{'fraction_non_alphanumeric': 0.02847025495750708, 'fraction_numerical': 0.0033050047214353163, 'mean_word_length': 5.2517709563164106, 'pattern_counts': {'":': 0, '<': 1, '<?xml version=': 0, '>': 1, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Disaster-Resilient Control Plane Design and Mapping in Software-Defined Networks

Communication networks, such as core optical networks, heavily depend on their physical infrastructure, and hence they are vulnerable to man-made disasters, such as Electromagnetic Pulse (EMP) or Weapons of Mass Destruction (WMD) attacks, as well as to natural disasters. Large-scale disasters may cause huge data loss and connectivity disruption in these networks. As our dependence on network services increases, the need for novel survivability methods to mitigate the effects of disasters on communication networks becomes a major concern. Software-Defined Networking (SDN), by centralizing control logic and separating it from physical equipment, facilitates network programmability and opens up new ways to design disaster-resilient networks. On the other hand, to fully exploit the potential of SDN, along with data-plane survivability, we also need to design the control plane to be resilient enough to survive network failures caused by disasters. Several distributed SDN controller architectures have been proposed to mitigate the risks of overload and failure, but they are optimized for limited faults without addressing the extent of large-scale disaster failures. For disaster resiliency of the control plane, we propose to design it as a virtual network, which can be solved using Virtual Network Mapping techniques. We select appropriate mapping of the controllers over the physical network such that the connectivity among the controllers (controller-to-controller) and between the switches to the controllers (switch-to-controllers) is not compromised by physical infrastructure failures caused by disasters. We formally model this disaster-aware control-plane design and mapping problem, and demonstrate a significant reduction in the disruption of controller-to-controller and switch-to-controller communication channels using our approach.

Japan Earthquake and Tsunami, around 1,500 telecom buildings experienced long power outages by the main shock on March 11; while most were fixed, 700 telecom buildings experienced power outages by the aftershock on April 7, 2011 [2]. Because of the potential huge data loss and networkconnectivity disruptions, high-capacity optical communication networks must be designed to provide resiliency against disasters, be adaptable to rapidly-changing network conditions due to disasters, and be able to recover after disasters, even if they are infrequent.
Today's networks are inflexible to effectively respond to large, complex disaster failures. They are rigidly verticallyintegrated, i.e., control and data planes are bundled together, and this is a main reason behind the complexity of network reconfiguration and management. Software-defined networking (SDN), a new networking paradigm, has emerged as a promising candidate to support the new demands and requirements of current and future communication networks. SDN breaks vertical integration of traditional networks by separating the network's control logic from the underlying routers and switches, promotes (logical) centralization of network control, and introduces the ability to program the network. The evolution of traditional control logic towards a centralized control plane simplifies network management, facilitates new vendor-independent network innovations, and introduces new optimization opportunities with the global view it provides.
These new functions of SDN can be exploited to provide higher survivability against disasters, but these opportunities come with a cost. In SDN, along with data-plane survivability, we also need to design the control plane and its communication with the data plane to be resilient enough to survive disaster disruptions.
Early deployments of SDN relied on physically-centralized control-plane architectures with a single controller, but a centralized system suffers from scalability, performance, and reliability problems in a large network deployment. Even a very powerful controller will lack the CPU and memory capacity necessary to maintain complete network state, and react to all network events, for large, high-capacity networks [5]. Also, the centralized design is vulnerable to disruptions and attacks, particularly to single point of failures [6]. Several distributed SDN controller architectures have been proposed to mitigate the risks of overload and failures. However, disaster-resilient design of control plane is almost unexplored, and it poses several challenges. As disasters occur in specific geographical locations and disrupt specific parts of the network, design of the network determines the impact of the disasters. Ignoring the vulnerable regions of the physical network while designing the distributed control plane and assigning switches to controller instances increases the risk of disconnection between switches and controllers, as well as controller-to-controller communication. Reprovisioning these communication channels can cause huge time loss in the event of disasters, and eventually connection disruption rate increases. To address this, we present a new approach to design the control plane in a disaster-aware manner by considering it as a virtual network, and solving it using a modified virtual-network-embedding approach. Our scheme decides on the number and placement of the controllers, maps them onto the physical network, and assigns switches to distributed controller instances in a disaster-resilient way.
The rest of this study is organized as follows: Section II reviews previous works on disaster resilience in communication networks and SDN. Section III presents the proposed disaster-resilient control-plane design framework, and its mathematical formulation is provided in Section IV. Section V describes the simulation scenario and presents the obtained results. Finally, Section VI concludes the study.

II. RELATED WORK
Researchers have proposed a number of techniques to overcome the disadvantages of the physical centralization of the SDN control plane in terms of not being robust against overloads and failures. Proposals exist to push the intelligence into the switches to offload the controller [7][8] and to offer a basic connectivity in the data plane [9]. Also, a logicallycentralized yet physically-distributed control plane as in Fig. 1 has been built such as Kandoo, HyperFlow, and Onix [10], which can benefit from the scalability and reliability of a distributed architecture while preserving the simplicity of a centralized system. Besides providing higher survivability against network failures, advantages of the distributed control plane include more scalability (control-plane throughput increases as many controllers can be used for load balancing) and reduced control delay by choosing the quickestresponding controller.
The problem of how many controllers to use and where to place them in the distributed control-plane design was studied in [11] using a static setting and with a fixed number and placement of controllers. Refs. [10] [12] propose dynamic controller provisioning where number of controllers and their locations change dynamically with changing network conditions to minimize flow setup time and communication overhead.
Nonetheless, even considering the inherent survivability of a distributed control-plane system, controller distribution does not guarantee control-plane network connectivity, which is a necessity for SDN to function properly against network failures, especially after a large-scale disaster failure. Existing distributed control-plane designs do not address the extent of large-scale disasters, despite the catastrophic disaster effects on communication networks that have been experienced in the past.
The first step in disaster survivability is modeling the disaster. Several studies (e.g., [13]) aim at modelling disasters and define the parts of the network that are more vulnerable to regional/correlated failures caused by disasters for analysis and/or design purposes. Although there are many studies that exploit the information on vulnerable regions of the network to proactively (before disasters occur) and/or reactively (after disasters) take necessary actions to minimize the loss in data plane, disaster resilience in SDN control plane is largely unexplored.
In this work, we study the problem of designing a disasterresilient SDN-based control plane to make the control plane resilient and dynamically adaptable to all disruptions: controller failure, inter-controller communication failure, and controller-to-switch communication.

III. DISASTER-AWARE CONTROL-PLANE DESIGN
A distributed control-plane topology can be designed as an overlay (i.e., virtual/logical) network mapped over a physical (i.e., backbone) network, which we call the Control Network Mapping (CNM) problem. This mapping problem can be solved using virtual network embedding (VNE) [14][15] techniques which are defined as the assignment of virtual network resources to physical network elements, e.g., virtual links are created using multi-hop physical links. CNM allocates necessary resources in the substrate network through node mapping and link mapping. Different from the traditional VNE problem, in CNM, a virtual network (control network in this case) topology is not given, i.e., the selection of the number of virtual nodes (controllers) and of the virtual links connecting them are also a part of this new problem. The selection of virtual links and nodes, and their mappings are jointly optimized, because preselecting a virtual topology without considering its relation to the link-mapping phase restricts the solution space and can result in poor performance. Given these additional decisions, existing schemes already developed for Wavelength-Division Multiplexing (WDM), Orthogonal Frequency Division Multiplexing (OFDM) or Layer 2/3 VNE solutions are not directly applicable to our problem.
In Fig. 2(a), a control plane is mapped onto a physical topology while minimizing resource usage, whereas in Fig.   2(b), the control plane is mapped considering a predicted disaster zone. After a disaster occurs, in the disaster-unaware design, one of the controllers (C3) fails, and hence the switches connected to it get disconnected from the control logic of the network. Also, the control plane gets islanded, and the switches connected to the controllers located on different islands can no longer communicate. Although the physical topology is still connected, due to the control-plane disconnection, the data plane also gets islanded.

Disaster Risk Modeling
To devise a disaster-resilient mapping the control plane, network vulnerability to different types of disasters in different locations needs to be assessed. In this study, we use a probabilistic disaster model [13], where a network component inside the affected region of a disaster fails with a probability that depends on many factors such as its distance from the disaster's epicenter, and type and magnitude of the disaster. Using this model, we calculate a vulnerability metric, called disaster risk, to be used to design a disaster-resilient control plane. Disaster risk captures the expected connectivity loss of the control plane due to controller node failure, inter-controller communication failure, and controller-to-switch communication failure given the location, span, and probability of occurrence of the potential disasters. Risk is calculated by the formula: where Y is the set of all disasters; P is set of all paths used for controller-to-controller and controller-to-switch communications; ∈ 0,1 : 1 if path p is affected in case of disaster y; and is the probability of occurrence of disaster y multiplied by probability that disaster y causes a failure. This formula covers controller node failures because, when a node is down, paths passing through that node also get affected.

Problem Statement
We formalize and investigate this new problem of CNM to ensure control-plane connectivity against both single point of failures and large-scale disaster failures. We present a mathematical formulation for jointly optimizing the virtual topology design and virtual network embedding such that control-network connectivity is ensured after failures.
This problem can be stated as follows: Given the network topology with the nodes (switches) connected to a datacenter (which are possible locations for controller placement) and survivability requirements of the network, find the number of controllers, decide on the virtual topology, and perform virtual control network mapping such that the network is survivable against any single point of failure and predicted disaster failures while minimizing physical resource usage. While minimizing the resource usage, we also consider intercontroller and switch-to-controller delay to be able to respond to failures promptly. The ultimate aim is to make the control plane resilient to controller failure, inter-controller communication failure, and controller-to-switch communication failure.

IV. PROBLEM FORMULATION
We formulate the problem of designing a control plane (deciding on the number of controllers, their placement, and the control-plane topology) and mapping it on a physical network as an integer linear program (ILP), given below. To simplify the model, we assume that physical links have no constraints on bandwidth resource. Also, we assume control communication is in-band (i.e., control communication channels use data-plane resources). A subset of the switches has datacenters located onsite, where controllers can be deployed. We evaluate the disaster risk of paths between switch to controller and controller to controller offline. Based on the risk information, our formulation decides the number and placement of controllers, maps the control plane, and performs controller-to-switch assignments.
We ensure control-plane connectivity after the predicted disaster occurrence by assigning two disaster-zone-disjoint virtual paths for each controller-to-controller communication.
We formulate the problem as follows: Disaster zone circular region where shortest-path distance to every node within this region from this node satisfies the latency constraint of this node. Latency constraint can be determined by the network operator and depends on the required time to react a particular event (such as connection arrival, departure, etc.) • : Number of controllers that must be guaranteed to be located within a certain latency limit by every switch. • : At least q controllers are active at any time in the network. • : Maximum number of switches that can be assigned to any controller.

•
: Set of possible paths to be used for virtual-link mapping between node i and node j.
• Y= {y | y = <E y , >}: Set of disasters where E y is the set of links that are part of Disaster y and is the probability that disaster y causes a failure. is the probability of occurrence of a disaster.
The resource minimization (Min-Resource) objective function of the disaster-unaware scheme for comparison purposes is as follows: where the resource usage is calculated as the total number of links used for the virtual link mappings between controller-tocontroller and controller-to-switch communication.
Reachability Constraint: ∑ · ≥ ∈: It ensures that at least k controllers are active within the reachability island of any switch node (in our case k=2).

Binarization of Variable:
where M is a very large number. All controllers which have an assigned switch should be up and running.

Controller-Capacity Constraint:
Total number of switches assigned to a controller should not exceed a maximum number to avoid overloading the controllers. We assume that each switch which has a controller on it is automatically assigned to that controller.
Switch-Assignment Constraint: Every switch is assigned to exactly one controller within latency limits. If there is a controller located at a switch location, that switch is assigned to it, along with the other switches that are assigned to that controller.
Latency Constraint: A switch only can be assigned to a controller that is located within latency limits. If a controller is not within the reachability distance of a switch, it automatically sets ! to 0.

Switch to Controller Assignment Check:
A switch can only be assigned to a node which has a controller on it.
Virtual Links Determination Constraint: Based on the flows enforced in Eqn. (8), this constraint ensures that the virtual links are set between controllers. After any disaster, this constraint ensures that at least one path (composed of virtual links) survives between any controller pair. It is similar to the flow-conservation constraint, but it ensures post-disaster, and not the normal, operation. ILP is for static problems, and do not scale for large problem instances. By developing heuristic methods, this problem can be adaptable to a dynamic scenario where we can redesign and remap the control network (possibly by restricting the amount of allowable changes in the logical topology) when network state changes (e.g., when intelligence agencies predict an attack, risky regions in the network also change).

V. ILLUSTRATIVE NUMERICAL EXAMPLES
We study a 14-node NSF physical network (Fig. 3) with 32 Gbps link capacity. As the disaster scenario, we consider a large-scale EMP attack, which affects four nodes and seven links. We chose a drastic example to show that, even when large portion of the network goes down, our scheme can still make the remaining network functional by preserving connectivity for the control communication channels. There are six nodes attached to datacenters, namely nodes 1, 3, 5, 8, 10, and 13, which are possible controller locations. For the latency constraint, each switch is allowed to connect only to controllers located within a 3-hop distance. If a switch has a controller on it, it will be assigned to that controller. We compare our disaster-aware control-plane design with a traditional (disaster-unaware) scheme which designs the control plane and its communication with the switches based on resource consumption minimization while providing protection against single-link failures. In the proposed scheme, risk is minimized using the objective function (Min-Risk) in Section IV. In Fig. 4, we compare these two schemes in terms of number of disruptions experienced in the control plane after a disaster. Figure 4 shows i) the number of virtual links between switches and controllers that fail due to physical network equipment failure, and ii) the number of failed nodes where a controller is located for an increasing number of controllers deployed. We see that, as long as there are datacenters available outside of the disaster zone that meet latency requirements of the network, controllers are placed at these locations; but, in the disasterunaware scheme, controllers are placed in datacenters located at high-risk nodes.
In Fig. 5, resource consumptions of the two schemes are compared in terms of total number of links that are used for control communication. Our evaluations show that our approach (Min-Risk) yields a significant decrease in the number of disconnected switches with an increase in the capacity required. The increase in capacity requirement is correlated with the predicted disaster scale. Protecting the network from an EMP attack can be costly due to its extremely large scale, and even in this dramatic scenario, our design requires 25% more resources compared to disasterunaware design (Min-Resource) when three controllers deployed (see Fig. 5), to save as much as 50% of the switches getting disconnected from the control plane. In this setting, three controllers were enough for disasteraware design (Min-Risk) to provide the lowest risk possible. When we force the design to have more controllers, some nodes in risky zones are also used as controllers, and this increases disruptions. For the disaster-unaware scheme (Min-Resource), although more controllers do not necessarily mean better survivability, still we observe a sudden decrease in disruptions when we increase the number of controllers. The connections to and from the nodes that are failed during the disasters are not counted as disrupted.

VI. CONCLUSION AND FUTURE WORK
In this paper, we have shown that the current disasterunaware distributed control-plane architectures are not sufficient to provide resilience in the event of disasters due to disconnections in the control network. We presented a disaster-aware, efficient and distributed SDN control plane that jointly minimizes the control-plane disconnections due to disasters and resource consumption for the control-plane network. Our solution determines the number of controllers, and their placement along with control-plane topology and its mapping to the physical network. Our initial evaluation results are promising, and we plan to develop a practical heuristic that solves the problem within strict time constraints since solving this problem is NP-hard. Also, the adaptability to changing network conditions due to disasters needs investigation.