In software-defined networking (SDN), as data plane scale expands, scalability and reliability of the control plane have become major concerns. To mitigate such concerns, two kinds of solutions have been proposed separately. One is multi- controller architecture, i.e., a logically centralized control plane with physically distributed controllers. The other is control devolution, i.e., delegating control of some flows back to switches. Most of existing solutions adopt either static switch-controller association or static devolution, which may not adapt well to the traffic variation, leading to high communication costs between switches and controller, and high computation costs of switches. In this paper, we propose a novel scheme to jointly consider both solutions, i.e., we dynamically associate switches with controllers and dynamically devolve control of flows to switches. Our scheme is an efficient online algorithm that does not need the statistics of traffic flows. By adjusting a parameter, we can make a trade- off between costs and queue backlogs. Theoretical analysis and extensive simulations show that our scheme yields much lower costs or latency compared to other schemes, as well as balanced loads among controllers.
For software-defined networking (SDN) systems, to enhance the scalability and reliability of control plane, existing solutions adopt either multi-controller design with static switch-controller associations, or static control devolution by delegating certain request processing back to switches. Such solutions can fall short in face of temporal variations of request traffics, incurring considerable local computation costs on switches and their communication costs to controllers. So far, it still remains an open problem to develop a joint online scheme that conducts dynamic switch-controller ass…
In software-defined networking (SDN) systems, it is a common practice to adopt a multi-controller design and control devolution techniques to improve the performance of the control plane. However, in such systems, the decision-making for joint switch-controller association and control devolution often involves various uncertainties, e.g., the temporal variations of controller accessibility, and computation and communication costs of switches. In practice, statistics of such uncertainties are unattainable and need to be learned in an online fashion, calling for an integrated design of learning …
In a reliable SDN environment, different controllers coordinate different switches and backup controllers can be set in place to tolerate faults. This approach increases the challenge to maintain a consistent network view. If this global view is not consistent with the actual network state, applications will operate on a stale state and potentially lead to incorrect behavior. Faced with this problem, we propose a fault-tolerant SDN controller that is able to maintain a consistent network view by using transactional semantics on both control and data plane state. Different from previous proposa…
Efficient algorithms and techniques to detect and identify large flows in a high throughput traffic stream in the SDN match-and-action model are presented. This is in contrast to previous work that either deviated from the match and action model by requiring additional switch level capabilities or did not exploit the SDN data plane. Our construction has two parts; (a) how to sample in an SDN match and action model, (b) how to detect large flows efficiently and in a scalable way, in the SDN model. Our large flow detection methods provide high accuracy and present a good and practical tradeoff b…
In the paper, a new mechanism for Software-Defined Networking (SDN) flow aggregation accompanied with multipath transmission is proposed. The aggregation results in a low number of flow entries in core switches. This type of scalability improvement of flow processing is obtained thanks to application of the procedure based on introduction of centrally managed MPLS label distribution performed by an SDN controller. Moreover, multipath transmission improves network resource utilization. The proposed mechanism does not involve definition of new protocols. It neither needs application of legacy si…
To improve traffic management ability, Internet Service Providers (ISPs) are gradually upgrading legacy network devices to programmable devices that support Software-Defined Networking (SDN). The coexistence of legacy and SDN devices gives rise to a hybrid SDN. Existing hybrid SDNs do not consider the potential performance issues introduced by a centralized SDN controller: flow requests processed by a highly loaded controller may experience long tail processing delay; inappropriate multi-controller deployment could increase the propagation delay of flow requests. In this paper, we propose to j…
In Software-Defined Networking (SDN), network applications use the logically centralized network view provided by the controller to remotely orchestrate the network switches. To avoid the controller being a single point of failure, traditional fault-tolerance techniques are employed to guarantee availability, a fundamental requirement in production environments. Unfortunately, these techniques fall short of ensuring correct network behaviour under controller failures. The problem of these techniques is that they deal with only part of the problem: guaranteeing that application and controller s…
We present ez-Segway, a decentralized mechanism to consistently and quickly update the network state while preventing forwarding anomalies (loops and black-holes) and avoiding link congestion. In our design, the centralized SDN controller only pre-computes information needed by the switches during the update execution. This information is distributed to the switches, which use partial knowledge and direct message passing to efficiently realize the update. This separation of concerns has the key benefit of improving update performance as the communication and computation bottlenecks at the cont…
Middleboxes are special network devices that perform various functions such as enabling security and efficiency. SDN-based routing approaches in networks with middleboxes need to address resource constraints, such as memory in the switches and processing power of middleboxes, and traversal constraint where a flow must visit the required middleboxes in a specific order. In this work we propose a solution based on MultiPoint-To-Point Trees (MPTPT) for routing traffic in SDN-enabled networks with consolidated middleboxes. We show both theoretically and via simulations that our solution significan…
We propose a novel framework that reduces the management and integration overheads for real-time network flows by leveraging the capabilities (especially global visibility and management) of software-defined networking (SDN) architectures. Given the specifications of flows that must meet hard real-time requirements, our framework synthesizes paths through the network and associated switch configurations - to guarantee that these flows meet their end-to-end timing requirements. In doing so, our framework makes SDN architectures "delay-aware" - remember that SDN is otherwise not able to reason a…
When dealing with node or link failures in Software Defined Networking (SDN), the network capability to establish an alternative path depends on controller reachability and on the round trip times (RTTs) between controller and involved switches. Moreover, current SDN data plane abstractions for failure detection (e.g. OpenFlow "Fast-failover") do not allow programmers to tweak switches' detection mechanism, thus leaving SDN operators still relying on proprietary management interfaces (when available) to achieve guaranteed detection and recovery delays. We propose SPIDER, an OpenFlow-like pipel…
Networking for big data has to be intelligent because it will adjust data transmission requirements adaptively during data splitting and merging. Software-defined networking (SDN) provides a workable and practical paradigm for designing more efficient and flexible networks. Matching strategy in the flow table of SDN switches is most crucial. In this paper, we use a classification approach to analyze the structure of packets based on the tuple-space lookup mechanism, and propose a matching model of the flow table in SDN switches by classifying packets based on a set of fields, which is called a…
The highly dynamic nature of the current network traffics, makes the network managers to exploit the flexibility of the state-of-the-art paradigm called SDN. In this way, there has been an increasing interest in hybrid networks of SDN-MPLS. In this paper, a new traffic engineering architecture for SDN-MPLS network is proposed. To this end, OpenFlow-enabled switches are applied over the edge of the network to improve flow-level management flexibility while MPLS routers are considered as the core of the network to make the scheme applicable for existing MPLS networks. The proposed scheme re-assi…
The successful OpenFlow approach to Software Defined Networking (SDN) allows network programmability through a central controller able to orchestrate a set of dumb switches. However, the simple match/action abstraction of OpenFlow switches constrains the evolution of the forwarding rules to be fully managed by the controller. This can be particularly limiting for a number of applications that are affected by the delay of the slow control path, like traffic management applications. Some recent proposals are pushing toward an evolution of the OpenFlow abstraction to enable the evolution of forwa…
Software-defined networking (SDN) is an architecture that aims to make networks fast and flexible. SDN's goal is to improve network control by enabling service providers as well as enterprises to respond quickly to changing business needs. In SDN, the administrator can shape traffic from a centralized control console without having to modify any of the individual switches belonging to the network. The SDN controller which is centralized directs the switches to deliver network services wherever they are needed, irrespective of the specific connections between a server and devices. This methodol…
We propose P4-MACsec to protect network links between P4 switches through automated deployment of MACsec, a widespread IEEE standard for securing Layer 2 infrastructures. It is supported by switches and routers from major manufacturers and has only little performance limitations compared to VPN technologies such as IPsec. P4-MACsec introduces a data plane implementation of MACsec including AES-GCM encryption and decryption directly on P4 switches. P4-MACsec features a two-tier control plane structure where local controllers running on the P4 switches interact with a central controller. We prop…
As the most competitive solution for next-generation network, software-defined network (SDN) and its dominant implementation OpenFlow, are attracting more and more interests. But besides convenience and flexibility, SDN/OpenFlow also introduces new kinds of limitations and security issues. Of these limitations, the most obvious and maybe the most neglected one, is the flow table capacity of SDN/OpenFlow switches. In this paper, we proposed a novel inference attack targeting at SDN/OpenFlow network, which is motivated by the limited flow table capacities of SDN/OpenFlow switches and the followi…
To meet the timing requirements of interactive applications, the no-frills congestion-agnostic transport protocols like UDP are increasingly deployed side-by-side in the same network with congestion-responsive TCP. In cloud platforms, even though the computation and storage is totally virtualized, they lack a true virtualization mechanism for the network (i.e., the underlying data centers networks). The impact of such lack of isolation services, may result into frequent outages (for some applications) when such diverse traffics contend for the small buffers in the commodity switches used in da…
Current approaches to tackle the single point of failure in SDN entail a distributed operation of SDN controller instances. Their state synchronization process is reliant on the assumption of a correct decision-making in the controllers. Successful introduction of SDN in the critical infrastructure networks also requires catering to the issue of unavailable, unreliable (e.g. buggy), and malicious controller failures. We propose MORPH, a framework tolerant to unavailability and Byzantine failures, which distinguishes and localizes faulty controller instances and appropriately reconfigures the c…
We consider a distributed Software Defined Networking (SDN) architecture adopting a cluster of multiple controllers to improve network performance and reliability. Besides the Openflow control traffic exchanged between controllers and switches, we focus on the control traffic exchanged among the controllers in the cluster, needed to run coordination and consensus algorithms to keep the controllers synchronized. We estimate the effect of the inter-controller communications on the reaction time perceived by the switches depending on the data-ownership model adopted in the cluster. The model is a…
Software-Defined Networking (SDN) is an emerging paradigm that promises to change this state of affairs, by breaking vertical integration, separating the network's control logic from the underlying routers and switches, promoting (logical) centralization of network control, and introducing the ability to program the network. The separation of concerns introduced between the definition of network policies, their implementation in switching hardware, and the forwarding of traffic, is key to the desired flexibility: by breaking the network control problem into tractable pieces, SDN makes it easie…
Modern In-Vehicle Networks (IVNs) are composed of a large number of devices and services linked via an Ethernet-based time-sensitive network. Communication in future IVNs will become more dynamic as services can be updated, added, or removed during runtime. This requires a flexible and adaptable IVN, for which Software-Defined Networking (SDN) is a promising candidate. In this paper, we show how SDN can be used to support a dynamic, service-oriented network architecture. We demonstrate our concept using the SOME/IP protocol, which is the most widely deployed implementation of automotive servic…
SDN promises to make networks more flexible, programmable, and easier to manage. Inherent security problems in SDN today, however, pose a threat to the promised benefits. First, the network operator lacks tools to proactively ensure that policies will be followed or to reactively inspect the behavior of the network. Second, the distributed nature of state updates at the data plane leads to inconsistent network behavior during reconfigurations. Third, the large flow space makes the data plane susceptible to state exhaustion attacks. This paper presents SDNsec, an SDN security extension that pro…
The state-of-the-art OpenFlow technology only partially realized SDN vision of abstraction and centralization for packet forwarding in switches. OpenFlow/P4 falls short in implementing middlebox functionalities due to the fundamental limitation in its match-action abstraction. In this paper, we advocate the vision of Software-Defined Middleboxes (SDM) to realize abstraction and centralization for middleboxes. We further propose OpenFunction, an SDM reference architecture and a network function abstraction layer. Our SDM architecture and OpenFunction abstraction are complementary to existing SD…
We propose Range-based Ternary Search Tree (RTST), a tree-based approach for flow-table lookup in SDN network. RTST builds upon flow-tables in SDN switches to provide a fast lookup among flows. We present a parallel multi-pipeline architecture for implementing RTST that benefits from high throughput and low latency. The proposed RTST and architecture achieve a memory efficiency of 1 byte of memory for each byte of flow. We also present a set of techniques to support dynamic updates. Experimental results show that RTST can be used to improve the performance of flow-lookup. It achieves a through…
Software Defined Networking (SDN) has been recently introduced as a new communication paradigm in computer networks. By separating the control plane from the data plane and entrusting packet forwarding to straightforward switches, SDN makes it possible to deploy and run networks which are more flexible to manage and easier to configure. This paper describes a set of extensions for the INET framework, which allow researchers and network designers to simulate SDN architectures and evaluate their performance and security at design time. Together with performance evaluation and design optimization…
Distributed Software Defined Networking (SDN) controllers aim to solve the issue of single-point-of-failure and improve the scalability of the control plane. Byzantine and faulty controllers, however, may enforce incorrect configurations and thus endanger the control plane correctness. Multiple Byzantine Fault Tolerance (BFT) approaches relying on Replicated State Machine (RSM) execution have been proposed in the past to cater for this issue. The scalability of such solutions is, however, limited. Additionally, the interplay between progressing the state of the distributed controllers and the …
Providing resilient network control is a critical concern for deploying Software-Defined Networking (SDN) into Wide-Area Networks (WANs). For performance reasons, a Software-Defined WAN is divided into multiple domains controlled by multiple controllers with a logically centralized view. Under controller failures, we need to remap the control of offline switches from failed controllers to other active controllers. Existing solutions could either overload active controllers to interrupt their normal operations or degrade network performance because of increasing the controller-switch communicat…
Software-defined networking (SDN) has become a fundamental technology for data centers and 5G networks. In an SDN network, routing and traffic management decisions are made by a centralized controller and communicated to switches via a control channel. Transport Layer Security (TLS) has been proposed as its single security layer; however, use of TLS is optional and connections are still vulnerable to downgrade attacks. In this paper, we propose the strengthening of security assurance using a protocol dialecting approach to provide additional and customizable security. We consider and evaluate …
SDN-enabled Integrated satellite-terrestrial networks (ISTNs), can provide several advantages including global seamless coverage, high reliability, low latency, etc. and can be a key enabler towards next generation networks. To deal with the complexity of the control and management of the integrated network, leveraging the concept of software-defined networking (SDN) will be helpful. In this regard, the SDN controller placement problem in SDN-enabled ISTNs becomes of paramount importance. In this paper, we formulate an optimization problem for the SDN controller placement with the objective of…
SDN efficiency is driven by the ability of controllers to process small packets based on a global view of the network. The goal of such controllers is thus to treat new flows coming from hundreds of switches in a timely fashion. In this paper, we show this ideal remains impossible through the most extensive evaluation of SDN controllers. We evaluated five state-of-the-art SDN controllers and discovered that the most efficient one spends a fifth of his time in packet serialization. More dramatically, we show that this limitation is inherent to the object oriented design principle of these contr…
The communication network context in actual systems like 5G, cloud and IoT (Internet of Things), presents an ever-increasing number of users, applications, and services that are highly distributed with distinct and heterogeneous communications requirements. Resource allocation in this context requires dynamic, efficient, and customized solutions and Bandwidth Allocation Models (BAMs) are an alternative to support this new trend. This paper proposes the BAMSDN (Bandwidth Allocation Model through Software-Defined Networking) framework that dynamically allocates resources (bandwidth) for a MPLS (…
Software Defined Networking (SDN) is a new networking architecture which aims to provide better decoupling between network control (control plane) and data forwarding functionalities (data plane). This separation introduces several benefits, such as a directly programmable and (virtually) centralized network control. However, researchers showed that the required communication channel between the control and data plane of SDN creates a potential bottleneck in the system, introducing new vulnerabilities. Indeed, this behavior could be exploited to mount powerful attacks, such as the control plan…
We introduce the real-time multi-technology transport layer monitoring to facilitate the coordinated virtualisation of optical and Ethernet networks supported by optical virtualise-able transceivers (V-BVT). A monitoring and network resource configuration scheme is proposed to include the hardware monitoring in both Ethernet and Optical layers. The scheme depicts the data and control interactions among multiple network layers under the software defined network (SDN) background, as well as the application that analyses the monitored data obtained from the database. We also present a re-configur…
Recent years have seen an evolution of SDN control plane architectures, starting from simple monolithic controllers, over modular monolithic controllers, to distributed controllers. We observe, however, that today's distributed controllers still exhibit inflexibility with respect to the distribution of control logic. Therefore, we propose a novel architecture of a distributed SDN controller in this paper, providing maximum flexibility with respect to distribution. Our architecture splits control logic into light-weight control modules, called controllets, based on a micro-kernel approach, redu…
Software Defined Networking (SDN) is an emerging technology of efficiently controlling and managing computer networks, such as in data centres, Wide Area Networks (WANs), as well as in ubiquitous communication. In this paper, we explore the idea of embedding the SDN components, represented by SDN controller and virtual switch, in end-hosts to improve network performance. In particular, we consider load balancing across multiple network interfaces on end-hosts with different link capacity scenarios. We have explored and implemented different SDN-based load balancing approaches based on OpenFlow…
The convergence of IT and OT technologies results in the need for efficient network management solutions for automotive and industrial automation environments. However, configuring real-time Ethernet networks while maintaining the desired QoS is challenging due to the dynamic nature of OT networks and the high configuration parameters. This paper introduces an SDN-based self-configuration framework for the fully automated configuration of TSN networks. Unlike standard TSN configuration, we remove end-host-related dependencies and put flows initially on default paths to extract traffic characte…
In this work, we propose and experimentally assess the automatic and flexible NSs configurations of optical OPSquare DCN controlled and orchestrated by an extended SDN control plane for multi-tenant applications with differentiated QoS provisioning. Optical Flow Control (OFC) protocol has been developed to prevent packet losses at switch sides caused by packet contentions.Based on the collected resource topology of data plane, the optical network slices can be dynamically provisioned and automatically reconfigured by the SDN control plane. Meanwhile, experimental results validate that the prio…
An approach to using the concept of Software-Defined Networking and Network Functions Virtualization (SDN/NFV) for the implementation of an information security monitoring and management system in 5G and 6G networks is proposed. SDN switches based on the OpenFlow protocol are offered as network sensors. In order to reduce the time for finding a subset of the right rules in the vast array of all rules on traffic filtering systems that are logically located on sensors, a method of processing and filtering traffic in 5G and 6G transport networks is proposed. This method is based on DPDK with the …
Software-defined networking (SDN) eases network management by centralizing the control plane and separating it from the data plane. The separation of planes in SDN, however, introduces new vulnerabilities in SDN networks since the difference in processing packets at each plane allows an adversary to fingerprint the network's packet-forwarding logic. In this paper, we study the feasibility of fingerprinting the controller-switch interactions by a remote adversary, whose aim is to acquire knowledge about specific flow rules that are installed at the switches. This knowledge empowers the adversar…
Flow delegation is a flexible technique to mitigate flow table capacity bottlenecks in Software-defined Networks (SDN). Such bottlenecks occur when SDN switches provide insufficient flow table capacity which leads to performance degradation and network failures. Flow delegation addresses this problem by automatically relocating flow rules from a bottlenecked switch to neighboring switches with spare capacity. This paper introduces a new algorithm to efficiently perform flow delegation based on a novel delegation template abstraction and multi-period multi-objective optimization. Different from…
The concept of SDN has emerged as a way to address numerous challenges with traditional network architectures by decoupling network control and forwarding. So far, the use cases for SDN mainly targeted data-center applications. This article considers SDN for network carriers, facing operation of large-scale networks with millions of customers, multiple technologies, and high availability demands. With specific carrier-grade features such as scalability, reliability, flexibility, modularity, and virtualization in mind, the SPARC EU project has developed the SPARC SplitArchitecture concept. The …
Software Defined Networking (SDN) paradigm has the benefits of programmable network elements by separating the control and the forwarding planes, efficiency through optimized routing and flexibility in network management. As the energy costs contribute largely to the overall costs in networks, energy efficiency has become a significant design requirement for modern networking mechanisms. However, designing energy efficient solutions is non-trivial since they need to tackle the trade-off between energy efficiency and network performance. In this article, we address the energy efficiency capabil…
In this paper, we propose a destination-aware adaptive traffic flow rule aggregation (DATA) mechanism for facilitating traffic flow monitoring in SDN-based networks. This method adapts the number of flow table entries in SDN switches according to the level of detail of traffic flow information that other mechanisms (e.g. for traffic engineering, traffic monitoring, intrusion detection) require. It also prevents performance degradation of the SDN switches by keeping the number of flow table entries well below a critical level. This level is not preset as a hard threshold but learned during oper…
Software-defined networking is considered a promising new paradigm, enabling more reliable and formally verifiable communication networks. However, this paper shows that the separation of the control plane from the data plane, which lies at the heart of Software-Defined Networks (SDNs), introduces a new vulnerability which we call \emph{teleportation}. An attacker (e.g., a malicious switch in the data plane or a host connected to the network) can use teleportation to transmit information via the control plane and bypass critical network functions in the data plane (e.g., a firewall), and to vi…
Software Defined Networking (SDN) is a novel network management technology, which currently attracts a lot of attention due to the provided capabilities. Recently, different works have been devoted to testing / verifying the (correct) configurations of SDN data planes. In general, SDN forwarding devices (e.g., switches) route (steer) traffic according to the configured flow rules; the latter identifies the set of virtual paths implemented in the data plane. In this paper, we propose a novel preventive approach for verifying that no misconfigurations (e.g., infinite loops), can occur given the …
In this paper we consider a Wireless Mesh Network (WMN) integrating SDN principles. The Wireless Mesh Routers (WMR) are OpenFlow capable switches that can be controlled by SDN controllers, according to the wmSDN (wireless mesh SDN) architecture that we have introduced in a previous work. We consider the issue of controller selection in a scenario with intermittent connectivity. We assume that over time a single WMN can become split in two or more partitions and that separate partitions can merge into a larger one. We assume that a set of SDN controllers can potentially take control of the WMRs…
The current functionality supported by OpenFlowbased software defined networking (SDN) includes switching, routing, tunneling, and some basic fire walling while operating on traffic flows. However, the semantics of SDN do not allow for other operations on the traffic, nor does it allow operations at a higher granularity. In this work, we describe a method to expand the SDN framework to add other network primitives. In particular, we present a method to integrate different network elements (like cache, proxy etc). Here, we focus on storage and caching, but our method could be expanded to other …
By introducing programmability, automated verification, and innovative debugging tools, Software-Defined Networks (SDNs) are poised to meet the increasingly stringent dependability requirements of today's communication networks. However, the design of fault-tolerant SDNs remains an open challenge. This paper considers the design of dependable SDNs through the lenses of self-stabilization - a very strong notion of fault-tolerance. In particular, we develop algorithms for an in-band and distributed control plane for SDNs, called Renaissance, which tolerate a wide range of failures. Our self-stab…
Data communication in cloud-based distributed stream data analytics often involves a collection of parallel and pipelined TCP flows. As the standard TCP congestion control mechanism is designed for achieving "fairness" among competing flows and is agnostic to the application layer contexts, the bandwidth allocation among a set of TCP flows traversing bottleneck links often leads to sub-optimal application-layer performance measures, e.g., stream processing throughput or average tuple complete latency. Motivated by this and enabled by the rapid development of the Software-Defined Networking (SD…
The Internet of Things (IoT) connected by Software Defined Networking (SDN) promises to bring great benefits to cyber-physical systems. However, the increased attack surface offered by the growing number of connected vulnerable devices and complex nature of SDN control plane applications could overturn the huge benefits of such a system. This paper addresses the vulnerability of some unspecified security flaw in the SDN control plane application (such as a zero-day software vulnerability) which can be exploited to insert malicious flow rules in the switch that do not match network policies. Sp…
Software-defined networking (SDN) attracts the attention of the research community in recent years, as evidenced by a large number of survey and review papers. The architecture of SDN clearly recognizes three planes: application, control, and data plane. The application plane executes network applications; control plane regulates the rules for the entire network based on the requests generated by network applications; and based on the set rules, the controller configures the switches in the data plane. The role of the switch in the data plane is to simply forward packets based on the instructi…
