Search

Software Defined Networking (SDN) is an evolving technology that decouples the control functionality from the underlying hardware managed by the control plane. The application plane supports programmers to develop numerous applications (such as networking, management, security, etc.) that can even be executed from remote locations. Northbound interface (NBI) bridges the control and application planes to execute the third-party applications business logic. Due to the software bugs in applications and existing vulnerabilities such as illegal function calling, resource exhaustion, lack of trust, and so on, NBIs are susceptible to different attacks. Based on the extensive literature review, we have identified that the researchers and academia have mainly focused on the security of the control plane, data plane, and southbound interface (SBI). NBI, in comparison, has received far less attention. In this article, the security of the least explored, but a critical component of the SDN architecture, i.e., NBI, is analyzed. The article provides a brief overview of SDN, followed by a detailed discussion on the categories of NBI, vulnerabilities of NBI, and threats posed by malicious applications to NBI. Efforts of the researchers to counter malicious applications and NBI issues are then discussed in detail. The standardization efforts for the single acceptable NBI and security requirements of SDN by Open Networking Foundation (ONF) are also presented. The article concludes with the future research directions for the security of a single acceptable NBI.

As the growth of development on both network architecture and cloud computing, the existing quality of service (QoS) measurement mechanism in VNF design is not sufficient for the cloud network architecture, especially the development of container technology. It is important for service provider to provide to customers a service level agreement (SLA) on cloud network service by provision of Container-as-a-Service (CaaS) and container network function (CNF). In this paper, we propose an enhanced vQOS (EvQOS) measurement mechanism for container-based network architecture that retains the vQOS in VNF architecture [1] including the TWAMP light (TWL) protocol and the northbound interface design, and provides a containerization architecture and the friendliness of system management and monitoring.

International audience; With the popularity of software defined networking architectures, the growing complexity of its use cases dictates the need for better auditability especially for security. In this paper, we aim at facilitating high-level management-plane policy configuration conformance auditing and their reflection in the data plane, to detect missing or spurious flow rules with respect to security policies. To this end, we propose an efficient conformance checking approach based on an intentional northbound interface as well as traces of management, control and data plane. Leveraging a proof-of-concept implementation of our approach, we compare its conformance-checking runtime and precision against a direct method on virtual topologies and find that it significantly improves scalability. We conclude by proposing directions for further enhancements extending the techniques presented herein.

SDH optical fiber transmission is widely used in various information transmission networks. It transmits a variety of information. According to the actual operation and maintenance requirements, the business management module of SDH optical fiber transmission network operation and maintenance support system is designed to realize the classified and targeted business management. The business records are information-based and scientific. Using the equipment performance data obtained from the northbound interface, the key performance indicators of the optical fiber transmission network can be extracted and displayed. It can give early warning of equipment failure and provide data support for network performance analysis and troubleshooting. Business management and device performance data are friendly displayed by the popular open source visualization tool based on JavaScript. The application of the system can improve the operation and maintenance efficiency of SDH optical fiber transmission network.

Northbound interface is the interface for manufacturers or operators to access and manage the network. Through it, the superior network management can obtain a large number of data such as configuration performance and operation and maintenance of optical network. For various reasons, there are usually missing values in real data sets. In order to improve the accuracy of filling missing values. In this paper, from the perspective of data mining, we use a variety of processing methods to fill the missing value of the north interface. In this paper, by analyzing the principle of KNN algorithm, decision tree algorithm, random forest algorithm and extreme random tree algorithm, the four algorithms are simulated in the missing value processing of northbound interface data respectively. The performance differences of various algorithms are compared and analyzed, and their advantages and disadvantages are compared. Finally, the most suitable algorithm for missing value processing of northbound interface data is found. Based on the simulation and experimental results, it is concluded that the extreme random tree algorithm has better filling effect in dealing with the missing values of the north interface.

This paper introduces a mechanism to adaptively ensure Quality of Service (QoS) for user data flow by leveraging Software-Defined Networking (SDN) in heterogeneous tactical networks. We start with a hypothesis that an application using the northbound interface of the SDN controller can support the management of unreliable radio links at the edge of tactical networks. Thus, we developed applications to support adaptive shaping of user data flows over data rates supported by VHF and UHF radios, and to ensure the dropping of expired messages. We also introduce a hybrid scheduling mechanism for these user data flows using queuing discipline. The goal is to differentiate IP packets from command and control services with different QoS requirements. Our hypothesis was verified with experiments using four classes of messages with different QoS requirements, such as priority, reliability, and time of expire. Experimental results in an emulated network suggest that our solution can differentiate data flows in a heterogeneous tactical network while ensuring its QoS requirements.

In the comprehensive digital transformation work, China Unicom takes the construction of SDOTN network as the top priority. This paper analyzes the reasons for the use of REST interface in SDOTN network. Based on the interface development experience, we make an in-depth interface model analysis of two mainstream northbound interface (NBI) of SDOTN controller, and give the basis and principles of model selection. Finally, the time to create the service is actually measured and the comparison data is given based on two different interface models.

Recently, emerging SDN-based VANET (i.e., vehicular ad hoc network based on software-defined networking) enables VANET management to be programmable and flexible. It introduces SDN controllers to maintain network-wide resources and SDN applications to program configurations through arbitrarily accessing resources via the northbound interface (NBI). However, this brings with it security issues on the NBI, such as network-wide resource exposure and configuration manipulation. Most of the existing works employed permission systems to restrict resource access; these solutions are generally controller-dependent, which means controller codes need to be modified for giving access permissions to external applications. In this paper, we propose a scalable and dynamic access control scheme on the NBI for SDN-based VANET, named BENBI. In the proposed scheme, we dynamically and flexibly control network resources by employing broadcast encryption, rather than altering source codes of the controller or updating permission lists with various degrees of granularity. Moreover, the resources are encrypted during transmission so that they are only available to authorized applications. Finally, we implement a prototype of BENBI. The experimental results demonstrate that the cost of allocating secret keys is independent of the number of SDN entities being appointed, which indicates the scalability of our scheme.

In this manuscript we present an original implementation of network management functions in the context of Software Defined Networking. We demonstrate a full integration of an artificial intelligence driven management, an SDN control plane, and a programmable data plane. Constraint Programming is used to implement a management operating system that accepts high level specifications, via a northbound interface, in terms of operational objective and directives. These are translated in technology-specific constraints and directives for the SDN control plane, leveraging the programmable data plane, which is enriched with functionalities suited to feed data that enable the most effective operation of the “intelligent” control plane, by exploiting the P4 language.

With the rapid development of data-driven and bandwidth-intensive applications in the Software Defined Networking (SDN) northbound interface, big data stream is dynamically generated with high growth rates in SDN-based data center networks. However, a significant issue faced in big data stream communication is how to verify its authenticity in an untrusted environment. The big data stream traffic has the characteristics of security sensitivity, data size randomness, and latency sensitivity, putting high strain on the SDN-based communication system during larger spoofing events in it. In addition, the SDN controller may be overloaded under big data stream verification conditions on account of the fast increase of bandwidth-intensive applications and quick response requirements. To solve these problems, we propose a two-phase adaptive authenticated model (TAAM) by introducing source address validation implementation- (SAVI-) based IP source address verification. The model realizes real-time data stream address validation and dynamically reduces the redundant verification process. A traffic adaptive SAVI that utilizes a robust localization method followed by the Sequential Probability Ratio Test (SPRT) has been proposed to ensure differentiated executions of the big data stream packets forwarding and the spoofing packets discarding. The TAAM model could filter out the unmatched packets with better packet forwarding efficiency and fundamental security characteristics. The experimental results demonstrate that spoofing attacks under big data streams can be directly mitigated by it. Compared with the latest methods, TAAM can achieve desirable network performance in terms of transmission quality, security guarantee, and response time. It drops 97% of the spoofing attack packets while consuming only 9% of the controller CPU utilization on average.

Software-Defined Networking (SDN) is an emerging network architecture. Its property of network programmability makes the network technology more open and flexible. It is achievable by decoupling the data plane and control plane. The control plane has bridged the data plane and application plane by northbound interface and southbound interface, respectively. By using the interfaces of SDN controllers, different applications can enforce their own rules into the control. The controller applies the highest priority rules to the switches. The attacker can manipulate the SDN network by malicious rules with low priority. This paper discusses different scenarios of priority passing attack and proposes a security module. The proof of the proposed module explains that it nullifies the threat proposed by the attacker. Moreover, the Hashmap using Binary Search Tree (BST) is implemented in the security model to minimize the search time for matching flow rules. It is observed that the latency remains as low as 40ms even with 10 thousand rules.

Intent-based network (IBN) is a novel approach to network management and automation designed to simplify a generic high-level policy called intent to a specific low-level network configuration. At present, plenty of researches have focused more on definition of intent-based northbound interface (NBI) but less on methods for intent-based service orchestration. In this paper, an IBN reference architecture is presented to manage IoT infrastructure and deliver end-to-end services across multi-domains. After that, this paper introduces a DDQN-based heuristic algorithm to solve the dynamic service chain orchestration problem. Simulation results clearly show that the proposed algorithm has better cost efficiency and convergence than those of compared algorithms, and can also guarantee the QoS requirements and make the traffic balanced.

Software defined networks (SDN) – is an innovative network architecture that provides centralized management of networks with a complex structure SDN consists of three layers: the infrastructure layer of network equipment, the network management layer (represented by SDN controllers) and the application layer. SDN controllers provide open programming interfaces that allow network applications to manage the network. Architecture and software implementation of the service for the development and implementation of SDN segmentation algorithms are proposed in paper. The aim of creating the presented service is to optimize the network resources usage through the use of an additional layer of abstraction – a layer of network segments.

The anticipated technological advancement of 5th Generation (5G) network is the ability to apply intelligence directly to network’s edge, in the form of virtual network appliances through the archetypes of Network Functions Virtualisation (NFV) and Edge Cloud Computing.The adoption and use of innovative technologies, such as Software Defined Networking (SDN) and NFV is the key to making 5G networks more promising. However, implementing these technologies yield to the imaging of new security challenges. A Cloud-Enabled Small Cell (CESC) provides multi-operator platform to integrates and execute at the virtualised environment. Providing services to multiple operators/tenants to access technologies and protocols in unified network architecture requires well-define security approach in order to deliver secured data communication, privacy and integrity. The CESC security requirement analysis was carried out using Secure Tropos (SecTro) methodology. The paper will thoroughly examine the CESC security challenges and provide possible solutions to mitigate those challenges.

Segment Routing is a source routing based architecture that provides an opportunity to include a list of instructions called segments in the packet headers. The segments may allow the inclusion of detours for responding to Traffic Engineering needs or Service Function Chaining implementations. Even though there is an increasing interest towards enhancing and adopting Segment Routing, the administrators are still burdened with the task of manually write and maintain the segment lists. Such type of management presents several challenges ranging from error-prone configurations to increased response time for network updates. In this paper, we present a Segment Routing management framework named Busoni, which automates and simplifies the process of segments lists management. Additionally, we also provide programming tools to compose and manage Segment Routing policies that operate efficiently, even under multi-tenancy environments. Using different use cases, we show the programming capabilities offered by our framework.

Software-Defined Network (SDN), which is recommended as a new generation of the network, a substitute for TCP/IP network, has the characteristics of separation of data plane and control plane. Although the separation of the control plane brings a high degree of freedom and simple operation and maintenance, it also increases the cost of north–south communication. There are many additional modules for SDN to modify and enhance the basic functions of SDN. This paper proposes a message queue-based northbound communication mechanism, which pre-categorizes messages from the data plane and accurately pushes them to the apps potentially interested. This mechanism improves the efficiency of northbound communication and apps’ execution. Furthermore, it supports both OpenFlow and the protocol-independent southbound interface, and it has strong compatibility. Experiments have proved that this mechanism can reduce the control-response latency by up to 41% when compared with the normal controller northbound communication system, and it also improves the network situation of the data plane, such as real-time bandwidth.

The open Software Defined Network (SDN) capability of optical transmission network under telecom operation is always the core problem concerned by operators. Based on the idea of Abstraction and Control of TE Networks (ACTN), this paper analyzes the northbound interface (NBI) modeling of the controller system and explains how the interface model can meet the needs of the upper application system.

The most significant threats to networks usually originate from external entities. As such, the Northbound interface of SDN networks which ensures communication with external applications requires particularly close attention. In this paper we propose the Risk Assessment and Management approach to SEcure SDN (RAMSES). This novel solution is able to estimate the risk associated with traffic demand requests received via the Northbound-API in SDN networks. RAMSES quantifies the impact on network cost incurred by expected traffic demands and specifies the likelihood of adverse requests estimated using the reputation system. Accurate risk estimation allows SDN network administrators to make the right decisions and mitigate potential threat scenarios. This can be observed using extensive numerical verification based on an network optimization tool and several scenarios related to the reputation of the sender of the request. The verification of RAMSES confirmed the usefulness of its risk assessment approach to protecting SDN networks against threats associated with the Northbound-API.

Software Defined Networking (SDN) is a technology which provides a network architecture with three distinct layers that is, the application layer which is made up of SDN applications, the control layer which is made up of the controller and the data plane layer which is made up of switches. However, the exits different types of SDN architectures some of which are interconnected with the physical network. At the core of SDN, the control plane is physically and logically separated from the data plane. The controller is connected to the application layer through an interface known as the northbound interface and to the data plane through another interface known as the southbound interface. The centralized control plane uses APIs to communicate through the northbound and southbound interface with the application layer and the data plane layer respectively. By default, these APIs such as Restful and OpenFlow APIs do not implement security mechanisms like data encryption and authentication thus, this introduces new network security threats to the SDN architecture. This report presents a technique known as threat modeling in SDN. To achieve this technique, attack scenarios are created based on the OpenFlow SDN vulnerabilities. After which these vulnerabilities are defined as predicates or facts and rules, a framework known as multihost multistage vulnerability analysis (MulVAL) then takes these predicates and rules to produce a threat model known as attack graph. The attack graph is further used to performed quantitative risk analysis using a metric to depict the risks associated to the OpenFlow SDN model

Software Defined Networking (SDN) – a new rising terminology of network is recently gained more and more interest in both academic and industrial field. Not only decoupling of its control plane and data plane, SDN also provides the whole view of entire network for better and more flexible network management. Despite the benefits of the global view of the whole network, SDN with a single point of failure at the controller encounters some drawbacks and additional challenge for security. A malicious OpenFlow application (OF app) can access to SDN controller to perform illegal activities due to the lack of the authentication protocol in Northbound interface to ensure that only trusted, and authorized applications access critical network resources. The information about the whole network, such as topology data, flow information or statistics can be retrieved. Even worse the entire network can be controlled from the compromised controller. In this paper, we introduce Trust Trident - a framework of securing trustworthy authentication between applications and controller, with the controller-independent capability. It gives network administrator a fully and fine-grained observation of OF apps communicating with the controller. Threats in Northbound interface and counter measurements by our plugin are classified and evaluated according to the threat categories from the STRIDE methodology.

The proposed demonstration will showcase a live testing of the northbound API on optical DCI equipment which is compliant with the NETCONF network configuration protocol and OpenConfig YANG data models.

The rules issued by third-party applications may have direct violations or indirect violations with existing security flow rules in the SDN (software-defined network), thereby leading to the failure of security rules. Currently, existing methods cannot detect the rule collision in a comprehensive and fine-grained manner. This paper proposes a deep detection mechanism for rule collision that can detect grammatical errors in the flow rules themselves, and can also detect direct and indirect rule collisions between third-party and security applications based on the set intersection method. In addition, our mechanism can effectively and automatically resolve the rule collision. Finally, we implement the detection mechanism in the RYU controller, and use Mininet to evaluate the function and performance. The results show that the mechanism proposed in this paper can accurately detect the static, dynamic and dependency collisions of flow rules, and ensure that the decline of throughput of the northbound interface of the SDN network is controlled at 20%.

In Software-Defined Networking (SDN), Northbound Interface provides APIs, which allow network applications to communicate with SDN controllers. However, a malicious application can access to SDN controller and perform illegal activities via these APIs. Although some studies proposed AAA (Authentication, Authorization, Accounting) systems to protect SDN controllers from malicious applications, their proposed systems also exist several limitations. Attackers can compromise a system, then modify its database or files to gain higher privileges. This system can be taken down because of Single Point of Failure threat. To enhance security for the Northbound interface, we propose a novel system using blockchain, namely BlockAS. It is used to authenticate, authorize and monitor accessing critical controller resources from applications. Specifically, BlockAS leverages blockchain features to maintain the immutability and decentralization of credential data. Our proposed system has five key properties: immutability of database, decentralization, authentication, authorization, and accounting to enhance security for SDN controller and its offered services.

Software-defined network (SDN) is becoming an advance technology. It is not only used to manage IP networks but also manages data centers as well as cloud data and it can be applied in various types of networks. Earlier approaches for IP networks were more complex and IP networks are now a big network; thus, it is very difficult to manage those networks in terms of configuring thenetwork devices, applying policies on the network dynamically and get the knowledge of the faults, load and changes in the network. Software-defined approach made it easy to manage and configure the network. The role of the SDN controller in network devices can be extended with an application that effectively solves a particular problem and provide a flexible management service. One of the protocols used for this technology is OpenFlow. It basically works on southbound interface, i.e., between controller and network devices. Many solutions to utilize the network and exploit as much information possible from the network is one of the aim of researchers and many solutions have been proposed for the same. One of the most important and distinct features is to detect denial-of-service (DoS) attack quickly and precisely. In this paper, we are going to give an introduction about how and why SDN is trending and also analysis of solutions to detect and save a network from DDoS attacks.

We implement IETF YANG models interface and test its interoperability through a multi-domain coordinate experiment according to ACTN (Abstraction and Control of Traffic Engineered Networks) framework. We validate YANG models are well-suited for multi-domain coordination.

Software-defined networking (SDN) has received a great deal of attention from both academia and industry in recent years. Studies on SDN have brought a number of interesting technical discussions on network architecture design, along with scientific contributions. Researchers, network operators, and vendors are trying to establish new standards and provide guidelines for proper implementation and deployment of such novel approach. It is clear that many of these research efforts have been made in the southbound of the SDN architecture, while the northbound interface still needs improvements. By focusing in the SDN northbound, this paper surveys the body of knowledge and discusses the challenges for developing SDN software. We investigate the existing solutions and identify trends and challenges on programming for SDN environments. We also discuss future developments on techniques, specifications, and methodologies for programmable networks, with the orthogonal view from the software engineering discipline.

We present an open design of a filterless add/drop reconfigurable optical add/drop multiplexer module with a NETCONF northbound interface. Compared to commercial offerings, the device design is openly documented and available for detailed inspection. Performance is evaluated with up to seven adjacent high-speed 100 Gbps signals on a 50 GHz frequency grid.

Software Defined Networking (SDN) presents a unique networking paradigm that facilitates the development of network innovations. This paper aims to improve application awareness by incorporating Machine Learning (ML) techniques within an open source SDN architecture. The paper explores how end-to-end application Key Performance Indicator (KPI) metrics can be designed and utilized for the purpose of application awareness in networks. The main goal of this research is to characterize application KPI metrics using a suitable ML approach based on available network data. Resource allocation and network orchestration tasks can be automated based on the findings. A key facet of this research is introducing a novel feedback interface to the SDN's Northbound Interface that receives realtime performance feedback from applications. This paper aim to show how could we exploit the applications feedback to determine useful characteristics of an application's traffic. A mapping application with a defined KPI is used for experimentation. Linear multiple regression is used to derive a characteristic relationship between the application KPI and the network metrics.

SDN-based cloud has the merit of allowing more flexibility in network management, however, the security of network accessing and the correctness of network configuration in SDN-based cloud have not been effectively addressed yet. In this paper, SDNKeeper, a generic and fine-grained policy enforcement system in SDN-based cloud is proposed, which can defend against unauthorized attacks and avoid network resource misconfiguration. With the usage of SDNKeeper, numerous flexible network management policies can be created by administrators, which give administrators the discretionary room on controlling the network resources. To be specific, SDNKeeper can reject any unauthorized network access request at Northbound Interface (NBI), which located between application plane and control plane. Moreover, compared with other traditional policy-based access control systems, SDNKeeper is totally application-transparent and lightweight, which is easy to implement, deploy and runtime configure. Based on the prototype implementation and evaluation, we conclude that SDNKeeper can perform access control accurately with negligible computation overhead whilst the throughput degradation is still within the acceptable range.

Software Defined Networking (SDN) enables highly flexible routing and traffic engineering. The network using the centralized SDN control can be operated by globally viewing the entire network. On the other hand, the network operation of the routing and traffic engineering based on internal network traffic monitoring does not immediately perform the network recovery specifically in case of the multiple network failures induced by the large scale disaster such as Great East Japan Earthquake. Hence, we will investigate the new network operation utilizing the external information abstracted from the social data. The social data contains the real-time user experience of the network quality degradation due to the emergency events, natural disaster etc. and useful for the immediate network recovery. The integration of the social data with SDN will enable the new network operation. In order to obtain the real-time information from the social data, Twitter is most relevant for our purpose. First, we constructed the SDN enabled network testbed in the wide area network controlled by the centralized system using th northbound interface (NBI). Next using the testbed, the network restoration experiment was successfully performed by the network path computation algorithm using actual Tweet logs of the Great East Japan Earthquake.

One of the goals of Software-Defined Networking (SDN) is to allow users to specify high-level policies into lower level network rules. Managing a network and decide what policy set is appropriate requires, however, expertise and low level know-how. An emerging SDN paradigm is to allow higher-level network level decisions wishes in the form of "intents". Despite its importance in simplifying network management, intent specification is not yet standardized. In this work, we propose a northbound interface (NBI) for intent declaration, based on Behavior-Driven Development. In our approach, intents are specified in plain English and translated by our system into pre-compiled network policies, that are in turn, converted into low-level rules by the software-defined infrastructure e.g. an SDN controller. We demonstrated our behavior-driven approach with two practical use cases: service function chaining deployed on OpenStack, supported by both ONOS and Ryu controllers, and dynamic firewall programming. We also measured the overhead and response time of our NBI. We believe that our approach is far more general and paves the way for a more expressive and simplified northbound interface for intent-driven networking.

In recent years, a variety of different approaches have been proposed to tackle the problem of scaling and placing network services, consisting of interconnected virtual network functions (VNFs). This paper presents a placement abstraction layer (PAL) that provides a clear and simple northbound interface for using such algorithms while hiding their internal functionality and implementation. Through its southbound interface, PAL can connect to different back ends that evaluate the calculated placements, e.g., using simulations, emulations, or testbed approaches. As an example for such evaluation back ends, we introduce a novel placement emulation framework (PEF) that allows executing calculated placements using real, container- based VNFs on real-world network topologies. In a case study, we show how PAL and PEF facilitate reusing and evaluating placement algorithms as well as validating their underlying models and performance claims.

The most important features of software-defined networking is the flexibility and network development capability by the ability of the network to be programmable. Accordingly, the controller delivers network resources to the third party applications or other networks through the Northbound Interface (NBI) of SDN. But this interface has some defects, including the lack of necessary security features such as authentication and access level determination. In this paper, we presented a new solution for using third party applications from network resources based on the NTRU algorithm and the NSS digital signature, which by the controller can provide network information only for approved and reliable programs through a safe REST API. The results show that using the NTRU against algorithms such as RSA and ECC presents low memory consumption, high speed, and low computing, although it does not work faster on small Networks.