Scalability and Resilience in SDN: an overview. Nicola Rustignoli

Transcription

1 Scalability and Resilience in SDN: an overview Nicola Rustignoli Nicola Rustignoli

2 Software-Defined networking CONTROL LAYER SWITCH FORWARDING LAYER Graphs source:[1] van Asten, Benjamin J., Niels LM van Adrichem, and Fernando A. Kuipers. "Scalability and resilience of software-defined networking: An overview." arxiv preprint arxiv: (2014). Nicola Rustignoli

3 How does Software-Defined networking perform in datacentre networks? Source:[2] Singh, Arjun, et al. "Jupiter Rising: A Decade of Clos Topologies and Centralized Control in Google's Datacenter Network." Proceedings of the 2015 ACM Conference on Special Interest Group on Data Communication. ACM, Nicola Rustignoli

4 What about carrier-grade networks? End to end applications require a delay <50ms 50ms What can go wrong? Nicola Rustignoli

5 Many things can go wrong! Controller is too busy to manage new flows Controller fails A link fails Your network is under attack Nicola Rustignoli

6 Scalability One single controller is unable to handle requests for very large (or busy) networks How to scale? A. Distributed controllers: can handle more flows B. Hierarchical controllers: only most relevant flows are managed by central control, while others are taken care by other entities Nicola Rustignoli

7 A: Distributed controllers (1): HyperFlow [4] Controllers are brought close to switches Each area of network is managed by one single controller Controllers have a global view of network. This comes with high synchronization overhead Nicola Rustignoli

8 A: Distributed controllers (1): HyperFlow [4] GLOBAL LAYER Event-based CONTROL LAYER Push-subscribe system slow SWITCH FORWARDING LAYER Nicola Rustignoli

9 A: Distributed controllers (2): ONIX [5] Switches are dynamically assigned to controller instances according to load Topology and link monitoring are offloaded to a dedicated control platform Network Information is distributed across instances thanks to an high performance system (SQL+DHT). Nicola Rustignoli

10 A: Distributed controllers (2): ONIX [5] GLOBAL LAYER Global optimal routing CONTROL LAYER Area control Nicola Rustignoli

11 A: Distributed controllers (3), virtualized network: FlowVisor[3] A transparent virtualization layer is introduced between switch and multiple OpenFlow controllers The virtualization layer offers slices of network to each controller Provides multi-tenancy, isolation, resilience Nicola Rustignoli

12 A: Distributed controllers (3), virtualized network: FlowVisor[3] CONTROL LAYER VIRTUALIZATION LAYER This layer adds significant delay in flow setup SWITCH LAYER Nicola Rustignoli

13 B: Hierarchical controllers. Managing relevant flows and congestion Only elephant flows need management by central controller Small flows are handled at switch layer or by local controllers Goal: route (heavy) traffic on least congested paths Nicola Rustignoli

14 B: Hierarchical controllers (1): DevoFlow [6] CONTROL LAYER SWITCH LAYER Modified for small flow handling Hard to deploy in existing networks Nicola Rustignoli

15 B: Hierarchical controllers (2): Kandoo[7] GLOBAL CONTROL LAYER LOCAL CONTROL LAYER Switch-local controller performance is limiting factor SWITCH LAYER Nicola Rustignoli

16 Conclusion: scalability Workload can be effectively divided Optimal flow management is important for bigger flows A compromise between performance, reliability and complexity has to be made while scaling up to large networks Nicola Rustignoli

17 Break! Nicola Rustignoli

18 Resilience Ability to quickly respond to: 1. Controller failure 2. Link failure, path failure (including case of in-band networks) 3. Attacks on network Nicola Rustignoli

19 Controller replication (Fonseca et al. [8]) Backup controllers are kept in sync, before flows are installed to switches (adding latency in flow setup) Recovery might fail in case of network partitioning Recovery takes too long (900ms) Nicola Rustignoli

20 Reactive link failure recovery (Controller-based) Sharma et al [9], Van Andrichem et al [11]. Restoration a. Use a spanning tree algorithm to remove possible loops in topology [9] b. Learn topology using LLDP[9] (Link Layer Discovery Protocol) or LoS [11] (Loss of Signal failure detection in OpenFlow). Upon failure, inform controller that takes consistent routing decisions Protection a. Controller is manually configured with fixed alternative paths [9] Nicola Rustignoli

21 Reactive link failure recovery [9] [11] (Controller-based) Restoration Dynamic, need link discovery mechanisms with their overhead, slow response (>100ms) Protection Quite fast response (120ms), no overhead traffic, manual configuration, inflexible Nicola Rustignoli

22 Path/Link-based protection (Switch-based) Sharma et al [10], Van Andrichem et al[11] 1:1 Protection: use backup paths preconfigured in switches, using OpenFlow group tables. BFD* used for failure detection. a) Path based[10]: number of monitored paths grows quadratically with number of nodes b) Link based [11]: per-link BFD guarantees fastest detection time (3.3ms recovery). Linear complexity. *BFD=Bidirectional Forwarding Detection. Group tables are aware of BFD. Nicola Rustignoli

23 Network security Switch-controller connection is not secure in all controller implementations In order to respond to attacks on your network, you should: 1. Detect malicious flows (i.e. flow statistics?...) 2. Modify flow rules 3. Check that new rules comply with security policy Nicola Rustignoli

24 Conclusions: resilience No presented scheme offers controller failure resiliency that satisfies the 50ms requirement of carrier networks Paths can be recovered in less than 50ms Detecting malicious flows remains a challenge Nicola Rustignoli

25 Thank you! Questions? Nicola Rustignoli Nicola Rustignoli

26 References 1. Benjamin J. van Asten, Niels L. M. van Adrichem and Fernando A. Kuipers Scalability and Resilience of Software-Defined Networking: An Overview. In Proceedings of CoRR. Vol. abs/ Singh, Arjun, et al. "Jupiter Rising: A Decade of Clos Topologies and Centralized Control in Google's Datacenter Network." Proceedings of the 2015 ACM Conference on Special Interest Group on Data Communication. ACM, Rob Sherwood, Glen Gibb, Kok-Kiong Yap, Guido Appenzeller, Martin Casado, Nick McKeown, Guru Parulkar FlowVisor: A Network Virtualization Layer. 4. Tootoonchian, Amin, and Yashar Ganjali. "HyperFlow: A distributed control plane for OpenFlow." Proceedings of the 2010 internet network management conference on Research on enterprise networking Koponen, Teemu, et al. "Onix: A Distributed Control Platform for Large-scale Production Networks." OSDI. Vol Curtis, Andrew R., et al. "DevoFlow: scaling flow management for high-performance networks." ACM SIGCOMM Computer Communication Review. Vol. 41. No. 4. ACM, Hassas Yeganeh, Soheil, and Yashar Ganjali. "Kandoo: a framework for efficient and scalable offloading of control applications." Proceedings of the first workshop on Hot topics in software defined networks. ACM, Nicola Rustignoli

27 References 8. Fonseca, Paulo, et al. "A replication component for resilient OpenFlow-based networking." Network Operations and Management Symposium (NOMS), 2012 IEEE. IEEE, Sharma, Sachin, et al. "Enabling fast failure recovery in OpenFlow networks." Design of Reliable Communication Networks (DRCN), th International Workshop on the. IEEE, Sharma, Sachin, et al. "OpenFlow: Meeting carrier-grade recovery requirements." Computer Communications 36.6 (2013): van Adrichem, Niels LM, Benjamin J. Van Asten, and Fernando A. Kuipers. "Fast recovery in software-defined networks." Software Defined Networks (EWSDN), 2014 Third European Workshop on. IEEE, Nicola Rustignoli