Marija Furdek
email: furdek@chalmers.se

Vincent W S Chan

Carlos Natalino

Lena Wosinska

Network-Wide Localization of Optical-Layer Attacks

Keywords: Optical network security, Physical-layer attack detection, Attack monitoring trails

Optical networks are vulnerable to a range of attacks targeting service disruption at the physical layer, such as the insertion of harmful signals that can propagate through the network and affect copropagating channels. Detection of such attacks and localization of their source, a prerequisite for secure network operation, is a challenging task due to the limitations in optical performance monitoring, as well as the scalability and cost issues. In this paper, we propose an approach for localizing the source of a jamming attack by modeling the worst-case scope of each connection as a potential carrier of a harmful signal. We define binary words called attack syndromes to model the health of each connection at the receiver which, when unique, unambiguously identify the harmful connection. To ensure attack syndrome uniqueness, we propose an optimization approach to design attack monitoring trails such that their number and length is minimal. This allows us to use the optical network as a sensor for physical-layer attacks. Numerical simulation results indicate that our approach obtains network-wide attack source localization at only 5.8% average resource overhead for the attack monitoring trails.

Introduction

Optical networks are critical communication infrastructure supporting a range of vital societal services and stakeholders. As such, they can be a target of deliberate attacks aimed at service disruption (SD) or eavesdropping by exploiting the inherent vulnerabilities of the optical devices [START_REF] Skorin-Kapov | Physical-layer security in evolving optical networks[END_REF]. While protection from eavesdropping relies on various methods for encryption at different layers of the networking stack, including the recent efforts in Quantum Key Distribution (QKD) systems, service disruption attacks threatening the advanced physical-layer paradigms, have not been adequately addressed so far. A plethora of physical-layer SD attack methods differs in terms of their level of sophistication, ease of implementation, damaging effects, their scope, extent, and persistence, ease of discovery, etc. For example, fiber cuts are relatively straightforward to implement, they affect all connections traversing the cut link, with the effect confined to that link, and are easy to discover.

One of the most harmful attack methods identified in the literature is power jamming. It is performed by inserting a harmful signal of excessive power into the fiber (e.g., by bending it [START_REF] Uematsu | Design of a temporary optical coupler using fiber bending for traffic monitoring[END_REF]), which reduces the amount of gain allocated to co-propagating optical channels and aggravates the physical-layer impairments in the fiber. The damaging effects of this attack technique are not necessarily confined to the primarily intruded link but may propagate through the network. Combined with the lack of accurate attack models, as well as limited availability of physical-layer information due to the high cost and sparse placement of Optical Performance Monitoring (OPM) devices, identification and source localization of attacks at the optical layer is very challenging.

Recent advancements in commercially available coherent receivers that provide a rich set of OPM parameters to the Network Management System (NMS), paired with the proliferation of machine learning (ML) techniques, enable a breakthrough in physical-layer security management. Instead of relying on strategic deployment of OPM devices to help localize security breaches, which is expensive and unscalable, attack management can now leverage the ample OPM information obtained from the receivers at the destination of each connection, where they need to be detected anyway. This extensive set of OPM data can then be exhaustively analysed by applying ML techniques which allow to identify intricate relationships among the various parameters under different security regimes.

In our previous work, we have experimentally investigated the detection of harmful signals to identify signatures of jamming attacks of varying intensities. To this end, we developed machine learning approaches based on supervised [START_REF] Natalino | Field demonstration of machine-learning-aided detection and identification of jamming attacks in optical networks[END_REF] and unsupervised learning [START_REF] Furdek | Experiment-based identification of service disruption attacks in optical networks[END_REF], that analyzed the OPM data obtained for a particular connection, and identified whether it has been affected by a jamming attack. The approaches based on supervised learning were able to achieve 100% accuracy in attack identification [START_REF] Natalino | Field demonstration of machine-learning-aided detection and identification of jamming attacks in optical networks[END_REF], while previously unseen (zero-day) attack scenarios were detected in up to 92% of occurrences [START_REF] Furdek | Experiment-based identification of service disruption attacks in optical networks[END_REF]. In spite of the favorable performance of these approaches for detecting disruption at the connection level, localizing the source of a harmful signal at the network level requires a network-wide approach.

To this end, we propose an approach for network security diagnostics based on correlating the health of multiple connections upon their detection at the receiver and localizing the attack source according to the subset of degraded connections. We focus on the worst-case jamming attacks where we assume that any individual connection can carry a jamming signal, which can then affect the co-propagating connections along its entire physical path (i.e., there is no mechanism of thwarting the harmful signal propagation). This allows us to provide a general model for localizing the source of a harmful signal, which can easily be adapted to more specific cases by fine-tuning the assumptions. The scope of the damage from a jamming signal is modeled by defining binary words which we refer to as attack syndromes. Attack syndromes, if unique, provide a way of using the network as a sensor capable of diagnosing the security status of the network and identifying the harmful connection. To support such functionality, we develop an approach for generating unique attack syndromes in the network by sparse addition of attack monitoring probes such that their number and length is minimal.

The remainder of the paper is organized as follows. Section 2 overviews the related work. Section 3 explains the concept of proposed attack syndromes, their significance and formation. The problem of designing attack monitoring trails that ensure unique attack syndromes is formulated as an integer linear program in Section 4. Section 5 evaluates the performance of the proposed approach, while Section 6 outlines the remaining challenges and concludes the paper.

Related Work

Studies [START_REF] Mas | Failure location algorithm for transparent optical networks[END_REF][START_REF] Wu | Crosstalk attack monitoring and localization in all-optical networks[END_REF][START_REF] Rejeb | Multiple attack localization and identification in all-optical networks[END_REF] focus on the detection of jamming attacks. In [START_REF] Mas | Failure location algorithm for transparent optical networks[END_REF], the authors leverage alarms raised by the network components. Binary trees are formed based on the established channels and the deployed devices to reduce the time needed to analyze an alarm received by the centralized NMS. In [START_REF] Wu | Crosstalk attack monitoring and localization in all-optical networks[END_REF], another centralized approach is proposed, relying on monitors and diagnostic lightpaths to improve attack detection efficiency. A distributed approach from [START_REF] Rejeb | Multiple attack localization and identification in all-optical networks[END_REF] detects jamming attacks by tracking power levels of each connection at every port of each node in the network and forwarding the diagnostic procedure upstream until the source node of the harmful signal is located. The effectiveness of these procedures heavily depends on the assumptions of a particular attack method (e.g., monitoring only power to detect power jamming). Moreover, alarming the components for all types of attacks is costly, while monitoring all signals at all ports is expensive and unscalable. A mechanism based on constant sensing and reporting of numerous individual active monitors does not scale well with the size and the agility of future optical networks. In addition, such procedures increase the NMS complexity and stress the limited capability of network processing units, as the total amount of monitored information and signalling grows linearly with the number and size of network elements, and the number of connections. Therefore, we propose an approach that leverages only the information about connection health available at the receiver to form attack syndromes, while sparsely adding attack monitoring trails to resolve potential syndrome ambiguity.

The concept of monitoring trails has been thoroughly investigated in the context of link failure detection. In [START_REF] Wen | Efficient fault-diagnosis algorithms for all-optical WDM networks with probabilistic link failures[END_REF], the authors applied information theory to derive a tight lower bound on the minimum number of probes per network edge needed for failure diagnostics. The optimal design of monitoring trails using Integer Linear Programming (ILP) for single-link failures was presented in [START_REF] Wu | Monitoring trail: On fast link failure localization in mesh all-optical networks[END_REF]. [START_REF] Babarczi | Adjacent link failure localization with monitoring trails in all-optical mesh networks[END_REF][START_REF] Ali | M-burst: A framework of SRLG failure localization in all-optical networks[END_REF][START_REF] Tapolcai | Neighborhood failure localization in all-optical networks via monitoring trails[END_REF] proposed monitoring trail design to detect shared risk link group (SRLG) failures. While these approaches enable cost-efficient detection of failures of single or multiple geographically correlated links, our approach is concerned of detecting harmful connections that can traverse multiple links and affect different connections along their paths, requiring a connection-based approach.

Attack Syndromes for Unambiguous Localization of an Attack Source

The main idea of the proposed approach for attack source localization is to model the mutual attacking relations among the connections in the network, and deduce the source of an attack based on the subset of connections registered as degraded upon an attack occurrence. We use a simple example shown in Fig. 1 depicting a network with 6 nodes (A to F) and 4 connections (c 1 to c 4 ) to explain the basic concepts and structures used in the proposed approach. The attacking relations among connections are modeled using an attack graph (AG) and the corresponding attack diagnostic matrix A. Each connection c i in the network is represented by an AG node. The AG element c i is adjacent to all other connections c j that are affected in case c i carries a harmful signal.

The dimensions of the attack diagnostic matrix A match the number of connections in the network. Element A[i, j] is equal to 1 if a harmful signal inserted on connection c i can affect connection c j (i.e., if they are adjacent in AG), and 0 otherwise. In this way, row i represents the binary attack syndrome (AS) of connection c i . If the syndromes are unique, when NMS receives alarms reporting degradation of connections c j that are adjacent to c i in the AG, the received attack syndrome will match the one of c i , which will identify c i as the harmful connection. This is the case for the attack syndromes of all connections shown in Fig. 1.

However, attack syndromes of different individual connections can match and, hence, fail to provide unambiguous attack localization. Fig. 2(a) illustrates such a scenario using the same network topology as in Fig. 1, and a different set of connections. As can be seen in the attack matrix, the attack syndromes of connections {c 1 , c 2 , c 3 } are identical, as well as those of {c 4 , c 5 }. We refer to the set of connections with matching attack syndromes as a Cluster of Ambiguous Attack Syndromes (CLAS). As can be seen from the attack graph in Fig. 2(a), there are two CLASes, denoted with ϑ 1 and ϑ 2 , and connections inside each CLAS ϑ2 CLAS form a clique (not necessarily maximal) in the AG. In general, a CLAS may be a part of a larger clique in the AG, where the attack syndromes of the CLAS non-members are differentiated due to their adjacency to other connections outside of the clique. Attack syndrome disambiguation can be aided through judicious resource assignment, aimed at avoiding the creation of CLASes, minimizing their number or size [7]. However, such approaches cannot guarantee complete elimination of CLASes as a prerequisite for unambiguous identification of harmful connections. Therefore, we propose an approach for adding attack monitoring trails in the network which guarantee to break the ambiguity of indistinguishable attack syndromes, while minimizing the number and the length of added trails.

c 1 c 3 c 4 c 2 c1 c2 c3 c4 c1 c2 c3 c4 1 1 1 0 1 1 0 0 1 0 1 1 0 0 1 1 c1 c2 c3 c4 c1 c2 c3 c4 1 1 1 0 1 1 0 0 1 0 1 1 0 0 1 1 Attack graph:
1 1 1 0 0 1 1 1 0 0 0 0 0 1 1 c1 c2 c3 c5 c1 c2 c3 c4 c5 c1 c2 c3 c4 c5 T1 T2 1 1 1 0 0 1 1 0 0 0 1 1 1 - c1 c2 c3 c4 c5 c1 c2 c3 c4 c5 T1 T2 1
The example in Fig. 2(b) illustrates how to resolve attack syndrome ambiguity through sparse addition of dedicated attack monitoring trails. In general, in order to distinguish among attack syndromes of |ϑ| connections in CLAS ϑ, log 2 |ϑ| distinguishing bits need to be added to their respective attack sydromes, i.e., we need to probe log 2 |ϑ| individual network links. Any link to be probed for AS disambiguation needs to be traversed by one up to |ϑ| -1 connections from the CLAS ϑ (otherwise it does not provide any extra information about the harmful connection). For the example in Fig. 2 In order to be resource-efficient, the total number of attack monitoring trails in the network, as well as their length, should be minimized. Therefore, each trail should traverse multiple individual links selected for probing. When deciding which candidate links to select for probing, and how to establish the attack monitoring trails over those links, two main constraints must be taken into account:

-The binary suffixes formed by the bits added to the attack syndromes of connections in the same CLAS by the established attack monitoring trails must be unique, and -A monitoring trail should not include multiple candidate links intended to break attack syndrome ambiguity of connections in the same CLAS.

A feasible solution with two attack monitoring trails, denoted as T 1 and T 2 is shown in Fig. 2(b). T 1 is a multi-link trail that traverses link D-A to disambiguate the syndromes of connections in CLAS ϑ 1 , and link A-B to disambiguate the syndromes in CLAS ϑ 2 . As there are 3 connections in ϑ 2 , link C-F is used for trail T 2 . The suffixes added by T 1 and T 2 in the attack matrix in Fig. 2(b) are shown in bold. In the next section, we present an ILP for the establishment of attack monitoring trails that ensure unique attack syndromes and, hence, unambiguous identification of the harmful connection, while minimizing the number and the length of the trails.

Design of Probing Trails for Attack Localization

Problem Definition

Given is a physical network topology and a set of routed optical connections. The network topology is modeled as a graph G=(V, E), where V denotes a set of vertices representing network nodes, and E denotes a set of edges, representing directed network links. The set of routed optical connections is denoted as C, where each connection c ∈ C traverses a set of links P c along its path from the source node s c to the destination node d c . Based on the assignment of resources to the connections, the mutual attacking relations among them are identified a priori and given in form of an attack graph and a corresponding attack matrix, that allows for derivation of the attack syndromes. Consequently, the set of Clusters of Ambiguous Attack Syndromes (CLASes), denoted with Θ, is also given. Our objective is to set up attack monitoring trails in the network which will ensure disambiguation among matching attack syndromes of the connections in such a way that the number and the length of the added trails is minimal. To do so, we must first determine the individual links in the network whose probing enables attack syndrome disambiguation, followed by the routing of the attack monitoring trails over the links identified in the previous step.

ILP Formulation

Input parameters -G(V, E): a directed graph where V is the set of vertices that represent the network nodes, and E is the set of arcs that represent the network links.

Each link e is defined by its source node o e and destination node t e ; -C: a set of connections, where each connection c ∈ C is defined by its source node s c , destination node d c and physical route π c ; -Φ: connection routing, where φ c e is equal to 1 if connection c traverses link e; -Θ: a set of CLASes. Each CLAS ϑ ∈ Θ comprises connections that have matching attack syndromes. In order to disambiguate the attack syndromes of lightpaths in CLAS ϑ, log 2 |ϑ| links need to be probed; -F : probe-CLAS mapping matrix, where F ϑ,p is equal to 1 if probing link p contributes to the disambiguation of attack syndromes for CLAS ϑ.

-H: probe-connection mapping matrix, where H c,p is equal to 1 if probing link p contributes to the disambiguation of the attack syndrome for connection c; -P: set of links that need to be probed, and may be concatenated into attack monitoring trails; -T : set of attack monitoring trails, |T | initiated to |P|; -M : a large constant, set to 1000.

Variables

The objective of the approach is to minimize the total number of attack monitoring trails established in the network, and their total length in terms of link count.

Constraints

∆ c = p 10 p • α c p • H c,p , ∀c ∈ C. (2)
Constraint ( 2) calculates the decimal value of the attack syndrome binary suffix formed by the probed links.

∆ c = ∆ d , ∀c, d ∈ C : c, d ∈ ϑ, c = d. (3)
M • α c p ≥ e∈E α c,p e , ∀c ∈ C, ∀p ∈ P. (4)
α c p ≤ e∈E α c,p e , ∀c ∈ C, ∀p ∈ P. (5)
Constraints ( 4)-( 6) ensure that probed link p is marked as affected by connection c if they share any common link e.

t∈T β t p ≥ 1, ∀p ∈ P. (7)
M • η t ≥ p∈P β t p , ∀t ∈ T . (8)
β t p ≤ η t , ∀p ∈ P, ∀t ∈ T . (9)
β t p + β t r ≤ 2 -F ϑ,p • F ϑ,r , ∀t ∈ T , (10)
∀ϑ ∈ Θ, ∀p, r ∈ P : F ϑ,p = F ϑ,r = 1, p = r.

Constraints (7)-( 9) make sure that each probed link is included in an active attack monitoring trail. Constraint [START_REF] Tapolcai | Neighborhood failure localization in all-optical networks via monitoring trails[END_REF] guarantees that two probed links p and r which are used for disambiguation of attack syndromes within the same CLAS ϑ are not included in the same trail.

v∈V δ t v = η t , ∀t ∈ T . ( 11
)
v∈V δ t v = η t , ∀t ∈ T . ( 12
)
δ t v + δ t v ≤ 1, ∀t ∈ T , ∀v ∈ V. (13)
Constraints ( 11)-( 13) assign a source and a destination node to each active trail t.

t,p e = γ p e ∧ β t p , ∀T ∈ T , ∀p ∈ P, ∀e ∈ E.

t,p e = γ p e ∧ (1 -β t p ), ∀t ∈ T , ∀p ∈ P, ∀e ∈ E.

Constraints ( 14) and (15) model the relation between trail t and probe p that matches link e. Symbol ∧ represents the logical AND operation in a compact form.

Relation a = b ∧ c is linearized as a ≥ b + c -1; a ≤ b; a ≤ c. M • γ t e ≥ p∈P t,p e , ∀t ∈ T , ∀e ∈ E. ( 16
) M • (1 -γ t e ) ≥ p∈P t,p e , ∀t ∈ T , ∀e ∈ E. (17)
γ t e ≤ η t , ∀t ∈ T , ∀e ∈ E.

Constraints ( 16) and ( 17) model the dependency of the attack monitoring trail routing on the arrangement of probed links which they include or exclude. According to (16), trail t must traverse link e if there exists a probe p which matches e and is included in t. Correspondingly, t is not allowed to traverse link e if it is used by probe p that is excluded from t. Constraint (18) ensures that only active trails use links.

e∈E:v=oe

γ t e -e∈E:v=te

γ t e -1 + M • x t v ≥ 0, ( 19
) ∀t ∈ T , ∀v ∈ V. δ t v ≤ M • (1 -x t V ), ∀t ∈ T , ∀v ∈ V. (20) e∈E:v=te
γ t e -e∈E:v=oe

γ t e -1 + M • y t v ≥ 0, (21) ∀t
∈ T , ∀v ∈ V. δ t v ≤ M • (1 -y t v ), ∀t ∈ T , ∀v ∈ V. (22)
e∈E:v=oe γ t e -e∈E:v=te

γ t e + M • z t v ≥ 0, (23)
∀t ∈ T , ∀v ∈ V.

1 -δ t v ∧ δ t v ≤ M • (1 -z t v ), ∀t ∈ T , ∀v ∈ V. (24)

Numerical Results

We evaluate the performance of the proposed approach in terms of the generated CLASes and the resources needed for attack diagnostics. The ILP was imple- mented in Optimization Programming Language (OPL) and solved with CPLEX v12.8 running on a Red Hat Enterprise Linux workstation with 16-cores Intel Xeon processor and 64 GB of RAM. The investigated topologies, shown in Fig. 3, were a dummy network with 6 nodes and 18 unidirectional links (Fig. 3(a)), Polish network with 12 nodes and 36 links [START_REF] Orlowski | Towards secure optical networks: A framework to aid localization of harmful connections[END_REF] (Fig. 3(b)), and the NSF network with 14 nodes and 42 links (Fig. 3(c)).

For each topology, we considered a low, medium and high traffic load, by randomly generating uniformly distributed traffic matrices with {2, 3, 5} connection requests per node for the 6-node network, {4, 6, 11} for the Polish, and {5, 7, 13} for the NSF network, respectively. The requests were routed over the shortest physical path, the resulting CLASes were extracted using a C++ script, and fed to the ILP solver. The reported results are averaged over 10 traffic matrices.

To illustrate the need for attack syndrome disambiguation, Fig. 4(a) shows the percentage of connections whose attack syndromes are not unique. For the 6-node and the Polish 12-node network, attack syndromes of 23% connections on average are ambiguous, while this value for the NSF network is 12%. The percentage of AS-ambiguous connections in the 6-node and Polish network decreases for higher loads, which can be explained by a greater number of diverse connections disambiguating each other's syndromes. The average number of CLASes and their respective size are shown in Fig. 4(b) and (c), respectively. The number of CLASes in the 6-node network ranges between 1 and 2, while the Polish and the NSF network test cases have between 3 and 4.9 CLASes. The 6-node and the NSF network have between 2 and 3 connections in each CLAS (denoted with the error bars in Fig. 4(c)), while the maximum CLAS size in the Polish network equals 4, yielding an average CLAS size of just above 2 for all networks. The number of links which must be probed in order to resolve the ambiguity of the attack syndromes is shown in Fig. 5(a). For the 6-node network, probing on average 1.8 links over all scenarios provides the necessary distinguishable suffixes in the attack syndromes of the connections inside each CLAS. In the Polish and the NSF network, on average 5.6 and 4 links need to probed, respectively. If we assume that only single-link monitoring probes are applied, i.e., there is no concatenation of the probing links into attack monitoring trails, probing each link would require one pair of transponders, and the number of probing links would translate into the number of necessary transponder pairs. Concatenating the probing links into monitoring trails reduces this cost. As shown in Fig. 5(b), our approach requires 1.5, 2.87, and 2.3 attack monitoring trails on average for the three networks, respectively. Establishing multi-link monitoring trails reduces the respective number of necessary transponder pairs by 15.2%, 49.1%, and 44%. The hop count of the established trails is shown in Fig. 5(c). On average over all test cases, attack monitoring trails traverse 2.09, 3.8, and 3.1 links in the 6-node, Polish, and NSF network, respectively. The trails incurred a resource usage overhead of 9.45%, 5.72% and 2.25% for the three networks, respectively, or 5.8% on average over all instances. For the 6-node network, the ILP was solved in less than 1 s, while the average running times for the Polish and the NSF network were 32.8 s and 28.9 s, respectively.

Conclusions and Future Work

This paper investigated scalable and resource-efficient localization of harmful connections inserted in the network with the goal of disrupting co-propagating optical channels. The proposed approach is based on leveraging OPM data available from the receivers and forming binary attack syndromes that reflect the health of each connection. To ensure the attack syndromes are unique, which is essential for correct identification of the harmful connection, we developed an ILP for sparse addition of attack monitoring probes of minimal number and length. The simulation results indicate that complete attack syndrome disambiguation can be achieved at only a minor resource overhead for the probes. For future work, we plan to investigate diagnostics of a broader range of attacks with different effects, while also incorporating the uncertainty of ML approaches in the detection of connection degradation caused by attacks. To enhance the scalability of the framework, low-complexity heuristic solutions will be developed.

Fig. 1 .

 1 Fig. 1. An illustrative example with unique attack syndromes for all connections.

  , c2: A→C, c3: B→F, c4: F→A, c5: E→D c5 c4 CLAS ϑ1

Fig. 2 .

 2 Fig. 2. An illustrative example with ambiguous attack syndromes (a), resolved by adding two attack monitoring trails T1 and T2 (b).

  (b), disambiguation of CLAS ϑ 1 requires probing log 2 |ϑ 1 | = log 2 3 = 2 links (candidate links: A-B and C-F), while disambiguation of CLAS ϑ 2 requires probing log 2 |ϑ 2 | = log 2 1 = 1 link (candidates: F-E and D-A).

Constraint ( 3 )

 3 ensures distinctive attack syndrome suffixes of any two connections c and d in the same CLAS ϑ. α c,p e = φ c e • γ p e , ∀c ∈ C, ∀p ∈ P, ∀e ∈ E.

Fig. 3 .

 3 Fig. 3. Test topologies used in simulations: (a) 6-node dummy network, (b) Polish network, and (c) NSF network.

Fig. 4 .Fig. 5 .

 45 Fig. 4. The percentage of connections with ambiguous attack syndromes (a), the num-

  relate to the source node of trail t. If node v is the source of t, i.e., δ t v =1, then the control variable x t v in (20) takes on the value of 0, forcing the number of outgoing links from node v carrying t to be greater than the number of incoming links. Similar observations apply to constraints (21)-(22) and (23) -(24) which relate to the destination node and the intermediate nodes of t, respectively. Assuming |T | is upper-bounded by |P|, which is in turn upper-bounded by log 2 |C|, the number of variables is upper-bounded by |V|D(|C|log 2 |C| + log 2 2 |C|), where D is the maximum nodal degree. The number of constraints is upperbounded by |C| 2 + log 2 2 |C|(VDC + log 2 |C|).

	Constraints (19)-(24) ensure flow conservation of attack monitoring trails. Con-
	straints (19) and (20)

This work was supported by the CelticPlus project SENDATE-EXTEND and COST Action 15127 RECODIS.


Jing Zhu

Marija Furdek
email: furdek@chalmers.se

Carlos Natalino

Zuqing Zhu
email: zqzhu@ieee.org

How to Survive Targeted Fiber Cuts: A Game Theoretic Approach for Resilient SDON Control Plane Design

Keywords: Software-defined optical networks, control plane resilience, targeted fiber cuts, non-cooperative game

Software-defined optical networking (SDON) paradigm enables programmable, adaptive and application-aware backbone networks via centralized network control and management. Aside from the manifold advantages, the control plane (CP) of an SDON is exposed to diverse security threats. As the CP usually shares the underlying optical infrastructure with the data plane (DP), an attacker can launch physical-layer attacks to cause severe disruption of the CP. This paper studies the problem of resilient CP design under targeted fiber cut attacks, whose effectiveness depends on both the CP designer's and the attacker's strategies. Therefore, we model the problem as a noncooperative game between the designer and the attacker, where the designer tries to set up the CP to minimize the attack effectiveness, while the attacker aims at maximizing the effectiveness by cutting the most critical links. We define the game strategies and utility functions, conduct theoretical analysis to obtain the Nash Equilibrium (NE) as the solution of the game. Extensive simulations confirm the effectiveness of our proposal in improving the CP resilience to targeted fiber cuts.

Introduction

As the underlying infrastructure of backbone networks, optical networks support diverse vital network services and require efficient network control and management (NC&M) [START_REF] Lu | Highly-efficient data migration and backup for Big Data applications in elastic optical inter-datacenter networks[END_REF]. The widely accepted software-defined networking (SDN) Fig. 1: The data and the control plane of an SDON. paradigm decouples the network control and the data planes (CP and DP) [START_REF] Mckeown | OpenFlow: Enabling innovation in campus networks[END_REF]. In SDN, NC&M is carried out by logically centralized controller(s) in the CP, while the DP devices only need to execute packet forwarding/data transmission tasks. The controller(s) collect the status of DP devices to maintain a global view of the network, and then intelligently instruct the devices to perform corresponding tasks [START_REF] Li | Protocol oblivious forwarding (POF): Software-defined networking with enhanced programmability[END_REF]. By implementing SDN in optical networks, software-defined optical networks (SDONs) have the programmability and application-awareness that allow operators to flexibly customize networks and significantly expedite the launch of new services [START_REF] Zhu | Demonstration of cooperative resource allocation in an openflowcontrolled multidomain and multinational SD-EON testbed[END_REF][START_REF] Thyagaturu | Software defined optical networks (SDONs): A comprehensive survey[END_REF][START_REF] Zhu | Build to tenants' requirements: On-demand application-driven vSD-EON slicing[END_REF].

One of the essential problems in SDON planning is the design of the CP. As shown in Fig. 1, the CP of an SDON is generally composed of one or more controllers, each of which controls a subset of optical devices (e.g., optical transponders and switches) via signalling in control channels. As the traffic in each fiber link can reach Tb/s or even Pb/s, the CP should be well-designed to meet the requirements of low communication latency and high reliability [START_REF] Heller | The controller placement problem[END_REF]. To this end, previous studies investigated the disruptions due to random failures (e.g., random link cuts), and proposed several CP design schemes [START_REF] Li | Byzantine-resilient secure software-defined networks with multiple controllers in cloud[END_REF][START_REF] Chen | Leveraging master-slave openflow controller arrangement to improve control plane resiliency in SD-EONs[END_REF][START_REF] Zhao | Survivable control plane establishment with live control service backup and migration in SD-EONs[END_REF][START_REF] Mohan | Primary-backup controller mapping for Byzantine fault tolerance in software defined networks[END_REF][START_REF] Huang | Realizing highly-available, scalable and protocol-independent vSDN slicing with a distributed network hypervisor system[END_REF][START_REF] Yang | An efficient algorithm for constructing controller trees in SDN[END_REF][START_REF] Zhang | On resilience of split-architecture networks[END_REF][START_REF] Hu | On reliability-optimized controller placement for software-defined networks[END_REF][START_REF] Hock | Pareto-optimal resilient controller placement in SDN-based core networks[END_REF]. Nevertheless, they overlooked the threats from deliberate attacks disrupting the underlying network infrastructure.

Although logically decoupled, the CP and the DP of a backbone SDON typically share the same fiber infrastructure, which is vulnerable to various physicallayer attacks [START_REF] Skorin-Kapov | Physical-layer security in evolving optical networks[END_REF]. Targeted fiber cuts can result in severe disruption of the CP by interrupting communication among CP elements or increasing latency to an unacceptable level. Existing CP design schemes that protect from random failures do not guarantee robustness to targeted cuts. Unlike random cuts which are usually accidental, targeted cuts can be launched with embedded intelligence to boost the efficiency of the attack and aggravate its effects. A common attacker's strategy would be to sever the fiber links which are most critical for network operation. As existing CP design schemes usually use the shortest paths to route the control channels, they may concentrate on links with high betweenness centrality [START_REF] Rueda | Robustness comparison of 15 real telecommunication networks: Structural and centrality measurements[END_REF], which can be easily identified by attackers as possible targets. Therefore, preparing for the attackers' likely strategies of targeting links when disrupting the CP is paramount for resilient CP design. Hence, the problem can be viewed as a game between two rational entities (i.e., the CP designer and the attacker). To solve it, a game theoretic approach is needed, which, to the best of our knowledge, has not yet been applied for CP design.

In this paper, we consider an SDON under the threat from targeted fiber cuts, and address the problem of robust CP design with a game theoretic approach. We model the problem as a non-cooperative game between the CP designer and the attacker, and define the game strategies and the utility functions for both players. In the game, the designer tries to design the CP such that the damage from targeted fiber cuts is minimal, while the attacker aims at cutting the most critical links to maximize CP disruption. To solve the game, we conduct theoretical analysis to obtain the Nash Equilibrium (NE), which is widely accepted as the solution of a game [START_REF] Nisan | Algorithmic Game Theory[END_REF]. Simulation results confirm that under the guidance of the NE, the designer can mitigate the damage from attacks. This verifies the effectiveness of our proposal in increasing resilience of the CP under targeted fiber cuts.

The rest of the paper is organized as follows. Section 2 reviews the related work. The CP design problem as a non-cooperative game is described in Section 3. In Section 4, we analyze the NE to solve the game. Simulations are performed and the results are discussed in Section 5. Finally, Section 6 concludes the paper.

Related Work

Extensive efforts have been carried out to improve the performances and availability of the CP. The basic CP design problem of deciding how many controllers to deploy and where to place them has been formulated in [START_REF] Heller | The controller placement problem[END_REF]. In [START_REF] Li | Byzantine-resilient secure software-defined networks with multiple controllers in cloud[END_REF][START_REF] Chen | Leveraging master-slave openflow controller arrangement to improve control plane resiliency in SD-EONs[END_REF][START_REF] Zhao | Survivable control plane establishment with live control service backup and migration in SD-EONs[END_REF][START_REF] Mohan | Primary-backup controller mapping for Byzantine fault tolerance in software defined networks[END_REF][START_REF] Huang | Realizing highly-available, scalable and protocol-independent vSDN slicing with a distributed network hypervisor system[END_REF][START_REF] Yang | An efficient algorithm for constructing controller trees in SDN[END_REF][START_REF] Zhang | On resilience of split-architecture networks[END_REF][START_REF] Hu | On reliability-optimized controller placement for software-defined networks[END_REF][START_REF] Hock | Pareto-optimal resilient controller placement in SDN-based core networks[END_REF], the authors studied resilient CP design under various failure scenarios, which can be classified into controller failures, switch failures and link failures. To address controller failures, researchers have considered managing each switch by multiple controllers [START_REF] Li | Byzantine-resilient secure software-defined networks with multiple controllers in cloud[END_REF][START_REF] Chen | Leveraging master-slave openflow controller arrangement to improve control plane resiliency in SD-EONs[END_REF][START_REF] Zhao | Survivable control plane establishment with live control service backup and migration in SD-EONs[END_REF][START_REF] Mohan | Primary-backup controller mapping for Byzantine fault tolerance in software defined networks[END_REF][START_REF] Huang | Realizing highly-available, scalable and protocol-independent vSDN slicing with a distributed network hypervisor system[END_REF]. In [START_REF] Li | Byzantine-resilient secure software-defined networks with multiple controllers in cloud[END_REF], the authors applied Byzantine fault tolerant mechanism and studied the assignment of controllers to switches. CP design algorithms with various primary-backup models for controllers have been investigated in [START_REF] Chen | Leveraging master-slave openflow controller arrangement to improve control plane resiliency in SD-EONs[END_REF][START_REF] Zhao | Survivable control plane establishment with live control service backup and migration in SD-EONs[END_REF]. In [START_REF] Mohan | Primary-backup controller mapping for Byzantine fault tolerance in software defined networks[END_REF], both Byzantine fault tolerant mechanism and primary-backup model were used when addressing controller-switch mapping. To address switch failures, tree-like CP design that maximizes single-node failure survivability was proposed in [START_REF] Yang | An efficient algorithm for constructing controller trees in SDN[END_REF]. Assuming both switches and links can fail, the work in [START_REF] Zhang | On resilience of split-architecture networks[END_REF] proposed a controller placement scheme aimed at minimizing the connectivity loss between controllers and switches, while the study in [START_REF] Hu | On reliability-optimized controller placement for software-defined networks[END_REF] compared different controller placement schemes in terms of CP connectivity. For similar assumptions, the authors of [START_REF] Hock | Pareto-optimal resilient controller placement in SDN-based core networks[END_REF] introduced a Pareto-optimal framework for CP design to balance communication latency and resiliency. Nevertheless, none of these studies considered failures caused by deliberate physical-layer attacks.

A relatively straightforward method of attacking the optical infrastructure is disabling the fibers or optical nodes [START_REF] Skorin-Kapov | Physical-layer security in evolving optical networks[END_REF]. The impact of such attacks on the DP has been investigated in [START_REF] Iyer | Attack robustness and centrality of complex networks[END_REF][START_REF] Shen | On the discovery of critical links and nodes for assessing network vulnerability[END_REF][START_REF] Natalino | Content accessibility in optical cloud networks under targeted link cuts[END_REF]. The study in [START_REF] Iyer | Attack robustness and centrality of complex networks[END_REF] evaluated the robustness of large-scale network topologies under targeted attacks. In [START_REF] Shen | On the discovery of critical links and nodes for assessing network vulnerability[END_REF], the authors identified the critical nodes/links in a topology, whose removals would minimize the network connectivity. The work in [START_REF] Natalino | Content accessibility in optical cloud networks under targeted link cuts[END_REF] studied how targeted fiber cuts affect the robustness of fiber-based content delivery networks. Given the CP, our previous work [START_REF] Zhu | Control plane robustness in software-defined optical networks under targeted fiber cuts[END_REF] evaluated the CP robustness under targeted fiber cuts. These investigations suggested that the intelligence of attackers in selecting targets plays an important role, and this motivates us to leverage game theory for CP design. Game theory is a powerful mathematical tool to analyze the competition and cooperation among rational decision-makers, and has been used to solve the problems of network topology design in [START_REF] Nahir | Topology design of communication networks: A game-theoretic perspective[END_REF][START_REF] Ciftcioglu | Topology design games and dynamics in adversarial environments[END_REF]. In [START_REF] Nahir | Topology design of communication networks: A game-theoretic perspective[END_REF], a multi-player game was formulated to assist each node with neighbor selection in order to optimize link establishment price, path delay and proneness to congestion. A dynamic game for network topology design was modeled in [START_REF] Ciftcioglu | Topology design games and dynamics in adversarial environments[END_REF], where the designer and attacker add and remove links so as to maximize their utilities in terms of considered network properties (e.g., connectivity) and operational costs.

Game Model for Control Plane Design

We consider a backbone SDON, whose optical infrastructure carries the mutually disjoint control and data plane. The physical topology is modeled as an undirected graph G(V, E), where V and E represent the sets of nodes and undirected fiber links, respectively. Each node v ∈ V hosts an optical switch and/or a network controller. The subset of nodes that host controllers is denoted by U , where the number of controllers |U | is given a priori. Each edge e ∈ E denotes a fiber link that can carry data and/or control channels (i.e., in-band control). The set of links that carry control channels is denoted by L. Consequently, U and L constitute the CP topology G c (U, L). Each controller manages a cluster of switches, while, for simplicity, we assume that each switch is under control of a single controller 3 . As an attacker can launch fiber link cut attacks aimed at disrupting the CP property (e.g., connectivity and communication latency) to the largest extent, a designer needs to design a resilient CP by carefully determining the sets U and L. In general, fiber cuts can disrupt the communication between switches and controllers, among the switches, and among the controllers. Here, we focus only on the communication between switches and controllers. The problem of designing a resilient CP can be viewed as a two-player non-cooperative game between the designer and the attacker as shown in Fig. 2. In the game, the players' strategies and utility functions are as follows.

The finite strategy space of the designer is denoted as where s d i refers to a specific CP design strategy of determining U and L. An example strategy s d i is to minimize |L|, as proposed in [START_REF] Hu | The energy-aware controller placement problem in software defined networks[END_REF]. By implementing a strategy s d i , the designer obtains a CP solution at the cost D i , which relates to |L| and can be expressed as:

S d = {s d 1 , s d 2 , • • • },
D i = f 1 (|L|). (1)
Here, f 1 (•) is assumed to be a linear increasing function of |L|, as a higher number of links included in the CP would increase both its capital and operational expenses [START_REF] Hu | The energy-aware controller placement problem in software defined networks[END_REF]. Meanwhile, the attacker aims at maximizing CP disruption Fig. 2: An example of a non-cooperative game between the network designer and the attacker. by deliberately cutting n critical links, whose set is denoted as

E c (|E c | = n).
The finite strategy space of the attacker is denoted as S a = {s a 1 , s a 2 , • • • }. An example strategy s a j is to select links whose removal minimizes the connectivity of G c (U, L), i.e., maximizes the number of disconnected controller-switch pairs. Each s a j corresponds to a cost A ij , which is also related to the designer's strategy s d i . For instance, in the simple SDON example shown in Fig. 2 for |U | = 2, the designer has established a CP by placing two controllers at nodes 2 and 6, and routing the control channels over the paths marked by the dashed lines. In this case, assuming n = 1, the attacker is likely to cut link 2-3.

The cost A ij relates to both n and the geographical distribution of the links in E c , and can be written as:

A ij = f 2 (n, e1,e2∈Ec x e1,e2 ), (2)
where x e1,e2 is a boolean variable with value equal to 1 if two links e 1 and e 2 do not share any end-nodes and 0 otherwise. f 2 (•) is a linear increasing function of n and x e1,e2 which ensures that cutting more, and non-adjacent links is more costly. Once the designer and the attacker select s d i and s a j to take their actions, the SDON is left with a CP affected by n fiber cuts. The CP's property in terms of controller-switch connectivity and communication latency can be described by:

P ij = f 3 (c(n), l(n)). (3)
In Eq. (3), c(n) and l(n) are two CP metrics defined in [START_REF] Zhu | Control plane robustness in software-defined optical networks under targeted fiber cuts[END_REF], i.e., the average CP connectivity and the average CP transmission distance after n link cuts, respectively. f 3 (•) is a linear function of c(n) and l(n), which decreases with c(n) and increases with l(n). Upon an attack, the attacker obtains a gain of P ij while the designer suffers a loss of P ij . Based on D i , A ij and P ij , the utility functions F d ij and F a ij of the designer and the attacker, respectively, can be calculated as:

F d ij = -α • P ij -D i , F a ij = β • P ij -A ij . (4)
where α and β are constant coefficients. In the game, both players are rational in choosing strategies to benefit themselves unilaterally, i.e., to maximize their own expected utilities.

Table 1: Game in Strategic Form

s a 1 s a 2 • • • s d 1 (F d 11 , F a 11 ) (F d 12 , F a 12 ) • • • s d 2 (F d 21 , F a 21 ) (F d 22 , F a 22 ) • • • • • • • • • • • • • • •
Table 1 shows the game in strategic form. For example, when the two players act with strategy profile (s d 2 , s a 1 ), their utilities would be F d 21 and F a 21 , respectively. Assuming that s d 2 creates the CP solution shown in Fig. 2 and s a 1 cuts links 2-3 and 4-5, all nodes can still connect to their own controllers, but nodes 3 and 5 have to use longer paths for control channels, resulting in c(2) = 1 and l(2) = 1458 km. Therefore, we obtain

F d 21 = -α • f 3 (1, 1458) -f 1 (4) and F a 21 = β • f 3 (1, 1458) -f 2 (2, 1).
4 Nash Equilibrium for Control Plane Design

In the described game, each player tries to find their own best response to their opponent's strategy. Therefore, to obtain the design scheme that leads to a resilient CP, we need to find the strategy profile in which neither the designer nor the attacker can increase their utilities by unilaterally adjusting their own strategies, which is essentially the Nash equilibrium (NE) [START_REF] Nisan | Algorithmic Game Theory[END_REF]. In an NE, the designer's strategy is precisely the solution of the CP design problem. As each player in the game has a finite strategy space, the game admits at least one mixed-strategy NE [START_REF] Nisan | Algorithmic Game Theory[END_REF]. To obtain it, we formulate the game as optimization problems of the two players, and analyze their best response functions to derive the general form of the NE. Then, we adapt the formulations of the optimization problems to obtain the NE with a simplex-based method.

Notations and Variables:

-Φ d /Φ a : the utility matrix of the designer/attacker.

φ d /φ a : variable, the expected utility of the designer/attacker.

-y d : variables, the vector of probability distribution (y d 1 , y d 2 , • • • ) T to indicate how the designer selects strategies4 , (e.g., y d 1 is the probability that the designer selects strategy s d 1 ). -y a : variables, the vector of probability distribution (y a 1 , y a 2 , • • • ) T to indicate how the attacker selects strategies, (e.g., y a 1 is the probability that the attacker selects strategy s a 1 ). -y d * /y a * : variables, the best response function of the designer/attacker. -z d /z a : auxiliary variables, the vector with the form similar to y d /y a .

For the designer, we can formulate the game as the following optimization problem.

Objective:

Maximize φ d = (y d ) T • Φ d • y a . (5)
Constraints:

y d ≥ 0, 1 T • y d = 1, Φ d • y a ≤ 1 • φ d . (6)
The designer tries to maximize the objective function in (5) under the constraints in [START_REF] Hu | The energy-aware controller placement problem in software defined networks[END_REF]. The first two equations in ( 6) are the nonnegativity and regularity constraints for the probability distribution vector of strategy selection, while the third one ensures that the designer cannot increase their utility by changing the strategy.

Analogously, for the attacker, the game can be formulated as the following optimization problem.

Objective:

Maximize φ a = (y d ) T • Φ a • y a . ( 7
)
Constraints:

y a ≥ 0, 1 T • y a = 1, (Φ a ) T • y d ≤ 1 • φ a . (8)
Eqs. ( 7)-( 8) express the attacker's objective function and constraints, respectively.

Using the above formulations, the best response functions of both players can be expressed as:

y d * (y a ) = arg max y d φ d , (9)
y a * (y d ) = arg max y a (φ a ) . (10)
Specifically, given that the attacker selects strategies with y a , the designer uses [START_REF] Li | Byzantine-resilient secure software-defined networks with multiple controllers in cloud[END_REF] to obtain the best response y d * . Similarly, the attacker leverages [START_REF] Li | Protocol oblivious forwarding (POF): Software-defined networking with enhanced programmability[END_REF] to get their best response y a * to designer strategy y d . Hence, by definition, the NE can be derived as (y d * , y a * ), where y d * provides the solution of the CP design problem. In order to find (y d * , y a * ), we first adapt the above formulations of optimization problems by introducing z d = y d φ a and z a = y a φ d . The designer's optimization problem can be expressed as: Objective:

Maximize φ d = 1 1 T • z a . ( 11
)
Constraints: z a ≤ 0,

Φ d • z a ≥ 1. ( 12
)
The attacker's optimization problem is adapted as:

Objective:

Maximize φ a = 1 1 T • z d . ( 13
)
Constraints:

z d ≥ 0, (Φ a ) T • z d ≤ 1. ( 14
)
By applying the simplex-based Lemke-Howson algorithm in [START_REF] Nisan | Algorithmic Game Theory[END_REF], we solve the problems in ( 11)-( 14) in a coordinated way for z d and z a . Hence, the NE (y d * , y a * ) can be obtained as (

z d • 1 1 T z d , z a • 1 1 T z a )
, where

y d * = z d • 1
1 T z d provides the solution of the CP design problem. The complexity of the algorithm is at most O(M • N ), where M and N are the respective numbers of vertices of the polytopes defined by ( 12) and ( 14).

Simulation Results

In order to validate the proposed game theoretic approach for resilient CP design, we perform simulations on the SprintNET shown in Fig. 3 [START_REF] Zhu | Control plane robustness in software-defined optical networks under targeted fiber cuts[END_REF]. In the game, we assume that the designer has two strategies and the attacker has three strategies. The designer's strategies are:

s d 1 : the algorithm from [START_REF] Zhu | Control plane robustness in software-defined optical networks under targeted fiber cuts[END_REF], which places controllers at nodes with the highest degree, s d 2 : the genetic algorithm from [START_REF] Hu | The energy-aware controller placement problem in software defined networks[END_REF], which adopts the placement scheme that aims at minimizing the number of control links.

In both strategies, the shortest physical paths are used for control channels. The attacker's strategy is always to cut n links deemed most critical, i.e., whose cutting maximizes P ij . However, the link criticality assessment is based on three different assumptions:

s a 1 : the physical topology only (no CP considerations), s a 2 : the CP realized according to strategy s d 1 , s a 3 : the CP realized according to strategy s d 2 .

The coefficients α and β in the utility functions are set to ensure P ij D i /A ij , so that the attacker has the incentive to launch attacks and the designer to defend against them.

We first set the number of controllers and link cuts to |U | = 2 and n = 2, respectively. The resulting controller placement for the designer's strategies s d 1 and s d 2 , as well as the results of link cuts under the attacker's strategies s a 1 , s a 2 and s a 3 , are depicted in Fig. 3. For example, when the attacker adopts s a 2 , links 7-8 and 10-11 are cut, as the links deemed most critical under the assumption of strategy s d 1 applied for CP design. Based on this, Table 2 elaborates on the utilities of the two players under different strategy profiles, whose rationality can be analyzed as follows. As can be seen in the table, the designer always has higher utility when the attacker's utility is lower, regardless of the adopted strategies. For instance, if the designer's strategy is fixed to s d 1 , the attacker gains the maximum utility when it selects strategy s a 2 . This is because in s a 2 , the attacker detects the most critical links based on the CP implementation determined by s d 1 , which verifies that the attacker can maximize utility under the correct assumption of the designer's strategy. Under this strategy profile, i.e., (s d 1 , s a 2 ), the designer has the minimum utility of -92.8, which represents the largest loss on the CP resilience. Compared to the other two strategy profiles (i.e., (s d 1 , s a 1 ) and (s d 1 , s a 3 )), the utility of the attacker for (s d 1 , s a 1 ) is higher than that for (s d 1 , s a 3 ). This bears an important implication for the attacker -if the information about the CP implementation is not available, launching attacks based on criticality of links evaluated for the physical topology may be more favorable than that based on a CP implementation guess. Observations similar to above hold for the designer's strategy s d 2 as well. If the attacker's strategy is fixed, e.g., to s a 2 , the designer's utility under strategy s d 2 is lower than under s d 1 . This may seem counterintuitive as s a 2 is based precisely on the correct assumption of the CP implemented using s d 1 , yet s d 1 yields higher robustness than s d 2 . However, as indicated by the utilities for the other two attacker's strategy profiles, the CP implemented with s d 2 is more vulnerable than that implemented with s d 1 . If the designer chooses s d 2 , link cuts can be more damaging even when the attacker bases the link criticality assessment on the wrong assumption of the CP design strategy. Consequently, by analyzing the game, the designer tends to prioritize s d 1 for a more resilient CP, which is reflected in the resulting NE.

By solving the game in Table 2, we obtain an NE (y d * , y a * ) as ((0.746, 0.254) T , (0.0, 0.0, 1.0) T ), where the designer selects strategy s d 1 with the probability of 0.746 and strategy s d 2 with the probability of 0.254, while the attacker uses strategy s a 3 in all cases. Namely, in the NE, when the attacker uses s a 3 for their own benefit, the designer defends by selecting s d 2 with a comparatively lower probability. Hence, by following the NE, the designer can avoid large damages to the CP. We assess the game when the number of fiber cuts n changes within [START_REF] Chen | Leveraging master-slave openflow controller arrangement to improve control plane resiliency in SD-EONs[END_REF][START_REF] Hu | On reliability-optimized controller placement for software-defined networks[END_REF]. The NEs of the games are listed in Table 3. For example, when n = 1, the game is shown in Table 4, whose rationality can be analyzed similarly as the one in Table 2. In this game, the NE suggests that the designer should select s d 1 and s d 2 with probabilities of 0.493 and 0.507, respectively, to defend against the attack performed with s a 1 . When n changes from 2 to 5, the probability of selecting s d 1 by the designer is always higher than s d 2 , while the attacker would never use s a 2 otherwise the designer would suffer from the largest CP robustness loss, which violates the NE.

To gain insight into the CP solutions resulting from the NEs, we use two metrics to measure their properties in terms of the expected average CP connectivity c(n) and the expected average CP transmission distance l(n). These are calculated as:

c(n) = (y d * ) T • C • y a * , l(n) = (y d * ) T • L • y a * , . (15)
where both C and L are |S d | × |S a | matrices, each element of C is the average CP connectivity c(n) and each element of L is the average control channel transmission distance l(n) under the corresponding pure strategy profile. The pure strategy profile refers to the one in which both players select one strategy from their own strategy space deterministically. Figs. 4 and5 show the respective results of c(n) and l(n) under the NE. For comparison, we also provide the results under the best and the worst scenarios resulting from the pure strategy profiles, denoted with c b (n) and c w (n), respectively. Naturally, in Fig. 4(a), the average CP connectivity c(n) exhibits a downward trend when n increases. As shown in Fig. 4(a), c(n) is higher than c w (n), while Fig. 4(b) shows the advantage of l(n) over l w (n). This verifies that, guided by the NEs, the designer can mitigate the effectiveness of attacks, and thus improve the CP robustness. However, c(n) cannot reach c b (n), which is inevitable for the existence of an intelligent attacker. Note that, in Fig. 4(b), the (expected) average transmission distance of control channels can increase or decrease with n. The reason for the increase is that the control channels have to traverse longer paths, while the decrease occurs when the connectivity between some switch-controller pairs is lost and, thus, the control channels disappear.

Conclusion

This paper considered an SDON under the threat from targeted fiber cut attacks and studied the problem of resilient CP design. To solve it, we proposed a game theoretic approach where the problem was modeled as a non-cooperative game between the CP designer and the attacker, and defined the game strategies and the utility functions for both players. In the game, the goal of the designer was to minimize the CP connectivity and latency degradation caused by targeted fiber cuts, while the attacker aimed at maximizing the CP disruption by cutting the most critical links. Theoretical analysis were conducted to obtain the Nash Equilibrium (NE) as the solution. Extensive simulation results suggested that following the NE enabled the designer to avoid the worst-case scenario where the CP suffers the largest losses, which confirmed the effectiveness of the proposed game-theoretic approach in improving the CP resilience to targeted fiber cuts.

Fig. 3 :

 3 Fig. 3: SprintNET Topology.

Fig. 4 :

 4 Fig.4: The expected average CP connectivity and control channel length for different number of cut links. intelligent attacker. Note that, in Fig.4(b), the (expected) average transmission distance of control channels can increase or decrease with n. The reason for the increase is that the control channels have to traverse longer paths, while the decrease occurs when the connectivity between some switch-controller pairs is lost and, thus, the control channels disappear.

Table 2 :

 2 Game in strategic form with n = 2

	s a 1	s a 2	s a 3
	s d 1 (-84.1, 71.1) (-92.8, 77.8) (-83.1, 70.1)
	s d 2 (-102.6, 88.6) (-95.6, 79.6) (-116.5, 102.5)

Table 3 :

 3 NEs of Games with Different n

	n	y d *

Table 4 :

 4 Game in strategic form with n = 1

		s a 1	s a 2	s a 3
	s d 1	(-81.2, 69.2) (-86.5, 74.5) (-78.4, 66.4)
	s d 2	(-93.5, 80.5) (-88.4, 75.4) (-94.4, 81.4)

In more sophisticated scenarios, an optical switch can be assigned to multiple controllers to improve CP resiliency.

The superscript T in (y d 1 , y d 2 , • • • ) T represents the transposition operator.

This work was supported by the NSFC projects 61871357 and 61701472, CAS key project (QYZDY-SSW-JSC003), and NGBWMCN key project (2017ZX03001019-004). M. Furdek, C. Natalino, and L. Wosinska are supported in part by the COST Action 15127 RECODIS.

Control Plane


Andrew Lord
email: andrew.lord@bt.com

Albert Rafel

Michael Parker

Adrian Farrel

The Impact of the Optical Network on 5G -The Metro-Haul Project

Keywords: 5G, optical networks, KPIs, SDN, orchestration, slicing

de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Metro-Haul is an EU project in the 5G-PPP cluster that has been running since June 2017. It is focused on building the metro side of a future End-to-End (E2E) 5G network. The rationale behind the project is simple -we assume that an intelligent, dynamic and most importantly 5G-aware optical transport layer will assist far better in terms of performance and cost-effectiveness in the delivery and operation of 5G services, than a dumb and inevitably over-provisioned transport layer. Figure 1 [START_REF]Functional Architecture Specifications and Functional Definition[END_REF], provides an overview of the Metro-Haul network architecture, showing how it acts as the intelligent interface between the 5G access (fixed & wireless) and photonic core of the overall telecommunications network.

In this paper, we focus on the major benefits that Metro-Haul technology brings to 5G, and we describe them in terms of so-called Golden Nuggets (GNs). Once these are highlighted, we go on to unpack Metro-Haul's contribution to the crucial 5G E2E Key Performance Indicators (KPIs) -indicators that are effectively our project's measure of the effectiveness of Metro-Haul technology. Note that this technology extends from the physical layer to control plane and monitoring layers -in other words, improving the underlying physical performance, introducing dynamic service level monitoring for individual slices and finally implementing a Software Defined Networking (SDN) based orchestration capability that can dynamically provision existing and new 5G slices on demand. The monitoring is handled by a key Monitoring and Data Analytics function developed within the project which is built into the overall SDN framework as well as capitalizing on recent AI developments for complex decision making / autonomous operation.

Finally, we look at the planned Metro-Haul demonstrations designed to illustrate our impact on the KPIs. Although Metro-Haul still has more than a year to run, with many of the demonstration-based results still to come, we already can see the very wide ranging and deep impact that the project will have on E2E 5G-sourced networks in the future. As an ambitious 5G research project, Metro-Haul distinguishes itself through a set of three key technical innovations. These have been referred to elsewhere as Golden Nuggets and can be understood to be the key "take home" messages offered by the project, representing its unique selling point (USP) amongst the other 5G projects being investigated around the world. These key technical innovations centre around the optical technologies that Metro-Haul is investigating to cater for the enhanced bandwidth and network operation requirements that the 5G use cases are expected to exploit. In addition, Metro-Haul is also investigating open, multi-layer disaggregation as a means to offer economies of scale, simplify network inventory, and offer enhanced network operational agility and flexibility. Finally, related to parallel developments in the artificial intelligence (AI) control of complex and adaptive systems, Metro-Haul is also testing technologies that offer real-time performance monitoring and analytics, and a network planning tool to assist in optimised investment and deployment of network resources.

These key innovations are summarised as follows:

1

. High capacity & flexible Metro optical network with edge computing

This provides for a dynamic data plane with an intelligent control plane involving multiple network segments and layers, spanning multiple geographical Data Centre (DC) locations, and addressing resource heterogeneity including, notably, the optical transport. Without these data and control plane architectures, network resources supporting future 5G services would require enormous over-provisioning of both optical transport capacity across metro and core networks, and edge Data-Centre resources such as compute and storage.

Aspects of this first Metro-Haul innovation are being demonstrated in Berlin (Germany) in a use case scenario consisting of real-time video surveillance and lowlatency object tracking.

Open multi-layer disaggregated network

A systematic and unified approach based on model-driven development enables the SDN control of multilayer disaggregated and open transport networks, while allowing flexibility in deployment choices, extensibility for the integration of new technologies and agility in migration processes without vendor lock-in.

This particular aspect is being demonstrated in the city of Bristol (UK), featuring a crowd-sourced video broadcast use case scenario.

Real-time performance monitoring and analytics, and planning tool

A telemetry/monitoring framework that provides a global, real-time view of the E2E network performance. This new technology enables service configuration and reliable autonomous operation. It provides pro-active actions on early detection of issues. Machine-learning within the decision engine allows this new Metro-Haul technology to continually learn and improve as real network data is collected. It includes tools for stateof-the-art advanced planning, resource placement, and network re-optimization/reconfiguration, enabling holistic optimization across heterogeneous resources.

Aspects of this third innovation are to be found in the Metro-Haul "portable" control plane demonstrator, where all software components from the project partners are integrated into a single platform.

Metro-Haul KPIs

5G is well recognised as a disruptive technology with wide impact on a broad set of vertical industries (automotive, health, media, public safety, energy, IoT, and Industry 4.0), social infrastructures (entertainment, education, leisure activities), as well as impacting on the more conventional telecom players (operators, manufacturers/vendors, and service providers etc.) associated with communications technology. Critical to ensuring the social, environmental, and techno-economic success of 5G (as indicated by an associated widespread take-up and seamless interoperability between different 5G technologies) are a successful suite of emerging 5G standardisations, as well as an objective means of benchmarking the developing 5G technologies. This latter aspect will be based on a set of Key Performance Indicators (KPIs) and Key Quality Indicators (KQIs) appropriate for both the physical (PHY) and service (i.e. QoS/QoE) levels.

Reaching a common understanding and consensus of the 5G KPIs is now a critical aspect of 5G research -especially with many groups and projects around the world working on competing or complementary visions. Initially, 5G was conceived as a Radio Access Technology (RAT) providing an enhanced and upgraded technical solution to the earlier 3G and 4G mobile telephony and data technologies. However, as is always the case in technology evolution, convergence of disparate and independent technology areas also frequently provides an attractive opportunity to also improve end-user experience (e.g., via seamless and ubiquitous interconnectivity and new services) This convergence also achieves economies of scale on a unified platform (CapEx savings), improves overall efficiency of operation (OpEx savings), and enables new business models.

The Metro-Haul project is no exception to such a 5G trend -except that it is principally looking to understand 5G beyond the conventional RAT space, that is to say, to make the telecoms network that is closer to the core (i.e., the metro network) ready for the huge technical demands that new 5G services (i.e. eMBB, URLLC, mMTC use cases) will place on the overall network. Thus, Metro-Haul (as the name implies) is a metro-centric project.

Reflecting its metro-network emphasis, as well as its reliance on exploiting optical technologies to achieve the massive capacity increases with increased flexibility and efficiency of network operation, we have defined nine KPIs in the Metro-Haul project (Table 1) to assess the success of the Metro-Haul architecture to support vertical services enabled by 5G RAT technologies. We now discuss the Metro-Haul KPIs in greater detail, describing how the KPIs are defined, their context and use case application, and how they are to be measured. It is worth noting that aspects of these KPIs (e.g. targets, or how to be measured) is still work on progress and hence have yet to be completely defined.

KPI#1. Optical Point-to-Point connection set-up time (control plane across optical transport layer)

This KPI is the configuration time in the Optical Layer to set up or reconfigure services handling 5G applications enabled by the SDN-based management framework. The new optical nodes use disaggregated solutions. This KPI is composed of the following elements:

-Control plane latency and optical node reconfiguration delay.

-Time required to instantiate a network connection through the optical layer This KPI will be measured using traces from the SDN controller, and time stamps and protocol analysers. The target is under one minute.

KPI#2. Metro-Haul E2E Point-to-Point connection set-up time

This KPI is the connection set-up time between two Virtual Network Function (VNF) elements as part of a service slice, using the SDN-based management framework. It includes Packet over an Optical Point-to-Point Connection.

This KPI is composed of the following elements:

-The VNFs, which are already available in the Virtual Machines (VMs) -Control plane latency and device reconfiguration latency -Time required to instantiate a network service -Time required to create and install all required flow entries The target time for this KPI is under two minutes.

KPI#3. Set-up time of network service slice across Metro-Haul

This KPI is the time to set up a network slice as a set of interconnected VNFs, and the target is under one hour.

KPI#4. Capacity of Controller

This KPI is the maximum number of Netconf devices that a single SDN optical controller can support. The target is the control of 10 -100 nodes (AMENs/MCENs, i.e., Open Disaggregated ROADMs (Reconfigurable Optical Add Drop Multiplexers).

KPI#5. Fault/degradation detection time

This KPI is the time between the instant a fault/degradation actually happens (e.g., some threshold is violated or an unexpected trend is confirmed) until it is detected. The target for this KPI is still to be defined.

KPI#6. Capacity of Metro-Haul infrastructure

This KPI is measured as the number of service instances that can be supported. This capacity combines the optical connections and AMEN capacities (throughput, storage, and computing). The specific services that are used to assess the capacity and the specific services configuration are still to be defined.

KPI#7. New Optical Components/Systems

This KPI relates to the new components being defined in the Metro-Haul and are still to be defined.

KPI#8. CapEx Reduction

This KPI relates to the relative cost reduction with respect to baseline network cost to support a predefined set of vertical services. The baseline network costs represent the costs of supporting the vertical services using current technologies and will be defined during the course of the project using techno-economic modelling comparisons.. The target is still to be defined.

KPI#9. Energy Consumption

This KPI is the reduction of energy consumption achieved using new node technologies (e.g., Photonic Integrated Circuits, filterless technology) and the dynamic service infrastructure (set-up/tear-down of services) relative to the energy use made by technologies that make the Baseline Metro Network (based on current network technologies). The target for this KPI will be defined during the project.

Use Case Scenarios

Having defined the Metro-Haul KPIs and the key technical innovations being investigated within the project, we now describe some of the important 5G use cases and scenarios for which we expect these 5G innovations to be particularly of advantage. The use case scenarios also provide an opportunity to measure, calibrate, and verify the Metro-Haul performance in a realistic 5G networking context by examining the performance of the technologies against the project KPIs.

The Metro-Haul project is focusing on three demonstration testbeds. These will exercise the key use case scenarios and will provide valuable test and measurement information with respect to the emerging Metro-Haul 5G optical technologies and network architecture solutions.

Crowdsourced Video Broadcasts

The Crowdsource Video Broadcast demonstration testbed will be hosted at the University of Bristol. The setup demonstrates the ability to provision low-latency compute resources and connectivity at the AMEN locations.

The overall architecture of the crowd sourced video broadcast demo is shown in Figure 2. It consists of 2 AMEN as aggregators and 1 MCEN node for core network access. The nodes are placed in active node locations of the UK National Dark Fibre Infrastructure so that the demonstration can run over this network.

The Bristol-based AMEN node has connection to the stadium and will aggregate crowd-sourced video stream traffic to client connections to transponder client ports. The site will also host compute nodes needed for VNFs and software components. The Reading node will use an emulator to generate similar high bandwidth video streams of the order of multiple 100G. Multiple wavelengths from AMEN node will congregate at MCEN node which will connect to the crowdsource video app software hosted in a cloud. Both the BT Adastral and Bristol Labs have the capability to host MCEN and AMEN nodes, with BT Adastral site hosting the MCEN.

The use case follows the partial disaggregated optical network scenario. Here, the Optical Line System (OLS) is managed as a single black box supporting different mux/transponders. This OLS "black box" transport system, is open to support Optical Channels from external Terminal Points (TPs) as client signals, whose characteristics are specified by the Single Wavelength Interfaces (SWI). An OLS North Bound Interface (OLS-NBI) API is needed to configure and report events from the OLS. This OLS-NBI should be standard to help in the process of vertical integration with the Open WDM Transport Controller of the whole WDM system.

Real-time Low-Latency Object Tracking

The Real-time Low-Latency Object Tracking demonstration testbed will be hosted in Berlin. This demonstration will show the ability to provision low-latency compute resources and connectivity at the AMEN locations. Utilizing these resources, realtime object tracking is performed by automatic control of PTZ (Pan-Tilt-Zoom) cameras based on analysis of video streams from fixed and mobile cameras as well as from thermal cameras.

The network constructed in support of this demonstration is shown in Figure 3. It is a metro-ring with three semi-filterless nodes (one MCEN and two AMENs) based on coherent transponders, filterless add/drop paths and wavelength blockers in the express path of the nodes. At the edge of the network are compute units integrated with AMENs and with locally attached IP cameras and Remote Radio Heads (RRH). The RRH is driven by a BBU (Base Band Unit) located in the MCEN's metro data centre, where the Core Node or EPC (Evolved Packet Core) is also located. Note that for practical reasons 4G technology will be used for this demo. Remote Participation Demonstration.

Remote Control Plane Demo

While the first two demonstrations require hardware to be physically located at the test sites, the remote participation demonstration is designed to facilitate inclusion of equipment that is not sited at the central demonstration site, and in particular is intended to allow testing of software components that can be hosted on computer equipment that is interconnected over the Internet. This environment is known as the Metro-Haul "portable" control plane demonstrator, where all software components from the project partners are integrated into a single platform.

The SDN architecture of the demonstration is based on the concept of hierarchical orchestration, serving data connectivity to an OSM-based NVF-O. The parent controller acts as the single entry-point for systems to request network resources, with two Metro-Haul nodes interconnected via the optical networks, with NFVI at each node to support VNFs according to the placement constraints. In addition, monitoring and data analytics are demonstrated in a testbed in Barcelona with monitoring probes incorporated in a Madrid-based testbed.

Figure 1 :

 1 Figure 1: The Reference Metro-Haul Network Architecture

TABLE 1 :

 1 Metro-Haul KPIs

	KPI	Category	Target
	1	connection set-up time Optical Point-to-Point	≤ 1 min
		Metro-Haul E2E Point-	≤ 2 min
	2	to-Point connection set-
		up time
		Set-up time of network	≤ 1 hr
	3	service slice across
		Metro-Haul
			Control of 10 -100
	4	Capacity of Metro-Haul Controller	nodes (AMENs/MCENs * , i.e., Open Disaggregated
			ROADMs)
	5	detection time Fault/degradation	To be defined
	6	Capacity of Metro-Haul infrastructure	100x more 5G capacity supported over the same optical fibre infrastructure
	7	Components/Systems New Optical	To be defined
	8	CapEx Reduction	To be defined
	9	Energy Consumption	To be defined

* AMEN -Access Metro Edge Node, MCEN -Metro Core Edge Node

Acknowledgment

The research leading to this paper has received funding from the European Commission for the H2020-ICT-2016-2 METRO-HAUL project (G.A. 761727). The authors would like to acknowledge the support of the partners of the Metro-Haul project.

More information about the Metro-Haul project can be found on the project's web site https://metro-haul.eu/

Conclusions

The paper has presented a snap shot of the current state of development of the EU Metro-Haul project. This project has identified key benefits of designing and operating a fully orchestrated E2E solution for 5G, including the optical transport layer as well as compute and storage functions. These key benefits have associated KPIs which provide a mechanism to quantify the benefit. Finally the paper has presented some of the demonstrations designed to prove Metro-Haul technology. The remaining, crucial techno-economic aspect will develop models designed to calculate performance, CAPEX and OPEX benefits -and this will be the topic of further work.