{"title":"Don't call them middleboxes, call them middlepipes","authors":"H. Jamjoom, Dan Williams, Upendra Sharma","doi":"10.1145/2620728.2620760","DOIUrl":"https://doi.org/10.1145/2620728.2620760","url":null,"abstract":"As interest grows in introducing network functions---middleboxes---to Platform as a Service (PaaS) clouds, it is tempting to treat them as normal PaaS services. However, the PaaS service abstraction lacks sufficient support for middlebox services. For example, network functions may require proximity to data sources for efficient snooping or request rewriting, or access to raw packets rather than application-level requests. Instead, we propose a new network function abstraction to PaaS clouds called middlepipes. True to PaaS philosophy, middlepipes are sufficiently high level for application developers to forget about details like packets vs. requests and data source proximity. Middlepipes can be chained together to cooperatively interpose on traffic between applications and services. Furthermore, they can generate callbacks into applications; in this paper, we describe the middlepipe PaaS architecture in the context of a \"circuit breaker\" network function.","PeriodicalId":309136,"journal":{"name":"Proceedings of the third workshop on Hot topics in software defined networking","volume":"50 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115499406","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Tolerating SDN application failures with LegoSDN","authors":"B. Chandrasekaran, Theophilus A. Benson","doi":"10.1145/2620728.2620781","DOIUrl":"https://doi.org/10.1145/2620728.2620781","url":null,"abstract":"Despite Software Defined Network’s(SDN) provenbenefits, there remains significant reluctance in adopting it. Among the issues that hamper SDN’s adoption two stand out: reliability and fault tolerance. At the heart of these issues is a set of fate-sharing relationships: The first between the SDN-Apps and controllers, where-in the crash of the former induces a crash of the latter, and thereby affecting availability; and, the second between the SDN-App and the network, where-in a byzantine failure e.g., black-holes and networkloops, induces a failure in the network, and thereby affecting network availability. The principal position of this paper is that availability is of utmost concern – second only to security. To this end, we present a re-design of the controller architecture centering around a set of abstractions to eliminate these fate-sharing relationships, and make the controllers and network resilient to SDN-App failures. We illustrate how these abstractions can be used to improve the reliability of an SDN environment, thus eliminating one of the barriers to SDN’s adoption.","PeriodicalId":309136,"journal":{"name":"Proceedings of the third workshop on Hot topics in software defined networking","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124402774","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Josh Bailey, D. Pemberton, A. Linton, C. Pelsser, R. Bush
{"title":"Enforcing RPKI-based routing policy on the data plane at an internet exchange","authors":"Josh Bailey, D. Pemberton, A. Linton, C. Pelsser, R. Bush","doi":"10.1145/2620728.2620769","DOIUrl":"https://doi.org/10.1145/2620728.2620769","url":null,"abstract":"Over a decade of work has gone into securing the BGP routing control plane. Through all this, there has been an oft repeated refrain, \"It is acknowledged that rigorous control plane verification does not in any way guarantee that packets follow the control plane.\" We describe what may be the first deployment of data plane enforcement of RPKI-based control plane validation. OpenFlow switches providing an exchange fabric and controlled by a Quagga BGP route server drop traffic for prefixes which have invalid origins without requiring any RPKI support by connected BGP peers.","PeriodicalId":309136,"journal":{"name":"Proceedings of the third workshop on Hot topics in software defined networking","volume":"120 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127287952","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Using MAC addresses as efficient routing labels in data centers","authors":"Arne Schwabe, H. Karl","doi":"10.1145/2620728.2620730","DOIUrl":"https://doi.org/10.1145/2620728.2620730","url":null,"abstract":"A number of new technologies such as cloud services and/or virtualization have changed data center networks in the last few years. The benefits of the techniques are clear but the downside is that more forwarding entries are needed in network switches to support these techniques. Unfortunately, the number of forwarding entries in switches have a hard limit. We give a formal problem definition for minimizing the number of forwarding entries and a proof that the problem is NP complete. We show that the destination MAC address can be used as a universal label in software-defined networks and the ARP caches of hosts can exploited as an ingress label table, reducing the size of the forwarding tables of network devices. We have the additional advantage of not requiring a special type of data center network or additional hardware capabilities. We demonstrate that our technique can solve the problem of FIB sizes by introducing a greedy scheme for all pairs ECMP with a minimal number of FIB entries.","PeriodicalId":309136,"journal":{"name":"Proceedings of the third workshop on Hot topics in software defined networking","volume":"241 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132126536","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Bill McCormick, F. Kelly, Patrice Plante, P. Gunning, P. Ashwood-Smith
{"title":"Real time alpha-fairness based traffic engineering","authors":"Bill McCormick, F. Kelly, Patrice Plante, P. Gunning, P. Ashwood-Smith","doi":"10.1145/2620728.2620762","DOIUrl":"https://doi.org/10.1145/2620728.2620762","url":null,"abstract":"SDN traffic engineering is used to assign bandwidth to flows. Classic traffic engineering algorithms are well understood however implementations of these algorithms typically take seconds or even minutes to execute. These long execution times force traffic engineering to be used as an off-line tool. We demonstrate a traffic engineering algorithm equivalent to these classic algorithms that executes in millisecond times, allowing traffic engineering to be used as an on-line tool -- much as shortest path computations are used in today's routers.","PeriodicalId":309136,"journal":{"name":"Proceedings of the third workshop on Hot topics in software defined networking","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132395819","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Optimizing rules placement in OpenFlow networks: trading routing for better efficiency","authors":"X. Nguyen, D. Saucez, C. Barakat, T. Turletti","doi":"10.1145/2620728.2620753","DOIUrl":"https://doi.org/10.1145/2620728.2620753","url":null,"abstract":"The idea behind Software Defined Networking (SDN) is to conceive the network as one programmable entity rather than a set of devices to manually configure, and OpenFlow meets this objective. In OpenFlow, a centralized programmable controller installs rules onto switches to implement policies. However, this flexibility comes at the expense of extra overhead as the number of rules might exceed the memory capacity of switches, which raises the question of how to place most profitable rules on board. Solutions proposed so far strictly impose paths to be followed inside the network. We advocate instead that we can trade routing requirements within the network to concentrate on where to forward traffic, not how to do it. As an illustration of the concept, we propose an optimization problem that gets the maximum amount of traffic delivered according to policies and the actual dimensioning of the network. The traffic that cannot be accommodated is forwarded to the controller that has the capacity to process it further. We also demonstrate that our approach permits a better utilization of scarce resources in the network.","PeriodicalId":309136,"journal":{"name":"Proceedings of the third workshop on Hot topics in software defined networking","volume":"62 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130666716","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Xitao Wen, Chunxiao Diao, Xun Zhao, Yan Chen, Erran L. Li, Bo Yang, Kai Bu
{"title":"Compiling minimum incremental update for modular SDN languages","authors":"Xitao Wen, Chunxiao Diao, Xun Zhao, Yan Chen, Erran L. Li, Bo Yang, Kai Bu","doi":"10.1145/2620728.2620733","DOIUrl":"https://doi.org/10.1145/2620728.2620733","url":null,"abstract":"Measurement results show that updating rules on switches poses major latency overhead during the course of the policy update. However, current SDN policy compilers do not handle policy updates well and generate large amount of redundant rule updates, most of which modify only the priority field. Our analysis shows that the lack of knowledge on the rule dependency and the consecutively distributed priority numbers are the fundamental problems behind the redundancy. In this paper, we propose to tackle the problems through 1) an extended policy compiler that builds rule dependency along with the compilation, and 2) an online optimization algorithm that maintains a scattered priority distribution. Our preliminary evaluation demonstrates that our proposed patch can eliminate nearly all the priority updates.","PeriodicalId":309136,"journal":{"name":"Proceedings of the third workshop on Hot topics in software defined networking","volume":"26 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126427740","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Towards a novel and optimal packet identifier design for SDN","authors":"Michael O'Neill, Andrew Wells, Xin Sun","doi":"10.1145/2620728.2620775","DOIUrl":"https://doi.org/10.1145/2620728.2620775","url":null,"abstract":"We argue that separate identifiers should be used in SDN for identifying users, packets for forwarding purpose, and packets for policy enforcement purpose. We discuss the requirements and challenges in designing such an identifier scheme and sketch its various components. We show that our design can minimize switch table sizes by enabling optimized aggregation, make table sizes stable and predictable, and honor legacy address assignment in existing networks.","PeriodicalId":309136,"journal":{"name":"Proceedings of the third workshop on Hot topics in software defined networking","volume":"14 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"134088677","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Fleet: defending SDNs from malicious administrators","authors":"S. Matsumoto, Samuel Hitz, A. Perrig","doi":"10.1145/2620728.2620750","DOIUrl":"https://doi.org/10.1145/2620728.2620750","url":null,"abstract":"We present the malicious administrator problem, in which one or more network administrators attempt to damage routing, forwarding, or network availability by misconfiguring controllers. While this threat vector has been acknowledged in previous work, most solutions have focused on enforcing specific policies for forwarding rules. We present a definition of this problem and a controller design called Fleet that makes a first step towards addressing this problem. We present two protocols that can be used with the Fleet controller, and argue that its lower layer deployed on top of switches eliminates many problems of using multiple controllers in SDNs. We then present a prototype simulation and show that as long as a majority of non-malicious administrators exists, we can usually recover from link failures within several seconds (a time dominated by failure detection speed and inter-administrator latency).","PeriodicalId":309136,"journal":{"name":"Proceedings of the third workshop on Hot topics in software defined networking","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"115497506","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Pratyaastha: an efficient elastic distributed SDN control plane","authors":"Anand Krishnamurthy, Shoban Preeth Chandrabose, Aaron Gember","doi":"10.1145/2620728.2620748","DOIUrl":"https://doi.org/10.1145/2620728.2620748","url":null,"abstract":"Several distributed SDN controller architectures have been proposed to mitigate the risks of overload and failure. However, since they statically assign switches to controller instances and store state in distributed data stores (which doubles flow setup latency), they hinder operators' ability to minimize both flow setup latency and controller resource consumption. To address this, we propose a novel approach for assigning SDN switches and partitions of SDN application state to distributed controller instances. We present a new way to partition SDN application state that considers the dependencies between application state and SDN switches. We then formally model the assignment problem as a variant of multi-dimensional bin packing and propose a practical heuristic to solve the problem with strict time constraints. Our preliminary evaluations show that our approach yields a 44% decrease in flow setup latency and a 42% reduction in controller operating costs.","PeriodicalId":309136,"journal":{"name":"Proceedings of the third workshop on Hot topics in software defined networking","volume":"2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2014-08-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127150595","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}