SDN‐based dynamic multipath forwarding for inter–data center networking

Equal‐cost multipath (ECMP)–based traffic engineering (TE) methods are commonly used in intra–data center (DC) networks to improve the transmission performance for east‐west traffic (ie, traffic from server to server within a DC). However, applying ECMP on inter‐DC wide area network (WAN) offers limited performance enhancement as a result of irregular network topology. Since TE can be intelligently and efficiently realized with software‐defined networking (SDN), SDN‐based multipath becomes a popular option. However, SDN suffers from scalability issue caused by limited ternary content‐addressable memory (TCAM) size. In this paper, we propose an SDN‐based TE method called dynamic flow‐entry‐saving multipath (DFSM) for inter‐DC traffic forwarding. DFSM adopts source‐destination–based multipath forwarding and latency‐aware traffic splitting to reduce the consumption of flow entries and achieve load balancing. The evaluation results indicate that DFSM saves 15% to 30% of system flow entries in practical topologies and reduces the standard deviation of path latencies from 10% to 7% than do label‐switched tunneling, and also reduces average latency by 10% to 48% by consuming 6% to 20% more flow entries than do ECMP in less‐interconnected topologies. Note that the performance gain may not always be proportional to flow entry investment, with the interconnectivity between nodes being an important factor. The evaluation also indicates that per‐flow provision consumes several times the flow entries consumed by DFSM but reduces latency by 10% at most. Besides, DFSM reduces the standard deviation of path latencies from 14% to 7% than do even traffic splitting.     

Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments

Software Defined Networks (SDNs) based on the OpenFlow (OF) protocol export control-plane programmability of switched substrates. As a result, rich functionality in traffic management, load balancing, routing, firewall configuration, etc. that may pertain to specific flows they control, may be easily developed. In this paper we extend these functionalities with an efficient and scalable mechanism for performing anomaly detection and mitigation in SDN architectures. Flow statistics may reveal anomalies triggered by large scale malicious events (typically massive Distributed Denial of Service attacks) and subsequently assist networked resource owners/operators to raise mitigation policies against these threats. First, we demonstrate that OF statistics collection and processing overloads the centralized control plane, introducing scalability issues. Second, we propose a modular architecture for the separation of the data collection process from the SDN control plane with the employment of sFlow monitoring data. We then report experimental results that compare its performance against native OF approaches that use standard flow table statistics. Both alternatives are evaluated using an entropy-based method on high volume real network traffic data collected from a university campus network. The packet traces were fed to hardware and software OF devices in order to assess flow-based data-gathering and related anomaly detection options. We subsequently present experimental results that demonstrate the effectiveness of the proposed sFlow-based mechanism compared to the native OF approach, in terms of overhead imposed on usage of system resources. Finally, we conclude by demonstrating that once a network anomaly is detected and identified, the OF protocol can effectively mitigate it via flow table modifications.     

基于SDN架构的地址跳变技术研究

网络嗅探作为网络攻击的前奏,对于网络安全存在较大威胁。为增强网络本身的抗嗅探窃听能力,在移动目标防御网络的地址跳变技术的研究基础上提出了一种基于传输过程的地址跳变方案,主要思想是在SDN网络架构下,控制器通过为传输路由上交换机下发不同流表来实现IP地址的跳变。仿真结果表明,可以以较小的网络开销实现跳变机制,并使网络对于网络嗅探达到较高的防御能力。     

基于OpenFlow网络的流媒体传输QoS的研究与设计

Open Flow是软件定义网络(Software Definded Network,SDN)的产物,是一种新型的网络结构,且发展十分迅速。但Open Flow网络的Qo S功能仍待优化,针对于Open Flow网络中流媒体传输Qo S的不足,在现有网络Qo S模式基础上提出了Open Qo S,它应用于Open Flow网络的控制器上,采用动态路由的方式,使得流媒体在网络端到端传输时,能够根据网络状况,动态改变路由路径,进而提高网络Qo S。最后,通过一个小的拓扑网络对本研究进行了试验验证。     

基于SDN的光纤无线混合接入网络架构研究

在分析 SDN (软件定义网络)组网的国内外相关工作的基础上,提出了一种新型融合宽带接入网络架构,该架构遵从OpenFlow协议,实现了光纤无线接入网络的智能管控,相关的资源分配算法、路由选择协议和节能机制可以在该架构下有效实施并提升网络性能。     

SDN技术在电信网络中应用的关键问题探讨

通过对软件定义网络(SDN)技术总体架构的分析,提出了SDN技术在电信网络中规模应用面临的4个方面的问题,包括数据平面构建问题、控制平面构建问题、与应用的整合问题以及如何在电信网络内平滑演进的问题。并参考业内主流的解决技术,给出了SDN技术应用在电信网络中的解决方案。     

Integrating IPsec within OpenFlow Architecture for Secure Group Communication

Network securityprotocolssuch as IPsechave been used for many years to ensure robust end-to-end communication and are impor-tant in the context of SDN.Despite the widespread installation of IPsec to date,per-packet protection offered by the protocol isnot very compatible with OpenFlow and flow-like behavior.OpenFlow architecture cannot aggregate IPsec-ESP flows in transportmode or tunnel mode because layer-3 information is encrypted and therefore unreadable.In this paper,we propose using the Secu-rity Parameter Index(SPI)of IPsec within the OpenFlow architecture to identify and direct IPsec flows.Thisenables IPsec to con-form to the packet-based behavior of OpenFlow architecture.In addition,by distinguishing between IPsec flows,the architectureis particularly suited to secure group communication.     

基于虚拟化环境下的网络安全监控技术应用

在某大型国企的数据中心虚拟化环境背景下,分析虚拟化与云计算安全在网络接入层的"虚拟以太网交换机"(Virtual Ethernet Bridge,VEB)技术在目前的实现方式中的优缺点,研究业界为解决其不足之处所提出的相关方案,阐述采用基于新型网络架构"软件定义网络"(Software Defined Network,SDN)中OpenFlow框架的可行性,提出采用该框架下的Open vSwitch开源技术来实现虚拟网络隔离、QoS配置、流量监控以及数据包分析等虚拟化网络安全监控工作的应用思路。本研究在虚拟网络交换的数据转发与安全控制的解耦、网络安全服务的独立和虚拟网络的安全控制等方面具有创新性,为采用虚拟化和云计算技术的信息系统在接入安全方面提供了参考价值。     

基于OpenF1oW的可编程终端设计与实现

随着互联网和网络接入技术的不断发展,终端配备多个网络接口已经十分普遍,多个接口同时接入网络,会建立多条连接,现有的多接口终端除了修改内核之外,没有一种灵活的方法管理多个连接。OpenFlow技术已经吸gj了越来越多网络研究人员的关注,本文中将OpenFlow技术应用到终端,兼容现有的网络协议栈的同时,使终端具有可编程性,并提供了一种在可编程终端上管理多连接的方法,基于终端控制器开发实现了连接管理组件,并且在Linux系统上成功实现。     

基于OpenFlow的SDN技术研究

软件定义网络(software-defined networking,简称SDN)技术分离了网络的控制平面和数据平面,为研发网络新应用和未来互联网技术提供了一种新的解决方案.综述了基于OpenFlow 的SDN 技术发展现状,首先总结了逻辑控制和数据转发分离架构的研究背景,并介绍了其关键组件和研究进展,包括OpenFlow交换机、控制器和SDN技术,然后从4 个方面分析了基于OpenFlow 的SDN 技术目前所面临的问题和解决思路.结合近年来的发展现状,归纳了在校园网、数据中心以及面向网络管理和网络安全方面的应用,最后探讨了未来的研究趋势.