An extended SDN architecture for network function virtualization with a case study on intrusion prevention

Abstract

n contrast to traditional networks, software-defined networking (SDN) decouples the control plane from the data plane to enhance programmability and flexibility of network control [1]. In SDN, the control plane is a logically centralized controller, which communicates with the data plane via a control channel, say the OpenFlow protocol standardized by the Open Networking Foundation (ONF) [2]. SDN is suitable for managing connectivity because the controller has a global view of the network. If deploying network function virtualization (NFV) modules [3] as SDN services is desired, the controller will have to handle numerous control messages and incoming packets from the data plane to classify them or even inspect packet payloads.This work presents an extended SDN architecture to reduce the traffic overhead to the controller and support NFV by service chaining [4]. We designed a two-tier mechanism to classify traffic on the data plane instead of the control plane as much as possible. In the first tier, a classification module, which inspects the TCP/IP and application headers, is added on the switch. If this module is unable to determine the policy to be applied, a deep packet inspection (DPI) module in the second tier serves as an NFV module and analyzes the packets that cannot be classified in the first tier. The controller determines the services to be invoked based on the classification results, and makes the decision about service routing. Both modules will retain the decision, so subsequent packets will be directly forwarded to the NFV modules designated by the controller. We implemented intrusion prevention as the example for evaluating the extended architecture.The rest of this article is organized as follows. We first present the background of this work. Then we present the extended architecture, and evaluate its performance. Finally, we conclude this work.

A secure software defined networking for distributed environment

“…Ying et al 24 discuss a new approach of taking the load off the controller. SDN controller is the single point of control for the whole SDN network as such there are always high chances of bottle‐neck happening at the controller so they proposed a new architecture to add two‐layer network classification service chaining mechanism and protocol (OpenFlow) messages in the data plane.…”

Research Challenges for Network Function Virtualization - Re-Architecting Middlebox for High Performance and Efficient, Elastic and Resilient Platform to Create New Services -

“…Lin et al [150] proposed an extended SDN architecture for NFV with a case study on intrusion prevention. In conventional SDN, a controller classifies the traffic redirected from a switch to determine the path to NFV modules.…”

“…It uses VM to achieve adaptability by automatically creating software-defined middleboxes to process traffic flows, and automatically setting up flow rules to steer traffic flows. Lin et al [150] (2015) SDN architecture for network function virtualization for intrusion prevention.…”

A Survey of Controller Placement Problem in Software-Defined Networking

“…Software-defined networking (SDN) [2]- [4] is a new promising network paradigm that propose to solve those problem, which core idea is to separate the control and data planes, and to transfer the control function of network components (such as switches and routers) to the upper control plane (controller). This decoupling allows the network to be programmed directly which could achieve many benefits [5], [6], such as simplifying network management, improving network utilization efficiency, supporting network innovation and so on.…”