Full Text:   <3060>

Summary:  <1760>

CLC number: TP393

On-line Access: 2016-07-05

Received: 2015-10-07

Revision Accepted: 2016-01-26

Crosschecked: 2016-06-08

Cited: 2

Clicked: 6405

Citations:  Bibtex RefMan EndNote GB/T7714

 ORCID:

Peng Zhang

http://orcid.org/0000-0001-7721-2675

-   Go to

Article info.
Open peer comments

Frontiers of Information Technology & Electronic Engineering  2016 Vol.17 No.7 P.634-646

http://doi.org/10.1631/FITEE.1500321


A secure and high-performance multi-controller architecture for software-defined networking


Author(s):  Huan-zhao Wang, Peng Zhang, Lei Xiong, Xin Liu, Cheng-chen Hu

Affiliation(s):  Department of Computer Science and Technology, Xian Jiaotong University, Xian 710049, China; more

Corresponding email(s):   hzhwang@xjtu.edu.cn, p-zhang@xjtu.edu.cn, huc@ieee.org

Key Words:  Software-defined networking (SDN), Security, Multi-controller, Distributed rule store


Huan-zhao Wang, Peng Zhang, Lei Xiong, Xin Liu, Cheng-chen Hu. A secure and high-performance multi-controller architecture for software-defined networking[J]. Frontiers of Information Technology & Electronic Engineering, 2016, 17(7): 634-646.

@article{title="A secure and high-performance multi-controller architecture for software-defined networking",
author="Huan-zhao Wang, Peng Zhang, Lei Xiong, Xin Liu, Cheng-chen Hu",
journal="Frontiers of Information Technology & Electronic Engineering",
volume="17",
number="7",
pages="634-646",
year="2016",
publisher="Zhejiang University Press & Springer",
doi="10.1631/FITEE.1500321"
}

%0 Journal Article
%T A secure and high-performance multi-controller architecture for software-defined networking
%A Huan-zhao Wang
%A Peng Zhang
%A Lei Xiong
%A Xin Liu
%A Cheng-chen Hu
%J Frontiers of Information Technology & Electronic Engineering
%V 17
%N 7
%P 634-646
%@ 2095-9184
%D 2016
%I Zhejiang University Press & Springer
%DOI 10.1631/FITEE.1500321

TY - JOUR
T1 - A secure and high-performance multi-controller architecture for software-defined networking
A1 - Huan-zhao Wang
A1 - Peng Zhang
A1 - Lei Xiong
A1 - Xin Liu
A1 - Cheng-chen Hu
J0 - Frontiers of Information Technology & Electronic Engineering
VL - 17
IS - 7
SP - 634
EP - 646
%@ 2095-9184
Y1 - 2016
PB - Zhejiang University Press & Springer
ER -
DOI - 10.1631/FITEE.1500321


Abstract: 
Controllers play a critical role in software-defined networking (SDN). However, existing single-controller SDN architectures are vulnerable to single-point failures, where a controller’s capacity can be saturated by flooded flow requests. In addition, due to the complicated interactions between applications and controllers, the flow setup latency is relatively large. To address the above security and performance issues of current SDN controllers, we propose distributed rule store (DRS), a new multi-controller architecture for SDNs. In DRS, the controller caches the flow rules calculated by applications, and distributes these rules to multiple controller instances. Each controller instance holds only a subset of all rules, and periodically checks the consistency of flow rules with each other. Requests from switches are distributed among multiple controllers, in order to mitigate controller capacity saturation attack. At the same time, when rules at one controller are maliciously modified, they can be detected and recovered in time. We implement DRS based on Floodlight and evaluate it with extensive emulation. The results show that DRS can effectively maintain a consistently distributed rule store, and at the same time can achieve a shorter flow setup time and a higher processing throughput, compared with ONOS and Floodlight.

The paper presents a distributed controller architecture for SDN deployments. The key mechanism proposed is a distributed rule store that maintains a global view of the network state and allows each controller to make local decisions based on this global view. The DRS design tries to guarantee that this global view is consistent at all times. The paper is well written and well motivated.

一种安全、高性能的软件定义网络多控制器体系结构

目的:控制器在软件定义网络(software-defined networking,SDN)中扮演着至关重要的角色。然而现有的SDN控制器体系结构存在单点失效、响应时延较大等问题。本文提出一种名为分布式数据存储(distributed rule store,DRS)的SDN多控制器体系结构,预先计算流表规则,并分布式缓存在不同控制器实例上。如此,每个控制器仅存储其中的一部分规则,且来自交换机的请求被分配到不同的控制器进行并行处理,从而达到减小响应时延,解决单点失效的目的。
创新点:提出一种名为DRS的软件定义网络多控制器体系结构;通过实验证明该控制器体系结果对于已有的ONOS和Floodlight控制器,数据流建立的时间更短、吞吐量更大。
方法:在控制器中预先计算网络中的流表规则,利用分布式哈希表将这些规则存储在不同的控制器实例上。每个控制器周期性地检查其他控制器中规则的完整性,防止单个控制器上规则的失效和篡改。当交换机请求流表时,系统根据控制器当前负载,将请求分配到相应控制器进行处理。
结论:本文提出的多控制体系结构可以有效保证分布式规则存储的一致性(图5);相对于已有的ONOS和Floodlight控制器,数据流建立的时间更短(图6、7),吞吐量更大(图8);多个控制器实例的负载相对均衡(图9、10)。

关键词:软件定义网络;安全;多控制器;分布式规则存储

Darkslateblue:Affiliate; Royal Blue:Author; Turquoise:Article

Reference

[1]Berde, P., Gerola, M., Hart, J., et al., 2014. ONOS: towards an open, distributed SDN OS. Proc. 3rd Workshop on Hot Topics in Software Defined Networking, p.1-6.

[2]Dittrich, D., 1999. The DoS Project’s ‘Trinoo’ Distributed Denial of Service Attack Tool. University of Washington, USA. Available from http://staff.washington.edu/dittrich/misc/trinoo.analysis.txt.

[3]Dixit, A., Hao, F., Mukherjee, S., et al., 2013. Towards an elastic distributed SDN controller. ACM SIGCOMM Comput. Commun. Rev., 43(4):7-12.

[4]Floodlight Project, 2016. Floodlight Controller. Available from http://www.projectfloodlight.org/floodlight/.

[5]Gude, N., Koponen, T., Pettit, J., et al., 2008. NOX: towards an operating system for networks. ACM SIGCOMM Comput. Commun. Rev., 38(3):105-110.

[6]Karger, D., Lehman, E., Leighton, T., et al., 1997. Consistent hashing and random trees: distributed caching protocols for relieving hot spots on the World Wide Web. Proc. 29th Annual ACM Symp. on Theory of Computing, p.654-663.

[7]Katta, N.P., Rexford, J., Walker, D., 2013. Incremental consistent updates. Proc. 2nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, p.49-54.

[8]Koponen, T., Casado, M., Gude, N., et al., 2010. Onix: a distributed control platform for large-scale production networks. Proc. 9th USENIX Symp. on Operating Systems Design and Implementation, p.1-6.

[9]Krishnamurthy, A., Chandrabose, S.P., Gember-Jacobson, A., 2014. Pratyaastha: an efficient elastic distributed SDN control plane. Proc. 3rd Workshop on Hot Topics in Software Defined Networking, p.133-138.

[10]Lakshman, A., Malik, P., 2010. Cassandra: a decentralized structured storage system. ACM SIGOPS Oper. Syst. Rev., 44(2):35-40.

[11]Lantz, B., Heller, B., McKeown, N., 2010. A network in a laptop: rapid prototyping for software-defined networks. Proc. 9th ACM SIGCOMM Workshop on Hot Topics in Networks, Article 19.

[12]Mahajan, R., Wattenhofer, R., 2013. On consistent updates in software defined networks. Proc. 12th ACM Workshop on Hot Topics in Networks, Article 20.

[13]McGeer, R., 2012. A safe, efficient update protocol for OpenFlow networks. Proc. 1st Workshop on Hot Topics in Software Defined Networks, p.61-66.

[14]McKeown, N., Anderson, T., Balakrishnan, H., et al., 2008. OpenFlow: enabling innovation in campus networks. ACM SIGCOMM Comput. Commun. Rev., 38(2):69-74.

[15]Merkle, R.C., 1988. A digital signature based on a conventional encryption function. In: Pomerance, C. (Ed.), Advances in Cryptology, p.369-378.

[16]NOXRepo, 2016. The POX Controller. Available from http://www.noxrepo.org/.

[17]OpenDaylight Project, 2016. The OpenDaylight Controller. Available from https://www.opendaylight.org/.

[18]Ousterhout, J., Agrawal, P., Erickson, D., et al., 2010. The case for RAMClouds: scalable high-performance storage entirely in DRAM. ACM SIGOPS Oper. Syst. Rev., 43(4):92-105.

[19]Paul, S., 2014. Software Defined Application Delivery Networking. PhD Thesis, School of Engineering & Applied Science, Washington University in St. Louis, USA.

[20]Perešíni, P., Kuzniar, M., Vasić, N., et al., 2013. OF.CPP: consistent packet processing for OpenFlow. Proc. 2nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking, p.97-102.

[21]Pfaff, B., Pettit, J., Amidon, K., et al., 2009. Extending Networking into the Virtualization Layer. Available from http://openvswitch.github.io/papers/hotnets2009.pdf.

[22]Reitblatt, M., Foster, N., Rexford, J., et al., 2012. Abstractions for network update. Proc. ACM SIGCOMM Conf. on Applications, Technologies, Architectures, and Protocals for Computer Communication, p.323-334.

[23]Ryu SDN Framework Community, 2014. The Ryu Controller. Available from http://osrg.github.io/ryu/.

[24]Shin, S., Yegneswaran, V., Porras, P., et al., 2013. AVANT-GUARD: scalable and vigilant switch flow management in software-defined networks. Proc. ACM SIGSAC Conf. on Computer & Communications Security, p.413-424.

[25]Stoica, I., Morris, R., Karger, D., et al., 2001. Chord: a scalable peer-to-peer lookup service for Internet applications. ACM SIGCOMM Comput. Commun. Rev., 31(4):149-160.

[26]Tootoonchian, A., Ganjali, Y., 2010. HyperFlow: a distributed control plane for OpenFlow. Proc. Internet Network Management Conf. on Research on Enterprise Networking, p.1-6.

[27]Yeganeh, S.H., Ganjali, Y., 2012. Kandoo: a framework for efficient and scalable offloading of control applications. Proc. 1st Workshop on Hot Topics in Software Defined Networks, p.19-24.

Open peer comments: Debate/Discuss/Question/Opinion

<1>

Please provide your name, email address and a comment





Journal of Zhejiang University-SCIENCE, 38 Zheda Road, Hangzhou 310027, China
Tel: +86-571-87952783; E-mail: cjzhang@zju.edu.cn
Copyright © 2000 - 2024 Journal of Zhejiang University-SCIENCE