Fault Tolerance of Elements of Modern Infocommunication Networks with the Use of Default Gateway Redundancy Protocols

The article is devoted to the Network Layer means to ensure resilience during designing an infocommunication system that can counteract faults and failures. A review of the default gateway redundancy protocols concept and analysis of recent developments to overcome fault tolerance challenges in the Software-Defined Networks (SDN) control plane are conducted. In addition, an approach to the use of default gateway redundancy protocols in the existing Software-Defined Network architecture is proposed. Therefore, within the approach, the redundancy of the virtual controller is organized based on the current protocol implemented in traditional IP networks, and the SDN switch interacts with the virtual controller. This mechanism aims to reduce the amount of circulating overhead (control traffic), and the backup controller’s organization increases the control plane’s reliability. Whereas in hybrid and hierarchical SDN networks with border routers, the GLBP mechanism can be applied, which increases the reliability of the controller connected to the data plane. In addition, there are several scenarios where the controller that manages the operation of the SDN data plane may have multiple backup controllers to switch in case of failure, or a controller pool is used to manage each network that makes up the SDN data plane. It also highlights promising future areas for research and development to improve Software-Defined Network resilience, which contributes to the emergence of new solutions. Thus, future research directions are seen in proposing mathematical flow-based models of fault-tolerant interaction of the control plane and the data plane based on redundancy. At the same time, setting the problem in an optimization form with the implementation of load balancing will help to use available network resources effectively.

Traffic management inside software-defined data centre networking

In recent years, data centre (DC) networks have improved their rapid exchanging abilities. Software-defined networking (SDN) is presented to alternate the impression of conventional networks by segregating the control plane from the SDN data plane. The SDN presented overcomes the limitations of traditional DC networks caused by the rapidly incrementing amounts of apps, websites, data storage needs, etc. Software-defined networking data centres (SDN-DC), based on the open-flow (OF) protocol, are used to achieve superior behaviour for executing traffic load-balancing (LB) jobs. The LB function divides the traffic-flow demands between the end devices to avoid links congestion. In short, SDN is proposed to manage more operative configurations, efficient enhancements and further elasticity to handle massive network schemes. In this paper the opendaylight controller (ODL-CO) with new version OF 1.4 protocol and the ant colony optimization algorithm is proposed to test the performance of the LB function using IPv6 in a SDN-DC network by studying the throughput, data transfer, bandwidth and average delay performance of the networking parameters before and after use of the LB algorithm. As a result, after applying the LB, the throughput, data transfer and bandwidth performance increased, while the average delay decreased.

DeepGuard: Efficient Anomaly Detection in SDN With Fine-Grained Traffic Flow Monitoring

Software-Defined Networking (SDN) leverages the implementation of reliable, flexible and efficient network security mechanisms which make use of novel techniques such as artificial intelligence (AI) and machine learning (ML). In particular, these techniques - together with SDN - are the key enablers for the design of anomaly detection methods which are based on efficient traffic flow monitoring. In this paper, we tackle this problem by proposing an efficient anomaly detection framework, denoted as DeepGuard, which improves the detection performance of cyberattacks in SDN based networks by adopting a fine-grained traffic flow monitoring mechanism. Specifically, the proposed framework utilizes a deep reinforcement learning technique, i.e., Double Deep ${Q}$ -Network (DDQN), to learn traffic flow matching strategies maximizing the traffic flow granularity while proactively protecting the SDN data plane from being overloaded. Afterwards, by implementing the learned optimal traffic flow matching control policy, the most beneficial traffic information for anomaly detection is acquired at runtime—thereby improving the cyberattack detection performance. The performance of the proposed framework is validated by extensive experiments, and the results show that DeepGuard yields significant performance improvements compared to existing traffic flow matching mechanisms regarding the level of traffic flow granularity. In the case of distributed denial-of-service (DDoS) attacks, DeepGuard achieves a remarkable attack detection performance while effectively preventing forwarding performance degradation in the SDN data plane.

Design, Analysis, and a Terabit Implementation of a Source-Routing-Based SDN Data Plane

This article demonstrates the design, analysis, implementation, and operation of a 1-Tb/s carrier-class programmable data-plane SDN system. The system is based on the principles of programmable data planes and is implemented using a recent software-defined networks (SDNs) manifestation, called bitstream, and FPGAs. It supports P4 parsing to facilitate a 1-Tb/s-capable SDN, carrier-class network element. We discuss how bitstream fits in a service provider network architecture. A node-level FPGA implementation using a reconfigurable match-tables technique is presented. We show that bitstream brings programmability to the data plane without the need for large custom silicon. A controller that interoperates with P4 is developed. A terabit carrier-class SDN node that demonstrates layer-0 to layer-4 protocols is built and shown in a test bed. We show FPGA-level, controller-level, and service-level operations. A management plane for carrier-class performance measurements and provisioning is showcased. A qualitative and quantitative study benchmarking this article versus other approaches is put forth. We show benchmarking for different services, such as equal-cost multiple paths and sub-50 ms restoration from the test-bed implementation.

ISDSDN: Mitigating SYN Flood Attacks in Software Defined Networks

Software defined networking (SDN) has emerged over the past few years as a novel networking technology that enables fast and easy network management. Separating the control plane and the data plane in SDNs allows for dynamic network management, implementation of new applications, and implementing network specific functions in software. This paper addresses the problem of SYN flood attacks in SDNs which are considered among the most challenging threats because their effect exceeds the targeted end system to the controller and TCAM of OpenFlow switches. These attacks exploit the three-way handshaking connection establishment mechanism in TCP, where attackers overwhelm the victim machine with flood of spoofed SYN packets resulting in a large number of half-open connections that would never complete. Therefore, degrading the performance of the controller and populating OpenFlow switches’ TCAMs with spoofed entries. In this paper, we propose ISDSDN, a mechanism for SYN flood attack mitigation in software defined networks. The proposed mechanism adopts the idea of intentional dropping to distinguish between legitimate and attack SYN packets in the context of software defined networks. ISDSDN is implemented as an extension module of POX controller and is evaluated under different attack scenarios. Performance evaluation shows that the proposed mechanism is very effective in defending against SYN flood attacks.

Detection and Mitigation of DoS and DDoS Attacks in IoT-Based Stateful SDN : An Experimental Approach.

The expected advent of the Internet of Things (IoT) has triggered a large demand of embedded devices, which envisions the autonomous interaction of sensors and actuators while offering all sort of smart services. However, these IoT devices are limited in computation, storage, and network capacity, which makes them easy to hack and compromise. To achieve secure development of IoT, it is necessary to engineer scalable security solutions optimized for the IoT ecosystem. To this end, Software Defined Networking (SDN) is a promising paradigm that serves as a pillar in the fifth generation of mobile systems (5G) that could help to detect and mitigate Denial of Service (DoS) and Distributed DoS (DDoS) threats. In this work, we propose to experimentally evaluate an entropy-based solution to detect and mitigate DoS and DDoS attacks in IoT scenarios using a stateful SDN data plane. The obtained results demonstrate for the first time the effectiveness of this technique targeting real IoT data traffic.

Fingerprinting SDN Policy Parameters: An Empirical Study

Research in Software Defined Networks (SDN) has gained momentum in recent years. SDNs are getting mature, however, there are still many research challenges that need to be considered before SDN become ubiquitous. The adaptation of the technology brings immediate focus to its security aspects. The centralized nature of the SDN makes it prone to many denial of service attacks, especially if the policy parameters of SDN are known to adversaries. In this work, we present techniques to perform fingerprinting of SDN including policy parameters such as hard and idle/soft timeouts, OpenFlow match-fields used by the SDN controller, controller reaction at table full event and information about the topology of the targeted network. An adversary can launch a carefully planned attack, especially on the SDN data plane, if these policy parameters are easily discoverable for a SDN domain. Assuming access to the SDN domain’s host and customized packet generation from the compromised host, we propose efficient techniques to discover these aforementioned policy parameters. The results of the proposed fingerprinting techniques are verified by using Mininet.

SDN-Enabled Network Coding-Based Secure Data Dissemination in VANET Environment

Security and reliability in data transmission are considered as the challenging concerns in VANET. Software-defined networking (SDN) and network coding (NC) are the two key apprehensions in networking that have caught much attention from both industry and academia in recent years. Decoupling of control plane and data plane in SDN enables the centralized control of the network, providing flexibility to a great extent. On the other hand, NC has shown immense potential for improving robustness and security when deployed on VANET. This article advocates for the design of an architecture which exercises the SDN concept by incorporating NC with multigeneration-mixing (MGM) functionalities to increase reliability as well as security of data transmission in vehicular networks. We design an MGM-based NC protocol for encoding and decoding of data. Moreover, a centralized SDN controller takes charge of authentication of vehicles. Finally, we build a simulation model based on realistic traffic and communication characteristics. The simulation results show that the proposed protocol leveraged by the SDN framework outperforms the conventional NC-based protocol in case of security and reliability. Moreover, the simulation model is exhibited and point-by-point execution assessment is given to demonstrate the scalability and prevalence of the proposed strategy.

FTLink: Efficient and flexible link fault tolerance scheme for data plane in Software-Defined Networking

Link fault tolerance has been a hotspot in Software-Defined Networking (SDN) for many years. Both proactive and reactive schemes are proposed to guarantee network availability and robustness. However, the former wastes plenty of Ternary Content Addressable Memory (TCAM) and bandwidth resources, while the latter faces long fault recovery time.In this paper, we propose FTLink, an efficient and flexible link fault tolerance scheme in SDN. Firstly, through collecting the current network state information, we pre-generate a set of backup links for each link of the primary path of the flow. We formulate the backup links planning as a multi-objective optimization problem that minimizes the required switch TCAMs and link bandwidths. Combining flow characteristics, we develop a two-step heuristic algorithm, namely planning backup links for each link that transmits elephant flows with the greedy tracing method in step 1 and for each link that transmits mice flows with the bidirectional searching method in step 2, to determine the backup links set. Then, we introduce a global matching table in the controller to maintain the generated backup links and additional flow rules. Once monitoring a faulty link, FTLink looks up the matching table entries and enables the backup links via installing the additional flow rules into the switches to realize flexible fault recovery. Simulations show that FTLink is effective in terms of high-efficiency TCAM and bandwidth usage and produces an acceptable recovery time of less than 30 ms, compared with baseline schemes. The prototype tests under realistic network further confirm the efficiency of FTLink.

A survey of control consistency in Software-Defined Networking

Software-Defined Networking (SDN) offers a flexible and programmable model to manage and schedule network resources. With the separation of control plane and data plane in SDN, the centralized controller frequently updates the flow tables in data plane to control network, and the data plane also communicates its requests with the control plane for forwarding actions. Due to the asynchronous control nature of SDN, a SDN network may suffer from inconsistency issues caused by concurrency violations, which may lead to network misbehaviors, such as communication interruption, policy violation, and performance degradation. To make SDN correct and stable, consistency is an essential feature that SDN should possess. In this paper, we make a survey about the control consistency in SDN from three aspects: (1) a consistent network view and control decisions made by the control plane, (2) consistency and efficiency during data plane update, (3) maintaining consistent flow tables in the data plane. We summarize the fundamental causes of consistency issues, the potential inconsistency problems and the state-of-art solutions, and then discuss the challenges to guarantee the consistency for SDN.

P4-to-blockchain: A secure blockchain-enabled packet parser for software defined networking

Security is one of the most challenging issues in software defined networking (SDN), and causes include the inability to detect the contents of the packets. In addition, file transferring to SDN is a potential attack vector that can be exploited at the network level. On the SDN data plane (i.e. the switch), packets are processed so that their behavior in the network can be determined. Packet parser (PP) acts as the main role of this operation on the switch. PP plays a very important role in identifying packets and supporting protocols and testing new ideas in SDN, which requires packet parsers on the data plane to provide the necessary flexibility and programmability. In recent times, cryptographic ledger technology (also referred to as Blockchain in the literature) has been applied to securely transfer transactions and files in the networks, mainly for crypto payments. In this paper, we propose a new packet parser architecture called Blockchain-enabled Packet Parser (BPP) based on the security characteristics of the blockchain and support for data processing functions with the description of Programming Protocol-Independent Packet Processors (P4) language that has the BPP-independent attribute of the protocol. In the proposed architecture, we provide a mathematical model based on a multivariate correlation approach for attack detection from the observed packet traffic. The implementation of BPP architecture is on Field Programmable Gate Array (FPGA), which is known for its higher processing speed, flexibility, and lower consumption resources. The result indicates that the proposed BPP is able to detect attacks and policy performed on the control plane in how to detect an attack from a packet structure efficiently. Furthermore, the impact of the bandwidth with and without the BPP in hardware environment is evaluated to demonstrate BPP's efficiency.

Impact of Adaptive Consistency on Distributed SDN Applications: An Empirical Study

Scalability of the control plane in a software-defined network (SDN) is enabled by means of decentralization of the decision-making logic, i.e., by replication of controller functions to physically or virtually dislocated controller replicas. Replication of a centralized controller state also enables the protection against controller failures by means of primary and backup replicas responsible for managing the underlying SDN data plane devices. In this paper, we investigate the effect of the deployed consistency model on scalability and correctness metrics of the SDN control plane. In particular, we compare the strong and eventual consistency, and make a case for a novel adaptive consistency approach. The existing controller platforms rely on either strong or eventual consistency mechanisms in their state distribution. We show how an adaptive consistency model offers the scalability benefits in terms of the total request-handling throughput and response time, in contrast to the strong consistency model. We also outline how the adaptive consistency approach can provide for correctness semantics that are unachievable with the eventual consistency paradigm in practice. The adaptability of our approach provides a balanced and tunable tradeoff of scalability and correctness for the SDN application implemented on top of the adaptive framework. To validate our assumptions, we evaluate and compare the different approaches in an emulated testbed with an example of a load balancer controller application. The experimental setup comprises up to five extended OpenDaylight controller instances and two network topologies from the area of service provider and data center networks.

A Proactive Flow Admission and Re-Routing Scheme for Load Balancing and Mitigation of Congestion Propagation in SDN Data Plane

The centralized architecture in software-defined network (SDN) provides a global view of the underlying network, paving the way for enormous research in the area of SDN traffic engineering (SDN TE). This research focuses on the load balancing aspects of SDN TE, given that the existing reactive methods for data-plane load balancing eventually result in packet loss and proactive schemes for data plane load balancing do not address congestion propagation. In the proposed work, the SDN controller periodically monitors flow level statistics and utilization on each link in the network and over-utilized links that cause network congestion and packet loss are identified as bottleneck links. For load balancing the identified largest flow and further traffic through these bottleneck links are rerouted through the lightly-loaded alternate path. The proposed scheme models a Bayesian Network using the observed port utilization and residual bandwidth to decide whether the newly computed alternate path can handle the new flow load before flow admission which in turn reduces congestion propagation. The simulation results show that when the network traffic increases the proposed method efficiently re-routes the flows and balance the network load which substantially improves the network efficiency and the quality of service (QoS) parameters.

IEEE NetSoft 2017 special issue: Softwarization sustaining a hyper‐connected world: En route to 5G

IEEE NetSoft 2017 special issue: Softwarization sustaining a hyper‐connected world: En route to 5G

PNPL: Simplifying programming for protocol-oblivious SDN networks

Protocol-Oblivious Forwarding (POF) is a groundbreaking technology that enables a protocol-independent data plane for the future Software-Defined Networking (SDN). Compared to OpenFlow and P4, POF provides more generality and flexibility in the data plane, but at a cost of additional complexity in the control plane. To overcome such complexity, in this paper we present PNPL, the first control plane programming framework over the POF SDN data plane. PNPL provides an easy-to-use programming paradigm that includes a header specification language and a set of protocol-agnostic programming APIs. With PNPL, a programmer can arbitrarily define network protocols, and compose network policies over the self-defined protocols with high-level abstractions. PNPL’s runtime system takes the user program as input, automatically produces and maintains forwarding pipelines in POF switches. The pipeline efficiently parses the self-defined protocol headers and enforces the programmer’s network policy. We have implemented a PNPL prototype, and experiment with existing and novel protocols and a number of network applications. We show that PNPL can effectively facilitate network innovations by simplifying programming over novel protocols, producing and maintaining forwarding pipelines of high quality; compared to P4, PNPL does not require a device configuration phase, and improves network performance by significantly reducing the packet parsing overhead.