Some Research Results in Software-Defined Networks

Some Research Results in Software-Defined Networks Wen-Tsuen Chen Distinguished Research Fellow, Academia Sinica Sun Yun-suan Chair Professor, National Tsing Hua University

November 4, 2016

Outline     

Software-Defined Networking Reliable Multicast Routing for Software-Defined Networks Multicast Traffic Engineering for Software-Defined Networks Service Chain Platform: Green Service Chain Embedding for NFV in Cloud A Cost-Effective Shuffling-Based Defense against HTTP DDoS Attacks with SDN/NFV

2

Software-Defined Networking (SDN)

Routing in Traditional Networks 

How to deliver packets to another side of a network?

4

Routing in Traditional Networks  

In-band signaling Nodes exchange network conditions

5

Routing in Traditional Networks  



In-band signaling Nodes exchange network conditions Pick up a route with less cost

6

However…  



Lack global view to optimize the routing Less flexibility for traffic engineering Difficult to manage the networks

7

Centralized Solution

SDN separates the control plane and data plane

Policies

Controller

Control plane Data plane

Control plane Data plane

Control plane Data plane

8

OpenFlow Switching

Controller

OpenFlow Switch specification

OpenFlow Switch

PC

sw Secure Channel hw

Flow Table

9

Advantages and challenges of SDN 

Advantages   



Elastic to manage the networks Global view to optimize the routing More flexible for traffic engineering (TE)

Challenges 

How to reduce or off-load the controller overhead? 



Frequent traffic optimization and rule deployment are CPU-intensive

How to effectively utilize the limited TCAM (Ternary contentaddressable memory) entries? 

TCAM overflow may seriously degrade the network performance

10

Reliable Multicast Routing for Software-Defined Networks

Presented in INFOCOM 2015

SDN and Traffic Engineering 





Software Defined Network (SDN) 

SDN controller



SDN forwarding elements (switches)

Current unicast traffic engineering for SDN 

Flexibly route the paths inside the network



Avoid congestion and maximize throughput

Most research on SDN traffic engineering focuses on only unicast

12

Problem of Unicast 

Video live broadcast via unicast connections suffers from high server load and network congestion Keep one connection for each client  high server load

Duplicated traffic  high network load

13

Advantage of Multicast  

Multicast reduces the load of a server to 1/d, and save significant network bandwidth The clients load of with the the same resources Support more server is reduced More clients can be served

The load of the network is reduced 14

Reliable Multicast 

Reliable transmission is desired by most applications  

 

Software Update Video services with Flash and MPEG-DASH

Sender handles recovery  source implosion problem, high recovery cost in networks Hierarchical recovery architecture (in IETF and Cisco routers) Recovery Packets

Acks

Acks

Save BW and latency

Acks

Place a recovery node 15

Multicast with SDN 

Are the solutions suitable for multicast traffic engineering in SDN? 



Shortest-Path Tree (SPT) in Internet (IETF PIM-SM) 

Employ OSPF unicast shortest-path routing



Minimize an end-to-end cost



Difficult to aggregate the traffic in fewer links for reducing the bandwidth consumption

Steiner Tree (ST) in Graph Theory 

Minimum bandwidth consumption (number of links in ST)



Not consider the selection of the recovery nodes



Difficult to facilitate local loss recovery 16

Recover-Aware Steiner Tree (RST)  

Explore reliable multicast routing in SDN Input   



Output  



A network graph G A multicast source s and a set D of destinations A set C of candidate recover nodes in reliable multicast Routing of a multicast tree T to span s and D Selection of a set R of at most r recovery nodes in the tree

Minimize tree cost + α × recovery cost  

α: weighting factor for recovery cost, determined by the SDN-C If heavy loaded, assign larger α to reduce recovery cost 17

Recover-Aware Steiner Tree (RST) 

Tree cost  



Total cost of the edges in T Bandwidth consumption of the tree

Recovery cost 

Total cost of the recovery paths in T 





Recovery path of a recovery node u: the path from its parent recovery node to u

Recovery bandwidth consumption or delay

Trade-off in r (at most r recovery nodes in T) 

Larger r → more recovery nodes → shorter recovery paths → smaller recovery cost, larger protocol overhead 18

Example of RST 

Node s is the source



Nodes v and 7 are recovery nodes



Tree cost c (T ) = 36, recovery cost w (T ) = 39



For node v, source s is the recovery node  cost = 3+8



For node 2, node v is the recovery node  cost = 1+2 s

3 8

9 7

u

2 v 1 1

5

2 w 3

3

6 1

2 2

4

5

19

Related Work 

Traffic engineering in SDN  



Mostly focus on unicast Our recent work – solving scalability in SDN multicast traffic engineering (Globecom 2014 Best Paper Nominated)

Reliable multicast 



Hierarchical recovery architecture to avoid source implosion Mostly focus on protocol design for SPT 



Efficient ACK and NAK suppression, FEC

None of them explores  

Multicast traffic engineering in reliable multicast Routing of a tree + selection of recovery nodes in a tree 20

Main Contributions  

Observe that both SPT and ST are not suitable for reliable multicast in SDN traffic engineering Propose Recover-Aware Steiner Tree (RST) 



Prove that RST is NP-hard and not approximable within d 



Integer Programming (IP) formulation d: number of destinations

Propose d-approximation algorithm RAERA for RST 

RAERA: Recover-Aware Edge Reduction Algorithm 



Tree Routing Phase and Recovery Selection Phase

Achieve the best approximation ratio

21

Hardness Result 

RST is NP-Hard 



Equivalent to ST with α = 0 in (tree cost + α × recovery cost)

RST not approximable with |D|1-ε for every ε＞0  

Gap-introducing reduction from the Set Cover (SC) problem If there existed a |D|1-ε approximation algorithm, it could solve SC problem

22

RAERA – Tree Routing Phase 

Tree Routing Phase     

Starts from the shortest-path tree and iteratively reroute the tree Aggregating the paths from s to more destinations Reroute a destination d to the closest node in the tree Re-routing path needs to include at least one candidate recovery node in C Any end-to-end path cannot exceed the original longest shortest path from s to any d to limit the end-to-end delay

23

RAERA – Recovery Selection Phase 

Recovery Selection Phase  

When the tree is determined, the sub-problem (to select the recovery node) can be solved in polynomial time Dynamic programming (DP) algorithm to select the recovery nodes from T in a bottom-up manner

24

Simulation Setup 

EstiNet network simulator   



A real topology 





Commercial software supporting OpenFlow Packet loss rate: 1% - 10% (ToN’13) Link delay: 10ms – 100ms Biznet with 29 nodes and 33 links Number of destinations: 6 ~ 12

Synthetic topologies   

Generated by Inet (SIGCOMM’02) Number of nodes: 4,000 ~ 10,000 Number of destinations: 100 ~ 500 25

Simulation Setup 

Comparison    



The shortest-path tree algorithm (SPT) The Steiner tree (ST) algorithm The optimal solution by CPLEX (IBM Mixed Integer Linear Programming solver) RAERA

Performance metrics   

Total cost (tree + recovery costs) Total retransmitted bytes Average latency (including retransmission) for each packet 

Important for QoE

26

Real Network 28

ST does not consider recovery cost and results in SPT minimizes the recovery SPTendalsohighest provides to-end52costs, andrecovery it cost higher cost CPLEX results in the highest tree cost RAERA 42 The ST tree cost provided by RAERA SPT 32 is similar to optimized solution

CPLEX

Tree Cost

20

Recovery Cost

RAERA 24

ST SPT

16

12 6

8

10 k

Tree Cost

12

ST 22 minimizes tree REARA also cost, and provides consider recovery 12 the lowest tree cost cost, so 6 8 the cost 10 is k the lowest

12

Recovery Cost

27

Synthetic Networks

Cost (Tree+Recovery)

RAERA 1600

The cost increases with k, because of larger tree for more destinations.

Cost (Tree+Recovery)

2000

ST and SPT work similar with higher The cost slightly cost. decreases with more recovery RAERA 1250 nodes

ST

SPT

1200 800 400 0

1150

ST

SPT

1050 950 850 750

100

200

300 k

400

500

Cost with Different k REARA successfully reduces the cost

15

25

35 r

45

55

Cost with Different r

28

Running Time of RAERA 

HP DL580 server 

Intel Xeon E7-4870 2.4 GHz CPUs and 128GB RAM

When scale is small, the running time is less than 1 second ｜v｜

Running time increases with k k = 100

k = 200

k = 300

k = 400

k = 500

4000

0.7

1.37

2.87

5.29

9.56

6000

1.5

2.23

3.9

6.93

11.48

8000

2.61

3.39

5.09

7.91

12

10000

4.08

4.9

6.6

10.14

13.99

Also increases with |V|

Even in a large scale, the running is still acceptable.

29

Preliminary Implementation Result    

Floodlight + HP Procurve 5406zl Youtube → a video proxy server (multicast source) → 8 multicast destinations with 2 recovery nodes A network with 14 nodes and 23 links A Youtube video with 136 seconds

Algorithm

Total Bandwidth Consumption

Re-buffering

RAERA

13.18 Mbytes

0.4 s

ST

16.39 Mbytes

33.5 s

SPT

17.83 Mbytes

7.8 s 30

Summary  

First work that addresses reliable multicast in SDN Recover-aware Steiner Tree (RST) 



NP-Hard and inapproximable within d.

Algorithm RAERA  

d–approximation algorithm – tightest bound Find a solution in seconds in massive networks

31

Multicast Traffic Engineering for Software-Defined Networks

Presented in INFOCOM 2016

Disadvantage of Unicast 

Video live broadcast via unicast connections suffers from high server load and network congestion Keep one connection for each client  high server load

Duplicated traffic  high network load

33

Advantage of Multicast  

Multicast reduces the load of a server to 1/d, and save significant network bandwidth The clients load of with the the same resources Support more server is reduced More clients can be served

The load of the network is reduced 34

Multicast with SDN 

Are the solutions suitable for multicast traffic engineering in SDN? 



Shortest-Path Tree (SPT) in Internet (IETF PIM-SM) 

Employ OSPF unicast shortest-path routing



Minimize an end-to-end cost (directly connect the source and destinations)



Difficult to aggregate the traffic in fewer links for reducing the bandwidth consumption by sharing more common edges among the paths to different destinations

Steiner Tree (ST) in Graph Theory 

Minimum bandwidth consumption (number of links in ST)



Only focuses on the routing of a single multicast tree, instead of jointly optimizing the routing all trees



Not consider the size of Group Table (in TCAM) of an SDN-FE to store the forwarding entries – scalability problem

35

Multicast Scalability Problem 

Scalability problem for multicast communications is even more serious in the deployment of SDN for a large network.  

The number of possible unicast connections is 𝑂(𝑛2 ) The number of possible multicast groups is 𝑂(2𝑛 ) 



𝑛 is the number of nodes in a network

Multicast scalability problem is more serious than unicast counterpart

36

Branch Forwarding Technique 

Store the multicast forwarding entries (our previous works) 

In only the branch nodes, instead of every node, of a multicast tree 



A branch node in a tree is the node with at least three incident edges

Remedy the multicast scalability problem   

Packets are forwarded in a unicast tunnel from the logic port of a branch node in SDN-FE to another branch node The two terminal nodes of a tunnel are branch nodes Nodes inside the tunnel no longer need to store a multicast forwarding entries

37

Trade-off between the link capacity and node capacity 

When TCAM is full, a branch node is not multicast capable since its forwarding entry cannot be stored  





No longer a terminal node of a tunnel Multiple unicast tunnels will pass through the branch node

Local unicast tunneling incurs more bandwidth consumption since duplicated packets will be delivered in a link. Each branch node can act as 

a branch state node 



with the corresponding multicast forwarding entry stored in TCAM

a branch stateless node 

that exploits the unicast tunneling strategy.

38

The first shortest-path tree

Example

Since 𝑣 has three Branch nodes downstream nodes 𝑑5′ , 𝑑6′ , 𝑑7′ If 𝑣 is assigned as a branch state node

The𝑢 second shortest-path thus needs to exploit tree unicast tunneling to 𝑑6 and 𝑑7 directly.Branch state nodes

𝑣 is not assigned as a branch state node Traffic of the first tree are duplicated in edge 𝑒𝑢,𝑣

Traffic duplication in state nodes Branch 𝑒𝑢,𝑣 would be more serious for the second tree

TCAM size = 1

39

SMTE problem for SDNs 

Scalable Multicast Traffic Engineering (SMTE)    

Finding the routing of all trees Assign the branch state nodes for each tree Minimize the total bandwidth cost of all trees Link capacity constraint 



Node capacity constraint 



Total rate of all multicast trees on each link < = link capacity Number of trees with branch state nodes located in the node 0 The fact can be proved by the reduction from a well-known NP-hard problem, the longest path problem We design a heuristic framework for the problem 

Approximate the optimal solution as much as possible

72

Idea of Framework  

 



In the beginning all servers are assumed to be turned on Relax the problem to a linear programming (LP) The framework solves the LP and turns off the most under-utilized working machine based on the LP solution Repeat the second and third steps until the desired solution appears Finally, it uses a heuristic rounding based on the LP solution to determine the routing path for each flow  

The LP solution may be infeasible Round the solution to an integral solution (feasible solution)

73

Numeric Result 



The total throughput grows as the number of working machines decreases, since the remaining energy for processing increases (*power budget is limited) However, when the number of machines is not enough, the processed flow size decreases Power Consumption (W) 8000

Power Consumption (W)

*power budget =

7000

power consumtion for working machines power consumption for processing

6000 5000

The desired solution is here

4000 3000 2000 1000 0 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 9 8 7 6 5 4 3 2 1

The number of working machines

74

References     

   

 

[1] Energy Logic: Reducing Data Center Energy Consumption by Creating Savings that Cascade Across Systems, white paper from EMERSON Network Power [2] W.Vereecken, W.V. Heddeghem, D. Colle, M. Pickavet and P. Demeester, “Overall ICT Footprint and Green Communication Technologies,” in IEEE ISCCSP, 2010. [3] A. Greenberg, J. Hamilton, D. A. Maltz, P. Patel, “The Cost of a Cloud: Research Problems in Data Center Networks,” in ACM SIGCOMM CCR, 2009 [4] A. Bergen, R. Desmarais, S. Ganti, U. Stege, “Towards software-adaptive green computing based on server power consumption,” In ACM GREENS, 2014. [5] D. Breitgand and A. Epstein, “Improving Consolidation of Virtual Machines with Risk-Aware Bandwidth Oversubscription in Compute Clouds,” in IEEE INFOCOM, 2012 [6] “Near optimal placement of virtual network functions,” in IEEE INFOCOM, 2015 [7] “User Mobility-Aware Virtual Network Function Placement for Virtual 5G Network Infrastructure,” in ICC, 2015 [8] “Service-Aware Network Function Placement for Efficient Traffic Handling in Carrier Cloud,” in WCNC, 2014 [9] “Optimized Network Traffic Engineering using Segment Routing,” in IEEE INFOCOM, 2015 [10] “On the Effect of Forwarding Table Size on SDN Network Utilization”, in IEEE INFOCOM 2014 [11] “Faster and simpler algorithms for multicommodity flow and other fractional packing problems,” SIAM J. Comput., 2007

75

Future Works • Improve the scalability of the platform • Change the SDN controller from Floodlight to OpenDaylight: • Deliver higher scalability and the ability to easily incorporate new applications and protocols

• Application to the Next-Generation Cellular Network Architecture • Seamless Handover in Wi-Fi/Small Cell environment • Our platform is believed to be able to help the handover process by reducing disconnection period.

• DNS poisoning prevention based on moving target defense: • Moving the DNS service before the attacks occur