Abstract In software defined networks (SDN) packet data switches are configured by a limited number of SDN controllers, which respond to queries for packet forwarding decisions from the switches. To enable optimal control of switches in real time the placement of controllers at network nodes must guarantee that the controller‐to‐controller and switch‐to‐controller communications delays are bounded. Apart from the primary controllers that control the switches in the nominal state, separate backup controllers can be introduced that take over when the primary controllers are unavailable, and whose delay bounds are relaxed. In this paper, we present optimization models to jointly optimize the placement of primary and backup controllers in long‐distance SDN networks, aimed at maximizing the network's resilience to node‐targeted attacks. Applying the models to two well‐known network topologies and running a broad numerical study we show that, when compared with the standard approach of using only primary controllers, the use of backup controllers provides significant resilience gains, in particular in case of tight delay bounds.

Abstract In telecommunication networks, full connectivity resilience to multiple link failures is too costly as it requires a network topology with too many redundant links. Alternatively, the connectivity resilience of a telecommunications network can be improved by resorting to available third‐party networks for temporary additional connectivity until the failing links are restored. In this approach, some nodes of the network must be selected in advance to act as gateway nodes to the third‐party networks when a multiple link failure event occurs. For a given network topology and a cost associated with each node to turn it into a gateway node to each of the third‐party networks, the aim is to select the gateway nodes providing maximum connectivity resilience at minimum cost. The Gateway Node Selection is defined as a bi‐objective optimization problem such that its Pareto‐optimal solutions represent different trade‐offs between cost and connectivity resilience. In this work, the connectivity resilience is modeled by the Critical Link Detection optimization problem. An exact optimization algorithm is proposed, based on a row generation algorithm and on set cover cuts. The computational results demonstrate the effectiveness of the proposed algorithm on four well‐known telecommunication network topologies.

In Software Defined Networks (SDNs), a number of controllers are placed in a given data plane network. In a standard logically centralized control plane, each controller acts simultaneously as a primary controller for some switches and as a backup controller for other switches, and the controller placements must meet given switch-controller (SC) and controller-controller (CC) delay bounds. Then, the SDN should be resilient to network disruptions such as node-targeted attacks. To improve the SDN resilience to this kind of disruptions, we assume that some controllers are deployed only as backup controllers so that they take over the functions of primary controllers only in case of disruption. We propose an optimization model that solves a relevant primary and backup controller placement problem, where a minimum number of primary controllers minimizing the maximum SC delay is first established, and then a joint primary and backup controller placement maximizing the resilience of the SDN against a list of the most dangerous node-targeted attacks is determined. A numerical study illustrating the merits of the proposed optimization methodology is presented.

With the risk of natural disaster occurrence rising globally, the interest in innovative disaster resilience techniques is greatly increasing. In particular, Data Center (DC) operators are investigating techniques to avoid data-loss and service downtime in case of disaster occurrence. In cloud DC networks, DCs host Virtual Machines (VM) that support cloud services. A VM can be migrated, i.e., transferred, across DCs without service disruption, using a technique known as “online VM migration”. In this article, we investigate how to schedule online VMs migrations in an alerted disaster scenario (i.e., for those disasters, such as tsunami and hurricanes, that grant an alert time to DC operators) where VMs are migrated from a risky DC, i.e., a DC at risk to be affected by a disaster, to a DC in safe locations, within a deadline set by the alert time of the incoming disaster. We propose a multi-objective Integer Linear Programming (ILP) model and heuristic algorithms for efficient online VMs migration to maximize number of VMs migrated, minimize service downtime and minimize network resource occupation. The proposed approaches perform scheduling, destination DC selection and assign route and bandwidth to VM migrations. Compared to baseline approaches, our proposed algorithms eliminate service downtime in exchange of an acceptable additional network resource occupation. Results also give insights on how to calculate the minimum amount of time required to evacuate all VMs with no service downtime. Moreover, since the proposed approaches exhibit different execution times, we design an ‘alert-aware VM evacuation’ tool to intelligently select the most suitable approach based on the number and size of VMs, alert time and available network capacity.

Abstract This paper addresses two related problems in the context of transparent optical networks. In the network design problem, the aim is to identify a set of fiber links to connect a given set of nodes. In the network upgrade problem, the aim is to identify a set of new fiber links to add to a given network topology. For a given fiber length budget, the aim in both problems is to maximize the network resilience to the simultaneous failure of its critical nodes. The resilience is evaluated by the average 2‐terminal reliability (A2TR) against a set of critical node failures and the critical nodes are the ones that minimize the A2TR of the network. So, the design/upgrade problem is a bi‐level max‐min optimization problem. Recently, a multi‐start greedy randomized heuristic was proposed for both problems. Here, we propose an alternative method based on a greedy deterministic algorithm and we provide computational results showing that the new method obtains better solutions. The results show that the resiliency difference between existing network topologies and the best network design solutions is very high but this difference can be significantly reduced by network upgrades with small fiber length budgets.

Abstract High throughput, resilience, and low latency requirements drive the development of 5G‐enabled content delivery networks (CDNs) which combine core data centers (cDCs) with edge data centers (eDCs) that cache the most popular content closer to the end users for traffic load and latency reduction. Deployed over the existing optical network infrastructure, CDNs are vulnerable to link cut attacks aimed at disrupting the overlay services. Planning a CDN to balance the stringent service requirements and increase resilience to attacks in a cost‐efficient way entails solving the content placement problem (CPP) across the cDCs and eDCs. This article proposes a framework for finding Pareto‐optimal solutions with minimal user‐to‐content distance and maximal robustness to targeted link cuts, under a defined budget. We formulate two optimization problems as integer linear programming (ILP) models. The first, denoted as K‐best CPP with minimal distance (K‐CPP‐minD), identifies the eDC/cDC placement solutions with minimal user‐to‐content distance. The second performs critical link set detection to evaluate the resilience of the K‐CPP‐minD solutions to targeted fiber cuts. Extensive simulations verify that the eDC/cDC selection obtained by our models improves network resilience to link cut attacks without adversely affecting the user‐to‐content distances or the core network traffic mitigation benefits.

In dynamic flex‐grid optical transport networks, Lightpath Admission Control (LAC) is the task of finding a Routing and Spectrum Assignment (RSA) solution for a current lightpath request; otherwise, the request is blocked if there are not enough free available resources. When rerouting is supported, one or more currently established lightpaths can be rerouted and/or assigned with a different spectrum in order to accommodate the current lightpath request. We propose LAC methods based on mixed integer linear programming that provide a RSA solution for the current request aiming to maximize the acceptance probability of future lightpath requests. When rerouting is supported, we consider that only one currently established lightpath can be rerouted. We compare the proposed methods with the traditional shortest path‐based approach through simulation. Without lightpath rerouting, the blocking probability is significantly improved. With lightpath rerouting, the number of rerouting operations is significantly decreased while the blocking probability is marginally improved. Moreover, the blocking fairness between lightpaths with different spectrum widths is improved both with and without lightpath rerouting. In all cases, the CPU times of the mixed integer linear programming approaches are a few seconds, on average. © 2016 Wiley Periodicals, Inc. NETWORKS, Vol. 69(1), 151–163 2017

Wireless sensor networks (WSNs) are a promising technology for several industrial and quotidian applications. IPv6 is the most consensual solution to connect such networks to the Internet, and 6LoWPAN is the adaptation layer to run IPv6 over WSNs. Self-organization and self-configuration are key characteristics of WSN because they minimize the network configuration efforts and simultaneously increase the network robustness but they can also be exploited to perform security attacks. This paper proposes a network admission control solution for 6LoWPAN WSN that prevents unauthorized nodes from using the network to communicate either with the legitimate nodes and with the Internet, reducing in this way the security attacks that can be performed. The proposed solution includes node presence detection and authentication, administrative node authorization, and data filtering to discard frames from/to unauthorized nodes. It uses the standard 6LoWPAN neighbor discovery and RPL protocols, minimizing the number of additional required control messages. It includes cryptographic mechanisms, based on the AES symmetric key algorithm, to guarantee node authenticity and integrity, source authenticity, and data freshness of data frames. This paper also presents the design and deployment of a laboratory testbed validating the proposed network admission control solution.

As client demands grow, optical network operators are required to introduce lightpaths of higher line rates in order to groom more demand into their network capacity. For a given fiber network and a given set of client demands, the minimum cost network design is the task of assigning routing paths and wavelengths for a minimum cost set of lightpaths able to groom all client demands. The variant of the optical network design problem addressed in this paper considers a transparent optical network, single hop grooming, client demands of a single interface type, and lightpaths of two line rates. We discuss two slightly different mixed integer linear programming models that define the network design problem combining grooming, routing, and wavelength assignment. Then, we propose a parameters increase rule and three types of additional constraints that, when applied to the previous models, make their linear relaxation solutions closer to the integer solutions. Finally, we use the resulting models to derive a hybrid heuristic method, which combines a relax-and-fix approach with an integer linear programming-based local search approach. We present the computational results showing that the proposed heuristic method is able to find solutions with cost values very close to the optimal ones for a real nation-wide network and considering a realistic fiber link capacity of 80 wavelengths. Moreover, when compared with other approaches used in the problem variants close to the one addressed here, our heuristic is shown to compute solutions, on average, with better cost values and/or in shorter runtimes.

The current tendency to embed computational resources on quotidian objects transforms them into smart objects. This is the vision of Internet of things, where many different devices collect and process information from different sources to both control physical processes and interact with human users. Initially wireless sensor networks and Internet of things concepts were used with the same meaning. The same happened with wireless sensor networks and the protocol IEEE 802.15.4. It is now accepted that the Internet of tings can comprise more than one type of networks and therefore several layer two protocols. In such scenarios the IP protocol it is used, like as before, to make this heterogeneity interoperable. This paper presents a demonstrator for power energy monitoring and actuating system and it was developed for home environments. This system is based on 6LoWPAN to connect to the Internet a smart object network with two layer 2 technologies: IEEE 802.156.4 and power line communication. IPv4 to IPv6 transition mechanisms were included to provide connectivity to both IPv4 and IPv6 Internet end systems.

Today, electronic devices may have multiple possibilities to communicate, either through wired or wireless interfaces. Despite this diversity, devices still fail to fully use the available resources by not simultaneously using multiple channels to their full extent. This is especially true in wireless channels where the efficient aggregation of multiple channels has proved to be a difficult task, as shown in recent simulation based works. In this Work In Progress paper, we present a testbed suitable to the evaluation of aggregation algorithms under real network environments. The proposed testbed aims to simulate and experiment both existing and new aggregation algorithms, optimized for wireless heterogeneous communication channels that can be deployed in industrial environments. In order to illustrate the merits of the proposed testbed, we also describe its use in the performance assessment of two aggregation algorithms: Linux Bonding Driver and Multipath TCP.

SUMMARY Denial of service (DoS) attacks can be defined as any third‐party action aiming to reduce or eliminate a network's capability to perform its expected functions. Although there are several standard techniques in traditional computing that mitigate the impact of some of the most common DoS attacks, this still remains a very important open problem to the network security community. DoS attacks are even more troublesome in smart object networks because of two main reasons. First, these devices cannot support the computational overhead required to implement many of the typical counterattack strategies. Second, low traffic rates are enough to drain sensors' battery energy making the network inoperable in short times. To realize the Internet of Things vision, it is necessary to integrate the smart objects into the Internet. This integration is considered an exceptional opportunity for Internet growth but, also, a security threat, because more attacks, including DoS, can be conducted. For these reasons, the prevention of DoS attacks is considered a hot topic in the wireless sensor networks scientific community. In this paper, an approach based on 6LowPAN neighbor discovery protocol is proposed to mitigate DoS attacks initiated from the Internet, without adding additional overhead on the 6LoWPAN sensor devices.Copyright © 2012 John Wiley & Sons, Ltd.

MPLS (multiprotocol label switching) over WDM (wavelength division multiplexing) networks are gaining significant attention due to the efficiency in resource utilization that can be achieved by jointly considering the two network layers. This paper addresses the design of MPLS over WDM networks, where some of the WDM nodes may not have packet switching capabilities. Given the WDM network topology and the offered traffic matrix, which includes the location of the edge LSRs (label switched routers), we jointly determine the location of the core LSRs (i.e. the core WDM nodes that also need to include packet switching capabilities) and the lightpath routes (which are terminated on the LSRs) that minimize the total network cost. We consider constraints both at the optical and packet layers: an MPLS hop constraint on the maximum number of LSRs traversed by each LSP (label switched path), which guarantees a given packet level QoS, and a WDM path constraint on the maximum length of lightpaths, which accommodates the optical transmission impairments. A novel integer linear programming (ILP) formulation based on an hop-indexed approach, which we call the HOP model, is proposed. A two-phase heuristic, derived from a decomposition of the HOP model in two simpler ILP models that are solved sequentially, is also developed. The computational results show that the heuristic is efficient and produces good quality solutions, as assessed by the lower bounds computed from the HOP model. In some cases, the optimal solution is obtained with the branch-and-bound method.