學術出版;;Publications

Permanent URI for this communityhdl:11536/1

收集所有交通大學研究人員與學生個人或團體所發表之各項學術著作，涵蓋期刊論文、教師專書、學位論文等項。;;Collections of Publications of NCTU Researchers and Students Like Journal Papers and Thesis.

Browse

🏛️國立陽明交通大學機構典藏

Search Results

Now showing 1 - 10 of 23

MToS: Multi-Tenant Network over Software Defined Networking
(2019-01-01)
Jia, Wen-Kang
;
Chen, Yaw-Chung
;
Lin, Johanes
;
資訊工程學系
;
Department of Computer Science
MToS, a multi-tenant network service is designed and implemented under Software-Defined Network (SDN) environment. One of the solutions to establish multi-tenant network in non-SDN environment is Multi-Protocol Label Switching Virtual Private Network that involves numerous and complicated protocols to be configured prior to the establishment of multi-tenant network. With SDN, it opens new opportunities to create multi-tenant networks that are less complicated, more automated, and lower implementation cost via SDN commodity devices. MToS categorizes OpenFlow switches into three hierarchies, where matching fields and actions in flow entries are different depending on the switch hierarchy. Therefore, traffic forwarding can be scalable. MToS provides tenant isolation through dedicate flow table associated with each tenant, and tenant MAC address as the identifier which is used in flow table redirection and packet header modification. Traffic forwarding between Edge switches is achieved through Edge MAC address as the identifier which is used in packet header modification, and Edge switch serves as ARP Proxy for tenant end hosts. Comparing to MPLS VPN, MToS only requires essential information about tenants to construct a multi-tenant network. By taking advantage of SDN centralized global network information, MToS adds automations of IP address management and shortest path routes calculation. MToS is developed based upon OpenFlow version 1.3, and implemented in Python and runs on top of Ryu SDN framework.
Mitigating DoS Attacks against SDN Controller Using Information Hiding
(2019-01-01)
Abdullaziz, Osamah Ibrahiem
;
Wang, Li-Chun
;
電機工程學系
;
Department of Electrical and Computer Engineering
Because of SDN centralization nature, denial of service (DoS) attacks have become a prominent concern. In the OpenFlow (OF) protocol, the transport layer security (TLS) protocol is recommended to secure the control channel. Unfortunately, the tasks involved in the proper configuration of a secured TLS are very challenging. Even worse, TLS is made an optional mode of communication in OF. As a consequence, some OF-enabled switches and controllers do not adopt TLS. In this paper, we develop a lightweight authentication mechanism, called Hidden Authentication (HiAuth), to protect SDN controller against DoS attacks. HiAuth legitimizes SDN forwarding devices by hiding authentication information into the header of control channel packets. Our experimental results prove that HiAuth is lightweight and can not only mitigate DoS attacks, but also provide high undetectability to the attacker.
Generic Validation Criteria and Methodologies for SDN Applications
(2019-12-01)
Lin, Ying-Dar
;
Lai, Yu-Kuen
;
Tsou, Yung-Liang
;
Lai, Yuan-Cheng
;
Liou, En-Cheng
Programmable control plane in software-defined networking (SDN), plays an essential role in the SDN architecture. The network function provided by the specialized hardware in a legacy network can be created in the form of software-based "SDN application" running on the controllers to manipulate entire network configurations. Therefore, the risk of having software bugs and errors in the SDN applications may threaten the normal operations of SDN networks. This paper presents systematic validation criteria and test cases based on the proposed novel methodologies for SDN application testing. The test framework can perform testbed build-up, generate desired packet sequences, and analyze results automatically. According to the results of a generic test suite, several issues are unveiled in the application under test (AUT). Some AUTs, which need to check all the incoming packets from Open-Flow switches, fail to meet the test criteria of burst packet-in and flow self-recycling. For most of the applications based on the Ryu controller, the evaluation results reveal that some are unable to recycle flow entries after they are unloaded. It is recommended that all flows populated by SDN applications must have timeout value specified to prevent unnecessary entries kept in the flow table.
Circuit-based logical layer 2 bridging in software-defined data center networking
(1970-01-01)
Wang, Yao-Chun
;
Lin, Ying-Dar
;
資訊工程學系
;
Department of Computer Science
With the expansion of the size of data centers, software-defined networking (SDN) is becoming a trend for simplifying the data center network management with central and flexible flow control. To achieve L2 abstractions in a multitenant cloud, Open vSwitch (OVS) is commonly used to build overlay tunnels (eg, Virtual eXtensible Local Area Network [VXLAN]) on top of existing underlying networks. However, the poor VXLAN performance of OVS is of huge concern. Instead of solving the performance issues of OVS, in this paper, we proposed a circuit-based logical layer 2 bridging mechanism (CBL2), which builds label-switched circuits and performs data-plane multicasting in a software-defined leaf-spine fabric to achieve scalable L2 without overlay tunneling. Our evaluations indicate that direct transmission in OVS improves throughput performance by 58% compared with VXLAN tunneling, and data-plane multicasting for ARP reduces address resolution latency from 149 to 0.5 ms, compared with control-plane broadcast forwarding. The evaluation results also show that CBL2 provides 0.6, 0.4, and 11-ms protection switching time, respectively, in the presence of switch failure, link failure, and port shutdown in practical deployment.
Fast Failover with Hierarchical Disjoint Paths in SDN
(2018-01-01)
Liao, Young-Zhe
;
Tsai, Shi-Chun
;
交大名義發表
;
National Chiao Tung University
When a link failure occurs in Software Defined Networking, a typical response is from controller's intervention once the Link Failure Event is triggered. Then the controller usually recalculates the possible alternative route and sets new flow rules on the affected SDN switches. However, the latency could lead to packet drop, if the route is not restored in time. Here, we propose a new method that utilizes the fast failover mechanism of group table to simulate distributed depth-firstsearch (DFS) with SDN switches without the intervention of controller after the related rules are installed. Based on Menger's Theorem, we can find a set of disjoint backup routes, if the topology possesses enough connectivity. With the backup routes, the controller can set up fast failover group tables with buckets watching the links appearing in the backup routes. We can properly arrange the order of the buckets in each switch, such that the switches together can simulate depth-first search for a backup route. According to our experiments, our method significantly reduces the communication between the SDN switch and the controller.
HiAuth: Hidden Authentication for Protecting Software Defined Networks
(2019-06-01)
Abdullaziz, Osamah Ibrahiem
;
Wang, Li-Chun
;
Chen, Yu-Jia
;
電機工程學系
;
Department of Electrical and Computer Engineering
Software defined networking (SDN) enables network function programmability for ease of configuration and maintenance, and also allows network administrators to change traffic rules on the fly. However, denial of service (DoS) attacks pose security challenges on the centralized control plane of SDN. Although the transport layer security (TLS) can help secure the control plane, it is computationally intensive, complex to configure, and not mandatory in OpenFlow protocol. In this paper, we present a lightweight authentication solution, called hidden authentication (HiAuth), to protect the SDN controller by hiding the identities of the forwarding devices into the control packets via efficient bitwise operations. HiAuth is the first to incorporate information hiding techniques into OpenFlow to provide security against DoS attacks. HiAuth exploits the IP identification field of IPv4 and the transaction identification field of OpenFlow in two authentication schemes. The experimental results show that HiAuth can effectively mitigate intruder DoS attacks and provide high undetectability to attackers.
Heterogeneous Flow Table Integration for Capacity Enhancement in Software-Defined Networks
(2018-01-01)
Hung, Chi-Hsiang
;
Wang, Jheng-Jyun
;
Wang, Li-Chun
;
Wang, Kuo-Chen
;
Lee, Chain-Wu
Commercial OpenFlow-enabled legacy switches implement flow tables with Ternary Content Addressable Memory (TCAM) to perform high speed flow matching process. However, the size of TCAM-based flow table is restricted to few thousands of entries due to manufacturing cost and high power consumption. In this paper, we propose the Flow Entry Agent which can integrate heterogeneous flow tables, such as ASIC-side MAC/IP/ACL tables and CPU-side SRAM-based tables to increase the storage capacity without modifying ASIC. Besides, the Agent will compress the CPU-side tables and perform flow matching process with these tables. Simulation results show that our Agent can not only increase the capacity of flow table to 11.38x to 65.24x but also reduce 80.99% to 87.36% of Packet_In messages with additional 1 MB CPU-side SRAM.
Two-tier dynamic load balancing in SDN-enabled Wi-Fi networks
(2018-11-01)
Lin, Ying-Dar
;
Wang, Chih Chiang
;
Lu, Yi-Jen
;
Lai, Yuan-Cheng
;
Yang, Hsi-Chang
This work proposes a Software Defined Networking (SDN) solution to address Wi-Fi congestion due to an unevenly distributed load among access points (APs). The conventional methods generally let client stations learn of APs' load status and select APs distributively. However, such a client-driven approach lacks a global view to make precise load balancing decisions and may result in repeated changes in client-AP association. Although several studies proposed more efficient network-controlled methods to carry out Wi-Fi load balancing, some of them are distributed methods incurring excessive message exchange among customized APs, while the rest centralized methods are found to burden the central controller with unnecessary AP association decisions. In contrast, our solution adopts standardized OpenFlow protocol and SDN controller technology to Wi-Fi networks, organizing the SDN controller and the APs into a two-tier architecture so that the controller can evaluate the degree of load balancing among the APs and decide up to which load level the APs can accept association requests without consulting the controller. From our experiment results, our solution improves Wi-Fi's load balancing degree by 34-41%, and yields an improvement of 28-36% in Wi-Fi's re-association time over generic centralized load balancing methods with positive control.
SDN-based dynamic multipath forwarding for inter-data center networking
(2019-01-10)
Wang, Yao-Chun
;
Lin, Ying-Dar
;
Chang, Guey-Yun
;
資訊工程學系
;
Department of Computer Science
Equal-cost multipath (ECMP)-based traffic engineering (TE) methods are commonly used in intra-data center (DC) networks to improve the transmission performance for east-west traffic (ie, traffic from server to server within a DC). However, applying ECMP on inter-DC wide area network (WAN) offers limited performance enhancement as a result of irregular network topology. Since TE can be intelligently and efficiently realized with software-defined networking (SDN), SDN-based multipath becomes a popular option. However, SDN suffers from scalability issue caused by limited ternary content-addressable memory (TCAM) size. In this paper, we propose an SDN-based TE method called dynamic flow-entry-saving multipath (DFSM) for inter-DC traffic forwarding. DFSM adopts source-destination-based multipath forwarding and latency-aware traffic splitting to reduce the consumption of flow entries and achieve load balancing. The evaluation results indicate that DFSM saves 15% to 30% of system flow entries in practical topologies and reduces the standard deviation of path latencies from 10% to 7% than do label-switched tunneling, and also reduces average latency by 10% to 48% by consuming 6% to 20% more flow entries than do ECMP in less-interconnected topologies. Note that the performance gain may not always be proportional to flow entry investment, with the interconnectivity between nodes being an important factor. The evaluation also indicates that per-flow provision consumes several times the flow entries consumed by DFSM but reduces latency by 10% at most. Besides, DFSM reduces the standard deviation of path latencies from 14% to 7% than do even traffic splitting.
High-Efficiency Matching Mechanism for Off-Chip Tables in OpenFlow-enabled Legacy Switch
(2017-01-01)
Wang, Jheng-Jyun
;
Hung, Chi-Hsiang
;
Wang, Li-Chun
;
Wang, Kuo-Chen
;
Lee, Chain-Wu
Commercial OpenFlow-enabled legacy switches implement flow tables with Ternary Content Addressable Memory (TCAM) to perform high-speed flow matching process. However, the size of TCAM-based flow table is restricted to few thousands of entries due to manufacturing cost and high power consumption. In our previous research, we proposed Flow Entry Agent to integrate Off-Chip tables to increase the storage capacity without modifying Application Specific Integrated Circuit (ASIC). In this paper, we propose an efficient matching mechanism for Off-Chip tables. Simulation results show that our mechanism significantly increase the efficiency of flow matching process.

學術出版;;Publications

Browse

Filters

Settings

Sort By

Results per page

🏛️國立陽明交通大學機構典藏

Search Results