Software Defined Networking simplifies design, monitoring and management of next generation networks by segregating a legacy network into a centralized control plane and a remotely programmable data plane. The intelligent centralized SDN control plane controls behavior of forwarding devices in processing the incoming packets and provides a bird-eye view of entire network at a single central point. The centralized control provides network programmability and facilitates introduction of adaptive and automatic network control. The SDN control plane can be implemented by using following three deployment models: (i) physically centralized, in which a single SDN controller is configured for a network; (ii) physically distributed but logically centralized, wherein multiple SDN controllers are used to manage a network; and (iii) hybrid, in which both legacy distributed control and centralized SDN control coexist. This manuscript presents all these control plane architectures and discusses various SDN controllers supporting these architectures. We have analyzed more than forty SDN controllers in terms of following performance parameters: scalability, reliability, consistency and security. We have examined the mechanisms used by various SDN controllers to address the said performance parameters and have highlighted the pros and cons associated with each mechanism. In addition to it, this manuscript also highlights number of research challenges and open issues in different SDN control plane architectures.

Scalability, Consistency, Reliability and Security in SDN Controllers: A Survey of Diverse SDN Controllers

DoS and DDoS attacks in Software Defined Networks: A survey of existing solutions and research challenges

Open Networking Foundation(ONF)の標準化動向

With the advantages of flexible scalability and fast delivery, microservice has become a popular software architecture in the modern IT industry. However, the explosion in the number of service instances and complex dependencies make the troubleshooting extremely challenging in microservice environments. To help understand and troubleshoot a microservice system, the end-to-end tracing technology has been widely applied to capture the execution path of each request. Nevertheless, the tracing data are not fully leveraged by cloud and application providers when conducting latency issue localization in the microservice environment. This paper proposes a novel system, named MicroRank, which analyzes clues provided by normal and abnormal traces to locate root causes of latency issues. Once a latency issue is detected by the Anomaly Detector in MicroRank, the cause localization procedure is triggered. MicroRank first distinguishs which traces are abnormal. Then, MicroRank’s PageRank Scorer module uses the abnormal and normal trace information as its input and differentials the importance of different traces to extended spectrum techniques . Finally, the spectrum techniques can calculate the ranking list based on the weighted spectrum information from PageRank Scorer to locate root causes more effectively. The experimental evaluations on a widely-used open-source system and a production system show that MicroRank achieves excellent results not only in one root cause situation but also in two issues that happen at the same time. Moreover, MicroRank makes 6% to 22% improvement in recall in localizing root causes compared to current state-of-the-art methods.

MicroRank: End-to-End Latency Issue Localization with Extended Spectrum Analysis in Microservice Environments

Fault-tolerance is an essential aspect of network resilience. Fault-tolerance mechanisms are required to ensure high availability and high reliability in systems. The advent of software-defined networking (SDN) has both presented new challenges and opened new paths to develop novel strategies, architectures, and standards to support fault-tolerance. In this survey, we address SDN fault-tolerance and discuss the OpenFlow fault-tolerance support for failure recovery. We highlight the mechanism used for failure recovery in Carrier-grade networks that includes detection and recovery phases. Furthermore, we highlight SDN-specific fault-tolerance issues and provide a comprehensive overview of the state-of-the-art SDN fault-tolerance research efforts. We then discuss and structure SDN fault-tolerance research according to three distinct SDN planes (i.e., data, control, and application). Finally, we conclude enumerating future research directions for SDN fault-tolerance development.

/pdf/fault-tolerance-in-the-scope-of-software-defined-networking-242dao8cva.pdf

Fault-Tolerance in the Scope of Software-Defined Networking (SDN)

Software-defined networking (SDN) has emerged as a new network paradigm that promises control/data plane separation and centralized network control While these features simplify network management and enable innovative networking, they give rise to persistent concerns about reliability  The new paradigm suffers from the disadvantage that various network faults may consistently undermine the reliability of such a network, and such faults are often new and difficult to resolve with existing solutions To ensure SDN reliability, fault management , which is concerned with detecting, localizing, correcting and preventing faults, has become a key component in SDN networks Although many SDN fault management solutions have been proposed, we find that they often resolve SDN faults from an incomplete perspective which may result in side effects More critically, as the SDN paradigm evolves, additional fault types are being exposed Therefore, comprehensive reviews and constant improvements are required to remain on the leading edge of SDN fault management In this paper, we present the first comprehensive and systematic survey of SDN faults and related management solutions identified through advancements in both the research community and industry We apply a systematic classification of SDN faults, compare and analyze existing SDN fault management solutions in the literature, and conduct a gap analysis between solutions developed in an academic research context and practical deployments The current challenges and emerging trends are also noted as potential future research directions This paper aims to provide academic researchers and industrial engineers with a comprehensive survey with the hope of advancing SDN and inspiring new solutions

Fault Management in Software-Defined Networking: A Survey

Software-Defined Networking (SDN) greatly simplifies middlebox policy enforcement. Middleboxes need tag packet headers to avoid forwarding ambiguity on SDN switches. In this paper, we present a new attack, called middlebox-bypass attack, to breach SDN-based middlebox policy enforcement. Such an attack manipulates a compromised switch to locally tag attacking packets without handing them over to the attached middlebox for inspection. Existing SDN security solutions, however, cannot detect the middlebox-bypass attack under practical constraints of efficiency, robustness, and applicability. We design and implement FlowCloak, the first protocol for per-packet real-time detection and prevention of middlebox-bypass attacks. FlowCloak enables middleboxes to generate tags that are probabilistically unknown to an attacker and confines it to only random guessing. We propose a multi-tag verification technique to address the tradeoff between FlowCloak robustness and TCAM usage by tag verification rules on the egress switch. Experiment results show that dozens of verification rules can confine the attacking probability under 0.1 %. FlowCloak imposes only a 0.3 ms packet processing delay on middleboxes and no obvious delay on the egress switch.

FlowCloak: Defeating Middlebox-Bypass Attacks in Software-Defined Networking

Towards Automated Inter-Service Authorization for Microservice Applications

In recent years, network function virtualization (NFV) has drawn considerable attention due to its potential for service agility and low total cost of ownership. As the core of an NFV implementation, security issues in the management and control platform must be comprehensively addressed—from architectural concept to deployment. In this article, we first analyze the state of the security architecture based on ETSI-NFV, and then propose useful security practices for an NFV-based management and control ecosystem. To encourage future research, we also identify the ongoing research challenges and open security issues relevant to the NFV.

Xing Li

Papers

Fault Management in Software-Defined Networking: A Survey

FlowCloak: Defeating Middlebox-Bypass Attacks in Software-Defined Networking

Towards Automated Inter-Service Authorization for Microservice Applications

State of the Art and Research Challenges in the Security Technologies of Network Function Virtualization

Thinking inside the Box: Differential Fault Localization for SDN Control Plane