Protocol customizations primarily come in two forms: those driven by public extensions to open standard protocols; and dialecting and performance tuning driven by an enterprise network’s private security and performance needs. Current deployment of protocol customizations is mostly ad hoc, through manual configuration or script programs that are highly specialized to each customization. This method lacks the agility necessary to support the relatively high tempo of private customizations. Also, it is common for today’s protocol customization efforts to experience middlebox interference. We propose a systematic framework of network-wide orchestration and continuous management of protocol customization to enable agile operation for enterprise and data-center networks. By introducing a logically centralized orchestrator along with a Layer 4.5 fine-grained device customization solution, our framework will allow operators to configure, deploy, and monitor customized flows from a single vantage point, providing timely detection of rogue devices as well as real-time coordination of middlebox traversal. Results from prototyping and experimentation confirm utility of our framework while incurring modest processing overhead, at the levels of 3% and 0.5% for sample customized flows and non-customized flows, respectively. Furthermore, we present two major system refinements: (i) generalizing the design of receiving modules to support customization of encrypted flows, and (ii) adding logic system wide to support seamless rotation of customization modules for live flows. Finally, we discuss specific agile network operation use cases enabled by our solution and outline future work.

We demonstrate a system prototype of a new software framework [1] for orchestration and continuous management of protocol customization of selected devices in an enterprise or data-center network. The prototype mainly consists of a network-wide customization orchestrator (NCO) that deploys sample customization modules to a pair of client-server hosts for insertion between the application and transport layers, termed Layer 4.5, and a device customization agent (DCA) installed at each host. In this demo, we show how our system can be used to customize multiple protocols on a client to match different network and server requirements.

Protocol customizations primarily come in two forms: those driven by public extensions to open standard protocols; and dialecting and performance tuning driven by an enterprise network’s private security and performance needs. Current deployment of protocol customizations is mostly ad hoc, through manual configuration or script programs that are highly specialized to each customization. The method lacks the agility necessary to support the relatively high tempo of private customizations. Also, it is common for today’s protocol customization efforts to experience middlebox interference. In this paper, we propose a systematic framework of network-wide orchestration and continuous management of protocol customization for enterprise and data-center networks. By introducing a logically centralized orchestrator along with a layer 4.5 fine-grained device customization solution, our framework will allow operators to deploy and monitor customized flows from a single vantage point, providing timely detection of rogue devices as well as real-time coordination of middlebox traversal. Results from prototyping and experimentation confirm utility of our framework and show that the framework incurs modest processing overhead, at the levels of 3% and 1% for sample customized flows and non-customized flows, respectively.

Software-defined networking (SDN) has become a fundamental technology for data centers and 5G networks. Transport Layer Security (TLS) has been proposed as its single security layer for SDN networks; however, use of TLS is optional and TLS connections between the controller and switches are still vulnerable to downgrade attacks. In this paper, we propose a protocol dialecting approach to provide additional and customizable security assurance for network control messages. We consider and evaluate two dialecting approaches for OpenFlow protocol operation, adding per-message authentication to the SDN control channel that is independent of TLS and provides robustness against downgrade attacks targeting TLS. Furthermore, we measure the performance impact of using these dialecting primitives in a Mininet experiment. The results show a modest increase of communication latency of less than 22%.