Search

As the growth of development on both network architecture and cloud computing, the existing quality of service (QoS) measurement mechanism in VNF design is not sufficient for the cloud network architecture, especially the development of container technology. It is important for service provider to provide to customers a service level agreement (SLA) on cloud network service by provision of Container-as-a-Service (CaaS) and container network function (CNF). In this paper, we propose an enhanced vQOS (EvQOS) measurement mechanism for container-based network architecture that retains the vQOS in VNF architecture [1] including the TWAMP light (TWL) protocol and the northbound interface design, and provides a containerization architecture and the friendliness of system management and monitoring.

SDH optical fiber transmission is widely used in various information transmission networks. It transmits a variety of information. According to the actual operation and maintenance requirements, the business management module of SDH optical fiber transmission network operation and maintenance support system is designed to realize the classified and targeted business management. The business records are information-based and scientific. Using the equipment performance data obtained from the northbound interface, the key performance indicators of the optical fiber transmission network can be extracted and displayed. It can give early warning of equipment failure and provide data support for network performance analysis and troubleshooting. Business management and device performance data are friendly displayed by the popular open source visualization tool based on JavaScript. The application of the system can improve the operation and maintenance efficiency of SDH optical fiber transmission network.

Northbound interface is the interface for manufacturers or operators to access and manage the network. Through it, the superior network management can obtain a large number of data such as configuration performance and operation and maintenance of optical network. For various reasons, there are usually missing values in real data sets. In order to improve the accuracy of filling missing values. In this paper, from the perspective of data mining, we use a variety of processing methods to fill the missing value of the north interface. In this paper, by analyzing the principle of KNN algorithm, decision tree algorithm, random forest algorithm and extreme random tree algorithm, the four algorithms are simulated in the missing value processing of northbound interface data respectively. The performance differences of various algorithms are compared and analyzed, and their advantages and disadvantages are compared. Finally, the most suitable algorithm for missing value processing of northbound interface data is found. Based on the simulation and experimental results, it is concluded that the extreme random tree algorithm has better filling effect in dealing with the missing values of the north interface.

Recently, emerging SDN-based VANET (i.e., vehicular ad hoc network based on software-defined networking) enables VANET management to be programmable and flexible. It introduces SDN controllers to maintain network-wide resources and SDN applications to program configurations through arbitrarily accessing resources via the northbound interface (NBI). However, this brings with it security issues on the NBI, such as network-wide resource exposure and configuration manipulation. Most of the existing works employed permission systems to restrict resource access; these solutions are generally controller-dependent, which means controller codes need to be modified for giving access permissions to external applications. In this paper, we propose a scalable and dynamic access control scheme on the NBI for SDN-based VANET, named BENBI. In the proposed scheme, we dynamically and flexibly control network resources by employing broadcast encryption, rather than altering source codes of the controller or updating permission lists with various degrees of granularity. Moreover, the resources are encrypted during transmission so that they are only available to authorized applications. Finally, we implement a prototype of BENBI. The experimental results demonstrate that the cost of allocating secret keys is independent of the number of SDN entities being appointed, which indicates the scalability of our scheme.

This paper introduces a mechanism to adaptively ensure Quality of Service (QoS) for user data flow by leveraging Software-Defined Networking (SDN) in heterogeneous tactical networks. We start with a hypothesis that an application using the northbound interface of the SDN controller can support the management of unreliable radio links at the edge of tactical networks. Thus, we developed applications to support adaptive shaping of user data flows over data rates supported by VHF and UHF radios, and to ensure the dropping of expired messages. We also introduce a hybrid scheduling mechanism for these user data flows using queuing discipline. The goal is to differentiate IP packets from command and control services with different QoS requirements. Our hypothesis was verified with experiments using four classes of messages with different QoS requirements, such as priority, reliability, and time of expire. Experimental results in an emulated network suggest that our solution can differentiate data flows in a heterogeneous tactical network while ensuring its QoS requirements.

In this manuscript we present an original implementation of network management functions in the context of Software Defined Networking. We demonstrate a full integration of an artificial intelligence driven management, an SDN control plane, and a programmable data plane. Constraint Programming is used to implement a management operating system that accepts high level specifications, via a northbound interface, in terms of operational objective and directives. These are translated in technology-specific constraints and directives for the SDN control plane, leveraging the programmable data plane, which is enriched with functionalities suited to feed data that enable the most effective operation of the “intelligent” control plane, by exploiting the P4 language.

With the rapid development of data-driven and bandwidth-intensive applications in the Software Defined Networking (SDN) northbound interface, big data stream is dynamically generated with high growth rates in SDN-based data center networks. However, a significant issue faced in big data stream communication is how to verify its authenticity in an untrusted environment. The big data stream traffic has the characteristics of security sensitivity, data size randomness, and latency sensitivity, putting high strain on the SDN-based communication system during larger spoofing events in it. In addition, the SDN controller may be overloaded under big data stream verification conditions on account of the fast increase of bandwidth-intensive applications and quick response requirements. To solve these problems, we propose a two-phase adaptive authenticated model (TAAM) by introducing source address validation implementation- (SAVI-) based IP source address verification. The model realizes real-time data stream address validation and dynamically reduces the redundant verification process. A traffic adaptive SAVI that utilizes a robust localization method followed by the Sequential Probability Ratio Test (SPRT) has been proposed to ensure differentiated executions of the big data stream packets forwarding and the spoofing packets discarding. The TAAM model could filter out the unmatched packets with better packet forwarding efficiency and fundamental security characteristics. The experimental results demonstrate that spoofing attacks under big data streams can be directly mitigated by it. Compared with the latest methods, TAAM can achieve desirable network performance in terms of transmission quality, security guarantee, and response time. It drops 97% of the spoofing attack packets while consuming only 9% of the controller CPU utilization on average.

Software-Defined Networking (SDN) is an emerging network architecture. Its property of network programmability makes the network technology more open and flexible. It is achievable by decoupling the data plane and control plane. The control plane has bridged the data plane and application plane by northbound interface and southbound interface, respectively. By using the interfaces of SDN controllers, different applications can enforce their own rules into the control. The controller applies the highest priority rules to the switches. The attacker can manipulate the SDN network by malicious rules with low priority. This paper discusses different scenarios of priority passing attack and proposes a security module. The proof of the proposed module explains that it nullifies the threat proposed by the attacker. Moreover, the Hashmap using Binary Search Tree (BST) is implemented in the security model to minimize the search time for matching flow rules. It is observed that the latency remains as low as 40ms even with 10 thousand rules.

Intent-based network (IBN) is a novel approach to network management and automation designed to simplify a generic high-level policy called intent to a specific low-level network configuration. At present, plenty of researches have focused more on definition of intent-based northbound interface (NBI) but less on methods for intent-based service orchestration. In this paper, an IBN reference architecture is presented to manage IoT infrastructure and deliver end-to-end services across multi-domains. After that, this paper introduces a DDQN-based heuristic algorithm to solve the dynamic service chain orchestration problem. Simulation results clearly show that the proposed algorithm has better cost efficiency and convergence than those of compared algorithms, and can also guarantee the QoS requirements and make the traffic balanced.

Software defined networks (SDN) – is an innovative network architecture that provides centralized management of networks with a complex structure SDN consists of three layers: the infrastructure layer of network equipment, the network management layer (represented by SDN controllers) and the application layer. SDN controllers provide open programming interfaces that allow network applications to manage the network. Architecture and software implementation of the service for the development and implementation of SDN segmentation algorithms are proposed in paper. The aim of creating the presented service is to optimize the network resources usage through the use of an additional layer of abstraction – a layer of network segments.

The anticipated technological advancement of 5th Generation (5G) network is the ability to apply intelligence directly to network’s edge, in the form of virtual network appliances through the archetypes of Network Functions Virtualisation (NFV) and Edge Cloud Computing.The adoption and use of innovative technologies, such as Software Defined Networking (SDN) and NFV is the key to making 5G networks more promising. However, implementing these technologies yield to the imaging of new security challenges. A Cloud-Enabled Small Cell (CESC) provides multi-operator platform to integrates and execute at the virtualised environment. Providing services to multiple operators/tenants to access technologies and protocols in unified network architecture requires well-define security approach in order to deliver secured data communication, privacy and integrity. The CESC security requirement analysis was carried out using Secure Tropos (SecTro) methodology. The paper will thoroughly examine the CESC security challenges and provide possible solutions to mitigate those challenges.

Segment Routing is a source routing based architecture that provides an opportunity to include a list of instructions called segments in the packet headers. The segments may allow the inclusion of detours for responding to Traffic Engineering needs or Service Function Chaining implementations. Even though there is an increasing interest towards enhancing and adopting Segment Routing, the administrators are still burdened with the task of manually write and maintain the segment lists. Such type of management presents several challenges ranging from error-prone configurations to increased response time for network updates. In this paper, we present a Segment Routing management framework named Busoni, which automates and simplifies the process of segments lists management. Additionally, we also provide programming tools to compose and manage Segment Routing policies that operate efficiently, even under multi-tenancy environments. Using different use cases, we show the programming capabilities offered by our framework.

The most significant threats to networks usually originate from external entities. As such, the Northbound interface of SDN networks which ensures communication with external applications requires particularly close attention. In this paper we propose the Risk Assessment and Management approach to SEcure SDN (RAMSES). This novel solution is able to estimate the risk associated with traffic demand requests received via the Northbound-API in SDN networks. RAMSES quantifies the impact on network cost incurred by expected traffic demands and specifies the likelihood of adverse requests estimated using the reputation system. Accurate risk estimation allows SDN network administrators to make the right decisions and mitigate potential threat scenarios. This can be observed using extensive numerical verification based on an network optimization tool and several scenarios related to the reputation of the sender of the request. The verification of RAMSES confirmed the usefulness of its risk assessment approach to protecting SDN networks against threats associated with the Northbound-API.

Software Defined Networking (SDN) – a new rising terminology of network is recently gained more and more interest in both academic and industrial field. Not only decoupling of its control plane and data plane, SDN also provides the whole view of entire network for better and more flexible network management. Despite the benefits of the global view of the whole network, SDN with a single point of failure at the controller encounters some drawbacks and additional challenge for security. A malicious OpenFlow application (OF app) can access to SDN controller to perform illegal activities due to the lack of the authentication protocol in Northbound interface to ensure that only trusted, and authorized applications access critical network resources. The information about the whole network, such as topology data, flow information or statistics can be retrieved. Even worse the entire network can be controlled from the compromised controller. In this paper, we introduce Trust Trident - a framework of securing trustworthy authentication between applications and controller, with the controller-independent capability. It gives network administrator a fully and fine-grained observation of OF apps communicating with the controller. Threats in Northbound interface and counter measurements by our plugin are classified and evaluated according to the threat categories from the STRIDE methodology.

The proposed demonstration will showcase a live testing of the northbound API on optical DCI equipment which is compliant with the NETCONF network configuration protocol and OpenConfig YANG data models.

In Software-Defined Networking (SDN), Northbound Interface provides APIs, which allow network applications to communicate with SDN controllers. However, a malicious application can access to SDN controller and perform illegal activities via these APIs. Although some studies proposed AAA (Authentication, Authorization, Accounting) systems to protect SDN controllers from malicious applications, their proposed systems also exist several limitations. Attackers can compromise a system, then modify its database or files to gain higher privileges. This system can be taken down because of Single Point of Failure threat. To enhance security for the Northbound interface, we propose a novel system using blockchain, namely BlockAS. It is used to authenticate, authorize and monitor accessing critical controller resources from applications. Specifically, BlockAS leverages blockchain features to maintain the immutability and decentralization of credential data. Our proposed system has five key properties: immutability of database, decentralization, authentication, authorization, and accounting to enhance security for SDN controller and its offered services.

Software-defined network (SDN) is becoming an advance technology. It is not only used to manage IP networks but also manages data centers as well as cloud data and it can be applied in various types of networks. Earlier approaches for IP networks were more complex and IP networks are now a big network; thus, it is very difficult to manage those networks in terms of configuring thenetwork devices, applying policies on the network dynamically and get the knowledge of the faults, load and changes in the network. Software-defined approach made it easy to manage and configure the network. The role of the SDN controller in network devices can be extended with an application that effectively solves a particular problem and provide a flexible management service. One of the protocols used for this technology is OpenFlow. It basically works on southbound interface, i.e., between controller and network devices. Many solutions to utilize the network and exploit as much information possible from the network is one of the aim of researchers and many solutions have been proposed for the same. One of the most important and distinct features is to detect denial-of-service (DoS) attack quickly and precisely. In this paper, we are going to give an introduction about how and why SDN is trending and also analysis of solutions to detect and save a network from DDoS attacks.

Software-Defined Network (SDN), which is recommended as a new generation of the network, a substitute for TCP/IP network, has the characteristics of separation of data plane and control plane. Although the separation of the control plane brings a high degree of freedom and simple operation and maintenance, it also increases the cost of north–south communication. There are many additional modules for SDN to modify and enhance the basic functions of SDN. This paper proposes a message queue-based northbound communication mechanism, which pre-categorizes messages from the data plane and accurately pushes them to the apps potentially interested. This mechanism improves the efficiency of northbound communication and apps’ execution. Furthermore, it supports both OpenFlow and the protocol-independent southbound interface, and it has strong compatibility. Experiments have proved that this mechanism can reduce the control-response latency by up to 41% when compared with the normal controller northbound communication system, and it also improves the network situation of the data plane, such as real-time bandwidth.

Software-defined networking (SDN) has received a great deal of attention from both academia and industry in recent years. Studies on SDN have brought a number of interesting technical discussions on network architecture design, along with scientific contributions. Researchers, network operators, and vendors are trying to establish new standards and provide guidelines for proper implementation and deployment of such novel approach. It is clear that many of these research efforts have been made in the southbound of the SDN architecture, while the northbound interface still needs improvements. By focusing in the SDN northbound, this paper surveys the body of knowledge and discusses the challenges for developing SDN software. We investigate the existing solutions and identify trends and challenges on programming for SDN environments. We also discuss future developments on techniques, specifications, and methodologies for programmable networks, with the orthogonal view from the software engineering discipline.

We present an open design of a filterless add/drop reconfigurable optical add/drop multiplexer module with a NETCONF northbound interface. Compared to commercial offerings, the device design is openly documented and available for detailed inspection. Performance is evaluated with up to seven adjacent high-speed 100 Gbps signals on a 50 GHz frequency grid.

We implement IETF YANG models interface and test its interoperability through a multi-domain coordinate experiment according to ACTN (Abstraction and Control of Traffic Engineered Networks) framework. We validate YANG models are well-suited for multi-domain coordination.

SDN-based cloud has the merit of allowing more flexibility in network management, however, the security of network accessing and the correctness of network configuration in SDN-based cloud have not been effectively addressed yet. In this paper, SDNKeeper, a generic and fine-grained policy enforcement system in SDN-based cloud is proposed, which can defend against unauthorized attacks and avoid network resource misconfiguration. With the usage of SDNKeeper, numerous flexible network management policies can be created by administrators, which give administrators the discretionary room on controlling the network resources. To be specific, SDNKeeper can reject any unauthorized network access request at Northbound Interface (NBI), which located between application plane and control plane. Moreover, compared with other traditional policy-based access control systems, SDNKeeper is totally application-transparent and lightweight, which is easy to implement, deploy and runtime configure. Based on the prototype implementation and evaluation, we conclude that SDNKeeper can perform access control accurately with negligible computation overhead whilst the throughput degradation is still within the acceptable range.

Software Defined Networking (SDN) enables highly flexible routing and traffic engineering. The network using the centralized SDN control can be operated by globally viewing the entire network. On the other hand, the network operation of the routing and traffic engineering based on internal network traffic monitoring does not immediately perform the network recovery specifically in case of the multiple network failures induced by the large scale disaster such as Great East Japan Earthquake. Hence, we will investigate the new network operation utilizing the external information abstracted from the social data. The social data contains the real-time user experience of the network quality degradation due to the emergency events, natural disaster etc. and useful for the immediate network recovery. The integration of the social data with SDN will enable the new network operation. In order to obtain the real-time information from the social data, Twitter is most relevant for our purpose. First, we constructed the SDN enabled network testbed in the wide area network controlled by the centralized system using th northbound interface (NBI). Next using the testbed, the network restoration experiment was successfully performed by the network path computation algorithm using actual Tweet logs of the Great East Japan Earthquake.

One of the goals of Software-Defined Networking (SDN) is to allow users to specify high-level policies into lower level network rules. Managing a network and decide what policy set is appropriate requires, however, expertise and low level know-how. An emerging SDN paradigm is to allow higher-level network level decisions wishes in the form of "intents". Despite its importance in simplifying network management, intent specification is not yet standardized. In this work, we propose a northbound interface (NBI) for intent declaration, based on Behavior-Driven Development. In our approach, intents are specified in plain English and translated by our system into pre-compiled network policies, that are in turn, converted into low-level rules by the software-defined infrastructure e.g. an SDN controller. We demonstrated our behavior-driven approach with two practical use cases: service function chaining deployed on OpenStack, supported by both ONOS and Ryu controllers, and dynamic firewall programming. We also measured the overhead and response time of our NBI. We believe that our approach is far more general and paves the way for a more expressive and simplified northbound interface for intent-driven networking.

The most important features of software-defined networking is the flexibility and network development capability by the ability of the network to be programmable. Accordingly, the controller delivers network resources to the third party applications or other networks through the Northbound Interface (NBI) of SDN. But this interface has some defects, including the lack of necessary security features such as authentication and access level determination. In this paper, we presented a new solution for using third party applications from network resources based on the NTRU algorithm and the NSS digital signature, which by the controller can provide network information only for approved and reliable programs through a safe REST API. The results show that using the NTRU against algorithms such as RSA and ECC presents low memory consumption, high speed, and low computing, although it does not work faster on small Networks.

Software-defined Networking, a new networking paradigm, provides network programming for third parties by separating control plane from data forwarding plane and opening network capabilities. SDN brings great flexibility and openness to the network, but the original design phase of SDN had not considered designing characteristics regarding security. For this reason, there are many potential vulnerabilities in SDN Environments. One of the most critical security threats arise from the vulnerability of trusting relationship due to the lack of authentication mechanism between the network application and the controller. A specific concern is whether an application can be trusted or not. This paper discusses the authentication mechanism of the network application. At the same time, it implements the application authentication system which addresses the key challenges: how to safely resolve conflicts between untrusted network applications and requests. The paper undergoes system testing in testbed constructed Floodlight architecture. The test results show that the system works well to effectively defend against unauthorized access and provide log history, which verifies the effectiveness of the proposed method to secure the northbound interface by introducing the application authentication system.

In the past year, the northbound interface application has become a hot topic in the Software-Defined Network technology. It offers an opening method and makes people able to develop own business application upper the SDN. In this paper, we propose and evaluate a visual plane based on android phone application to present an explicit watch of the state and working performance of the Openflow-based underlying network topology in Software-Defined Network. The impacts of the designing architecture are evaluated in the form of software simulation and actual operating effects of the android application that we have designed. Through the interface opened by the floodlight controller to the upper business application, we are aimed at making it able to call the underlying network resources and inquiry its status information conveniently. So this paper wants to achieve the unified dispatching by elaborated methods and transplants the idea to the android application. By the way of the software programming, we could make the android phone to probe the southbound network resources through the northbound interface whose connotation we will expand. Between the northbound interface and the android application, we introduce a data center and select the mysql database to implement its function. Through the technology framework we built, we are able to use an android phone to access the status of the underlying devices and monitor the software defined network better aiming at providing better service. And we judge its function from the perspective of overall feasibility and stability not only through the system performance but also sound experiment effects. Finally, we can use any android phone to view about the topology of the network effectively and simply.

Intent-Driven Networking is recently gaining interest, with all major SDN control platforms now providing an intent Northbound Interface (NBI) as a high-level abstraction for network management. With these frameworks network operators can conveniently define “what needs to be done”, rather than “how it should be done”. Current IDN frameworks pose two main limitations that affect deployment in production grade and multi-domain networks. They are mainly concerned with a single network domain, and thus enabling end-to-end network intents over a multi-domain and large-scale setup is still a challenge. Furthermore, these frameworks do not consider any differentiation between user intents and provider intents, and a limited set of intent classes are available for both. In this paper we present MD-IDN, which provides an intent framework for the users of multi-domain cloud infrastructures. We first propose a graph-based abstraction model for user-defined intents and a generic intent compilation process. Then, we propose compilation algorithms to achieve scalability in multi-domain networks: First, user-defined intents get processed over an abstracted multi-graph of network domains and their interconnections, and a set of local intents will be generated for each of the involved domains. Afterwards, the local intents will be compiled and installed in local regions in parallel. MD-IDN is deployed as a public service in the SAVI Testbed over more than ten data centers spanning across Canada. In multi-domain environments, our experiments show that MD-IDN outperforms current practices that compile intents over a flat network topology.

Software Defined Networking (SDN) is a new approach to configure and manage computer networks, based on its core idea of separating the data plane from the control plane. Through this, SDN provides a higher level of abstraction and allows better and simpler programmability and management of networks, thereby enabling faster innovation. The benefits of SDN have clearly been demonstrated for wired networks, in particular for wide area and data centre networks. The goal of this research was to explore how the concepts of SDN can be applied to wireless networks, in particular Wireless Mesh Networks (WMNs). The focus of our research was on exploring the feasibility of SDN-based routing and load balancing of traffic in WMNs. For this, we leveraged key SDN features such as centralised view of the network state, fine grained and flow-based traffic forwarding, and abstraction. Working towards this goal, we have addressed a number of key research challenges. Firstly, we have designed and implemented a new topology discovery mechanism with greatly reduced overhead compared to the state-of-the-art approach. Topology discovery is an essential service in any Software Defined Network, but an efficient mechanism with low overhead is particularly important for typically resource constrained WMNs. Another critical component for SDN-based routing in WMNs is link monitoring, in particular link capacity monitoring. In contrast to wired networks, where the link capacity is typically known and constant, it can be highly dynamic in wireless networks. We have designed, implemented and evaluated a new, SDN-based link capacity estimation approach, based on the concept of packet pair/train probing. Building on our topology discovery and link capacity estimation methods, we have developed a new SDN-based routing framework for WMNs. For this, we have leveraged a new northbound interface called SCOR (Software-defined Constrained Optimal Routing) for QoS routing and Traffic Engineering (TE). Using the abstraction provided by a small number of high level SCOR routing primitives, we have demonstrated the feasibility, simplicity and efficiency of this approach to implement relatively complex routing problems in WMNs. Finally, we have also provided critical evaluations of new potential testbeds for the evaluation of SDN-based WMNs. We believe this is an important contribution in its own right, since experimental validation is a key research methodology in this context, and trust in the validity of experimental results is absolutely critical.

In modern industrial control, it is significant to achieve interoperability of state data and control data at field level and service management layer. Therefore, the demand for data exchange and sharing is getting higher and higher. This paper presents a research of the common mainstream network protocols on industrial network architecture of Northbound Interface, then it makes a comprehensive analysis of protocol vitality, protocol satisfaction capability, use-cost of protocol and its covering products, vendors that support the protocol and product richness, and the optimum protocol has been chosen for a locomotive manufacturing enterprise at last.

Large enterprises are moving towards Software Defined Network (SDN) adoption, where business-critical applications are being deployed on top of highly programmable network components and orchestrated by a single or multiple controllers using network protocols, such as OpenFlow or NetConf for communication. Just like in traditional networks, low-cost monitoring solutions need to be developed for SDN. The issue of inaccurate network traffic tagging and amount of overhead associated with using traditional monitoring techniques based on packet sampling or Deep Packet Inspection (DPI) need to be addressed. These traditional techniques are no longer satisfactory for monitoring in SDN. This paper presents FlowVista — a lightweight solution to identify flows using the SDN Northbound interface and addressing flows rather than packets. The high flow matching accuracy is achieved by interacting directly with business application residing in the application layer and translating its high level information to low level network flows in a non-invasive fashion. FlowVista is tested using Voice over IP (VoIP) as a business-critical application in both real and simulated networks. In addition, the portability across various platforms, low bandwidth utilization characteristics and integration with many components native to SDN makes FlowVista suitable for those who want to analyze SDN traffic without having to attach expensive tools that often have limited visibility and granularity.

The northbound interface of SDN is the functional interface exposed by the controller for upper layer applications to implement business logic. Recent studies on northbound interface focus on aspects such as portability, programmability, network virtualization, etc. The rich software features and open architecture offered by SDN have broadened the concept of network resources. Nevertheless, a systematic and abstract SDN resource management framework on a higher-level is yet to be thoroughly studied. This paper studies the Semantic Web based northbound interface for SDN resource management. It proposes a multi-level and fine-grained model of SDN using OWL based on which an SDN network resource management platform, SemSDN, is implemented by means of RDF, SPARQL, etc. SemSDN also implements a non-invasive QoS information collecting mechanism based on LLDP (i.e., the QoS over LLDP scheme) as well as the cost-based top-k shortest paths query extension for standard SPARQL (i.e., the KSPARQL extension). Basic experiment results exhibit SemSDN's applicabilities in network resource management in the context of SDN.

One of the main challenges in delivering end-toend service chains across multiple Software Defined Networking (SDN) and Network Function Virtualization (NFV) domains is to achieve unified management and orchestration functions. A very critical aspect is the definition of an open, vendoragnostic, and interoperable northbound interface (NBI) that should be as abstracted as possible from domain-specific data and control plane technologies. In this paper we propose a reference architecture and an intent-based NBI for end-to-end service orchestration across multiple technological domains. In particular, we consider the use case of an Internet of Things (IoT) infrastructure deployment and the corresponding cloudbased data collection, processing, and publishing services with quality differentiation.We also report the experimental validation of the proposed architecture over a heterogeneous OpenFlow/IoT SDN test bed.

With the development of communication technology, the increasing scale of power communication network is bigger and bigger. Based on the important significance of electric power communication network to establish an alarm information acquisition system is necessary. CORBA, as a distributed processing environment interconnect solutions in hardware and software, is widely used in the field of network management for its high versatility. In this paper we use real-time CORBA platform TAO as a network management platform to develop a kind of electric power communication network alarm acquisition system.

International audience; Software-defined networking (SDN), as a new network paradigm, has the advantage of centralizing control and global visibility over a network. However, security issues remain a major concern and prevent SDN from being widely adopted. One of the challenges is the prevention of malicious OpenFlow application (OF app) access to the SDN controller as it opens a programmable northbound interface for third party applications. In this paper, we address app-to-control security issues with focus on five main attack vectors: unauthorized access, illegal function calling, malicious rules injection, resources exhausting and manin-the-middle attack. Based on the identified threat models, we develop a light-weight plug-in, which is called ControllerSEPA, by using RESTful API to defend SDN controller against malicious OF apps. Specifically, ControllerSEPA can provide the services including OF app-based AAA control (unlike OpenDaylight and ONOS which offer user-based or role-based AAA control), rule conflict resolution, OF app isolation, fine-grained access control and encryption. Furthermore, we study the feasibility of deploying ControllerSEPA on five open source SDN controllers: OpenDaylight, ONOS, Floodlight, Ryu and POX. Results show that the deployment operates with very low complexity, and most of time the modification of source codes is unnecessary. In our implementations, the repacked services in ControllerSEPA create negligible latency (0.1% to 0.3%) and can provide more rich services to OF apps

In SDN (Software Defined Network) environments, for the security considerations of the upper-layer application behaviors, we need to consider adding an access control mechanism to the northbound interface of the SDN control layer to limit the capabilities of the upper-layer applications, thereby improving the security of the SDN. In addition, considering the performance and management requirements of SDN, access control features including cross-domain support should be considered. In this paper, we proposed an MD-UCON access control model with role mechanism extension based on UCON and role-based access control mechanism. At the same time, we introduced a cross-domain role mapping method to support cross-domain access authorization, thereby enabling the model to be applied to the application of access control for the SDN northbound interface.

Facing current and future developments of the energy system, including the integration of large numbers of renewable energy sources and electric vehicles, live monitoring and control becomes essential for stable operation of the power grid. This transition to a Smart Grid requires coupling the power system with a reliable and real-time capable communication infrastructure. In response to this demand, we propose a combined approach for the control of power and communication systems, exploiting the opportunities of Software-Defined Networking (SDN). Due to its real-time capability, a Multi Agent System (MAS) is applied for controlling power flows, handling overloads and guaranteeing voltage stability in a decentralized manner. The MAS is supported by an Information and Communication Technologies (ICT) infrastructure, which follows the paradigms of SDN by applying a programmable controller platform with global network view to orchestrate traffic flows. To meet specific requirements of the MAS, we implement an SDN Northbound Interface, enabling control agents to communicate with the SDN controller directly. Thus, agents can advertise their demands to the controller, which translates them into corresponding forwarding rules and establishes them in the network. By applying fine grained prioritisation and integrating MAS and SDN controller, we showcase reliable and timely transmission of critical command messages, thereby ensuring power grid stability.

© 2016 IEEE. The Northbound Interface (NBI) plays a crucial role in promoting the adoption of SDN as it allows developers the freedom of developing their revenue-generating applications without being affected and constrained by the complexities of the underlying networks. To do so the NBI has to allow applications to express their requirements and constraints in their own application specific language, and the SDN controller to translate those requirements into SDN network specific language for provisioning network resources and services to satisfy the application requirements. The intent-based NBI is born from this consideration and the Open Networking Foundation (ONF) provides principles and guidelines to build such an intent-based NBI. However, these principles do not lend themselves readily to the design and practical realization of an intent-based NBI for extended classes of business-like network applications. This paper introduces a solution and its initial implementation in the form of a novel architecture for realizing the intent-based NBI. The new solution exploits the modularized and reuse features of the micro services and service oriented architectures.

The transition from IPv4 to IPv6 has been an inevitable trend, but data centers must support both in the near future. As Multi-tenant data center network calls for agility, programmability and scalability, we don't recommend to build traditional dual-stack multi-tenant network because it's too complicated to manage. Software Defined Network (SDN) separates control plane and data plane, and it brings an innovative idea for today's multi-tenant data center network. In this paper, we propose a novel SDN scheme which turns all traffic into IPv6 in data plane and provides IPv4 and IPv6 accessing for multi-tenant data centers. We introduce stateless translating actions V4V6/V6V4 to software switches to connect IPv4 and IPv6. Our scheme uses unified IPv6 address format to separate tenants in data center, and makes tenant networks more efficient and manageable. Our method offers unified and concise northbound interface in control plane for programming and management, as well as transition from IPv4 to IPv6.

Modern Industrial Control Systems (ICS) integrate advanced solutions from the field of traditional IP networks, i.e., Software-Defined Networks (SDN), in order to increase the security and resilience of communication infrastructures. Despite their clear advantages, such solutions also expose ICS to common cyber threats that may have a dramatic impact on the functioning of critical infrastructures, e.g., the power grid. As a response to these issues, this work develops a novel hierarchical SDN control plane for ICS. The approach builds on the features of a novel SDN controller named OptimalFlow that redesigns the network according to the solutions delivered by an integer linear programming (ILP) optimization problem. The developed ILP problem encapsulates a shortest path routing objective and harmonizes ICS flow requirements including quality of service, security of communications, and reliability. OptimalFlow exposes two communication interfaces to enable a hierarchical control plane. Its northbound interface reduces a complete switch infrastructure to an emulated (software) switch, while its southbound interface connects to an OpenFlow controller to enable the monitoring and control of real/emulated switches. Extensive experimental and numerical results demonstrate the effectiveness of the developed scheme.

Many Software-Defined Networking (SDN) controllers support a “northbound interface” by which applications can interact with the SDN controller and (indirectly) control the underlying SDN network. The absence of a standard for the northbound interface of these controllers makes it difficult for application developers to create interoperable/portable code (i.e., code that works with any SDN controller). Developers are forced to re-write almost all of their code every time they want to support a new controller. This tedious and time consuming process is typically a start-over software development cycle that involves learning new APIs, data models, and controller-specific conventions. In this paper, we present RAPTOR, a REST-based API translaTOR service for SDN networks that allows users to develop their network control software independent of any particular SDN controller. RAPTOR exposes its own REST-based API functions and data models to user applications and translates application requests into controller-specific northbound interface calls. To demonstrate the viability of RAPTOR, we implemented and deployed RAPTOR in GENI and used it in conjunction with different types of controllers. We also developed GENI Desktop modules that interacted with RAPTOR to install, list, delete and monitor end-to-end flows regardless of the controller used for controlling the underlying switches.

With the development of the software-defined networking (SDN), centralized and open network management has brought many security problems. In this paper, we analyzed the security problems in SDN architecture, and then designed a SDN security controller architecture. We verified the feasibility and effectiveness of the architecture by using DDoS attack defense as an example, and analyzed the influence of the architecture on the network performance. Introduction Since the software-defined networking (SDN) was put forward, it received great attention. Related theories and technologies are also evolving and developing continuously. In the traditional network, the expansion of the network scale and large quantities of applications lead to the complexity of network structure. In order to solve the problems of TCP/IP network architecture, a lot of researches are carried out for the future network architectures. Redesign and redeployment of network core devices should be the first consideration of future network research [1]. The characteristic of SDN is that control function is independent. This conform to the developing direction of future network. Although SDN technology has many advantages such as centralized control, fine-grained network control, and the reduction of management complexity, but as a new kind of network architecture, SDN technology is still in the development and test phase. It faces many new security issues. Security is the key to the development and popularization of SDN. Through the improvement of controller, development of security applications and innovation of security architecture, it can improve the security performance of SDN network and give full play to the characteristics of this SDN. SDN Architecture The core of SDN is separating control and data plane. Based on this, researchers at Stanford University proposed OpenFlow [2] technology as a way to the realization of SDN. Then ONF was established, it developed the OpenFlow protocol standard and the SDN white paper [3]. SDN network architecture is composed of infrastructure layer, control layer and application layer. Infrastructure layer consists of network devices which support SDN technology standard. Control layer shield the difference of the underlying devices by control data plane interface (Southbound Interface) to communicate with network devices. Control layer provides programmable network management environment, through the centralized control of the network devices, network resources can be configured flexibly and dynamically. Application layer can realize more web services through the Northbound Interface which is provided by control layer. Researchers designed many implementation scheme of control layer based on SDN architecture and OpenFlow protocol. NOX [4] first introduced the concept of network operating system (NOS). NOS is the control software in SDN. In the OpenFlow network based on NOX, NOX is the control core. Because of NOX is the first SDN control layer based on OpenFlow, it has become a design template of OpenFlow controller [1]. Cisco, IBM and many companies developed OpenDaylight [5] controller. It supports both the “classic” OpenFlow-based approach and emerging model-driven network management and programmability technologies. The Open Networking Lab (ON.LAB) 4th International Conference on Machinery, Materials and Computing Technology (ICMMCT 2016) © 2016. The authors Published by Atlantis Press 229 developed an Open Network Operating System (ONOS) [6]. ONOS implements an open distributed control plane, it can provide scalable, high performance and high reliability NOS for large networks. Security Analyses of SDN Security Problems of Controller. In the SDN based on OpenFlow, the direct manager of network is controller. So the running state of controller is related to the running of whole network. But the number of controller is limited, the centralizing of management device will be a weakness of network. When network is encountering with DDoS attack, large amount of traffic in network will be processed by controller. This may lead to the load of controller increases sharply, even lost processing capacity. Security Problems of Flow Table. Flow table is the basic guarantee of OpenFlow network. So the stability and reliability of flow table are also important to the security of SDN. In the process of network configuration, many flow tables may already exist in network devices. Each configuration may conflict with the existing policy. If controller do not coordinate the conflicts, configuration of network will be very confusing. And attackers can disable forwarding function or create a channel for malicious attacks by adding malicious flow entries through Northbound Interface. Security Problems of Application. As a feature of SDN, open Northbound Interface allows developers develop applications which could run on controller. But open interface can be used to attack network and cause other issues. If the Northbound Interface can be used freely, the attack to network will be so easily. Attacker can develop malicious application to break controller. Even non-malicious applications can also cause problems of flow table. Security Problems of Southbound Interface. The reliability of Southbound Interface is also an important indicator of security. At present, Southbound Interface mainly refers to OpenFlow protocol. SSL/TLS protocol is adopted for the secure channel between controller and switch. But SSL/TLS protocol is not enough to establish and assure trust between controllers and switches. Attacker can gains access to the control plane by exploit the weaknesses of SSL/TLS [7]. A Security Controller Architecture In this section, we design a security controller architecture. The architecture is shown in Fig. 1. This architecture is composed of basic control module and customizable multi-granularity security module. The basic control module implement basic functions, following the SDN architecture. And customizable multi-granularity security module provides customizable security features. Basic control module Device manager Flow table read-write Topology discoverer Routing service Customizable multi-granularity security module Application manager Authority Manager Code auditor Behavior detector Sandbox

This paper presents an SDN orchestrator that offers adaptive path provisioning in dynamic service chaining to recover from congestion events throughout service chain paths. Moreover, the SDN orchestrator exposes a Northbound interface based on REST principles and on the Intent-Based Network Modeling Language data model that allows applications to describe their requirements for the network (including dynamic service chaining) without being concerned with low-level implementation details. Experiments in an emulated network environment have been carried out to show the feasibility of the approach and to evaluate the effectiveness of the orchestration process in terms of network resource usage and adaptation overhead.

© 2015 IEEE. Software-Defined Networking (SDN) has emerged as a networking paradigm that can remove the limitations of current network infrastructures by separating the control plane from the data forwarding plane. The implications include: the underlying network state and decision making capability are centralized; programmability is provided on the control plane; the operation at the forwarding plane is simplified; and the underlying network infrastructure is abstracted and presented to the applications. This paper discusses and exposes the details of the design of a common SDN controller based on our study of many controllers. The emphasis is on interfaces as they are essential for evolving the scope of SDN in supporting applications with different network resources requirements. In particular, the paper review and compare the design of the three controllers: Beacon, OpenDaylight, and Open Networking Operation System.

Along with the widespread development of Internet and mobile applications, the demand for more flexible and dynamic networking services increases. It becomes a new challenge for many carriers to deploy a variety of new services by effective provisioning of network resources. Software-Defined Networking (SDN) is a novel approach to make networks reconfigurable and extensible such that new services can be deployed with existing network devices. By decoupling the controller plane from the data plane in network devices, SDN brings networks programmability of the data plane and centralization of the controller plane. Conventional Operations Support Systems (OSSs) were developed to manage networks in a standard fashion with Simple Network Management Protocol (SNMP) or proprietary protocols. SDN provides a new framework in managing SDN-enabled devices. A new issue for carriers is how SDN-enabled networks and devices can be monitored and controlled by current OSSs. This paper focuses on performance management and aims to develop an efficient scheme to collect traffic statistics data via the SDN controller plane. Similar to Bulkstat, an SNMP-based mechanism for periodic collection and transfer of MIB objects, the proposed scheme for bulk traffic statistics collection is developed in the controller plane and provides a northbound interface for upper network management applications. Instead of using SNMP and MIBs, the scheme is implemented by periodically gathering statistics information of flow tables from SDN-enabled switches via the OpenFlow protocol.

Software-Defined Networking (SDN) promises to introduce flexibility and programmability into networks by offering a northbound interface (NBI) for developers to create SDN applications. However, current designs and implementations have several drawbacks, including the lack of extended security features. In this paper, we present a secure northbound interface, through which an SDN controller can offer network resources, such as statistics, flow information or topology data, via a REST-like API to registered SDN applications. A trust manager ensures that only authenticated and trusted applications can utilize the interface. Furthermore, a permission system allows for fine-grained authorization and access control to the aforementioned resources. We present a prototypical implementation of our interface and developed example applications using our interface, including an SDN management dashboard.

In the software defined networks (SDNs), the Open-Flow protocol is typically used as the southbound API in manipulating OpenFlow switches. However, the OpenFlow control messages are in a low abstraction level. Therefore, even a single application-level operation requires many OpenFlow messages, which consume the bandwidth of the control network and reduce the SDN's scalability. One potential solution is to use high level domain specific northbound APIs in the control network. In this paper, we explore the possibility of adopting this solution by implementing and evaluating a new SDN framework, Ryuo. In Ryuo, we introduce Local Service, which runs directly on each SDN switch (hardware/software). In operations, Local Service provides northbound APIs to the SDN applications while it can use different southbound APIs for different switches. Ryuo eliminates unnecessary control messages, hence it decreases the volume of control traffic. Our evaluation of Ryuo on Mininet with example applications shows that Ryuo reduces the volume of control traffic at least 50% compared to the standard OpenFlow, and up to 40% compared to the local controller approach. We also evaluate the performance of running Local Services directly on physical switches. The results show that we can achieve lower event handling latency in large networks, but with the trade-off of a lower event handling throughput due to the computing power limitation on physical switches. In summary, we have shown that using high level northbound API in the control network can make the control network more efficient, and leads to better scalability.

A lot of new features and capabilities emerge in the network because of separation of data plane and control plane in Software Defined Network (SDN) terminology. One of them is the possibility to implement Northbound API to allow third-party application to access resources of the network. However, most of the current implementations of Northbound API do not consider the security aspect. Therefore, we design more secure scheme for it. The design consists of token authentication for application and user, who is responsible to control/use the application/network, using OAuth 2.0 protocol.

Continuous advances in network technologies challenge network architects in their attempt to foresee what new technologies deserve resources and investments, what existing infrastructure to keep, and their interplay during migration processes. Moreover, topics like energy efficiency, disaster resilience, or SDN/NFV are being intensively considered and investigated during the last years. As a result, R&D efforts have led to a number of solutions. Unfortunately, it is often difficult for operators to reproduce such results on their networks, maybe due to divergent philosophies between commercial planning tools used in the industry and academic tools. A paradigm shift to an open-source view of network planning could emphasize the power of peer-review and transparency to promote innovation at an accelerated pace and lower cost. This tutorial would focus on Net2Plan (http://www.net2plan.com), an open-source tool developed by the authors, and actively used in several courses (>200 students) and research projects since 2012. Built on top of a technology-agnostic multilayer network representation, Net2Plan is designed to assist users in the evaluation of built-in or original user-developed planning algorithms. In addition, users can analyze their designs using either reports or a simulation tool for in-operation scenarios like network resilience, connection-admission-control, time-varying traffic resource allocation, or even combinations of them. Besides, Net2Plan permits applying algorithms to orchestrate OpenFlow-enabled networks interacting with the northbound interface of OpenDaylight. Throughout the tutorial, attendees would have the opportunity to learn about the main features of Net2Plan, also discovering some of its applications. At the end of this tutorial, attendees would be guided through an intensive hands-on case study based on an IP-over-WDM network, e.g., including network dimensioning using built-in or user-developed algorithms, WDM line engineering (e.g., EDFA placement, impairment computations), automatic availability calculation under different failure patterns, and automatic simulation of the effects of time-varying traffic and assessment of energy-efficient switch-off techniques.