FPGA virtualization with accelerators overcommitment for network function virtualization

<span lang="EN-US">Network Function Virtualization (NFV) architectures are emerging to increase networks flexibility. However, this renewed scenario poses new challenges, because virtualized networks, need to be carefully verified before being actually deployed in production environments in order to preserve network coherency (e.g., absence of forwarding loops, preservation of security on network traffic, etc.). Nowadays, model checking tools, SAT solvers, and Theorem Provers are available for formal verification of such properties in virtualized networks. Unfortunately, most of those verification tools accept input descriptions written in specification languages that are difficult to use for people not experienced in formal methods. Also, in order to enable the use of formal verification tools in real scenarios, vendors of Virtual Network Functions (VNFs) should provide abstract mathematical models of their functions, coded in the specific input languages of the verification tools. This process is error-prone, time-consuming, and often outside the VNF developers’ expertise. This paper presents a framework that we designed for automatically extracting verification models starting from a Java-based representation of a given VNF. It comprises a Java library of classes to define VNFs in a more developer-friendly way, and a tool to translate VNF definitions into formal verification models of different verification tools.</span>

Network Function Virtualization (NFV) architectures are emerging to increase networks flexibility. However, this renewed scenario poses new challenges, because virtualized networks, need to be carefully verified before being actually deployed in production environments in order to preserve network coherency (e.g., absence of forwarding loops, preservation of security on network traffic, etc.). Nowadays, model checking tools, SAT solvers, and Theorem Provers are available for formal verification of such properties in virtualized networks. Unfortunately, most of those verification tools accept input descriptions written in specification languages that are difficult to use for people not experienced in formal methods. Also, in order to enable the use of formal verification tools in real scenarios, vendors of Virtual Network Functions (VNFs) should provide abstract mathematical models of their functions, coded in the specific input languages of the verification tools. This process is error-prone, time-consuming, and often outside the VNF developers' expertise. This paper presents a framework that we designed for automatically extracting verification models starting from a Java based representation of a given VNF. It comprises a Java library of classes to define VNFs in a more developer-friendly way, and a tool to translate VNF definitions into formal verification models of different verification tools.

Network softwarization technologies, such as software defined networking (SDN), network virtualization (NV), and network function virtualization (NFV), emerge and have been greatly promoted by their supporters. This softwarization scheme contributes to isolating network control from data panel, and allocating virtualized physical network resources flexibly. However, physical switches and links, supporting the softwarization scheme, may be attacked by malicious attackers. Even if these switches and links are softwarized and virtualized successfully, the problem of mapping various virtual network requests, known as virtual network embedding, is difficult to solve directly. Each customized VN request must be allocated and implemented in the appropriate manner. To deal with these issues, we research the virtual network mapping for secure SDN-enabled networks. Firstly, a hierarchical virtualization architecture for SDN- enabled networks is presented. Then, the security model for different malicious attacks is presented. Thirdly, we propose the novel and secure virtual network mapping framework, labeled as \textit{NoViSec}, for supporting SDN-enabled networks. Preliminary experiment results are plotted and discussed so as to validate the effectiveness of our secure \textit{NoViSec} framework.

The recent trends in software-defined networking (SDN) and network function virtualization (NFV) are boosting the advance of software-based packet processing and forwarding on commodity servers. Although performance has traditionally been the challenge of this approach, this situation changes with modern server platforms. High performance load balancers, proxies, virtual switches and other network functions can be now implemented in software and not limited to specialized commercial hardware, thus reducing cost and increasing the flexibility. In this paper we design a lossless software-based switch for high bandwidth data acquisition (DAQ) networks, using the ATLAS experiment at CERN as a case study. We prove that it can effectively solve the incast pathology arising from the many-to-one communication pattern present in DAQ networks by providing extremely high buffering capabilities. We evaluate this on a commodity server equipped with twelve 10 Gbps Ethernet interfaces providing a total bandwidth of 120 Gbps.

Chapter 12 - ICT Requirements and Recent Developments

Driven by the requirement of increasing performance and flexibility, networks are being softwarized by paradigms such as software-defined networking (SDN) and network function virtualization (NFV). These solutions reduce the complexity and the specialization of hardware devices, by extracting the inherently distributed control plane of forwarding network elements such as switches and routers, to a logically centralized control plane (referred as controller in SDN). The control plane acts as a broker between the network applications (e.g. monitoring, traffic engineering) and the data plane (i.e. physical network infrastructure). For scalability and robustness, the logically centralized control plane is implemented by physically distributing different controllers throughout the network. This chapter presents different solutions to increase the reliability of both planes: data and control planes. The reliability of the data plane can be increased by considering survivable virtual network embedding solutions. This chapter proposes a survivable embedding against single and double failures at either links or nodes. Furthermore, in order to provide a programmable and resilient data plane, BPFabric has been proposed for SDN which supports high performance functions suitable for detecting attacks. On the other hand, the reliability of the control plane applied to SDN can be addressed by considering enhanced controller placement solutions providing redundancy against uncorrelated as well as targeted failures while coping with latency and capacity requirements. Furthermore, a solution to increase the security and robustness of the control channel is also addressed in this chapter.

Traditional network resident functions (e.g., firewalls, network address translation) and middleboxes (caches, load balancers) have moved from purpose-built appliances to software-based components. However, L2/L3 network functions (NFs) are being implemented on Network Function Virtualization (NFV) platforms that extensively exploit kernel-bypass technology. They often use DPDK for zero-copy delivery and high performance. On the other hand, L4/L7 middleboxes, which usually require full network protocol stack support, take advantage of a full-fledged kernel-based system with a greater emphasis on functionality. Thus, L2/L3 NFs and middleboxes continue to be handled by distinct platforms on different nodes.This paper proposes MiddleNet that seeks to overcome this dichotomy by developing a unified network resident function framework that supports L2/L3 NFs and L4/L7 middleboxes. MiddleNet supports function chains that are essential in both NFV and middlebox environments. MiddleNet uses DPDK for zero-copy packet delivery without interrupt-based processing, to enable the ‘bump-in-the-wire’ L2/L3 processing performance required of NFV. To support L4/L7 middlebox functionality, MiddleNet utilizes a consolidated, kernel-based protocol stack processing, avoiding a dedicated protocol stack for each function. MiddleNet fully exploits the event-driven capabilities provided by the extended Berkeley Packet Filter (eBPF) and seamlessly integrates it with shared memory for high-performance communication in L4/L7 middlebox function chains. The overheads for MiddleNet are strictly load-proportional, without needing the dedicated CPU cores of DPDK-based approaches. MiddleNet supports flow-dependent packet processing by leveraging Single Root I/O Virtualization (SR-IOV) to dynamically select packet processing needed (Layer 2 to Layer 7). Our experimental results show that MiddleNet can achieve high performance in such a unified environment.

Due to the scarcity of labeled faulty data, Unsupervised Learning (UL) methods have gained great traction for anomaly detection and localization in Network Functions Virtualization (NFV) systems. In a UL approach, training is performed on only normal data for learning normal data patterns, and deviation from the norm is considered as an anomaly. However, it has been shown that even small percentages of anomalous samples in the training data (referred to as contamination) can significantly degrade the performance of UL methods. To address this issue, we propose an anomaly-detection approach based on the Noisy-Student technique, which was originally introduced for leveraging unlabeled datasets in computer-vision classification problems. Our approach not only provides robustness against training-data contamination, but also can leverage this contamination to improve anomaly-detection accuracy. Moreover, after an anomaly is detected, localization of the anomalous virtualized network functions in an unsupervised manner is a challenging task in the absence of labeled data. For anomaly localization in NFV systems, we propose to exploit existing local AI-explainability methods to achieve a high localization performance and propose our own novel AI-explainability method, specifically designed for the anomaly-localization problem in NFV, to improve the performance further. We perform a comprehensive experimental analysis on two datasets collected on different NFV testbeds and show that our proposed solutions outperform the existing methods by up to 22% in anomaly detection and up to 19% in anomaly localization in terms of F1-score.

The future Internet is envisioned to host a large number of virtual networks managed by different operators sharing the same physical infrastructure. In such a scenario, an operator may not even own physical resources as such, but lease virtual resources to have their own virtual networks. While control-plane virtualization with several routing instances becomes common in equipments, the data plane is generally shared relying on logical isolation or resource segmentation, lacking in efficient sharing with performance guarantees. This makes it necessary to look into layer 2, and virtualize the switching fabric to have control over the sharing of the most critical resources for packet switching. In this article, we come up with a flexible architectural design for virtualizing a switching fabric. This new architecture enables a multitude of choices to customize virtual switches as needed. Our simulations show the relative loss in performance brought by virtualization, and demonstrate how the offered flexibility can help in exploiting the resources in a new way, satisfying independent virtual switch requirements.

Software-based network functions (NFs) have seen growing interest. Increasingly complex functionality is achieved by having multiple functions chained together to support the required network-resident services. Network Function Virtualization (NFV) platforms need to scale and achieve high performance, potentially utilizing multiple hosts in a cluster. Efficient data movement is crucial, a cornerstone of kernel bypass. Moving packet data involves delivering the packet from the network interface to an NF, moving it across functions on the same host, and finally across yet another network to NFs running on other hosts in a cluster/data center. In this paper we measure the performance characteristics of different approaches for moving data at each of these levels. We also introduce a new high performance inter-host interconnect using InfiniBand. We evaluate the performance of Open vSwitch and the Open Net VM NFV platform, considering a simple forwarding function and Snort, a popular intrusion detection system.

The Network Function Virtualization (NFV) paradigm proposes to transform those network functions today running on dedicated and often closed appliances (e.g., firewall, wan accelerator) into pure software images, called Virtual Network Functions (VNFs), which can be consolidated and executed on high-volume standard servers. In this context, this dissertation focuses on the possibility of enabling each single end user (and not only network operators) to set up network services by means of NFV, allowing him to custoimize the set of services that are active on his Internet connection. This goal mainly requires to address flexibility and performance issues. Regarding to the former, it is important: (i) to support services including both network (e.g., firewall) and cloud (e.g., storage server) applications; (ii) to allow the user to define the service with an intuitive and high-level abstraction, hiding infrastructure-layer details. Instead, with respect to performance, multiple software-based services operating on the user's traffic should not introduce penalties in the user's Internet experience. This dissertation solves the above issues by proposing a number of improvements in the context of Network Function Virtualization, both in terms of high level models and architectures to define and instantiate network services, and in terms of mechanisms to efficiently interconnect VNFs. Experimental results demonstrate that the goal of allowing end users to deploy services operating on their own traffic is feasible without impacting the Internet experience

Enabling elastic scaling is the crucial advantage of Network Function Virtualization (NFV), of which the common usage is Service Function Chain (SFC). But how to scale SFC elastically on an NFV platform while ensuring performance and cost-effectiveness, remains to be vague and challenging. We propose ESFC, a user space service chain management framework to reallocate computing resource of each NF components dynamically based on real-time statistics, while minimizing performance overhead. The ESFC framework monitors load on a service chain at high frequency (1000Hz) and employs proactive resource allocation policy to enable elastic scaling. ESFC utilizes an asynchronous mechanism to notify the to-be-scaled NF, which will be reallocated with computing resources via thread. Moreover, ESFC adopts a perfect distribution algorithm to reduce cache invalidation and state migration while scaling, which are crucial to performance. The results show that ESFC could adjust the devoted resources dynamically and achieve up to 3x higher cost-effectiveness without compromising performance. Comparing with the latest popular SFC platform, ESFC achieves higher performance up to 1.3x under the same condition.

Today's communication networks process an increasing amount of traffic, while simultaneously providing services to a larger and more diverse quantity of devices. This enhances the complexity of the network and imposes a larger attack space, impacting network management and security efforts. Deployed hardware middle-boxes, like firewalls and Intrusion Detection Systems (IDSs) often lack the flexibility to adapt to this dynamic environment, which Network Function Virtualization (NFV) addresses by implementing these services in software. Yet, this may impose a bottleneck, due to the absence of hardware acceleration. To mitigate this drawback, the functionality can be offloaded to programmable hardware, using P4. In this work we implement an IDS, capable of operating in core and backbone networks up to 100Gbps. This is achieved by using the hardware acceleration of P4-enabled Intel <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">©</sup> Tofino™ switches for high performance metadata extraction, in order to train an ML-based detection engine. The system is evaluated regarding its throughput and obtainable aggregation levels as well as its accuracy for detecting a variety of network attacks.

The increasing adoption of Machine Type Communication (MTC) applications using the Long Term Evolution (LTE) brings new challenges for the traditional bearer allocation and network management. MTC devices are high in number, each requiring an individual bearer for a short data transmission; an inefficient process considering the signaling and management effort to the duration of the actual bearer use. This paper introduces the notion of a virtual bearer that can be shared among a number of MTC devices with similar Quality of Service (QoS) characteristics. The virtual bearer support at the MTC device side is based on the paradigm of Network Function Virtualization (NFV) and can migrate from one MTC device to another eliminating the need for individual device bearer establishment for both the radio and backhaul. The use of virtual bearers is enhanced by considering additionally MTC device-to-device (D2D) connectivity allowing devices without direct access to the network to use the virtual bearer via other devices, which act as gateways. Gateway devices may also be re-located dynamically based on NFV principles. In this way, a finer control is achieved on prioritizing certain services and providing load balancing. Our simulation results demonstrate the benefits of our proposed scheme compared to conventional approaches wherein MTC devices use individual bearers to send data in response to a trigger or according to a predetermined schedule.

One of the primary challenges associated with network functions virtualization (NFV) is the automated management of the service lifecycle. In this paper, we present a full software-based management and orchestration (MANO) stack which operates with OpenStack and OpenDaylight controllers and has the in-built functionality to automate the key phases of the NFV service lifecycle, namely resource discovery and matching, service mapping, service deployment, and monitoring. The MANO stack is being implemented by the EU FP7 project T-NOVA, with the components being released as open-source software. Service mapping and service deployment solutions developed in the scope of T-NOVA are presented in detail. As a proof-of-concept, we evaluate the performance of a virtualized traffic classifier network function, demonstrating the gains of virtualized hardware acceleration.