The Software Defined Network in Internet of Things (SDN-IoT) is enjoying growing popularity due to its flexibility, automaticity and programmability. However, there is still a lack of proper permission management on SDN-IoT applications (SIApps), especially when the SIApp’s required northbound interfaces are located in multiple heterogeneous controllers without mutual trust. Existing access control methods are usually based on centralized models, proprietary controllers, trusting conditions or manual operations. It can incur unnecessary performance degradation and poor scalability. To solve this problem, this paper proposes a SIApps’ ledger (SILedger), an open, trusted, and decentralized access control mechanism based on blockchain and attribute-based encryption (ABE). It can not only support effective authorization of SIApps in heterogeneous and untrusted SDN-IoT control domains, but also record all interactions between SIApps and resources, and thus facilitate SIApps further charging, analysis and audit. The main idea is that the SIApps are authorized using access tokens encrypted by ABE, and these tokens are seen as the currency of blockchain to be distributed. Specifically, we re-design blockchain transaction, token encryption, token initialization and token update schemes to achieve cross-domain, fine-grained and flexible SIApps’ permission management. In order to mitigate the delay and complexity problem of blockchain and ABE, we devise an access control framework that separates authorization from call process of SIApps. Finally, we perform security analysis and implement a FISCO-BCOS-based prototype for SILedger. The experimental results show that it can provide effective access control for SIApps with negligible overheads.
Blockchain relies on the underlying peer-to-peer (p2p) networking to broadcast and get up-to-date on the blocks and transactions. It is therefore imperative to have high p2p connectivity for the quality of the blockchain system operations. High p2p networking connectivity ensures that a peer node is connected to multiple other peers providing a diverse set of observers of the current state of the blockchain and transactions. However, in a permissionless blockchain network, using the peer identifiers—including the current approach of counting the number of distinct IP addresses and port numbers—can be ineffective in measuring the number of peer connections and estimating the networking connectivity. Such current approach is further challenged by the networking threats manipulating the identifiers. We build a robust estimation engine for the p2p networking connectivity by sensing and processing the p2p networking traffic. We implement a working Bitcoin prototype connected to the Bitcoin Mainnet to validate and improve our engine’s performances and evaluate the estimation accuracy and cost efficiency of our estimation engine.
Tooba Faisal, Damiano Di Francesco Maesa, Nishanth Sastry, Simone Mangiante
The viability of new mission-critical networked applications such as connected cars or remote surgery is heavily dependent on the availability of truly customized network services at a Quality of Service (QoS) level that both the network operator and the customer can agree on. This is difficult to achieve in today’s mainly "best effort" Internet. Even if a level of service were to be agreed upon between a consumer and an operator, it is important for both parties to be able to scalably and impartially monitor the quality of service delivered in order to enforce the service level agreement (SLA). Building upon a recently proposed architecture for automated negotiation of SLAs using smart contracts, we develop a low overhead solution for monitoring these SLAs and arranging automated payments based on the smart contracts. Our solution uses cryptographically secure bloom filters to create succinct summaries of the data exchanged over fine-grained epochs. We then use a state channel-based design for both parties to quickly and scalably agree and sign off on the data that was delivered in each epoch, making it possible to monitor and enforce at run time the agreed upon QoS levels.
Durbadal Chattaraj, Basudeb Bera, Ashok Kumar Das, Joel J. P. C. Rodrigues · 5 authors
Emerging next-generation Internet yields proper administration of a wide-ranging dynamic network to assist rapid ubiquitous resource accessibility, whilst providing higher channel bandwidth. Since its inception, the traditional static network infrastructure-based solutions involve manual configuration and proprietary controls of networked devices. It then leads to improper utilization of the overall resources, and hence experiences various security threats. Although transport layer security (TLS)-based solution is presently advocated in the said framework, it is vulnerable to many security threats like man-in-the-middle, replay, spoofing, privileged insider, impersonation, and denial-of-service attacks. Moreover, the current settings of the said tool do not facilitate any secure and reliable mechanisms for data forwarding, application flow routing, new configuration deployment, and network event management. Also, it suffers from the single point of controller failure issue. In this article, we propose a new private blockchain-enabled fine-grained access control mechanism for the SDN environment. In this regard, attribute-based encryption (ABE) and certificate-based access control protocol are incorporated. This proposed solution can resist several well-known security threats, and alleviate different system-level inconveniences. The formal and informal security inspections and performancewise comparative study of the proposed scheme endorse better qualifying scores as compared to the other existing competing state-of-the-art schemes. Besides, the experimental testbed implementation and blockchain simulation show the implementation feasibility of the proposed mechanism.
The inclusion of resource sharing schemes within Network Function Virtualization (NFV) ecosystems allows for optimized usage of 5G infrastructure and extended capabilities of network slicing services. In such environments, marketplaces are formed to facilitate the exchange of NFV services across administrative domains, which may, however, belong to untrusted and unreliable entities. In this work, we propose a novel zero-touch approach for cross-domain network slicing service assurance, using enterprise blockchain technologies and employing an AI-driven closed-loop automation architecture. Our approach is based on the lifecycle management of Service Level Agreements (SLAs) using smart contracts-from service negotiation to service binding, monitoring, reconfiguration and decommissioning. Our closed-loop architecture is materialized using Cloud-Native operational Data Lakes and allows to continuously monitor the status and health of exchanged services and to detect or predict SLA violations so that immediate mitigation actions are taken to ensure service continuity. The proposed approach is applied in real Content Distribution Networks scenarios within the European project 5GZORRO and our experimental results demonstrate the ability of our system to accurately predict changes in service demand and to timely respond with preventive scaling actions.
Adriana Fernández–Fernández, Michael De Angelis, Pietro G. Giardina, James C. Taylor · 10 authors
To fully cope with the requirements of innovative 5G use cases, evolving business models and flexible networking scenarios spanning multiple administrative domains are envisioned. In this context, transparent and trusted frameworks that enable network service providers and infrastructure providers to advertise, negotiate and acquire, in real time, 5G resources and services, distributed over various geographical areas, are extremely valuable. To address this goal, emerging Distributed Ledger Technologies (DLTs) arise as well-suited solutions to ensure distributed security and trust, as well as effective and agile transaction management across the various parties involved in the 5G service chain implementation. Following this vision, this paper presents the design of a DLT-enabled Marketplace aimed to foster the secure trading of heterogeneous resources in dynamic 5G ecosystems. The performance of an initial implementation as proof-of-concept is also analyzed. The results of this proof-of-concept validate the feasibility of a decentralized marketplace implementation in the context of 5G resource trading.
TeraFlow proposes a new type of secure, cloud-native Software Defined Networking (SDN) controller that will radically advance the state-of-the-art in beyond 5G networks by introducing novel micro-services architecture, and provide revolutionary features for both flow management (service layer) and optical/microwave network equipment integration (infras-tructure layer) by adapting new data models. TeraFlow will also incorporate security using Machine Learning (ML) and forensic evidence for multi-tenancy based on Distributed Ledgers. Finally, this new SDN controller shall be able to integrate with the current Network Function Virtualization (NFV) and Multi-access Edge Computing (MEC) frameworks as well as to other networks. The target pool of TeraFlow stakeholders expands beyond the traditional telecom operators towards edge and hyperscale cloud providers.
Andrew Cullen, Pietro Ferraro, Robert Shorten, William H. Sanders · 5 authors
The surge of Internet of Things (IoT) applications requires distributed systems capable of securely exchanging messages and immutably recording data. While traditional blockchain architectures were not designed with IoT in mind, more recent Distributed Ledger Technologies (DLTs), which are not based on proof of work, can be considered as a solution to deal with the above requirements. However, without proof of work, these ledgers require an explicit way to manage the rate at which messages are issued and disseminated. In this work, we present an access control scheme for IoT-oriented DLTs, that is the mechanism used to choose which messages can be written to the ledger. Our approach aims to efficiently exploit the available network resources (bandwidth, processing power) and to guarantee fair access depending on node reputation. While these concepts have already been touched by well-known areas of networking research, such as TCP and quality of service, in DLT networks this problem is harder since nodes cannot trust familiar feedback measurements, such as packet acknowledgements or congestion notifications. In this paper, we design a completely decentralised mechanism which involves a round robin-based scheduler and a TCP-inspired rate setter. Extensive simulations show that our approach provides fair access, guarantees that all honest nodes eventually receive the same messages, and makes sure that malicious nodes cannot degrade performance or affect security.
Tooba Faisal, Damiano Di Francesco Maesa, Nishanth Sastry, Simone Mangiante
5G promises unprecedented levels of network connectivity to handle diverse applications, including life-critical applications such as remote surgery. However, to enable the adoption of such applications, it is important that customers trust the service quality provided. This can only be achieved through transparent Service Level Agreements (SLAs). Current resource provisioning systems are too general to handle such variety in applications. Moreover, service agreements are often opaque to customers, which can be an obstacle for 5G adoption for mission-critical services.In this work, we advocate short-term and specialised rather than long-term general service contracts and propose an end-to-end Permissioned Distributed Ledger (PDL) focused architecture; which allows operators to advertise their service contracts on a public portal backed by a PDL. These service contracts with clear Service Level Agreement (SLA) offers are deployed as smart contracts to enable transparent, automatic and immutable SLAs. To justify our choice of using a permissioned ledger instead of permissionless, we evaluated and compared contract execution times on both permissioned (i.e. Quorum and Hyperledger Fabric) and permissionless (i.e. Ropsten testnet) ledgers.
The emerging 5G mobile network is a prominent technology for addressing networking related challenges of Internet of Things (IoT). The forthcoming 5G is expected to allow low-power massive IoT devices to produce high volumes of data that can be transmitted over ultra-reliable, low-latency wireless communication services. However, IoT systems encounter several security and privacy issues to prevent unauthorized access to IoT nodes. To address these challenges, this paper introduces a novel blockchain-based architecture that leverages Software Defined Network (SDN) and Network Function Virtualization (NFV) for securing IoT transactions. A novel security appliance is introduced in a form of Virtualized Network Functions (VNFs) for improving the scalability and performance of IoT networks. Then, we introduce a novel consensus algorithm to detect and report suspected IoT nodes and mitigate malicious traffic. We evaluate and compare our proposed solution against three well-known consensus algorithms, i.e., Proof of Work (PoW), Proof of Elapsed Time (PoET), and Proof of Stake (PoS). We demonstrate that the proposed solution provides substantially lower latency and higher throughput as well as trustworthy IoT communication.
The ever-growing trend of making the traditional power grids smarter than before has resulted in their gradual evolution to more sophisticated grids, referred to as Smart Grids (SGs) Cyber-Physical Systems with complex networking technologies. The integration of Information and Communication Technologies with power grids fosters seamless data sharing between different SG entities, which supports effective and smart governance in terms of demand response management, frequency support, and voltage stabilization. Nonetheless, this integration opens up several security and privacy concerns, namely, electricity theft, power loss, battery exhaustion, infrastructure mapping, etc. These issues become even more important with the addition of distributed energy sources, e.g. electric vehicles (EVs), battery energy storage systems, and renewable energy sources, into the SGs. We present a framework based on Software Defined Networking (SDN) and BlockChain (BC) to address two challenging issues of EV-aided SG ecosystems, namely, privacy assurance and power security. We leverage the capabilities of SDN to handle the complex interactions between different subsystems of the SG. Furthermore, we also employ BC and smart contracts' properties to secure energy transactions and data communications. We design a secure and efficient mutual authentication protocol based on Elliptic Curve Cryptography (ECC) and BC for privacy preservation during smart energy trading. We also proposed a BC-based smart contract for effective Demand Response Management (DRM) during bidirectional energy transfer between EVs and SG. Finally, we present experimental evaluations to validate the proposed framework's performance. The results obtained demonstrate the improved performance of the proposed scheme compared with current state-of-the-art approaches. The mutual authentication protocol designed is not only secure against major attack vectors (namely, session key security, message integrity, anonymity, forward secrecy, and so on), but it is also cost-efficient in terms of communication and computational costs. Additionally, the SC designed assures power security and maintains an adequate balance between demand and supply.
Software-Defined Networking (SDN) separates network data plane and control plane, thus facilitates the introduction of control approaches in centralised and distributed modes. In this context, data plane should be remotely accessible for software-based control. In addition, physically-distributed control plane architectures should maintain secure communications between the SDN control plane elements. Securing distributed SDN is one of the applications that can take benefit from the use of Blockchain technology. In this paper, we achieve the security between the SDN controllers using Blockchain based smart contracts. We propose the use of smart contracts that embedded the SDN rules. We show different scenarios invoking smart contracts that are developed to secure the distributed SDN and to avoid unauthorised access and DoS attacks.
With the wide application deployment of software defined networks, the security problems faced by software defined networks have become increasingly prominent. Nowadays, the security of SDN is gradually becoming an important factor restricting its development. At the application level, the main security problem faced by SDN lies in the imperfection of application mechanism and authority management; In the control layer, because the controller is the core node of the whole network, its main security problem is the single point failure of the controller. At the data forwarding layer, the main problem is that there is no good guarantee mechanism for the integrity of the flow rule information issued by the controller.[1] As a result, hackers can tamper with the flow table information of the AC machine. Yes, SDN traffic flows according to the attacker's intention, which leads to network function failure. In this paper, the main security problems faced by SDN will be solved from multiple dimensions based on the decentralized, trustworthy and self-willed characteristics of blockchain, which is a distributed database.
Abstract The wireless sensor network (WSN) with fluctuating environs might be susceptible to diverse types of malicious cyber‐attacks, and they are mostly dependent on the authentication and encryption algorithm to astound this challenge. Most predominant routing schemes in literature are fall backs in characterizing the malicious nodes on networks due to the real time variation of routing information. Therefore, a reliable and trustworthy inter‐correlated routing scheme based on Block chain, Meta‐heuristic, and Deep Learning Algorithms are presented in this paper. The disseminated routing info in the WSN is handled by Block chain strategy, in which the optimal routing is accomplished with the help of Salp Swarm Optimization algorithm. The routing info variations between the nodes are envisaged and the optimal routing decisions are done by using the Deep Convolutional Neural network algorithm. The proposed routing scheme is implemented in NS2 and its performance is evaluated based on latency, energy consumption, and throughput metrics are analyzed. The efficiency of the method is improved as 97% and the evaluation is done for the malicious attacks, latency, and the delay. The comparison is made for the existing methods as particle swarm optimization, Markov decision process, security disjoint routing‐based verified message, trusted‐cluster–based routing, and reinforcement learning‐based neural network (RLNN) with the proposed method for the delay ratio.
The past decade has witnessed an explosive growth in cryptocurrencies, but the blockchain-based cryptocurrencies have also raised many concerns, among which a crucial one is the scalability issue. Suffering from the large overhead of global consensus and security assurance, even the leading cryptocurrencies can only handle up to tens of transactions per second, which largely limits their applications in real-world scenarios. Among many proposals to improve the cryptocurrency scalability, one of the most promising and mature solutions is the payment channel network (PCN), which offers the off-chain settlement of transactions with minimal involvement of expensive blockchain operations. However, transaction failures may occur due to external attacks or unexpected conditions, e.g., an uncooperative user becoming unresponsive. In this paper, we present a distributed robust payment routing protocol RobustPay+to resist transaction failures, which achieves robustness, efficiency, distributedness and approximate optimization. Specifically, we investigate the problem of robust routing in PCNs from an optimization perspective, which is to find a pair of payment paths for a payment request, while minimizing the worst-case transaction fee, subject to the timeliness and feasibility constraints. We present a distributed 2-approximation algorithm for this problem. Moreover, we modify the original Hashed Time-lock Contract (HTLC) protocol and adapt it to the robust payment routing protocol to achieve robustness and efficiency. Extensive simulations demonstrate that RobustPay+significantly outperforms baseline algorithms in terms of the success ratio and the average accepted value.
With the constant development of 5G technology, such as softwareization and virtualization, the novel concept of network slicing has been appeared. Blockchain is a decentralized technology for managing transactions and data which can ensure the security of transaction. Recently, the classical mobile network introduces a new role such as network slice agent to provide slices for one or across multiple operators, providing services for users or vertical industries over a larger time and space range. In this paper, we propose the blockchain network slicing broker (BNSB), an intermediate broker, which receive resources request and response then allocation resources between Network Slice Tenants (NST) and then schedule physical resources from Infrastructure Provider (InP) through smart contracts. The topology information is obtained according to the Complex Network theory and the value of nodes is defined according to their importance. In addition, Deep Reinforcement Learning algorithms is used to explore the optimal policy under the condition of meeting the service Level Agreement (SLA).
Network slicing is the crucial enabler of the new emerging 5G and beyond network generations. It facilitates the facility to compose logical networks over shared physical infrastructures. From the implementation perspective of view, slice isolations and sharing become very challenging. It introduces challenges to provide secure information to the subscribers and enables users to modify and configure the registrations while following the service level agreement. To this aim, we introduce a blockchain as a service, in which the distributed ledger technologies provide security and accessibility to the end-users while removing a third-party involvement. Additionally, it allows tenants and subscribers to manage the slice information as necessary without violating the agreement. The primary advantage of including blockchain in architecture is using it to slice isolation and sharing.
With the advent of 5G verticals and the Internet of Things paradigm, Edge Computing has emerged as the most dominant service delivery architecture, placing augmented computing resources in the proximity of end users. The resource orchestration of edge clouds relies on the concept of network slicing, which provides logically isolated computing and network resources. However, though there is significant progress on the automation of the resource orchestration within a single cloud or edge cloud datacenter, the orchestration of multi-domain infrastructure or multi-administrative domain is still an open challenge. Towards exploiting the network service marketplace at its full capacity, while being aligned with ETSI Network Function Virtualization architecture, this article proposes a novel Blockchain-based service orchestrator that leverages the automation capabilities of smart contracts to establish cross-service communication between network slices of different tenants. In particular, we introduce a multi-tier architecture of a Blockchain-based network marketplace, and design the lifecycle of the cross-service orchestration. For the evaluation of the proposed approach, we set up cross-service communication in an edge cloud and we demonstrate that the orchestration overhead is less than other cross-service solutions.
Billions of IoT devices and smart objects are already in operation today and even more are expected to be on the network over time. These IoT devices will generate enormous amounts of data that cannot be allowed to transmit on the network without end-to-end encryption or any trust and security mechanism. Currently, we have certificate authorities that certify the identity of a network device by binding its identity with its public key. However, these certificate authorities are centralized in structure and will not be able to individually certify billions of IoT devices entirely. In this paper, we propose that in an SDN-based IoT network, the identities, i.e., public keys and trust indices of IoT devices, can be stored on a blockchain to ensure immutability and tamper-resistance. The paper presents a novel scalable solution for key and trust management of IoT devices in IoT networks, with a successful proof-of-concept that proves the scalability of the proposed solution. The combination of an IoT network along with blockchain technology and software-defined networking (SDN) is effectively demonstrated through simulation that is able to store the public keys of IoT devices on the blockchain and route the network traffic efficiently through SDN. The performance of the proposed solution is evaluated in terms of throughput and access time delay. The results illustrate that access delay and throughput were not affected linearly or exponentially and the proposed solution shows no significant degradation in the performance with the increase in the number of IoT nodes and packets.
Data flows of various applications, such as video conferencing, telesurgery, online-gaming, etc., require particular treatment regarding Quality of Service (QoS) because of their sensitivity to such parameters as high bandwidth, low delay, and so on. However, provisioning of QoS-based routing services across Autonomous Systems (ASes) poses gruelling challenges due to the distributed nature and business confidentially hesitations. This study presents a novel blockchain-aided QoS-enabled inter-AS routing framework,QoSChain (QC), by blending merits of Software-Defined Networking (SDN) and Blockchain technologies.QCframework introduces a coordination framework with mutually distrusting participants that eliminates centralized mediators in provisioning QoS among SDN-enabled ASes. Also,QCreduces the time to set up an end-to-end (E2E) path and the number of messages exchanged and processed by SDN controllers for a QoS flow. Furthermore, it alleviates the concerns of network operators regarding potentially sensitive information disclosure resulting from the required information sharing for QoS-based cross-AS paths by masking details of any confidential information. Experimental results verify the feasibility of the proposed framework on E2E QoS-based routing among SDN networks. This work aims at being a useful primer for researchers in providing insights on how blockchain can be deployed in QoS-enabled routing.
Some Internet of Things (IoT) platforms use blockchain to transport data. The value proposition of IoT is the connection to the Internet of a myriad of devices that provide and exchange data to improve people’s lives and add value to industries. The blockchain technology transfers data and value in an immutable and decentralised fashion. Security, composed of both non-intentional and intentional risk management, is a fundamental design requirement for both IoT and blockchain. We study how blockchain answers some of the IoT security requirements with a focus on intentional risk. The review of a sample of security incidents impacting public blockchains confirm that identity and access management (IAM) is a key security requirement to build resilience against intentional risk. This fact is also applicable to IoT solutions built on a blockchain. We compare the two IoT platforms based on public permissionless distributed ledgers with the highest market capitalisation: IOTA, run on an alternative to a blockchain, which is a directed acyclic graph (DAG); and IoTeX, its contender, built on a blockchain. Our objective is to discover how we can create IAM resilience against intentional risk in these IoT platforms. For that, we turn to complex network theory: a tool to describe and compare systems with many participants. We conclude that IoTeX and possibly IOTA transaction networks are scale-free. As both platforms are vulnerable to attacks, they require resilience against intentional risk. In the case of IoTeX, DIoTA provides a resilient IAM solution. Furthermore, we suggest that resilience against intentional risk requires an IAM concept that transcends a single blockchain. Only with the interplay of edge and global ledgers can we obtain data integrity in a multi-vendor and multi-purpose IoT network.