In this paper, we present our proposals and efforts for building an affordable playground (i.e., miniaturized testbed) for Software-Defined Networking (SDN)-Cloud experiments by using hyper-converged SmartX Boxes that are distributed across multiple sites. Each SmartX Box consists of several virtualized functions that are categorized into SDN and cloud functions. Multiple SmartX Boxes are deployed and inter-connected through SDN to build multi-site distributed cloud playground resources. The resulting deployment integrates both cloud multi-tenancy and SDN-based slicing, which allow developers to run experiments and operators to monitor resources in a distributed SDN-cloud playground. It also describes how the hyper-converged SmartX Box can increase the affordability of the playground deployment. Thus, the analysis result shows the efficiency of SmartX Box for building a distributed playground by providing semi-automated DevOps-style resource provisioning.

The requirement of auto provisioning, administration, management and governing of networking resources in distributed environment, which spreads over multiple administrative domains (i.e., multi-domain) is a challenging task. This paper demonstrates an effort to inter-connect distributed SDN-Cloud resources which spread over three administrative domains in three different countries on OF@TEIN Playground. The proposed SD-Routing-Exchange utilizes BGP routing protocol as control-plane for federated multi-domain SDN-Cloud data-plane. This method has improved the flexibility of networking control, and provides reasonable interconnections redundancy and performance enhancement.

The Internet architecture has recently shifted towards a framework characterized by multiple interconnected cloud sites, all linked via an L3 IP network. With this shift, managing networking controls among multiple cloud sites is becoming a significant operational challenge. In particular, ensuring effective networking control necessitates a deeper understanding of flow-level dynamics for comprehensively monitoring interconnection statuses across multiple sites. In this paper, we first propose an IO Visor-enabled tracing solution for Linux-based boxes to efficiently enable the comprehensive collection of network packet flows across interconnected sites. Next, we apply IP prefix-based flow-level analysis at a centralized location to support the intent-based networking control application. This flow-level analysis involves generating policy-based specific action (i.e., redirect) via SDN controllers for specific source IP prefixes, which are causing unknown or potentially vulnerable flows. Furthermore, we employ an open-source ONOS SDN controller to tackle the challenge of managing the hybrid SDN-IP interconnections. By leveraging intent-based networking control, we effectively apply ONOS intents based on IP routing information and generated a set of forwarding action. We evaluate our proposed solution in an experimental SDN-cloud testbed, demonstrating its effectiveness in real-world scenarios. Overall, through the seamless integration of these monitoring and control approaches, we manage to enhance the adaptability and security of the interconnected cloud sites of the testbed.

In global networks, Border Gateway Protocol (BGP) is widely used in exchanging routing information. While the original design of BGP did not focus on security protection against deliberate or accidental errors regarding to routing disruption, one of fundamental vulnerabilities in BGP is a lack of insurance in validating authority for announcing network layer reachability. Therefore, a distributed repository system known as Resource Public Key Infrastructure (RPKI) has been utilized to mitigate this issue. However, such a validation requires further deployment steps for Autonomous System (AS), and it might cause performance and compatibility problems in legacy network infrastructure. Nevertheless, with recent advancements in network innovation, some traditional networks are planning to be restructured with Software-Defined Networking (SDN) technology for gaining more benefits. By using SDN, Internet eXchange Point (IXP) is able to enhance its capability of management by applying softwarized control methods, acting as a Software-Defined eXchange (SDX) center to handle numerous advertisement adaptively. To use the SDN method to strengthen routing security of IXP, this paper proposed an alternative SDX development, SD-BROV, an SDX-based BGP Route Origin Validation mechanism that establishes a flexible route exchange scenario with RPKI validation. The validating application built in the SDN controller is capable of investigating received routing information. It aims to support hybrid SDN environments and help non-SDN BGP neighbors to get trusted routes and drop suspicious ones in transition. To verify proposed idea with emulated environment, the proof-of-concept development is deployed on an SDN testbed running over Research and Education Networks (RENs). During BGP hijacking experiment, the results show that developed SD-BROV is able to detect and stop legitimate traffic to be redirected by attacker, making approach to secure traffic forwarding on BGP routers.