Survivor: An enhanced controller placement strategy for improving SDN survivability

TLDR

In SDN, forwarding devices depend on a logically centralized controller, so distributed controller architectures are adopted to avoid single‑point failures, yet current placement strategies are limited by single‑path modeling, reactive overload handling, and insufficient failover information. This paper introduces Survivor, a controller placement strategy designed to overcome those shortcomings. Survivor explicitly incorporates multiple path diversity, capacity constraints, and proactive failover mechanisms into the placement design. Evaluation against state‑of‑the‑art methods shows that Survivor markedly improves survivability through enhanced path diversity and capacity‑aware handling of overload during both normal and failover conditions.

Abstract

In SDN, forwarding devices can only operate correctly while connected to a logically centralized controller. To avoid single-point-of-failure, controller architectures are usually implemented as distributed systems. In this context, recent literature identified fundamental issues, such as device isolation and controller overload, and proposed controller placement strategies to tackle them. However, current proposals have crucial limitations: (i) device-controller connectivity is modeled using single paths, yet in practice multiple concurrent connections may occur; (ii) peaks in the arrival of new flows are only handled on-demand, assuming that the network itself can sustain high request rates; and (iii) failover mechanisms require predefined information, which, in turn, has been overlooked. This paper proposes Survivor, a controller placement strategy that addresses these challenges. The strategy explicitly considers path diversity, capacity, and failover mechanisms at network design. Comparisons to the state-of-the-art on survivable controller placement show that Survivor is superior because (a) path diversity increases the survivability significantly; and (b) capacity-awareness is essential to handle overload during both normal and failover states.