Yehuda Afek, Tel Aviv University; Anat Bremler-Barr, The Interdisciplinary Center; Liron Schiff, Tel Aviv University
In this paper we present a new Openflow based architecture to manage flows across a multi entrance SDN network in a consistent way, thus improving in several aspects on previous works [4, 5]. Our contributions are in three levels. At the first level we use OpenFlow features in a sophisticated way to implement a range classification scheme which to the best of our knowledge is more space efficient (only 3 entries per range) than previous known classifiers. In the second contribution we show how to update ranges across multiple switches in an atomic manner - allows to update the set of ranges and their associated actions while packets are classified and the network is changing. Finally, using the two schemes above, we present an architecture suitable for several applications such as load-balancing, and NFV, to manage multi-entrance consistency - keeping Per Flow consistency even when the flow changes the entrance point to our network.
Shuyong Zhu, Jun Bi, and Chen Sun, Tsinghua University
Software Defined Networking (SDN) is a new network architecture where network control is decoupled from forwarding and is directly programmable. However, existing techniques provide limited support for stateful forwarding in SDN data plane. Relying on the controller for all state maintaining gives rise to scalability and performance issues. In this paper, we present Stateful Forwarding Abstraction (SFA) in SDN data plane. And we design a co-processing unit in SDN switches named Forwarding Processor (FP). It can deal with state infor-mation in data plane and its instructions can be flexibly extended to meet application requirements. Through SFA, we implement stateful network processing on the datapath which covers a full range of Layer 4 to Layer 7 services. We validate its performance based on IPsec. The experiment result proves that the forwarding effi-ciency is greatly improved.
Kirill Kogan, Advait Dixit, and Patrick Eugster, Purdue University
Standardized data-path provision as achieved by OpenFlow enables the integration of network elements from different vendors in the same forwarding plane, with these elements being managed by the same logically centralized control plane. However, there is no clear abstraction that enables the integration of control planes from different vendors into a single virtually centralized controller. Yet, today's software-dened network (SDN) control planes are highly homogeneous and require networks (or slices thereof) to be controlled by the same controller platform. Hence to deploy a new service in a network, an operator needs to acquire and integrate new implementation modules into the existing controller platform. Though some earlier work has considered increasing the flexibility of controllers by allowing dynamic addition and removal of services, all integrated services need to obey specific constraints of the integrating platform
Chi-Yao Hong, Matthew Caesar, and P. Brighten Godfrey, University of Illinois at Urbana-Champaign
Datacenters are increasingly expected to provide vital support for modern, data-intensive applications such as data-intensive distributed computing, large graph/matrix computation, and online
services. The large variety of cloud applications have demanded a diverse range of service requirements such as optimizing completion times, meeting task deadlines, and satisfying fairness constraints across tenants. However, legacy transport protocols used today, such as TCP, are known to be ill-suited for meeting modern application requirements.
Tal Mizrahi and Yoram Moses, Technion - Israel Institute of Technology
The usage of accurate time to schedule updates in software defined networks was recently proposed in ; time can be a powerful tool for applying network updates in a relatively simple manner and with a very brief period of inconsistency during the update. In the current paper we introduce the flow-swapping scenario, which demonstrates the necessity of time-based updates. We show that while traditional update approaches result in temporary packet loss, the time-based approach allows a smooth reconfiguration procedure. We introduce the lossless flow allocation problem, and formally show that given the online nature of resource allocation in SDN, scenarios that require simultaneous changes at multiple switches are bound to occur, with clock-based near-simultaneous scheduling offering an advantageous solution.
Hongxin Hu, Delaware State University; Gail-Joon Ahn, Wonkyu Han, and Ziming Zhao, Arizona State University
One primary goal of Software-Defined Networking (SDN) is to enable various network applications, which are basically network services, to run on the controller to manage the network directly by configuring packet-handling mechanisms in underlying devices. Consequently, when enterprises adopt OpenFlow for their networks, it is virtually inevitable that legacy security appliances, such
as firewalls, have to be migrated to OpenFlow-based networks by re-designing and implementing them as compatible security applications. However, our study reveals that OpenFlow not only presents tremendous opportunities to networking, but also brings great challenges for building SDN firewalls as follows...
Brandon Schlinker and Kyriakos Zarifis, University of Southern California; Italo Cunha, Universidade Federal de Minas Gerais; Nick Feamster, Georgia Institute of Technology; Ethan Katz-Bassett and Minlan Yu, University of Southern California
Adoption of Software Defined Networking (SDN) remains largely confined to data center networks, where network architects frequently have the luxury of designing and deploying within a tightly controlled greenfield environment. In comparison, adoption of SDN technologies within existing ISP and enterprise networks depends on the network operator’s ability to evaluate SDN’s impact and define a transition plan with confidence. Unfortunately, existing tools for emulating SDN networks do not support the evaluation of interactions with components found in today’s networks, such as intradomain routing policies and interdomain interactions with other autonomous systems. Within this work, we explain how our testbed provides network operators with comprehensive, 1:1 emulation of an existing network, which can then be used to experiment with SDN and evaluate its impact. We believe that our testbed will provide operators with a better understanding of how SDN fits into their existing networks, thus making SDN technologies more accessible to the broader community.
Seyed Kaveh Fayazbakhsh, Carnegie Mellon University; Luis Chiang, Deutsche Telekom Labs; Vyas Sekar, Carnegie Mellon University; Minlan Yu, University of Southern California; Jeffrey C. Mogul, Google
Software-defined networking (SDN) seeks to simplify and enhance network management by decoupling the management logic from its implementation. Our overarching vision is to integrate advanced data plane functions or middleboxes (e.g., firewalls, NATs, proxies, intrusion detection and prevention systems, and application-level gateways) into the SDN fold. This integration, however, is challenging on two fronts: (1) it is difficult to ensure that “service-chaining” policies are implemented correctly, and (2) middleboxes hinder management functions such as performance debugging.
The root cause of this problem is that as packets traverse the network, they are altered by dynamic and opaque middlebox actions; for instance, proxies terminate TCP sessions, while NATs and load balancers rewrite headers. Thus, the promise of SDN to systematically enforce and verify network-wide policies does not directly extend to networks with middlebox functions.
Jeff Rasley, Brown University; Brent Stephens, Rice University; Colin Dixon, Eric Rozner, Wes Felter, Kanak Agarwal, and John Carter, IBM Research—Austin; Rodrigo Fonseca, Brown University
Modern networks operate at a speed and scale that make it impossible for human operators to manually respond to transient problems, e.g., congestion induced by workload dynamics. Even reacting to issues in seconds can cause significant disruption, so network operators overprovision their networks to minimize the likelihood of problems.
Software-defined networking (SDN) introduces the possibility of building autonomous, self-tuning networks that constantly monitor network conditions and react rapidly to problems. Previous work has demonstrated that new routes can be installed by an SDN controller in tens of milliseconds, but state-of-the-art network measurement systems take hundreds of milliseconds or more to collect a view of current network conditions. To support future autonomous SDNs, a much lower latency network monitoring mechanism is necessary, especially as we move from 1 Gb to 10 Gb and 40 Gb links, which require 10x and 40x faster measurement to detect flows of the same size. We believe that networks need to, and can, adapt to network dynamics at timescales closer to milliseconds or less.
Ming Xia, Meral Shirazipour, Ying Zhang, Howard Green, and Attila Takacs, Ericsson Research Silicon Valley
We propose to use software-defined optics to achieve the required flexibility, while reducing the processing load of core packet switches. It also eliminates the need to reinstall multiple packet rules each time a virtualized NF is instantiated or torn down, which can be error prone. We believe the proposal is practical as the use of optics in data centers is becoming prevalent. Assuming high traffic loads, optics can achieve much lower cost per bit than packet switching, meanwhile offering high capacity and energy efficiency. Photonic integration promises further-lower cost per bit of 100GbE and 400GbE interfaces. The dense wavelength division multiplexing (DWDM) and flexible grid technologies allow a single fiber to carry tens of simultaneous non-uniform wavelength channels for ultra-high transmission capacity and spectrum efficiency. The major drawback of optical technology is coarse traffic granularity compared with the packet solutions. However, we argue that not all scenarios require fine-grained traffic steering; aggregated traffic steered in the optical domain may achieve higher throughputs and scalability more efficiently. Moreover, thanks to the increasing agility of optical equipment, the time for establishing wavelength paths is acceptable when considering the time required to instantiate a virtualized NF.
Chen Chen, University of Pennsylvania; Limin Jia, Carnegie-Mellon University; Wenchao Zhou, Georgetown University; Boon Thau Loo, University of Pennsylvania
Software defined network (SDN) eases the task of programming and managing computer networks. The conceptually centralized nature of the control plane provides a holistic view of the network, thereby making it feasible to verify SDN’s functionalities. Verification of SDN is gaining attention in the last few years. There are two main challenges of SDN: (1) SDNs are often programmed in general-purpose programming languages (e.g. Java, Python), which makes it tedious and error-prone to apply formal methods over controller applications; (2) the sheer scale of
modern networks makes state explosion problem an insurmountable challenge for model checking. Model checking techniques combined with limiting the expressiveness of the programming language have demonstrated as an effective approach to verifying basic properties. However, due to the highly dynamic nature of SDN, verification of more complex security properties is still challenging.
To address the above challenges, we propose a unified framework for programming and verification of SDNs. Our framework relies on the use of a declarative language, Network Datalog (NDLog), which provides compact encoding of SDN functionalities and serves as a basis for formal analysis. As a preliminary step, we demonstrate that NDLog can encode basic openflow applications succinctly, and preserve well-formed logical structure. Based on the semantics of NDLog, we develop a sound program logic for verifying invariant properties of NDLog program. The approach of static analysis avoids the state explosion problem. Also, properties of the system can be verified in a compositional manner by dividing them into smaller invariants of different components. Compared to existing proposals such as Frenetic, NDLog has a tighter connection to first-order logic and therefore makes the verification tasks easier.
Minlan Yu, University of Southern California; Ying Zhang, Ericsson Research; Jelena Mirkovic and Abdulla Alwabel, University of Southern California
Network attacks have long been an important problem, and have attracted a lot of research in academic and commercial sector. With a rapidly growing number of critical as well as business applications deployed on the Internet today, network attacks have both become more lucrative for the attackers and more damaging to the victims. The implications of network attacks on the victim can be huge. For example a distributed denial-of-service (DDoS) can overwhelm the victim and make it unable to handle its regular business. A large-volume DDoS attack can further cause collateral damage to traffic that shares links with the victim’s traffic, leading to large traffic drops, BGP session interruptions and routing interruptions. Besides the data plane attacks, control plane misconfigurations and attacks on the interdomain routing protocol BGP can have dire implications for victim networks. For example, the prefix-hijacking attack injects and propagates false routes to the Internet, causing victim’s traffic to be redirected to the attacker networks for sniffing, modification or dropping. Traffic sniffing and modification are very difficult to detect and mitigate, and create huge security and privacy issues for the victim, while blackholing severely affects online businesses and critical infrastructures.
Sachin Katti, Stanford University; Li Erran Li, Bell Labs, Alacatel-Lucent
To cope with the exponential traffic growth, increasingly diverse trafficc mix including voice, video, machine-to-machine (M2M), and the spectrum shortage, wireless networks have to get densely deployed and dynamically adapt to meet the distinct requirements of diverse traffic classes. However, current network architectures are ill-equipped to support a dense and dynamic wireless infrastructure. First, since it will be impossible to obtain regularly placed cell sites for an infrastructure with higher density, basestations will be deployed wherever possible in a chaotic fashion. However, a chaotic and dense wireless deployment will be very complex to manage, since it will experience highly variable loads and unpredictable inter-cell interference among other things. Further since spectrum is limited, very likely all the basestations will be operating on the same frequency (referred to as frequency reuse factor of one). This leads to a tremendous amount of inter-cell interference, and that becomes the limiting factor for network capacity. Second, a dense infrastructure is very expensive to deploy and operate. Current deployments are unaffordable except to the largest operators, so a deployment with significantly higher density will likely be enormously expensive even for the largest operators, preventing smaller operators from expanding and offering consumers the choices they need.
Yiannis Yiakoumis, Manu Bansal, Sachin Katti, and Nick McKeown, Stanford University
A large part of the population lives in high-density areas. Only in the US, 27 million households (24%) are located in multi-apartment buildings sharing resources with neighboring home networks. It’s expected to see 25 listed APs in an urban area, and such high density can be a bad indicator for network performance. Despite advancements in WiFi rates over the years, users often experience poor performance, deviating from what protocols promise. High interference and congested channels is commonplace, while misconfiguration often leads to poor channel and power allocation. Even though a plethora of access points are available, users can access only theirs, occasionally leading to poor coverage which in turn degrades the channel for everyone. A number of factors contribute to this: lack of
coordination between individual homes, no expertise from users, and poor manageability of WiFi itself.
In this paper, we present an SDN framework for designing a denseWiFi network which aims to provide users with a personalized, fast and reliable network service
Anduo Wang, University of Illinois at Urbana-Champaign; Wenchao Zhou, Georgetown University; Brighten Godfrey and Matthew Caesar, University of Illinois at Urbana-Champaign
In software-defined networks (SDN), the separation of the control and data-plane moves the concurrency control from the data-plane to a separate, now logically centralized controller program. As a result, despite its intention to simplify programming, the separation forces the programmer to deal with a spectrum of concurrent events (e.g. execution of controller programs, in-flight packets), a task that is notoriously challenging and error-prone. It is not even clear what concurrency problems the programmer shall account for. Although early stage works propose specific correctness
conditions and point solutions, a comprehensive study is still lacking.
Most existing work focuses on the concurrency problem we call atomicity, which concerns one single network-wide update transaction. We use network-wide transaction (or transaction) to refer to a logical network operation that consists of potentially multiple switch-level updates. An atomicity failure scenario is shown in the figure (the red transaction spanning over switches 1; 2; 4) when in-flight packets during the transaction are processed by a mixture of switches with rules before or after the transaction. In addition to atomicity, we identify concurrency problems arising from multiple transactions, which we call the consistency and isolation. To the best of our knowledge, they are not addressed in existing works. Section 3 will connect atomicity, consistency, and isolation to the well-studied ACID transactional semantics in databases literature.
Aggelos Lazaris, University of Southern California; Daniel Tahara, Yale University; Xin Huang, CIAN; Li Erran Li, Bell Labs; Andreas Voellmy and Y. Richard Yang, Yale University; Minlan Yu, University of Southern California
A major benefit of software-dened networking (SDN) over traditional networking is simpler and easier programming of networks. In particular, the emergence of OpenFlow (OF) has provided a standard, centralized approach for a network controller to install forwarding rules at the forwarding engines (called flow tables) of a heterogenous set of network switches, substantially reducing controller-switch dependency, and hence programming complexity.
Laurent Vanbever, Princeton University; Stefano Vissicchio, Universite catholique de Louvain
Software-Defined Networking (SDN) promises to significantly improve network manageability by enabling direct, and centralized control over the network forwarding state via a well-defined Application Programming Interface (API). Fulfilling this promise though is a challenge for network operators as it often requires heavy modifications to their current network architecture, including: i) equipment upgrades, as the vast majority of the installed base of network equipments (e.g., routers) do not support SDN protocols; ii) new management, monitoring and provisioning systems; but also iii) the need for operators training as managing and debugging a SDN network requires essentially completely different skill sets.
In this short paper, we present a lightweight SDN solution that does not require any new network equipment, nor SDNspecific protocols. While it is less expressive than OpenFlow-based SDN, our solution is powerful enough to fulfill complex traffic engineering requirements (e.g., traffic steering through middleboxes, load-balancing) that are hardly achieved in traditional, configuration-based, networks. Moreover, by minimizing SDN inertial factors and simplifying the management interface exposed to network operators, our lightweight SDN model can provide significant incentives to bootstrap the transition towards SDN.
Haoyu Song, Jun Gong, and Hongfei Chen, Huawei Technologies
SDN needs to program heterogeneous forwarding elements (FE) with different forwarding architectures. Ideally, OpenFlow should provide a uniform interface to allow platform-independent programming and platform-specific compiling. In this paper we discuss an SDN programming framework which is suitable for flexible and protocol-oblivious forwarding plane. Specifically, we describe three different forwarding plane programming approaches and their tradeoffs. We show how an OpenFlow instruction set can support different programming styles which map to different forwarding chip architectures. We also show how applications can be compiled into NP-based FEs and compare it with the interpreter-mode implementation.
Koji Yamazaki, NTT Microsystem Integration Laboratories; Takeshi Osaka, NTT Network Service Systems Laboratories; Sadayuki Yasuda, Shoko Ohteru, Akihiko Miyazaki, NTT Microsystem Integration Laboratories
Software Defined Networking (SDN) is attracting much attention in the information and communications tech-nology (ICT) industries. In particular, the telecom industry calls for Network Functions Virtualisation (NFV). NFV aims to reduce operator CAPEX and OPEX through reduced equipment costs and reduced power consumption. Equipment costs are not reduced by proprietary hardware appliances, but by implementing software on industry-standard servers. On the other hand, the reduction of power consumption for future networks is recommended by ITU-T Y.3021, which defines three levels of energy-saving technologies: the network level, equipment level, device level. Because of the software-centric implementation of the virtual network functions, there is still a lot of room for improvement in their performance. In this paper, the challenge is how to enhance the performance of virtual network functions in terms of device-level technology without increasing CAPEX and OPEX.
Specifically, we focus on two objectives. (1) Reduce programming effort by integrating accelerators into the in-dustry standard server CPU in a novel way, because COTS (commercial-off-the-shelf) accelerators, such as FPGAs, NPUs, or GPUs, have their own programming system that is different from standard one. (2) Devise an alternative accelerator that enables high-performance, energy-efficient operations for full-time flow forwarding servers. Alt-hough state-of-the-art servers are energy-efficient, their energy efficiency will become worse when several COTS
accelerators are mounted on them.
Peter Peresini and Maciej Kuzniar, École Polytechnique Fédérale de Lausanne (EPFL); Marco Canini, Université catholique de Louvain; Dejan Kostic, Institute IMDEA Networks
Network state is always in flux. Due to traffic engineering, topology changes, policy updates, VM migrations, etc., today’s networks undergo a variety of large updates that concurrently affect many switches. Transitioning between network states can be a source of instability, leading to outages, disruptions and security vulnerabilities. Consistent network updates introduces a mechanism that guarantees to preserve well defined behaviors when transitioning between states. However, a major problem for this technique is the update performance, that is, the time it takes to install a network state update onto the data-plane—the current generation of OpenFlow switches can install flows with rate as low as 40 rules/second. Even moderate-sized updates can take several seconds, during which operators are in the dark about how badly links could be congested. Therefore it is desirable to complete updates quickly. However, we note that the lowest
bound of the total time to complete the update is determined by the switch that is last to complete.
Ali Al-Shabibi and Marc De Leenheer, Open Networking Laboratory; Matteo Gerola, CREATE-NET; Ayaka Koshibe, William Snow, and Guru Parulkar, Open Networking Laboratory
Virtualized environments have been around for a long time, but until recently these have focused solely on compute virtualization and left the network behind. Network virtualization enables multiple tenants to share the same physical infrastructure by decoupling the physical network from the virtual network. In this paper, we introduce OpenVirteX, a Network Virtualization Platform which provides virtual Software Defined Networks (vSDNs). Each vSDN is customizable in terms of topology as well as addressing scheme.
Julius Schulz-Zander and Nadi Sarrar, Technische Universität Berlin; Stefan Schmid, Technische Universität Berlin and Telekom Innovation Laboratories
Applying the concept of SDN to WiFi networks is challenging, since wireless networks feature many peculiarities and knobs that often do not exist in wired networks: obviously, WiFi communicates over a shared medium, with all its implications, e.g., higher packet loss and hidden or exposed terminals. Moreover, wireless links can be operated in a number of different regimes, e.g., transmission rate and power settings can be adjusted, RTS/CTS mechanisms can be used.
Indeed, due to the non-stationary characteristic of the wireless channel, permanently adjusting settings such as transmission rate and power is crucial for the performance of WiFi networks and brings significant benefits in the service quality, e.g., through reducing the packet loss probability. Today’s rate and power control is mainly done on the WiFi device itself. But it is rarely optimized to the application-layer demands and their diverse traffic requirements, e.g., their individual sensitivity to packet loss or jitter. Therefore, if SDN for wireless can provide mechanisms to control the WiFi-specific transmission settings on a per-slice, per-client, and per-flow level, traffic and application-aware optimizations are feasible.
Dan Li and Yirong Yu, Tsinghua University; Kang Li, Kaiwang Technology
We design and develop a system called SODA, which enhances the data plane of SDN by providing richer semantics and more flexible programming interfaces. SODA’s innovation on the data plane includes arbitrarily setting the keys of forwarding rules, enabling (compute, action) operations on the forwarding rules, packet payload processing, and stateful processing on a sequence of packets. We develop a software implementation of SODA switch prototype based on CPU and GPU.
Chengchen Hu and Ji Yang, Xi'an Jiaotong University; Hongbo Zhao, MeshSr Co. Ltd.; Jiahua Lu, Xilinx Co. Ltd.
Software Defined Networking (SDN) breaks the barrier of Internet innovation and has attracted tremendous attentions from both industrial and academic communities. Although OpenFlow is the de factor SDN protocol nowadays, which defines the interface between the data plane switches and the control plane controllers, there are emerging SDN proposals. Even for OpenFlow itself, it keeps evolving. As a result, a flexible SDN data plane switch, which is capable to upgrade the processing logic, is highly desired for the research and innovation purpose.
Mehrdad Moradi, University of Michigan; Li Erran Li, Bell Labs, Alcatel-Lucent; Z. Morley Mao, University of Michigan
Rather than organizing mobile wide area networks as rigid regions with no direct traffic transit, we argue that the cellular networks should have a fully connected core topology, small logical regions, and more egress points. In addition, operators should leverage software dened networking to manage the entire network with a logically-centralized controller. The controller directs traffic through efficient network paths that might cross region boundaries, supports and optimizes inter-region handoffs, and dynamically adapts to traffic patterns with efficient inter-region traffic
Such an architecture raises unique scalability challenges in comparison with data-center and enterprise networks due to the geographically distributed nature of mobile WANs. Indeed, a logically-centralized controller in one point-of-presence with a at architecture quickly becomes infeasible, if the mobile WAN spans a large region. This is due to the high latency between the controller and the data plane switches, the amount of signaling load from mobile users, and the very high number cellular handoffs.
Vasileios Kotronis, ETH Zurich; Xenofontas Dimitropoulos, Foundation of Research and Technology Hellas (FORTH) and ETH Zurich; Rowan Klöti, Bernhard Ager, Panagiotis Georgopoulos,ETH Zurich;Stefan Schmid, Telekom Innovation Laboratories and Technische Universität Berlin
This paper presents the vision of the Control Exchange Point (CXP) architectural model. The model is motivated by the inflexibility and ossification of today’s inter-domain routing system, which renders critical QoS-constrained end-to-end (e2e) network services difficult or simply impossible to provide. CXPs operate on slices of ISP networks and are built on basic Software Defined Networking (SDN) principles, such as the clean decoupling of the routing control plane from the data plane and the consequent logical centralization of control. The main goal of the architectural model is to provide e2e services with QoS constraints across domains. This is achieved through defining a new type of business relationship between ISPs, which advertise partial paths (so-called pathlets) with specific properties, and the orchestrating role of the CXPs, which dynamically stitch them together and provision e2e QoS. Revenue from value-added services flows from the clients of the CXP to the ISPs participating in the service. The novelty of the approach is the combination of SDN programmability and dynamic path stitching techniques for inter-domain routing, which extends the value proposition of SDN over multiple domains. We first describe the challenges related to e2e service provision with the current inter-domain routing and peering model, and then continue with the benefits of our approach. Subsequently, we describe the CXP model in detail and report on an initial feasibility analysis.
connect with us