As an emerging technology, blockchain (BC) has been playing a promising role in today's software-defined networking (SDN)-enabled Internet of Things (IoT) applications. Because of the salient feature of the network function virtualization (NFV) techniques, SDN can ensure an IoT system runs efficiently and smoothly in a cloud-driven ecosystem. When cloud-enabled systems encounter immense security and operational challenges caused mainly by third-party dependency, large-scale data communication, and maintenance, BC offers effective and robust data transfer solutions without incorporating intermediaries over the distributed network. With the increased SDN-BC convergence in the IoT domain, the underlying challenges and perspectives deserve proper attention methodically and structurally. From the motivation of addressing such issues, this study provides necessary insights to combine those for successful plug-and-play. Therefore, the study includes purposefully investigating current state-of-the-art to extract the research trends, future directions, and perspectives in this domain. This study provides a comprehensive survey of IoT, SDN, NFV, and BC-enabled emerging technologies. More importantly, the authors intelligently integrated the four different technologies—IoT, SDN, BC, and NFV based on characteristics, scopes, challenges, taxonomies, and tables in numerous areas. Initially, the authors introduce the SDN-IoT ecosystem in brief and address the features and applications. We took a close look at the SDN's overall taxonomy based on security, environment, scopes, and challenges. We also briefly describe the integration of SDN-IoT with the NFV ecosystems. Moreover, we review the prospect of BC technology from security perspectives, its extent, challenges of practical implementation, and the possible integration of IoT regarding smart applications. Finally, this study highlights several future directions based on these technologies. 

Impacts of blockchain in software‐defined Internet of Things ecosystem with Network Function Virtualization for smart applications: Present perspectives and future directions

In the cloud environment, owing to the large-scale sharing of the upper application instance and the underlying virtual machine resources, the tenants' information flow boundary in the shared virtual machine is fuzzy and difficult to identify. In addition, protection of tenant information flow between processes is inadequate, resulting in the leakage of sensitive information of tenants. Therefore, a dynamic control method for tenants' sensitive information flow based on virtual boundary recognition is proposed. By analyzing the behavior and operation log of tenants, the behavior feature vectors of tenants are constructed, and an automatic recognition algorithm of tenant virtual boundary based on the dynamic spiking neural network is designed. This algorithm can realize dynamic identification of the tenant virtual security boundary when the application service demand changes dynamically. Further, combined with the concept of centralized and decentralized information flow control, a dynamic control method of sensitive information flow is established. The security label is formally defined by using the lattice structure, and the control rules of tenants' information flow and the rules of tenant label encryption-declassification are designed. Thus, the independent, dynamic and secure control of tenants' information flow inside and outside the tenant virtual boundary. Finally, the detailed design of a dynamic security control application system for cloud tenants' sensitive information flow is provided. Experiments confirm that the proposed algorithm can identify the security boundary of tenants more accurately and efficiently than the traditional spiking neural network classification methods. Further, the security and effectiveness of the method is verified by the intransitive noninterference theory and the experiment of information flow control.

/pdf/dynamic-control-method-for-tenants-sensitive-information-1ys5hfrb0u.pdf

Dynamic Control Method for Tenants’ Sensitive Information Flow Based on Virtual Boundary Recognition

Software-Defined Networking (SDN) has become an essential networking concept towards escalating the networking capabilities that are highly demanded future internet system, which is immensely distributed in nature. Owing to the novel concept in the field of network, it is still shrouded with security problems. It is also found that the Distributed Denial-of-Service (DDoS) attack is one of the prominent problems in the SDN environment. After reviewing existing research solutions towards resisting DDoS attack in SDN, it is found that still there are many open-end issues. Therefore, these issues are identified and are addressed in this paper in the form of a preemptive model of security. Different from existing approaches, this model is capable of identifying any malicious activity that leads to a DDoS attack by performing a correct classification of attack strategy using a machine learning approach. The paper also discusses the applicability of best classifiers using machine learning that is effective against DDoS attack.

/pdf/preemptive-modelling-towards-classifying-vulnerability-of-13ut35wa9t.pdf

Preemptive modelling towards classifying vulnerability of DDoS attack in SDN environment

The dynamic state of networks presents a challenge for the deployment of distributed applications and protocols. Ad-hoc schedules in the updating phase might lead to a lot of ambiguity and issues. By separating the control and data planes and centralizing control, Software Defined Networking (SDN) offers novel opportunities and remedies for these issues. However, software-based centralized architecture for distributed environments introduces significant challenges. Security is a main and crucial issue in SDN. This paper presents a deep study of the state-of-the-art of security challenges and solutions for the SDN paradigm. The conducted study helped us to propose a dynamic approach to efficiently detect different security violations and incidents caused by network updates including forwarding loop, forwarding black hole, link congestion, network policy violation, etc. Our solution relies on an intelligent approach based on the use of Machine Learning and Artificial Intelligence Algorithms.

Artificial Intelligence for SDN Security: Analysis, Challenges and Approach Proposal

The number of network users and devices has exponentially increased in the last few decades, giving rise to sophisticated security threats while processing users’ and devices’ network data. Software-Defined Networking (SDN) introduces many new features, but none is more revolutionary than separating the control plane from the data plane. The separation helps DDoS attack detection mechanisms by introducing novel features and functionalities. Since the controller is the most critical part of the SDN network, its ability to control and monitor network traffic flow behavior ensures the network functions properly and smoothly. However, the controller’s importance to the SDN network makes it an attractive target for attackers. Distributed Denial of Service (DDoS) attack is one of the major threats to network security. This paper presents a comprehensive review of information theory-based approaches to detect low-rate and high-rate DDoS attacks on SDN controllers. Additionally, this paper provides a qualitative comparison between this work and the existing reviews on DDoS attack detection approaches using various metrics to highlight this work’s uniqueness. Moreover, this paper provides in-depth discussion and insight into the existing DDoS attack detection approaches to point out their weaknesses that open the avenue for future research directions. Meanwhile, the finding of this paper can be used by other researchers to propose a new or enhanced approach to protect SDN controllers from the threats of DDoS attacks by accurately detecting both low-rate and high-rate DDoS attacks.

/pdf/information-theory-based-approaches-to-detect-ddos-attacks-20omq66p77.pdf

Information Theory-based Approaches to Detect DDoS Attacks on Software-defined Networking Controller a Review

The main purpose of Software Defined Networking (SDN) is to allow network engineers to respond quickly to changing network industrial requirements. This network technology focuses on making network as adaptable and active as virtual server. SDN is physical separation of Control plane from Data plane and control plane is centralized to manage underlying infrastructure. Hence, the SDN permit network administrator to adjust wide traffic flow from centralized control console without having to touch Switches and Routers, and can provide the services to wherever they are needed in the network. As in SDN the control plane is disassociated from underlying forwarding plane, however, susceptible to many security challenges like Denial of Service (DoS) attack, Distributed DoS (DDoS) attack, Volumetric attack. In this paper, we highlight some security challenges and evaluate some security solutions.

Charulata Patil

Papers

Security challenges in software defined network and their solutions