With the exponential increase in the complexity of network management and configuration, Software Defined Networking (SDN) has emerged as a promising network paradigm. SDN aims to efficiently transform network architecture and operations to be agile, and effectively enrich the functionality of underlying network elements, such as routers and switches, by decoupling the control plane from the data plane. In SDN, the network intelligence is centralized in a software entity so-called SDN controller, which enables network administrators to dynamically manage, secure, and optimize network resources and programmatically shape all entire network traffic pattern. Despite the impressive benefits SDN has brought to network architecture, it introduces new security challenges and prompts different implementation strategies to spread attack vectors. This paper comprehensively describes the utilization of Blockchain technology to secure and protect SDN architecture and discusses the feasibility of integrating the revolutionary technologies of SDN and Blockchain to provide confidentiality, integrity, and availability to network infrastructure.
A. S. M. Sanwar Hosen, Saurabh Singh, Pradip Kumar Sharma, Uttam Ghosh · 7 authors
Blockchain is attracting more and more attention to its applicability in the fields of Internet of Things (IoT). In particular, it is able to store data in unalterable blocks, associated with its secure peer-to-peer in a growing problem of transaction authorization in industrial and service provisioning applications. Moreover, it facilitates decentralized transaction (TX) validation and distributed ledger. The underneath algorithm of TX selection for validation may not be effective in terms of delay of various services of the applications. Because the existing random-based or fee-based selections are a delay insensitive that does not guarantee a minimum delay of a time-critical TX. This paper proposes a blockchain-based transaction validation protocol for a secure distributed IoT network. It includes a context-aware TX validation technique, where a TX is validated by a miner with the priority of a service. Besides, we adopt the Software Defined Networking enabled gateway as a middleware between IoT and the blockchain network in which the control operations and security of the network in a largescale are ensured. The proposed network model has evaluated and compared to the Core network. The results ensure the given priority in TX validation is more delay sensitive than the existing technique to provide quality of service of the network.
Anichur Rahman, Mostofa Kamal Nasir, Ziaur Rahman, Amir Mosavi · 6 authors
Security, privacy, and transparency aspects of the Internet of Things (IoT) sensors have recently raised significant concerns among the public and policymakers. The distributed ledger and Blockchain technologies had brought solutions through transparently bridging two or multiple untrusted parties. In this research, a novel architecture for a smart building system, including a control system and automatic approaches, is proposed. An efficient cluster head selection algorithm is proposed to select the desired cluster head with the consideration of low energy consumption and fast head selection. An enhanced combination of IoT forwarding devices and Software-Defined Networking (SDN) technology is further advanced. Furthermore, the proposed “DistBlockBuilding” architecture is implemented for managing a safe and secure data transfer from one surface to another surface. Besides, Blockchain technology is performed for transferring data within the smart building. Finally, the performance of IoT-SDN based secured networks is evaluated.
Oluwakayode Onireti, Lei Zhang, Muhammad Ali Imran
Distributed systems are crucial to the full realization of the Internet of Thing (IoT) ecosystem as it mitigates the challenges of trust, security, and scalability associated with the traditional centralized approach. In this paper, we present an analytical modeling framework for Practical Byzantine Fault Tolerance (PBFT)-a consensus method for blockchain in IoT networks. We define the viable area for the wireless PBFT networks which guarantees the minimum number of replica nodes required for achieving the protocol's safety and liveliness. We also present an analytical framework for obtaining the viable area which we later utilize for power optimization. Results show that significant energy saving can be achieved with the utilization of the viable area concept in wireless PBFT networks. The proposed framework can serve as a theoretical guidance for practical PBFT based wireless blockchain network deployment.
Shifeng Ding, Gangxiang Shen, Kevin X. Pan, Sanjay K. Bose · 6 authors
In communication networks, network virtualization can usually provide better capacity utilization and quality of service (QoS) than what can be achieved otherwise. Under this operation, once the capacity of a virtual optical network (VON) is allocated, it will be static for a certain period, for example, a service contract period. However, in reality, the actual traffic demand of a VON always fluctuates, which would lead to a mismatch between the capacity assigned and the actual traffic demand carried. This mismatch would further cause degradation of provisioned network services and inefficiency in assigned network capacity. To overcome this issue, we propose a new scheme, called spectrum trading (ST), to trade spectrum resources between VONs in the context of an elastic optical network (EON). The key idea is to allow different VONs to trade their spectrum resources according to their actual capacity requirement at different time instants. A VON with unused spectra can trade away its unused spectra to other VONs that are short of spectrum resources at that time. in exchange, it is rewarded with some credit for its contribution to the ST community, which it can then use later to obtain extra capacity, if needed. The trust-worthiness of the trading records between the VONs is ensured in a distributed fashion through a blockchain- assisted ledger that is updated whenever a new trade occurs. A software-defined control plane is also developed to enable spectrum trading with the support of the blockchain-assisted ledger. The performance of the ST scheme is evaluated and compared with the scenario without such trading. Results show that the proposed ST scheme is efficient in improving the QoS of each VON and significantly improves overall network capacity utilization.
Yoshitomi Eduardo Maehara Aliaga, Diego Fernandes Gonçalves Martins, Marco Aurélio Amaral Henriques
Neste trabalho apresentamos uma proposta mecanismo de consenso para blockchain baseado em PoS, que viabiliza a participação de usuários de uma maneira mais justa. Através da utilização de tempo discreto o protocolo utiliza rodadas, onde apenas participantes que passaram no desafio da rodada possam gerar o bloco. O protocolo garante uma participação mais igualitária pois não é possível gerar o bloco antes da próxima rodada esperada.
Cloud architecture has become a valuable solution for different applications, such as big data analytics, due to its high-degree of availability, scalability and strategic value. However, there still remain challenges in managing cloud architecture, in areas such as cloud security. In this paper, we exploit software-defined networking (SDN) and blockchain technologies to secure cloud management platforms from a networking perspective. We develop a blockchain-powered SDN-enabled networking infrastructure in which the integration between blockchain-based security and autonomy management layer and multi-controller SDN networking layer is defined to enhance the integrity of the control and management messages. Furthermore, our proposed networking infrastructure also enables the autonomous bandwidth provisioning to enhance the availability of cloud architecture. In the simulation section, we evaluate the performance of our proposed blockchain-powered SDN-enabled networking infrastructure by considering different scenarios.
In a fully interconnected world where even network-related services are becoming more dependent on software, the management of license agreements is critical for the business of any software vendor and communication provider. Building, managing and protecting the infrastructure to handle software license validation and scalability for the provider and, on the other hand, assessing the correct use of the software licenses for the vendor can become an expensive part of the relationship costs. We propose a novel approach for decentralized software licensing that leverages blockchain and smart contracts as fundamental enabling technologies. Our proposal guarantees a secure and inexpensive system with no central point of failure that can regulate the relations among untrusted parties. We describe the main design choices and present a prototype experimentation that demonstrates the benefits of the proposal in the context of virtualized network infrastructures.
Driven by the increasing number of stationary and portable devices, Distributed Denial-of-Service (DDoS) attacks pose a major threat to Internet availability. While advantages of cooperative defenses have been widely recognized over traditional on-premise defenses, there is not a widespread deployment of such cooperative defenses. This work demonstrates the Blockchain Signaling System (BloSS), a modular, network-agnostic and cooperative DDoS defense system consisting of independent instances working together to mitigate attacks targeted at any member of this alliance.
Raja Majid Ali Ujjan, Zeeshan Pervez, Keshav Dahal
Due to the rapid increment of the cyber attacks, intrusion detection system (IDS) is shifting towards collaborative approaches. There is a huge demand for securing larger networking environments for providing a safeguard against threats. In order to optimize the feasible detection performance, Collaborative Intrusion Detection Networks (CIDN) approaches have been adopted in practical scenarios, which enables a group of IDS nodes to mutually share and exchange mandatory information with each other, for example, IDS-signatures, attacks alarms. However, CIDN networks are distributed in nature, such networks still face plenty of implementation problems, especially, insider intruder can easily dominate any of security node and leave the entire security system vulnerable. To achieve the trust-based communication between each of IDS node, the recent advancement in blockchain applications is considered as a good fit to create trust-based communication in CIDN networks. This work converges CIDN network and blockchain in SDN context. Firstly, we investigated existing related work and highlighted challenges and research gap towards blockchain in CIDN networks. Secondly, we utilised three collaborated Snort IDS to receive the latest signature update from Ryu and then to securely share such signatures updates to all other Snort nodes within test-bed. Our work is motivated to detect seven types of common attacks with collaborated signature-based IDS, which feasibly processes more packets to achieve satisfactory detection results. Overall the evaluation results show that with the adoption of blockchain protocols, the proposed CIDN network achieves 96% of TP rate detection rate for TCP, UDP and ICMP packets.
Aug 1, 2019·2019 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech)
Software defined networking (SDN) is one of the most popular network technologies which provides an adaptive, agile and flexible network management and visibility. Although SDN architecture provides manifold benefits but on the same time its dependence on a logically centralized controller lead to the single point of failure. An attacker can easily capture the any forwarding device and restrict the availability of the controller using different prevalent attacks. Distributed denial of service (DDoS) is one of the most popular attack of this category which is quiet prevalent in SDN. Here, the aim of the attackers is to inject false script in the open flow tables through malicious switches which multiply exponentially. Therefore, in this paper, a blockchain as a service framework has been presented wherein BlockSDSec model is designed to provide security as a separate service for the SDN architecture. This work provides a mechanism to prevent the threats of DDoS at the switch level by embedding an security using blockchain onto the interaction channels of data and control planes. The load balancing at the controller level is achieved using a virtual controller. The proposed scheme is simulated using MiniNet Emulator to analyze the delay originating from usage of blockchain.
The industrial control systems are facing an increasing number of sophisticated cyber attacks that can have very dangerous consequences on humans and their environments. In order to deal with these issues, novel technologies and approaches should be adopted. In this paper, we focus on the security of commands in industrial IoT against forged commands and misrouting of commands. To this end, we propose a security architecture that integrates the Blockchain and the Software-defined network (SDN) technologies. The proposed security architecture is composed of: (a) an intrusion detection system, namely RSL-KNN, which combines the Random Subspace Learning (RSL) and K-Nearest Neighbor (KNN) to defend against the forged commands, which target the industrial control process, and (b) a Blockchain-based Integrity Checking System (BICS), which can prevent the misrouting attack, which tampers with the OpenFlow rules of the SDN-enabled industrial IoT systems. We test the proposed security solution on an Industrial Control System Cyber attack Dataset and on an experimental platform combining software-defined networking and blockchain technologies. The evaluation results demonstrate the effectiveness and efficiency of the proposed security solution.
Software-Defined Networking (SDN) separates the network control plane and data plane, which provides a network-wide view with centralized control (in the control plane) and programmable network configuration for data plane injected by SDN applications (in the application plane). With these features, a number of drawbacks of the traditional network architectures such as static configuration, non-scalability and low efficiency can be effectively avoided. However, SDN also brings with it some new security challenges, such as single-point failure of the control plane, malicious flows from applications, exposed network-wide resources and a vulnerable channel between the control plane and the data plane. In this paper, we design a monolithic security mechanism for SDN based on Blockchain. Our mechanism decentralizes the control plane to overcome single-point failure while maintaining a network-wide view. The mechanism also guarantees the authenticity, traceability, and accountability of application flows, and hence secures the programmable configuration. Moreover, the mechanism provides a fine-grained access control of network-wide resources and a secure controller-switch channel to further protect resources and communication in SDN.
Software Defined Networking (SDN) technology increases the evolution of Internet and network development. SDN, with its logical centralization of controllers and global network overview changes the network's characteristics, on term of flexibility, availability and programmability. However, this development increased the network communication security challenges. To enhance the SDN security, we propose the BCFR solution to avoid false flow rules injection in SDN data layer devices. In this solution, we use the blockchain technology to provide the controller authentication and the integrity of the traffic flow circulated between the controller and the other network elements. This work is implemented using OpenStack platform and Onos controller. The evaluation results show the effectiveness of our proposal.
A specific number of transaction confirmation blocks determines average time of receiving and accepting payments at cryptocurrencies, and the shortest confirmation time for the same level of blockchain security provides the best user properties. Existing papers on transaction confirmation blocks for Bitcoin use implicit assumption of prompt spreading of Bitcoin blocks over the network (that is not always the case for the real world conditions). The newer publications with rigorous analysis and proofs of Bitcoin blockchain properties that take into account network delays provide asymptotic estimates, with no specific numbers for transaction confirmation blocks. We propose three methods for determination of required number of confirmation blocks for Bitcoin and GHOST on networks with delayed message delivery with different models that take into account the possibility of faster adversarial node syncronization. For the GHOST we propose the first (to our knowledge) strict theoretical method that allows to get required number of confirmation blocks for a given attacker’s hashrate and attack success probability.
Yixin Li, Bin Cao, Mugen Peng, Long Zhang · 7 authors
Direct Acyclic Graph (DAG)-based ledger and the corresponding consensus algorithm has been identified as a promising technology for Internet of Things (IoT). Compared with Proof-of-Work (PoW) and Proof-of-Stake (PoS) that have been widely used in blockchain, the consensus mechanism designed on DAG structure (simply called as DAG consensus) can overcome some shortcomings such as high resource consumption, high transaction fee, low transaction throughput and long confirmation delay. However, the theoretic analysis on the DAG consensus is an untapped venue to be explored. To this end, based on one of the most typical DAG consensuses, Tangle, we investigate the impact of network load on the performance and security of the DAG-based ledger. Considering unsteady network load, we first propose a Markov chain model to capture the behavior of DAG consensus process under dynamic load conditions. The key performance metrics, i.e., cumulative weight and confirmation delay are analysed based on the proposed model. Then, we leverage a stochastic model to analyse the probability of a successful double-spending attack in different network load regimes. The results can provide an insightful understanding of DAG consensus process, e.g., how the network load affects the confirmation delay and the probability of a successful attack. Meanwhile, we also demonstrate the trade-off between security level and confirmation delay, which can act as a guidance for practical deployment of DAG-based ledgers.
Muriel Figueredo Franco, Eder J. Scheid, Lisandro Zambenedetti Granville, Burkhard Stiller
Network Functions Virtualization (NFV) is transforming the way in which network operators acquire and manage network services. By using virtualization technologies to move packet processing from dedicated hardware to software, NFV has introduced a new market focused on the offer and distribution of Virtual Network Functions (VNF). Infrastructure Providers (InP) can benefit from an NFV market by providing their infrastructures to fulfill demands of end-users that, in turn, acquire VNFsas- a-Service (VNFaaS). In this context, solutions that promote the competition between InPs can lead to lower prices, while increasing VNF performance to accommodate specific demands of end-users. In this paper, BRAIN, a blockchain-based reverse auction is presented to introduce an auditable solution in which InPs can compete to host VNFs taking into account the demands of each particular end-user. Such a solution helps reduce costs involved in VNF's commercialization and also monetize NFVenabled infrastructures. BRAIN is supported by a case study that provides evidence of the solution's feasibility and effectiveness. A discussion regarding blockchain advantages and drawbacks in this use-case (e.g., , additional costs and time) concludes this paper.
The existing LTE mobile system uses the vertical model to handle the session-based security management. However, the goal of this paper is to propose a packet key-based security management scheme on the blockchain control plane to enhance the existing session key-based security scheme and overcome the limitation that the existing vertical model, as well as the Software-Defined Networking (SDN) based horizontal model, confronts within solving end-to-end security management. The proposed blockchain-based security management (BSM) scheme enables each peer to easily obtain the necessary parameters required to manage the packet key-based security system. The important features of the BSM scheme include the renewal process, which enables the different packet data streams to use completely different security parameters for the security management. In addition, because even blind values cannot be exposed to the possible attackers, our BSM scheme guarantees very secure end-to-end data transfer against active attacks such as falsification of data and transactions. Finally, this paper compares the BSM scheme with the existing vertical model to prove the advantageous effects on latency.
Wireless Virtualization (WiVi) is emerging as a new paradigm to provide high speed communications and meet Quality-of-Service (QoS) requirements of users while reducing the deployment cost of wireless infrastructure for future wireless networks. In WiVi, Wireless Infrastructure Providers (WIPs) sublease their RF channels through slicing to Mobile Virtual Network Operators (MVNOs) based on their Service Level Agreements (SLAs) and the MVNOs independently provide wireless services to their end users. This paper investigates the wireless network virtualization by leveraging both Blockchain technology and machine learning to optimally allocate wireless resources. To eliminate double spending (aka over-committing) of WIPs' wireless resources such as RF channels, Blockchain - a distributed ledger - technology is used where a reputation is used to penalize WIPs with past double spending habit. The proposed reputation based approach helps to minimize extra delay caused by double spending attempts and Blockchain operations. To optimally predict the QoS requirements of MVNOs for their users, linear regression - a machine learning approach - is used that helps to minimize the latency introduced due to (multiple wrong) negotiations for SLAs. The performance evaluation of the proposed approach is carried out by using numerical results obtained from simulations. Results have shown that the joint Blockchain and machine learning based approach outperforms the other approaches.
Abbas Yazdinejad, Reza M. Parizi, Ali Dehghantanha, Kim-Kwang Raymond Choo
5G mobile networks provide additional benefits in terms of lower latency, higher data rates, and more coverage, in comparison to 4G networks, and they are also coming close to standardization. For example, 5G has a new level of data transfer and processing speed that assures users are not disconnected when they move from one cell to another; thus, supporting faster connection. However, 5G comes with its own technical challenges, such as those relating to authentication handover and user privacy protection. In 5G, for example, the frequent displacement of the users among the cells as a result of repeated authentication handovers often lead to a delay, contradicting the 5G objectives. Using inefficient authentication handover could also cause performance degradation among heterogeneous 5G cells, and increases the possibility of occurring user privacy and security issues. In this paper, we propose a new authentication approach that utilizes blockchain and software defined networking (SDN) techniques to remove the unnecessary re-authentication in repeated handover among heterogeneous cells. The proposed approach is designed to assure the low delay, appropriate for the 5G network in which users are replaced with the least delay among heterogeneous cells using their public and private keys provided by the devised blockchain component while protecting their privacy. In our comparison between Proof-of-Work (POW)-based and network-based models, the delay of our authentication handover is shown to be less than 1 ms. Also, our approach demonstrates less signaling overhead and energy consumption compared to peer models.
Boubakr Nour, Adlen Ksentini, Nicolas Herbaut, Pantelis A. Frangoudis · 5 authors
With advent of 5G, the classical mobile network business model is shifting from a network-operator-oriented business to a more open system with several actors. In this context, the network slice provider will play the role of an intermediate entity between the vertical service provider and the resource provider. To deploy a network slice, the network slice provider will require a brokering mechanism, which allows it to lease resources from different providers in a secure and private way. In this letter, we propose a broker design based on blockchain technology, providing a mechanism that secures and ensures anonymous transactions.
Software Defined Networking (SDN) is being extensively adopted by researchers and enterprise networks due to its feature of decoupling data and control planes from network device which enables them to implement new networking ideas. Communication between data and control planes faces various security issues where many users in data plane approach controller device in control plane to gain networking policies. In this paper, we proposed an efficient Zero-knowledge proof based identification scheme for securing SDN controller during data and control plane communication. This scheme ensures that only users who prove their knowledge about secrecy without revealing actual secret or any other information about it can communicate with controller. The computation cost was calculated to validate efficiency of the proposed work and compared with scheme that works in the basis of Kerberos authentication protocol.
Evangelos Pournaras, Srivatsan Yadhunathan, Ada Diaconescu
Structure plays a key role in learning performance. In centralized computational systems, hyperparameter optimization and regularization techniques such as dropout are computational means to enhance learning performance by adjusting the deep hierarchical structure. However, in decentralized deep learning by the Internet of Things, the structure is an actual network of autonomous interconnected devices such as smart phones that interact via complex network protocols. Self-adaptation of the learning structure is a challenge. Uncertainties such as network latency, node and link failures or even bottlenecks by limited processing capacity and energy availability can significantly downgrade learning performance. Network self-organization and self-management is complex, while it requires additional computational and network resources that hinder the feasibility of decentralized deep learning. In contrast, this paper introduces a self-adaptive learning approach based on holarchic learning structures for exploring, mitigating and boosting learning performance in distributed environments with uncertainties. A large-scale performance analysis with 864,000 experiments fed with synthetic and real-world data from smart grid and smart city pilot projects confirm the cost-effectiveness of holarchic structures for decentralized deep learning.
The new network paradigm of Software Defined Networking (SDN) has been widely adopted. Due to its inherent advantages, SDN has been widely used in various network fields such as data centers, WAN, enterprise, Optical Networks and energy Internet. Among them, SDN-based energy Internet systems are receiving more and more attention. But at the same time, some problems and challenges are gradually becoming more prominent. The SDN-based energy Internet is a distributed architecture for renewable energy, so the traditional centralized electric energy trading model will no longer apply. The blockchain has been rapidly developed and applied in various domains by virtue of its decentralization, coordinated autonomy, and non-tamperability. We propose an SDN-based energy Internet distributed energy trading scheme supported by blockchain technology. The proposed scheme achieves a reasonable match of the transaction objects under the premise of protecting privacy. Finally, we conducted a comprehensive, systematic security and applicability analysis of the proposed solution, further confirming that the system meets our design goals.