A secure and high-performance multi-controller architecture for software-defined networking

Huan-zhao WANG; Peng ZHANG; Lei XIONG; Xin LIU; Cheng-chen HU

doi:10.1631/FITEE.1500321

Your Location：

Home >

Browse articles >

A secure and high-performance multi-controller architecture for software-defined networking

Special Issue on Future Network: Software-Defined Networking | Updated：2022-05-19

- A secure and high-performance multi-controller architecture for software-defined networking
- 一种安全、高性能的软件定义网络多控制器体系结构
- Frontiers of Information Technology & Electronic Engineering Vol. 17, Issue 7, Pages: 634-646(2016)
- Affiliations：
  
  1Department of Computer Science and Technology, Xi'an Jiaotong University, Xi'an 710049, China
  2Science and Technology on Information Transmission and Dissemination in Communication Networks Laboratory, Shijiazhuang 050081, China
  3MOE Key Laboratory for Intelligent Networks and Network Security, Xi'an Jiaotong University, Xi'an 710049, China
- Author bio：
  
  E-mail:hzhwang@xjtu.edu.cn
  E-mail:p-zhang@xjtu.edu.cn
  E-mail:huc@ieee.org
- Funds：
- DOI：10.1631/FITEE.1500321
  CLC： TP393
- Received：07 October 2015，
  
  Accepted：26 January 2016，
  
  Published：2016-07
- Accepted：
Scan QR Code
Huan-zhao WANG, Peng ZHANG, Lei XIONG, et al. A secure and high-performance multi-controller architecture for software-defined networking[J]. Frontiers of Information Technology & Electronic Engineering, 2016, 17(7): 634-646.
DOI：

Huan-zhao WANG, Peng ZHANG, Lei XIONG, et al. A secure and high-performance multi-controller architecture for software-defined networking[J]. Frontiers of Information Technology & Electronic Engineering, 2016, 17(7): 634-646. DOI： 10.1631/FITEE.1500321.

摘要

目的

控制器在软件定义网络（software-defined networking，SDN）中扮演着至关重要的角色。然而现有的SDN控制器体系结构存在单点失效、响应时延较大等问题。本文提出一种名为分布式数据存储（distributed rule store，DRS）的SDN多控制器体系结构，预先计算流表规则，并分布式缓存在不同控制器实例上。如此，每个控制器仅存储其中的一部分规则，且来自交换机的请求被分配到不同的控制器进行并行处理，从而达到减小响应时延，解决单点失效的目的。

创新点

提出一种名为DRS的软件定义网络多控制器体系结构；通过实验证明该控制器体系结果对于已有的ONOS和Floodlight控制器，数据流建立的时间更短、吞吐量更大。

方法

在控制器中预先计算网络中的流表规则，利用分布式哈希表将这些规则存储在不同的控制器实例上。每个控制器周期性地检查其他控制器中规则的完整性，防止单个控制器上规则的失效和篡改。当交换机请求流表时，系统根据控制器当前负载，将请求分配到相应控制器进行处理。

结论

本文提出的多控制体系结构可以有效保证分布式规则存储的一致性（图5）；相对于已有的ONOS和Floodlight控制器，数据流建立的时间更短（图6、7），吞吐量更大（图8）；多个控制器实例的负载相对均衡（图9、10）。

Abstract

Controllers play a critical role in software-defined networking (SDN). However

existing single-controller SDN architectures are vulnerable to single-point failures

where a controller's capacity can be saturated by flooded flow requests. In addition

due to the complicated interactions between applications and controllers

the flow setup latency is relatively large. To address the above security and performance issues of current SDN controllers

we propose distributed rule store (DRS)

a new multi-controller architecture for SDNs. In DRS

the controller caches the flow rules calculated by applications

and distributes these rules to multiple controller instances. Each controller instance holds only a subset of all rules

and periodically checks the consistency of flow rules with each other. Requests from switches are distributed among multiple controllers

in order to mitigate controller capacity saturation attack. At the same time

when rules at one controller are maliciously modified

they can be detected and recovered in time. We implement DRS based on Floodlight and evaluate it with extensive emulation. The results show that DRS can effectively maintain a consistently distributed rule store

and at the same time can achieve a shorter flow setup time and a higher processing throughput

compared with ONOS and Floodlight.

关键词

Keywords

references

P Berde , , , M Gerola , , , J Hart , , , 等 . . ONOS: towards an open, distributed SDN OS . . 2014 . . Proc. 3rd Workshop on Hot Topics in Software Defined Networking . . 1 - - 6 . . DOI: 10.1145/2620728.2620744 http://doi.org/10.1145/2620728.2620744 . .

D Dittrich . . The DoS Project's 'Trinoo' Distributed Denial of Service Attack Tool. University of Washington, USA , , 1999 . . Available from: http://staff.washington.edu/dittrich/misc/trinoo.analysis.txt http://staff.washington.edu/dittrich/misc/trinoo.analysis.txt . .

A Dixit , , , F Hao , , , S Mukherjee , , , 等 . . Towards an elastic distributed SDN controller . . ACM SIGCOMM Comput. Commun. Rev. , , 2013 . . 43 ( ( 4 ): ): 7 - - 12 . . DOI: 10.1145/2534169.2491193 http://doi.org/10.1145/2534169.2491193 . .

Floodlight Project Floodlight Controller , , 2016 . . Available from: http://www.projectfloodlight.org/floodlight/ http://www.projectfloodlight.org/floodlight/ . .

N Gude , , , T Koponen , , , J Pettit , , , 等 . . NOX: towards an operating system for networks . . ACM SIGCOMM Comput. Commun. Rev. , , 2008 . . 38 ( ( 3 ): ): 105 - - 110 . . DOI: 10.1016/s0969-4765(07)70140-6 http://doi.org/10.1016/s0969-4765(07)70140-6 . .

D Karger , , , E Lehman , , , T Leighton , , , 等 . . Consistent hashing and random trees: distributed caching protocols for relieving hot spots on the World Wide Web . . 1997 . . Proc. 29th Annual ACM Symp. on Theory of Computing . . 654 - - 663 . . DOI: 10.1145/258533.258660 http://doi.org/10.1145/258533.258660 . .

NP Katta , , , J Rexford , , , D Walker . . Incremental consistent updates . . 2013 . . Proc. 2nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking . . 49 - - 54 . . DOI: 10.1145/2491185.2491191 http://doi.org/10.1145/2491185.2491191 . .

T Koponen , , , M Casado , , , N Gude , , , 等 . . Onix: a distributed control platform for large-scale production networks . . 2010 . . Proc. 9th USENIX Symp. on Operating Systems Design and Implementation . . 1 - - 6 . . . .

A Krishnamurthy , , , SP Chandrabose , , , A Gember-Jacobson . . Pratyaastha: an efficient elastic distributed SDN control plane . . 2014 . . Proc. 3rd Workshop on Hot Topics in Software Defined Networking . . 133 - - 138 . . DOI: 10.1145/2620728.2620748 http://doi.org/10.1145/2620728.2620748 . .

A Lakshman , , , P Malik . . Cassandra: a decentralized structured storage system . . ACM SIGOPS Oper. Syst. Rev. , , 2010 . . 44 ( ( 2 ): ): 35 - - 40 . . DOI: 10.1145/1773912.1773922 http://doi.org/10.1145/1773912.1773922 . .

B Lantz , , , B Heller , , , N McKeown . . A network in a laptop: rapid prototyping for software-defined networks . . 2010 . . Proc. 9th ACM SIGCOMM Workshop on Hot Topics in Networks, Article 19 . . DOI: 10.1145/1868447.1868466 http://doi.org/10.1145/1868447.1868466 . .

R Mahajan , , , R Wattenhofer . . On consistent updates in software defined networks . . 2013 . . Proc. 12th ACM Workshop on Hot Topics in Networks, Article 20 . . DOI: 10.1145/2535771.2535791 http://doi.org/10.1145/2535771.2535791 . .

R McGeer . . A safe, efficient update protocol for OpenFlow networks . . Proc. 1st Workshop on Hot Topics in Software Defined Networks . . 2012 . . 61 - - 66 . . DOI: 10.1145/2342441.2342454 http://doi.org/10.1145/2342441.2342454 . .

N McKeown , , , T Anderson , , , H Balakrishnan , , , 等 . . OpenFlow: enabling innovation in campus networks . . ACM SIGCOMM Comput. Commun. Rev. , , 2008 . . 38 ( ( 2 ): ): 69 - - 74 . . DOI: 10.1145/1355734.1355746 http://doi.org/10.1145/1355734.1355746 . .

RC Merkle . . A digital signature based on a conventional encryption function . . 1988 . . In: Pomerance, C. (Ed.), Advances in Cryptology . . 369 - - 378 . . DOI: 10.1007/3-540-48184-2_32 http://doi.org/10.1007/3-540-48184-2_32 . .

NOXRepo The POX Controller , , 2016 . . Available from: http://www.noxrepo.org/ http://www.noxrepo.org/ . .

OpenDaylight Project The OpenDaylight Controller , , 2016 . . Available from: https://www.opendaylight.org/ https://www.opendaylight.org/ . .

J Ousterhout , , , P Agrawal , , , D Erickson , , , 等 . . The case for RAMClouds: scalable high-performance storage entirely in DRAM . . ACM SIGOPS Oper. Syst. Rev. , , 2010 . . 43 ( ( 4 ): ): 92 - - 105 . . DOI: 10.1145/1713254.1713276 http://doi.org/10.1145/1713254.1713276 . .

S Paul . . Software Defined Application Delivery Networking . . PhD Thesis, School of Engineering & Applied Science, Washington University in St. Louis, USA , , 2014 . . DOI: 10.7936/K7CJ8BJH http://doi.org/10.7936/K7CJ8BJH . .

P Perešíni , , , M Kuzniar , , , N Vasić , , , 等 . . OF.CPP: consistent packet processing for OpenFlow . . 2013 . . Proc. 2nd ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking . . 97 - - 102 . . DOI: 10.1145/2491185.2491205 http://doi.org/10.1145/2491185.2491205 . .

B Pfaff , , , J Pettit , , , K Amidon , , , 等 . . Extending Networking into the Virtualization Layer , , 2009 . . Available from: http://openvswitch.github.io/papers/hotnets2009.pdf http://openvswitch.github.io/papers/hotnets2009.pdf . .

M Reitblatt , , , N Foster , , , J Rexford , , , 等 . . Abstractions for network update . . 2012 . . Proc. ACM SIGCOMM Conf. on Applications, Technologies, Architectures, and Protocals for Computer Communication . . 323 - - 334 . . DOI: 10.1145/2342356.2342427 http://doi.org/10.1145/2342356.2342427 . .

Ryu SDN Framework Community The Ryu Controller , , 2014 . . Available from: http://osrg.github.io/ryu/ http://osrg.github.io/ryu/ . .

S Shin , , , V Yegneswaran , , , P Porras , , , 等 . . AVANTGUARD: scalable and vigilant switch flow management in software-defined networks . . 2013 . . Proc. ACM SIGSAC Conf. on Computer & Communications Security . . 413 - - 424 . . DOI: 10.1145/2508859.2516684 http://doi.org/10.1145/2508859.2516684 . .

I Stoica , , , R Morris , , , D Karger , , , 等 . . Chord: a scalable peer-to-peer lookup service for Internet applications . . ACM SIGCOMM Comput. Commun. Rev. , , 2001 . . 31 ( ( 4 ): ): 149 - - 160 . . DOI: 10.1145/964723.383071 http://doi.org/10.1145/964723.383071 . .

A Tootoonchian , , , Y Ganjali . . HyperFlow: a distributed control plane for OpenFlow . . 2010 . . Proc. Internet Network Management Conf. on Research on Enterprise Networking . . 1 - - 6 . . . .

SH Yeganeh , , , Y Ganjali . . Kandoo: a framework for efficient and scalable offloading of control applications . . 2012 . . Proc. 1st Workshop on Hot Topics in Software Defined Networks . . 19 - - 24 . . DOI: 10.1145/2342441.2342446 http://doi.org/10.1145/2342441.2342446 . .

Views

Downloads

CSCD

Alert me when the article has been cited

Submit

Tools

Publicity Resources

Novel architectures and security solutions of programmable software-defined networking: a comprehensive survey

Stochastic stability analysis of networked control systems with random cryptographic protection under random zero-measurement attacks

A video conferencing system based on SDN-enabled SVC multicast

An efficient and coordinated mapping algorithm in virtualized SDN networks

AKself-adaptive SDN controller placement for wide area networks#

Related Author

Shen WANG

Jun WU

Wu YANG

Long-hua GUO

Dong-qin FENG

Meng-zhou GAO

Jian YANG

Zhen YAO

Related Institution

Research Center for Modern Governance, Zhejiang University of Science and Technology

School of Electronic Information and Electrical Engineering, Shanghai Jiao Tong University

Information Security Research Center, Harbin Engineering University

Huawei Technologies Co., Ltd.

School of Cyberspace, Hangzhou Dianzi University

Chat

Address：Zhejiang University Press, 148 Tianmushan Road, Hangzhou, China Postal code：310028
Tel：+86-571-88273162 Email：fitee@zju.edu.cn
It is recommended to read the content of this site in Chrome&IE9+. Please switch to extreme mode in browser 360.
Cookies We use cookies to help provide and enhance our service and tailor content. By continuing, you agree to the use of cookies.

⁰