Controller-proxy: Scaling network management for large-scale SDN networks

Ping, Song; Liu, Yi; Liu, Tianxiao; Qian, Depei

doi:10.1016/j.comcom.2017.05.002

Cited by 17 publications

(8 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Policies determine the way to manage packets without matching flow entries and also manage the switch flow table by updating flow entries securely. TLS is used as the default security mechanism for the OpenFlow controller since the standard OpenFlow does not provide security [12,13,[15][16][17][18].…”

Section: Related Workmentioning

confidence: 99%

“…Craiget et al [21] proposed a technique for using bloom filter-based multicasting in SDN that achieves the substantial forwarding state reduction while eliminating false positive packet delivery. Song et al [16] proposed a technique for SDN control plane to assign a group of the event processing module to switches. Authors in this work suggested to use switches for dealing with the OpenFlow events rather than the controllers.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Towards Securing OpenFlow Controllers for SDNs using ARMA Models

Aly

Kanj

Mostafa

et al. 2022

International Journal of Applied Mathematics, Computational Science and Systems Engineering

View full text Add to dashboard Cite

Control layers are moved away from the forwarding switching layers in Software Defined Networks. SDNs allow more programmability and flexibility to the controllers. OpenFlow is a protocol that gives access to the forwarding plane of a network switch or router over the SDN network. OpenFlow uses a centralized control of network switches and routers in SDN environment. Security is of a major importance for SDN deployment. Transport Layer Security (TLS) is be used to implement security for OpenFlow. This paper proposes a new technique to improve the security of the OpenFlow controller through modifying the TLS implementation. The proposed model is referred to as Secured Feedback model using Autoregressive Moving Average (ARMA) for SDN networks (SFBARMASDN). SFBARMASDN depends on computing the feedback for incoming packets based on ARMA models. Filtering techniques based on ARMA techniques are used to filter the packets and detect malicious packets to be dropped. SFBARMASDN is compared to two reference models. One reference model is based on Bayesian and the other reference model is the standard OpenFlow. Results are very promising. SFBARMASDN has outperformed both the secured standard using Bayesian network for SDN (SSBNSDN) and the standard OpenFlow in different scenarios by an average improvement of 7% and 80% respectively. The processing time overhead for the SFBARMASDN increases by only a percentage of 3% and 5% when compared to the SSBNSDN and the standard OpenFlow respectively.

show abstract

Section: Related Workmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Towards Securing OpenFlow Controllers for SDNs using ARMA Models

Aly

Kanj

Mostafa

et al. 2022

International Journal of Applied Mathematics, Computational Science and Systems Engineering

View full text Add to dashboard Cite

show abstract

“…Scalability of Controller: Would the SB controller become a bottleneck at ISP scale? Recent work [20,52,53,56,59] suggests that SDN controllers can scale to very large use cases -for instance, Cuttlefish [52] proposes a hierarchy of local and global controllers, which can offload tasks to each other, providing higher control plane throughput and better scalability. We suggest that, if needed, such approaches can be used when SB is deployed at scale.…”

Section: Sdns and Siegebreakermentioning

confidence: 99%

SiegeBreaker: An SDN Based Practical Decoy Routing System

Sharma

Gosain

Sagar

et al. 2020

Proceedings on Privacy Enhancing Technologies

View full text Add to dashboard Cite

Decoy Routing (DR), a promising approach to censorship circumvention, uses routers (rather than end hosts) as proxy servers. Users of censored networks, who wish to use DR, send specially crafted packets, nominally addressed to an uncensored website. Once safely out of the censored network, the packets encounter a special router (the Decoy Router) which identifies them using a secret handshake, and proxies them to their true destination (a censored site). However, DR has implementation problems: it is infeasible to reprogram routers for the complex operations required. Existing DR solutions fall back on using commodity servers as a Decoy Router. But as servers are not efficient at routing, most web applications show poor performance when accessed over DR. A further concern is that the Decoy Router has to inspect all flows in order to identify the ones that need DR. This may itself be a breach of privacy for other users (who neither require DR nor want to be monitored). In this paper, we present a novel DR system, Siege- Breaker (SB), which solves the aforementioned problems using an SDN-based architecture. Previous proposals involve a single unit which performs all major operations (inspecting all flows, identifying the DR requests and proxying them). In contrast, SB distributes the tasks for DR among three independent modules. (1) The SDN controller identifies DR requests via a covert, privacy preserving scheme, and does not need to inspect all flows. (2) The reconfigurable SDN switch intercepts packets, and forwards them to a secret proxy efficiently. (3) The secret proxy server proxies the client’s traffic to the censored site. Our modular, lightweight design achieves performance comparable to direct TCP downloads, for both in-lab setups, and Internet based tests involving commercial SDN switches.

show abstract

“…would send their monitoring data to the central collector and then the central collector can analyze, aggregate and store these data in the database according to different monitoring requirements. Since the SDN management framework [11] itself is a typical centralized framework, it is a good choice to design the monitoring framework in SDN on the basis of the SDN management framework. Compared with the traditional networks, there are several advantages in SDN on the network monitoring.…”

Section: Related Workmentioning

confidence: 99%

FlexMonitor: A Flexible Monitoring Framework in SDN

Wang

2018

Symmetry

View full text Add to dashboard Cite

Efficient network monitoring is an important basis work for network management. Generally, many management applications require accurate and timely statistics about network states at different aggregation levels at low cost, such as malicious traffic detection, traffic engineering, etc. Moreover, the network environment to be monitored is constantly changing and expanding, including not only the data center for cloud computing but also the Internet of Things (IoT) for smart urban sensing, which requires the intensive study of more fine-grained network monitoring. As is well known, the development of efficient network monitoring approaches greatly relies on a flexible monitoring framework. Software defined network (SDN) can provide dramatic advantages for network management by separating the control plane and data plane. Therefore, it is a good choice to design a flexible monitoring framework based on the advantages of SDN. However, most research works only take advantage of the centralized control feature in SDN, which leads to limited improvement in the flexibility of the monitoring framework. This paper proposes a flexible monitoring framework named FlexMonitor, which can realize greater flexibility based on not only the centralized control feature, but also the high programmability in the controller and the limited programmability in the openflow switches in SDN. There are two key parts in FlexMonitor, namely the monitoring strategy deployment part and the monitoring data collection part, which can enrich the deployment methods of monitoring strategies and increase the kinds of monitoring data sources, respectively. Based on the NetMagic platform, this monitoring framework was implemented and evaluated through realizing a distributed denial of service (DDoS) detection approach. The experimental results show that the proposed DDoS detection approach has a better detection performance compared with other related approaches as well as indirectly show that FlexMonitor can flexibly support a variety of efficient monitoring approaches.

show abstract

Controller-proxy: Scaling network management for large-scale SDN networks

Cited by 17 publications

References 4 publications

Towards Securing OpenFlow Controllers for SDNs using ARMA Models

Towards Securing OpenFlow Controllers for SDNs using ARMA Models

SiegeBreaker: An SDN Based Practical Decoy Routing System

FlexMonitor: A Flexible Monitoring Framework in SDN

Contact Info

Product

Resources

About