基于SDN/NFV的Service Chaining关键技术研究

随着数据时代的到来,运营商如何开展数据业务尤其重要。分析了基于SDN的动态Service Chaining的需求、标准进展、应用场景,介绍了当前动态Service Chaining的总体架构、控制面逻辑Service Chaining生成及数据面Service Chaining的转发方案,并对转发方案做了比较和分析。

An SDN/NFV Based Framework for Management and Deployment of Service Based 5G Core Network

The traffic explosion and the rising of diverse requirements lead to many challenges for traditional mobile network architecture on flexibility, scalability, and deployability. To meet new requirements in the 5 G era, service based architecture is introduced into mobile networks. The monolithic network elements(e.g., MME, PGW, etc.) are split into smaller network functions to provide customized services. However, the management and deployment of network functions in service based 5 G core network are still big challenges. In this paper, we propose a novel management architecture for 5 G service based core network based on NFV and SDN. Combined with SDN, NFV and edge computing, the proposed framework can provide distributed and on-demand deployment of network functions, service guaranteed network slicing, flexible orchestration of network functions and optimal workload allocation. Simulations are conducted to show that the proposed framework and algorithm are effective in terms of reducing network operating cost.

SDN Based Next Generation Mobile Network With Service Slicing and Trials

Software-Defined Network （SDN） empowers the evolution of Internet with the OpenFlow, Network Virtualization and Service Slicing strategies. With the fast increasing requirements of Mobile Internet services, the Internet and Mobile Networks go to the convergence. Mobile Networks can also get benefits from the SDN evolution to fulfill the 5th Generation （5G） capacity booming. The article implements SDN into Frameless Network Architecture （FNA） for 5G Mobile Network evolution with proposed Mobile-oriented OpenFlow Protocol （MOFP）. The Control Plane/User Plane （CP/UP） separation and adaptation strategy is proposed to support the User-Centric scenario in FNA. The traditional Base Station is separated with Central Processing Entity （CPE） and Antenna Element （AE） to perform the OpenFlow and Network Virtualization. The AEs are released as new resources for serving users. The mobile-oriented Service Slicing with different Quality of Service （QoS） classification is proposed and Resource Pooling based Virtualized Radio Resource Management （VRRM） is optimized for the Service Slicing strategy with resource-limited feature in Mobile Networks. The capacity gains are provided to show the merits of SDN based FNA. And the MiniNet based Trial Network with Service Slicing is implemented with experimental results.

Service Function Chain Migration in LEO Satellite Networks

With the advancements of software defined network(SDN)and network function virtualization(NFV),service function chain(SFC)placement becomes a crucial enabler for flexible resource scheduling in low earth orbit(LEO)satellite networks.While due to the scarcity of bandwidth resources and dynamic topology of LEO satellites,the static SFC placement schemes may cause performance degradation,resource waste and even service failure.In this paper,we consider migration and establish an online migration model,especially considering the dynamic topology.Given the scarcity of bandwidth resources,the model aims to maximize the total number of accepted SFCs while incurring as little bandwidth cost of SFC transmission and migration as possible.Due to its NP-hardness,we propose a heuristic minimized dynamic SFC migration(MDSM)algorithm that only triggers the migration procedure when new SFCs are rejected.Simulation results demonstrate that MDSM achieves a performance close to the upper bound with lower complexity.

SDN Based Security Services

With the development and revolution of network in recent years,the scale and complexity of network have become big issues.Traditional hardware based network security solution has shown some significant disadvantages in cloud computing based Internet data centers(IDC),such as high cost and lack of flexibility.With the implementation of software defined networking(SDN),network security solution could be more flexible and efficient,such as SDN based firewall service and SDN based DDoS-attack mitigation service.Moreover,combined with cloud computing and SDN technology,network security services could be lighter-weighted,more flexible,and on-demanded.This paper analyzes some typical SDN based network security services,and provide a research on SDN based cloud security service(network security service pool)and its implementation in IDCs.

SDN-Based Broadband Network for Cloud Services

Over-the-top services and cloud services have created great challenges for telecom operators. To better meet the requirements of cloud services, we propose a decoupled network architecture. Software-defined networking/network function virtualization （SDN/ NFV） will be vital in the construction of cloud-oriented broadband infrastructure, especially within data centers and for intercon nection between data centers. We also propose introducing SDN/NFV in the broadband access network in order to realize a virtu- alized residential gateway （VRG）. We discuss the deployment modes of VRG.

Service Parameter Exposure and Dynamic Service Negotiation in SDN Environments

Software-defined networking （SDN） is a generic term and one of the major interests of the telecoms industry （and beyond） over the past two years. However, defining SDN is a somewhat controversial exercise. The claimed flexibility, as well as other presumed assets of SDN, should be carefully investigated. In particular, the use of SDN to dynamically provision network services suggests the introduction of a certain level of automation in the overall network service delivery process, from service parameter negotiation to delivery and operation. This paper aims to clarify the SDN landscape and focuses on two main aspects of the SDN framework： net- work abstraction, and dynamic parameter exposure and negotiation.

Research on Service Function Chain Orchestrating Algorithm Based on SDN and NFV

Software defined network(SDN)and network function virtualization(NFV)have become a new paradigm of a new generation of network architecture.SDN and NFV can effectively improve the flexibility of deploying and managing service function chains(SFCs).By combining SDN and NFV and applying them to the resource orchestration problem of SFC deployment,the three-tier architecture consisting of SDN controller,network function virtualization and physical underlying computing resource layer in the process of heterogeneous network resource mapping is considered.And an optimization algorithm for active control resources based on SDN and NFV is proposed.Firstly,the user’s utility is modeled by the multistandard aggregated multi-criteria utility algorithm,and the optimization goal is transformed into the problem of maximizing the user’s utility.Then the controller,based on the algorithm’s prediction of the future state and realtime monitoring of the network utilization,makes decisions and issues control commands for the arriving SFC requests,based on which it occupies the underlying resources held by the virtualized network function(VNF).The simulation results show that,compared with the static timing resource allocation algorithm,the active control resource deployment algorithm proposed in the article has better performance in terms of resource utilization,acceptance rate,and user creation utility.

基于SDN的动态ServiceChaining方案

随着终端规模的不断增加和云计算的逐渐普及,园区网的业务越来越多样化,从而带来网络容量和带宽升级。基础网络升级后,园区边缘网络的专用设备(防火墙、广域网加速设备等)容易成为整个园区网的性能瓶颈点。而对这些专用设备进行升级和更换所带来的支出费用较大,同时由于这些设备都是专业的硬件设备,其部署配置和运维管理相对于交换机与路由器也较为复杂。如何利旧现有专用设备、降低改造费用成为园区网建设所需考虑的重要因素。本文通过引入SDN,阐述了如何基于SDN实现动态Service Chaining技术,实现按需引流。动态Service Chaining技术可实现网络出口智能引流、安全资源池化、网络安全协防,从而搭建一个富有弹性、高度可扩展的业务流处理平台。

Virtualizing Network and Service Functions: Impact on ICT Transformation and Standardization

Virtualization of network/service functions means time sharing network/service（and affiliated）resources in a hyper speed manner.The concept of time sharing was popularized in the 1970s with mainframe computing.The same concept has recently resurfaced under the guise of cloud computing and virtualized computing.Although cloud computing was originally used in IT for server virtualization,the ICT industry is taking a new look at virtualization.This paradigm shift is shaking up the computing,storage,networking,and ser vice industries.The hope is that virtualizing and automating configuration and service management/orchestration will save both capes and opex for network transformation.A complimentary trend is the separation（over an open interface）of control and transmission.This is commonly referred to as software defined networking（SDN）.This paper reviews trends in network/service functions,efforts to standardize these functions,and required management and orchestration.

An Energy-Efficient Mobile-Controlled Vertical Handover Management for Real Time Services

Multiple wireless access technology has been embedded into a single mobile device as a fundamental feature, aiming to give end users ubiquitous access at any time. To allow the users to enjoy the ubiquitous connectivity, the mobile device has to consume higher energy for the simultaneous activation of multiple wireless interface and the continuous connectivity. In addition, a seamless vertical handover between the access technologies is a mandatory requirement to insure the quality, reliability and continuity of real time services. In this paper, the continuity of real time services as well as energy saving for mobile devices has been taken into account. The conceptual idea is that whenever traffic rate is lower than a threshold it will be smoothly handed over to a low energy consumption technology, i.e., Bluetooth. When the traffic exceeds the limitation of Bluetooth bandwidth, it will be handed over to a wider bandwidth technology, i.e., Wi-Fi. In the considered scenarios, the technologies are not interconnected;hence, the vertical handover management must be fully controlled by the mobile devices. The performance of the system including energy saving and maintaining the continuity of real time services has been evaluated by direct measurements in a real testbed.

基于SDN弹性光网络的电力通信网智能业务编排方法

针对电力通信网差异化业务编排问题,首先构造基于SDN弹性光网络的电力通信网框架,通过业务层与SDN控制层完成配电网数据交互,支撑配网多种不同优先级电力通信网业务的正常运行。其次,提出基于自适应业务优先级感知的电力通信网智能业务编排算法,根据不同业务优先级自适应调节探索因子,权衡不同优先级业务摇臂选择时的探索和利用的倾向,从而保证高优先级业务的高可靠传输的同时降低网络开销。最后,通过算例分析验证所提技术在能效、时延等方面的性能优势。文章的研究内容能为电力通信网差异化业务数据流低时延高效传输提供参考,从而支撑电力通信网高效运行。

Threshold-Based Software-Defined Networking(SDN)Solution for Healthcare Systems against Intrusion Attacks

The healthcare sector holds valuable and sensitive data.The amount of this data and the need to handle,exchange,and protect it,has been increasing at a fast pace.Due to their nature,software-defined networks(SDNs)are widely used in healthcare systems,as they ensure effective resource utilization,safety,great network management,and monitoring.In this sector,due to the value of thedata,SDNs faceamajor challengeposed byawide range of attacks,such as distributed denial of service(DDoS)and probe attacks.These attacks reduce network performance,causing the degradation of different key performance indicators(KPIs)or,in the worst cases,a network failure which can threaten human lives.This can be significant,especially with the current expansion of portable healthcare that supports mobile and wireless devices for what is called mobile health,or m-health.In this study,we examine the effectiveness of using SDNs for defense against DDoS,as well as their effects on different network KPIs under various scenarios.We propose a threshold-based DDoS classifier(TBDC)technique to classify DDoS attacks in healthcare SDNs,aiming to block traffic considered a hazard in the form of a DDoS attack.We then evaluate the accuracy and performance of the proposed TBDC approach.Our technique shows outstanding performance,increasing the mean throughput by 190.3%,reducing the mean delay by 95%,and reducing packet loss by 99.7%relative to normal,with DDoS attack traffic.

SDN中的虚拟化安全机制设计

本研究围绕SDN中的虚拟化安全机制展开探讨,首先,对SDN虚拟化安全需求进行细致分析,包括物理层、链路层和应用层的安全需求。随后提出基于身份认证与授权、安全策略管理、入侵检测与防御等方面的安全服务设计和网络隔离、数据加密、应用程序安全防护等方面的安全应用设计。针对安全管理需求,设计安全配置管理、安全漏洞管理、安全合规管理和安全审计与日志管理四个管理模块。通过本研究,展示SDN中虚拟化安全机制设计的重要性和必要性。

Mitigating while Accessing:A Lightweight Defense Framework Against Link Flooding Attacks in SDN

Link flooding attack(LFA)is a type of covert distributed denial of service(DDoS)attack.The attack mechanism of LFAs is to flood critical links within the network to cut off the target area from the Internet.Recently,the proliferation of Internet of Things(IoT)has increased the quantity of vulnerable devices connected to the network and has intensified the threat of LFAs.In LFAs,attackers typically utilize low-speed flows that do not reach the victims,making the attack difficult to detect.Traditional LFA defense methods mainly reroute the attack traffic around the congested link,which encounters high complexity and high computational overhead due to the aggregation of massive attack traffic.To address these challenges,we present an LFA defense framework which can mitigate the attack flows at the border switches when they are small in scale.This framework is lightweight and can be deployed at border switches of the network in a distributed manner,which ensures the scalability of our defense system.The performance of our framework is assessed in an experimental environment.The simulation results indicate that our method is effective in detecting and mitigating LFAs with low time complexity.

基于SDN的优化遗传蚁群混合算法研究

互联网技术的飞速发展使网络规模不断扩大,传统的路由算法已然不能满足用户的不同服务质量(QoS)需求。针对以上问题,结合遗传算法和优化蚁群算法的优点,提出了一种基于优化遗传蚁群的混合算法。通过在Mininet平台上搭建网络拓扑并进行仿真实验,结果表明,该算法在遗传算法阶段全局搜索能力强,在优化蚁群算法阶段的收敛速度加快,对比其他算法使用更少的运行时间、时延和带宽占用率,能够更好地适应差异化网络。

SDN体系架构中元模型构建机制

微服务是现代应用架构的新方法,其特点在于将复杂的应用功能分解到离散、独立的服务中,以实现应用方案的解耦,并且各个服务可以单独开发、部署及扩展。应用的变化必然驱动着底层网络的变化,可重构基础网络体系架构旨在通过网络重构机制来弥补网络业务需求与网络基础传输能力之间的差距。融合可重构和软件定义网络技术,提出了一种SDN体系架构中元模型的构建机制,旨在将SDN体系架构中各层的服务以元模型的方式呈现,并且在借鉴AKF三维伸缩模型之后,提出了一种基于正交分解的元模型的构建方法。最后通过理论分析和开发实例,验证了基于正交分解的元模型构建方法的可行性。

基于网络资源管理技术的SDN DoS攻击动态防御机制

软件定义网络(software defined networking,SDN)已经迅速成为一种新的网络通信管理模式,极大地改变了传统网络架构.SDN可以通过将控制层与数据层分离来实现更细粒度的网络控制与管理.但是,转控分离的SDN架构也使得控制器极易成为DoS攻击的目标.为解决这一问题,现对SDN中的DoS攻击进行全面的研究,并提出一种轻量有效的MinDoS防御机制,该机制主要由简化的DoS攻击探测模块和优先级管理模块这2个核心模块实现.该机制可以根据用户信任值将流请求分类并将其划分到具有不同优先级的多个缓冲队列,然后使用SDN控制器以双轮询机制来调度处理这些流请求,从而在DoS攻击下更好地保护控制器.另外,MinDoS还结合了多控制器动态调度策略来降低全局响应时间,提高用户服务质量.最后,分别在SDN单控制器和多控制器实验环境中对MinDoS防御性能进行综合评估,实验结果表明:MinDoS防御效果良好,系统设计满足预期目标.

基于OpenFlow的SDN终端接入控制研究

为了解决基于Open Flow的SDN终端安全接入问题,通过对现有SDN中针对终端安全接入解决方案的深入研究,文章提出一种基于Open Flow的SDN终端接入控制系统。该系统将传统终端接入控制技术与基于Open Flow的SDN新型网络相结合,主要实现了SDN环境下的用户身份认证、终端安全状态评估、用户服务授权和Qo S控制等功能,并且对系统的安全性进行了详细分析。文章在Mininet中结合二次开发的RYU控制器进行网络仿真,完成了接入控制功能和通信时延性能的实验。实验结果表明,基于Open Flow的SDN终端接入控制系统具有灵活的接入控制安全策略,能够检测SDN中不安全终端接入带来的威胁,不仅实现了用户的身份认证,而且能够保证接入终端的安全,实现不同安全状态终端的访问授权。性能测试结果表明,基于Open Flow的SDN终端接入控制系统在身份认证时延、平台评估时延和通信时延等方面都能满足实际需要。

SDN驱动构建运营商新型业务平台体系

在移动互联网的大环境中,电信运营商的核心业务能力正在逐步丧失优势。互联网化的业务环境需要开放、灵活、运营化的业务体系架构。云计算和SDN为电信运营商提供了一种业务网络优化的理念和手段。通过分析SDN技术的理念和方法,并向上层应用扩展SDN的概念,运用于构建层次化、模块化、松耦合、虚拟化、服务化、开放的服务体系,为电信运营商的平台体系进一步优化和价值化提供参考。