Search

Network Function Virtualization (NFV) has been proposed as an important paradigm to speed up the service deployment and provision, by decoupling network functionalities from the underlying hardware. These network functionalities are implemented as software that refers to as Virtual Network Function (VNF) and managed under the software defined networking environment. Thus, VNFs are critical elements for service provision. However, in order to achieve a better service deployment and provision, VNF migration is a key challenge to be addressed. On one hand, previous researches resolving the VNF migration problem are under the assumption that each VNF is independently used by one Service Function Chain (SFC) which is actually composed of a sequential set of VNFs with traffic traversing these VNFs in order. In this way, they only need to consider one SFC when fulfilling the VNF migration. In contrast, we assume that each deployed VNF may be used by different services. Thus, when migrating one VNF, we take all the services traversing this VNF into consideration, which is more practical and meaningful. On the other hand, the VNF migration is primarily transferring the internal stateful information of VNFs, which is fast. Therefore, instead of focusing on the migration process, we prefer more to minimize the influence on services after executing the VNF migration. In this paper, we first formulate the VNF migration problem as a mathematical model with the objective of minimizing the influences. Then, a multi-criteria approach is proposed to address this problem, since we need to consider multiple services simultaneously. In particular, the service priority is also considered in the proposed approach in order to meet the practical situations. Finally, the simulation results indicate that the proposed approach is effective and efficient.

Software Defined Networking (SDN), which decouples control plane and data plane, normally stores states on controllers to provide flexible programmability and convenient management. However, recent studies have shown that such configuration may cause frequent and unnecessary interactions between data plane and controllers in some cases. For example, a DDoS detection installed on a controller needs to fetch information from data plane periodically, introducing additional network delay and controller overhead. Thus, stateful data plane is proposed to offload states and operation logics from controller to data plane. Stateful data plane allows switches to perform some operations independently, accelerating packets processing while reducing overhead on both controllers and networks. However, stateful data plane increases the complexity of network devices and imposes many new challenges to the management and schedule of SDN enabled networks. This paper conducts a comprehensive survey on the latest research works and provides insights into stateful data plane. Both stateful data plane platforms and compilers are extensively summarized and analyzed, as well as explicit design of applications based on them. Afterwards, we dwell on the fundamental technologies and research challenges, including implementation considerations of stateful data plane. Finally, we conclude this survey paper with some future works and discuss open research issues.

Programmable data planes recently emerged as a prominent innovation in Software Defined Networking (SDN), by permitting support of stateful flow processing functions over hardware network switches specifically designed for network processing. Unlike early SDN solutions such as OpenFlow, modern stateful data planes permit to keep (and dynamically update) local per-flow states inside network switches, thus dramatically improving reactiveness of network applications to state changes. Still, also in stateful data planes, the control and update of non-local states is assumed to be completely delegated to a centralized controller and thus accessed only at the price of extra delay. Our LOADER proposal aims at contrasting the apparent dichotomy between local states and global states. We do so by introducing a new possibility: permit to take localized (in-switch) decisions not only on local states but also on replicated global states, thus providing support for network-wide applications without incurring the drawbacks of classical approaches. To this purpose, i) we provide high-level programming abstractions devised to define the states and the update logic of a generic network-wide application, and ii) we detail the underlying low level state management and replication mechanisms. We then show LOADER's independence of the stateful data plane technology employed, by implementing it over two distinct stateful data planes (P4 switches and OPP - Open Packet Processor - switches), and by experimentally validating both implementations in an emulated testbed using a simple distributed Deny-of-Service (DoS) detection application.

While elasticity is valuable to the cloud, it may introduce security flaws due to misconfiguration after virtual machines migration. In this paper, we propose an automated approach to verify distributed firewalls reconfiguration after migration. To this end, we elaborate a language that captures distributed stateless and stateful firewalls with their underlying semantics. Integrated to Cloud Calculus, it allows specifying distributed firewalls topology. We also define semantic equivalence over stateful firewalls that forms the base for our verification approach. Furthermore, we define the property of network access control and state preservation using the concepts of soundness and completeness of firewall configurations. Additionally, we use constraint satisfaction problems to reason about our defined preservation property. Finally, we investigate the correctness and scalability of our approach.

Software-defined networking (SDN) is being strongly considered as the next promising networking platform, and studies regarding SDN have been actively conducted accordingly. However, the security of SDN remains undefined and unknown when considering the enhancement of network security in SDN. In this paper, we verify whether SDN can enhance network security. Specifically, the idea of enabling security functions with diverse SDN features is explored thoroughly. In order to elucidate the feasibility of SDN-based security functions, we implement four types of security functions with SDN in Floodlight applications: (i) in-line mode security functions (e.g. firewalls and IPS), (ii) passive mode security functions (e.g. IDS), (iii) network anomaly detection functions (e.g. scan and DDoS detector), and (iv) advanced security functions (e.g. stateful firewall and reflector networks). Furthermore, we focus on discovering issues that might arise throughout the implementation of SDN-based security applications and discuss how these issues can be addressed. In order to appropriately prove the feasibility of the SDN-based security applications, we evaluate our Floodlight applications in real testbeds that consist of SDN-enabled switches and a number of physical hosts.

Traditional network functions such as firewalls and Intrusion Detection Systems (IDS) are implemented in costly dedicated hardware, making the networks expensive to manage and inflexible to changes. Network function virtualization enables flexible and inexpensive operation of network functions, by implementing virtual network functions (VNFs) as software in virtual machines (VMs) that run in commodity servers. However, VNFs are vulnerable to various faults such as software and hardware failures. Without efficient and effective fault tolerant mechanisms, the benefits of deploying VNFs in networks can be traded-off. In this paper, we investigate the problem of fault tolerant VNF placement in cloud networks, by proactively deploying VNFs in stand-by VM instances when necessary. It is challenging because VNFs are usually stateful. This means that stand-by instances require continuous state updates from active instances during their operation, and the fault tolerant methods need to carefully handle such states. Specifically, the placement of active/stand-by VNF instances, the request routing paths to active instances, and state transfer paths to stand-by instances need to be jointly considered. To tackle this challenge, we devise an efficient heuristic algorithm for the fault tolerant VNF placement. We also propose two bicriteria approximation algorithms with provable approximation ratios for the problem without compute or bandwidth constraints. We then consider the dynamic fault recovery problem given that some placed active instances of VNFs may go faulty, for which we propose an approximation algorithm that dynamically switches traffic processing from faulty VNFs to stand-by instances. Simulations with realistic settings show that our algorithms can significantly improve the request admission rate compared to conventional approaches. We finally evaluate the performance of the proposed algorithm for the dynamic fault recovery problem in a real test-bed consisting of both physical and virtual switches, and results demonstrate that our algorithms have potentials of being applied in real scenarios.

Network Function Virtualization (NFV) allows to deploy network functions at low cost and high flexibility. Usually traffic needs to pass through several network functions in a particular order, which is known as network function chaining. Due to capacity limitation, one instance of a particular network function in the chain usually needs to be scaled to multiple instances when the traffic load increases. Recent studies show that network functions maintain rich internal states, which correlate with flows and determine their processing actions. In order to guarantee network functions to behave the same as before the scaling, these states on multiple instances need to be synchronized. As a result, communication requirement for synchronizing these states arises. Our experimental investigations show that such communication traffic for state synchronization is non-negligible. Unfortunately, to our best knowledge, no existing work for network function chain deployment considered such traffic. In this paper, we consider the problem of allocating both flow traffic and synchronization traffic with the goal to minimize the consumption of network interface card’s bandwidth, which is considered as the bottleneck resource of the network. The main challenge is that such two kinds of traffic are correlated and even conflicting. To deal with this challenge, a new graph-based model named Dual ( D eploy Statef u l Virtual Network Function Ch a ins by Joint l y Allocating Data-Control Traffic) is proposed, which characterizes the interaction of data-control traffic in an elegant manner. Based on Dual, the problem mentioned above is formulated through ILP and an approximation algorithm is designed. Extensive simulations show that the proposed approach is effective in terms of reducing server bandwidth usage.

Support for anycast in the IP network layer allows one source node to contact a single member out of a group of destination nodes configured with the same IP address. Due to the stateless nature of the IP protocol, subsequent packets from the same source node targeted at the same anycast group may arrive at different group members. Consequently, native IP anycast cannot be applied directly to support distributed session-based services. For this reason, an anycast overlay architecture combining the transparency offered by native anycast with support for stateful communications has been proposed. In this paper, we investigate the operational impact of deploying this overlay architecture. Performance evaluation of a data plane prototype implementation for an anycast overlay node shows that high throughput and small latency can be achieved. Additionally, we show how threshold-based update triggering, in combination with an appropriate inter-proxy update strategy, delivers control plane accuracy with minimal network overhead.

Application-layer tunnels nowadays represent a significant security threat for any network protected by firewalls and Application Layer Gateways. The encapsulation of protocols subject to security policies such as peer-to-peer, e-mail, chat and others into protocols that are deemed as safe or necessary, such as HTTP, SSH or even DNS, can bypass any network-boundary security policy, even those based on stateful packet inspection. In this paper we propose a statistical classification mechanism that could represent an important step towards new techniques for securing network boundaries. The mechanism, called Tunnel Hunter, relies on the statistical characterization at the IP-layer of the traffic that is allowed by a given security policy, such as HTTP or SSH. The statistical profiles of the allowed usages of those protocols can then be dynamically checked against traffic flows crossing the network boundaries, identifying with great accuracy when a flow is being used to tunnel another protocol. Results from experiments conducted on a live network suggest that the technique can be very effective, even when the application-layer protocol used as a tunnel is encrypted, such as in the case of SSH.

Firewalls are a crucial building block for securing IP networks. The usage of out-of-band signaling protocols such as SIP for IP telephony and multimedia applications requires a dynamic control of these firewalls and imposes several challenges. Recently, several firewall control architectures and protocols have been developed. The main focus of this paper is the simple middlebox configuration protocol (SIMCO), which is a new transaction-based firewall control protocol. Due to the impact on call setup delays, firewall signaling requires small end-to-end delays and thus mandates a careful choice of the transport protocol. Therefore, this paper studies SCTP, TCP and UDP-based transport for SIMCO and compares different configurations that allow to optimize the performance. We present an analytical model to quantify the impact of head-of-line blocking in SCTP and TCP and verify it with measurements. Both the model and measurements reveal that SCTP can significantly reduce the SIMCO response times by leveraging transmission over multiple parallel streams. While already a few SCTP streams can almost completely avoid head-of-line blocking, our results show that TCP- and UDP-based transport may suffer from significantly larger delays.