Enforcing Optimal ACL Policies Using K-Partite Graph in Hybrid SDN

Abstract

Software Defined Networking (SDN) as an innovative network paradigm that separates the management and control planes from the data plane of forwarding devices by implementing both the management and control planes at a logically centralized entity, called controller. Therefore, it ensures simple network management and control. However, due to several reasons (e.g., deployment cost, fear of downtime) organizations are very reluctant to adopt SDN in practice. Therefore, a viable solution is to replace the legacy devices by SDN devices incrementally. This results in a new network architecture called hybrid SDN. In hybrid SDN, both SDN and legacy devices operate in such a way to achieve the maximum benefit of SDN. The legacy devices are running a traditional protocol and SDN devices are operating using Open-flow protocols. Network policies play an essential role to secure the entire network from several types of attacks like unauthorized access and port/protocol control. In a hybrid SDN, policy implementation is a tedious task that requires extreme care and attention due to the hybrid nature of network traffic. Network policies may be implemented at various positions in hybrid SDN, e.g., near the destination or source node, and at the egress or ingress ports of a router. Each of these schemes has some trade-offs. For example, if policies are implemented near the source nodes then each packet generated from the source must pass through the filter and, thus, requires more processing power, time, resources, etc. Similarly, if policies are installed near the destination nodes, then a lot of unwanted traffic generated causing network congestion. This is an NP-hard problem. To address these challenges, we propose a systematic design approach to implement network policies optimally by using decision tree and K-partite graph. By traversing all the policies, we built up the decision tree that identifies which source nodes can communicate with which destination. Then, we traverse the decision tree and constructs K-partite graph to find possible places (interfaces of the routers) where ACL policies are to be implemented based on the different criteria (i.e., the minimum number of ACL rules and the minimum number of transmissions for unwanted traffic). The edge weight represents the cost per criteria. Then, we traverse the K-partite graph to find the optimal place for ACL rules implementation according to the given criteria. The simulation results indicate that the proposed technique outperforms existing approaches in terms of computation time, traffic optimization and successful packet delivery, etc. The results also indicate that the proposed method improves network performance and efficiency by decreasing network congestion and providing ease of policy implementation.

Achieving Near-Optimal Traffic Engineering Using a Distributed Algorithm in Hybrid SDN

“…With respect to the highly dynamic traffic situations, the algorithm should react fast to such changes and the resulting routes should be adjusted to the newly calculated SDN waypoints. A feasible way is to implement ACL policies to avoid the conflicting of the original and updated flow rules in the forwarding devices [23]. We leave these problems to our future work.…”

“…Unfortunately, since it can only reroute the path directly connected to a SDN node, not all network paths can be enforced by Telekinesis. Amin et al [23] propose a systematic design approach to implement ACL policies in hybrid SDN. The decision tree and k-partite graph are utilized to find the optimal place for ACL rules enforcement, whereby the number of ACL policies and unwanted traffic are minimized.…”

“…The decision tree and k-partite graph are utilized to find the optimal place for ACL rules enforcement, whereby the number of ACL policies and unwanted traffic are minimized. Since the work in this paper focuses on flow manageability by rerouting each flow originating from legacy node through an elaborately calculated SDN waypoint, the approach proposed in [23] can be used as an available method to fulfill the flow redirection operation. Poularakis et al [2] maximize the amount of programmable traffic similar to [20]- [22] to increase the TE flexibility.…”

“…With respect to the specific method to fulfill the waypoint enforcement, Panopticon [20], Fibbing [21], Telekinesis [22] and ACL policies implementation approach [23] can be the suitable methods in this paper to redirect every flow originating from a legacy node through a well-calculated SDN waypoint.…”

Hybrid SDN evolution: A comprehensive survey of the state-of-the-art

“…They propose a solution based on a graph difference technique to auto-detect the affected interfaces and network policies and to reconfigure the policies based on the new topology state. An evolution of this work is presented in [135], where the authors propose an approach to optimize the implementation of the ACL policies in hSDN networks. The proposed algorithm is based on constructing a K-partite graph to search for the possible placement of the ACL policies.…”