Metron

The recent trends in software-defined networking (SDN) and network function virtualization (NFV) are boosting the advance of software-based packet processing and forwarding on commodity servers. Although performance has traditionally been the challenge of this approach, this situation changes with modern server platforms. High performance load balancers, proxies, virtual switches and other network functions can be now implemented in software and not limited to specialized commercial hardware, thus reducing cost and increasing the flexibility. In this paper we design a lossless software-based switch for high bandwidth data acquisition (DAQ) networks, using the ATLAS experiment at CERN as a case study. We prove that it can effectively solve the incast pathology arising from the many-to-one communication pattern present in DAQ networks by providing extremely high buffering capabilities. We evaluate this on a commodity server equipped with twelve 10 Gbps Ethernet interfaces providing a total bandwidth of 120 Gbps.

Fault tolerant placement of stateful VNFs and dynamic fault recovery in cloud networks

Network Function Virtualization (NFV) is an emerging and promising solution to manage and maintain networks efficiently via developing network functions in software and executing them on commodity servers. NFV enables flexible compositions of network functions and swift deployment of novel services. A major challenge in the respect is the service function chaining problem that consists of creating an end-to-end path to ensure network flows pass through it efficiently traversing a specific sequence of services. Since this problem is known to be NP-hard, previous research focused on designing heuristic algorithms for efficient chaining of services. However, existing algorithms cannot deal with resource bottleneck perfectly in capacity constrained network, which leads to failures of allocating service chains. To address this issue, we first introduce a new concept of sensitivity and state the Resource Supplement Problem. We then propose two sensitivity computing approaches and devise two heuristic algorithms for efficient supplement of additional resources into the most sensitive node for better deployment of service chains. Simulation results show that the proposed algorithms increase the acceptance ratio and revenue significantly while decreasing the cost incurred by additional resources.

Traditional network resident functions (e.g., firewalls, network address translation) and middleboxes (caches, load balancers) have moved from purpose-built appliances to software-based components. However, L2/L3 network functions (NFs) are being implemented on Network Function Virtualization (NFV) platforms that extensively exploit kernel-bypass technology. They often use DPDK for zero-copy delivery and high performance. On the other hand, L4/L7 middleboxes, which usually require full network protocol stack support, take advantage of a full-fledged kernel-based system with a greater emphasis on functionality. Thus, L2/L3 NFs and middleboxes continue to be handled by distinct platforms on different nodes.This paper proposes MiddleNet that seeks to overcome this dichotomy by developing a unified network resident function framework that supports L2/L3 NFs and L4/L7 middleboxes. MiddleNet supports function chains that are essential in both NFV and middlebox environments. MiddleNet uses DPDK for zero-copy packet delivery without interrupt-based processing, to enable the ‘bump-in-the-wire’ L2/L3 processing performance required of NFV. To support L4/L7 middlebox functionality, MiddleNet utilizes a consolidated, kernel-based protocol stack processing, avoiding a dedicated protocol stack for each function. MiddleNet fully exploits the event-driven capabilities provided by the extended Berkeley Packet Filter (eBPF) and seamlessly integrates it with shared memory for high-performance communication in L4/L7 middlebox function chains. The overheads for MiddleNet are strictly load-proportional, without needing the dedicated CPU cores of DPDK-based approaches. MiddleNet supports flow-dependent packet processing by leveraging Single Root I/O Virtualization (SR-IOV) to dynamically select packet processing needed (Layer 2 to Layer 7). Our experimental results show that MiddleNet can achieve high performance in such a unified environment.

Software Defined Networking (SDN) and Network Function Virtualization (NFV) are transforming Data Center (DC), Telecom, and enterprise networking. The programmability offered by P4 enables SDN to be more protocol-independent and flexible. Data Centers are increasingly adopting SmartNICs (sNICs) to accelerate packet processing that can be leveraged to support packet processing pipelines and custom Network Functions (NFs). However, there are several challenges in integrating and deploying P4 based SDN control as well as host and sNIC-based programmable NFs. These include configuration and management of the data plane components (Host and sNIC P4 switches) for the SDN control plane and effective utilization of data plane resources. P4NFV addresses these concerns and provides a unified P4 switch abstraction framework to simplify the SDN control plane, reducing management complexities, and leveraging a host-local SDN Agent to improve the overall resource utilization. The SDN agent considers the network-wide, host, and sNIC specific capabilities and constraints. Based on workload and traffic characteristics, P4NFV determines the partitioning of the P4 tables and optimal placement of NFs (P4 actions) to minimize the overall delay and maximize resource utilization. P4NFV uses Mixed Integer Linear Programming (MILP) based optimization formulation and achieves up to 2. 5X increase in system capacity while minimizing the delay experienced by flows. P4NFV considers the number of packet exchanges, flow size, and state dependency to minimize the delay imposed by data transmission over PCI Express interface.

Diverse proprietary network appliances increase both the capital and operational expense of service providers, meanwhile causing problems of network ossification. Network function virtualization (NFV) is proposed to address these issues by implementing network functions as pure software on commodity and general hardware. NFV allows flexible provisioning, deployment, and centralized management of virtual network functions. Integrated with SDN, the software-defined NFV architecture further offers agile traffic steering and joint optimization of network functions and resources. This architecture benefits a wide range of applications (e.g., service chaining) and is becoming the dominant form of NFV. In this survey, we present a thorough investigation of the development of NFV under the software-defined NFV architecture, with an emphasis on service chaining as its application. We first introduce the software-defined NFV architecture as the state of the art of NFV and present relationships between NFV and SDN. Then, we provide a historic view of the involvement from middlebox to NFV. Finally, we introduce significant challenges and relevant solutions of NFV, and discuss its future research directions by different application domains.

Network Function Virtualization (NFV) is a paradigm that virtualizes traditional network functions and instantiates Virtual Network Functions (VNFs) as software instances separate from hardware appliances. Service Chaining (SC), seen as one of the major NFV use cases, provides customized services to users by concatenating VNFs. A VNF placement model for SC that relaxes the visit order constraints of requested VNFs has been considered. Relaxing the VNF visit order constraints reduces the number of VNFs which need to be placed in the network. However, since the model does not permit any loop within an SC path, the efficiency of utilization of computation resources deteriorates in some topologies. This paper proposes a VNF placement model for SC which minimizes the cost for placing VNFs and utilizing link capacity while allowing both relaxation of VNF visit order constraints and configuration of SC paths including loops. The proposed model determines routes of requested SC paths, which can have loops, by introducing a logical layered network generated from an original physical network. This model is formulated as an Integer Linear Programming (ILP) problem. A heuristic algorithm is introduced for the case that the ILP problem is not tractable. Simulation results show that the proposed model provides SC paths with smaller cost compared to the conventional model.

Software middlebox-based services can be flexibly managed by software defined networking (SDN) and network function virtualization (NFV). Meanwhile, traffic routing can be simplified and the number of routing rules in the SDN-enabled switches can be reduced through the consolidated middlebox model. However, different network functions in middleboxes may alter the volume of processed traffic, so high congestion may occur in specific bottleneck links if middlebox selection and traffic routing are not well jointly planned. Besides, in a statically switch-controller configured SDN, traffic dynamics will not only affect the link load in the data plane, but also pose a challenge to controller load balancing. Therefore, it’s necessary to achieve better quality-of-service (QoS) performance in both control and data planes. In this article, we first formulate this problem as a joint traffic-aware consolidated middleboxes selection and routing (JTMSR) problem and prove its NP-hardness. Then, we design a two-phase algorithm to achieve the controller and link load balancing where the first phase is to redirect selected flows by applying wildcard rules and the second phase is to find fine-grained routing path by a rounding-based algorithm with bounded approximation factor. Finally, compared with the existing algorithms through extensive simulations, it demonstrates that our method has near-optimal controller load balancing and link load balancing performance and can improve response time by 9.7% compared with static scheme.

The modern network is equipped with many service functions to acquire high-quality service. The emergence of network function virtualization (NFV) provides a convenient way to accomplish the network services in the form of virtual network function (VNF) and also makes the scheduling solution of VNFs flexible. The VNFs can be deployed on commodity servers as software processes. Besides, multiple VNFs are chained in a specified order as a service function chain (SFC) to serve a given flow, increasing the scheduling difficulty to minimize the average flow completion time. In this paper, we study the problem of scheduling multiple SFCs with the constraint of different resource limitations in various commodity servers. This problem is typically formulated as an Integer Linear Programming (ILP) problem, which is NP-hard. To well tackle this problem, we propose a deep reinforcement learning (DRL) approach. It involves multi-step decision making, which can be naturally transformed into a DRL problem. We design specific reward and state representations for such a multi-resource scheduling problem. We also consider how to use DRL to handle online requests of SFCs. The experiment results demonstrate that the DRL approach can significantly reduce the average completion time of a set of SFC and achieves a cost saving of 39.94% against the benchmark method.

Network Function Virtualization (NFV) brings flexibility and dynamics to the construction of service chain. However, the software and virtualization may cause security risks such as vulnerabilities and backdoors, which may have impact on Service Chain (SC) security. Thus, a Virtual Network Function (VNF) scheduling method is proposed. Firstly, heterogeneous images are built for every virtual network function in service chain, avoiding widespread attacks using common vulnerabilities. Then, one network function is selected dynamically and periodically. The executor of this network function is replaced by loading heterogeneous images. Finally, considering the impact of scheduling on the performance of network functions, Stackelberg game is used to model the attack and defense process, and the scheduling probability of each network function in the service chain is solved with the goal of optimizing the defender’s benefit. Experiments show that this method can reduce the rate of attacker’s success while controlling the overhead generated by the scheduling within an acceptable range.

VNF Performance modelling: From stand-alone to chained topologies

5G networks represent a paradigm shift from their 4G predecessors, engineered to cater to the burgeoning demands of densely populated areas and the high data throughput requirements of the Internet of Things (IoT) and smart city infrastructures. Beyond enhancing fundamental network attributes such as reliability, availability, and security, 5G introduces architectural innovations to accommodate these advanced needs. This paper delves into the architectural nuances of 5G, focusing primarily on the Standalone (SA) deployment method, distinguished by its utilization of network slicing. This approach leverages cutting-edge virtual network technologies, including Software-Defined Networking (SDN) and Network Function Virtualization (NFV), to forge virtual network slices tailored to diverse consumer needs. Such customization is imperative for meeting the expansive and varied connectivity demands characteristic of 5G networks.To navigate the complexities of 5G architecture, this study advocates for the adoption of Reference Architectures (RAs), which provide a high-level abstraction framework for dissecting and understanding intricate systems. By proposing a model that outlines the standalone architecture of 5G networks, our research lays the groundwork for evolving this model into a comprehensive RA for 5G. This foundational work is instrumental in equipping system designers with the tools necessary for generalizing systems to manage design and deployment challenges effectively, as well as the heterogeneity inherent in system components. Additionally, our proposed model facilitates the establishment of a common vocabulary, promoting a coherent understanding of component interactions and offering a unified system perspective. Ultimately, this paper contributes a pivotal model that not only enhances our comprehension of 5G network architecture but also paves the way for future advancements in network design and deployment, promising to significantly impact the development of smart cities and IoT ecosystems.Keywords: 5G, 5G architecture, Reference architecture, patterns. Network slicing, Network Function Virtualization, Virtual Network Function.

Attack-aware Security Function Management

The emerging paradigm of Network Function Virtualization (NFV) promises to shorten the renewal cycles of network functions and reduce the capital expenses by flexibly deploying virtualized network functions (VNFs) implementation on commodity servers. However, the required resource of each type (CPU, memory, etc.) for the running VNF should be provisioned to guarantee the performance when processing packets. This comes with different deployment cost, especially in a heterogeneous cloud consisting of a large number of network function platforms from various vendors. To optimally operate VNFs, it is necessary for the network operator to dynamically deploy VNFs in the expensive cloud infrastructures. In this article, we initiate the study of minimizing the deployment cost under multi-resource constraints in a heterogeneous cloud. We formulate multi-resource VNF deployment problem (MVDP) as an optimization program and prove its hardness. We propose an offline <inline-formula><tex-math notation="LaTeX">$(1, d+1)$</tex-math></inline-formula> -bicriteria approximation algorithm and an <inline-formula><tex-math notation="LaTeX">$(\mathcal {O}(1), \mathcal {O}(n \cdot \log n))$</tex-math></inline-formula> -competitive online algorithm to deploy VNFs in a scalable manner, where <inline-formula><tex-math notation="LaTeX">$d$</tex-math></inline-formula> is the number of resource types and <inline-formula><tex-math notation="LaTeX">$n$</tex-math></inline-formula> is the number of required VNFs. Large-scale simulations and DPDK-based OpenNetVM implementation show that our algorithms can reduce the overall cost by 34% and improve the performance in terms of multi-resource allocation.

Network Function Virtualization (NFV) has promoted the implementation of network functions from expensive hardwares to software middleboxes. These software middleboxes, also called Virtual Network Functions (VNFs), are executed on switch-connected servers. Efficiently deploying such VNFs on servers is challenging because the traffic rate of flows must be fully processed by their requested VNFs when they reach destinations, and the deployed positions of VNFs are restricted by the server capacity. In addition, each network function offers non-uniform VNF models (types) with different configurations of processing volumes and costs. This paper focuses on minimizing the total cost of deploying VNFs for providing a specific network function to all flows in tree-structured networks. First, we prove the NP-hardness of non-uniform VNF deployment in a tree topology and propose a dynamic programming based solution with a pseudo-polynomial time complexity. Then we narrow it down to three simplified cases by focusing on either uniform VNFs or the linear line topology. Specifically, three algorithms are introduced: an improved dynamic programming based algorithm for deploying uniform VNFs in a tree topology, a performance-guaranteed algorithm for deploying non-uniform VNFs in a linear line topology, and an optimal greedy algorithm for deploying uniform VNFs in a linear line topology. Additionally, we generalize our approach to a case of deploying a service chain, which consists of multiple network functions applied to flows in a specific order. We propose two solutions: one is optimal but time-consuming while another is heuristic but efficient. Extensive simulations are conducted to evaluate our algorithms.