Scalable and Flexible Traffic Steering for Service Function Chains

Complex services composed of middleboxes are mainly used to meet the requirements of advanced services such as security services, monitoring systems, and personalized enterprise services. However, forwarding a traffic across middleboxes is a tedious and error-prone task. Service function chaining (SFC) presents different solutions to steer the traffic among intermediate service functions. However statically managing, deploying, and configuring an SFC remains a challenging task. Dynamic SFC has recently gained significant interest from big networking operators motivated by the emerging technologies of Software Defined Networking (SDN) and Network Function Virtualization (NFV). In this paper, we present a new SDN based architecture and a novel header for traffic steering for dynamic SFC. Our results show that the header we describe in this paper does not increase the packet size nor the overhead.

Service Function Chaining (SFC) serves the traffic of a specific service along an ordered set of Service Functions (SFs). SFC uses Software Defined Networking (SDN) and Network Function Virtualization (NFV) technologies to reach the deployment and removal of SFC in an appropriate time with minimal costs. However, during the life time of deployed SFCs, the SFs are exposed to the risk of overloading, which results in an end-to-end packets drop and high delay at the application level. This paper presents the concept of a Scalable SFC Orchestrator capable of deploying SF Chains following the ETSI NFV architectural model, as well as orchestrating the runtime phase by rerouting the traffic to a different path in case of overload of certain SF instances. Moreover, a selection algorithm is presented to build the updated paths after scaling. The Scalable Orchestration feature is implemented and added as a main feature to an SFC Orchestrator. Furthermore, it is integrated into a current NFV architecture and evaluated in an NFV environment making use of the Fraunhofer FOKUS Open Baton toolkit in an OpenStack and Open Daylight based environment.

A comprehensive survey of service function chain provisioning approaches in SDN and NFV architecture

With the constant demand for connectivity at an all-time high, Network Service Providers (NSPs) are required to optimize their networks to cope with rising capital and operational expenditures required to meet the growing connectivity demand. A solution to this challenge was presented through Network Function Virtualization (NFV). As network complexity increases and futuristic networks take shape, NSPs are required to incorporate an increasing amount of operational efficiency into their NFV-enabled networks. One such technique is Machine Learning (ML), which has been applied to various entities in NFV-enabled networks, most notably in the NFV Orchestrator. While traditional ML provides tremendous operational efficiencies, including real-time and high-volume data processing, challenges such as privacy, security, scalability, transferability, and concept drift hinder its widespread implementation. Through the adoption of Advanced Intelligence techniques such as Reinforcement Learning and Federated Learning, NSPs can leverage the benefits of traditional ML while simultaneously addressing the major challenges traditionally associated with it. This work presents the benefits of adopting these advanced techniques, provides a list of potential use cases and research topics, and proposes a bottom-up micro-functionality approach to applying these methods of Advanced Intelligence to NFV Management and Orchestration.

Software-defined network (SDN) radically changes the network architecture by decoupling the network logic from the underlying forwarding devices. This architectural change rejuvenates the network-layer granting centralized management and reprogrammability of the networks. From a security perspective, SDN separates security concerns into control and data plane, and this architectural recomposition brings up exciting opportunities and challenges. The overall perception is that SDN capabilities will ultimately result in improved security. However, in its raw form, SDN could potentially make networks more vulnerable to attacks and harder to protect. In this paper, we provide a comprehensive review of SDN security domain while focusing on its data plane, which is one of the least explored but most critical aspects in securing this technology. We review the most recent enhancements in SDNs, identify the main vulnerabilities of SDNs, and provide a novel attack taxonomy for SDNs. Thereafter, we provide a comprehensive analysis of challenges involved in protecting SDN data plane and control plane and provide an in-depth look into available solutions with respect to the identified threats and identify their limitations. To highlight the importance of securing the SDN platform, we also review the numerous security services built on top of this technology. We conclude the paper by offering future research directions.

Network virtualization has become a promising paradigm for supporting diverse vertical services in Software Defined Networks (SDNs). Each vertical service is carried by a virtual network (VN), which normally has a chaining structure. In this way, a Service Function Chain (SFC) is composed by an ordered set of virtual network functions (VNFs) to provide tailored network services. Such new programmable flexibilities for future networks also bring new network management challenges: how to collect and analyze network measurement data, and further predict and diagnose the performance of SFCs? This is a fundamental problem for the management of SFCs, because the VNFs could be migrated in case of SFC performance degradation to avoid Service Level Agreement (SLA) violation. Despite the importance of the problem, SFC performance analysis has not attracted much research attention in the literature. In this current paper, enabled by a novel detailed network debugging technology, In-band Network Telemetry (INT), we propose a learning based framework for early SFC fault prediction and diagnosis. Based on the SFC traffic flow measurement data provided by INT, the framework firstly extracts SFC performance features. Then, Long Short-Term Memory (LSTM) networks are utilized to predict the upcoming values for these features in the next time slot. Finally, Support Vector Machine (SVM) is utilized as network fault classifier to predict possible SFC faults. We also discuss the practical utilization relevance of the proposed framework, and conduct a set of network emulations to validate the performance of the proposed framework.

Service Function Chaining (SFC) can be a basic deployment unit that composes a chaining order of required network functions to provide a network service. With the proliferation of Software-Defined Networking (SDN) and cloud computing, such virtualized network functions can be dynamically deployed in different sites, depending on SFC requests. While offering the advantages of flexibility and efficiency, this also leaves management complexity and room for optimization where Machine Learning (ML) can be applicable to solve the problems based on monitoring data. In this paper, we treat SFC as a problem of finding a best source-to-destination routing path from multiple candidates with different link costs and a required traversal order of network functions. There are many mathematical approaches that ensure best optimum but not scalable to the problem size, whereas our approach hides underlying considerations by applying ML technique on measured SFC data to quickly find suboptimal routing paths on a new SFC request, based on their predicted network performance such as the number of successful requests or end-to-end delay. So, we developed a measurement system that records the performance and path costs of SFCs in emulated networks with different per link costs and chain lengths. Then, we evaluate four different ML models for the approach described above.

With the emergence of Network Function Virtualization (NFV) and Software-Defined Networks (SDN), Service Function Chaining (SFC) has evolved into a popular paradigm for carrying and fulfilling network services. However, the implementation of Mobile Edge Computing (MEC) in sixth-generation (6G) mobile networks requires efficient resource allocation mechanisms to migrate virtual network functions (VNFs). Deep learning is a promising approach to address this problem. Currently, research on VNF migration mainly focuses on how to migrate a single VNF while ignoring the VNF sharing and concurrent migration. Moreover, most existing VNF migration algorithms are complex, unscalable, and time-inefficient. This paper assumes that each placed VNF can serve multiple SFCs. We focus on selecting the best migration location for concurrently migrating VNF instances based on actual network conditions. First, we formulate the VNF migration problem as an optimization model whose goal is to minimize the end-to-end delay of all influenced SFCs while guaranteeing network load balance after migration. Next, we design a Deep Learning-based Two-Stage Algorithm (DLTSA) to solve the VNF migration problem. Finally, we combine previous experimental data to generate realistic VNF traffic patterns and evaluate the algorithm. Simulation results show that the SFC delay after migration calculated by DLTSA is close to the optimal results and much lower than the benchmarks. In addition, it effectively guarantees the load balancing of the network after migration.

Service Function Chain (SFC) integrates Network Function Virtualization (NFV) for flexible deployment of Virtualized Network Function (VNF) and utilizes Software-Defined Networking (SDN) for establishing dynamic network connections, enabling customized service chains for specific applications. Security risks in NFV/SDN networks directly impact SFC, making them vulnerable to attacks. Traditional security solutions rely on passive defense mechanisms, which are insufficient against the uncertainties brought by vulnerabilities and backdoors in open networks. As an emerging network security technology, Moving Target Defense (MTD) is expected to break through traditional security protection mechanisms such as “enhanced”, “plug-in” and “passive” defense to achieve active defense against both known and unknown threats. Features of NFV/SDN networks, such as dynamic resource scheduling, microservices, and centralized control, also offer critical guidance for implementing MTD strategy. Therefore, in this paper, we propose a novel security enhancement mechanism by equipping SFC and VNFs with MTD to inherently protect SFC and VNFs during the deployment process, using a sub-pool partitioning algorithm to enhance heterogeneity across sub-pools. Additionally, to address Quality of Service (QoS) requirements, we formulate an optimization problem with three criteria: latency, cost, and defense success rate. Following that, we propose a dynamic deployment algorithm based on Deep Reinforcement Learning (DRL). Finally, to validate the effectiveness of the proposed algorithm, we conduct extensive experiment which have demonstrated that our proposed algorithm is good in increasing the security gains of both SFC and VNFs, provided that this improvement comes at the expense of modest cost and latency.

Owing to the Network Function Virtualization (NFV) and Software-Defined Networks (SDN), Service Function Chain (SFC) has become a popular service in SDN and NFV-enabled network. However, as the Virtual Network Function (VNF) of each type is generally multi-instance and flows with SFC requests must traverse a series of specified VNFs in predefined orders, it is a challenge for dynamic SFC formation to optimally select VNF instances and construct paths. Moreover, the load balancing and end-to-end delay need to be paid attention to, when routing flows with SFC requests. Additionally, fine-grained scheduling for traffic at flow level needs differentiated routing which should take flow features into consideration. Unfortunately, traditional algorithms cannot fulfill all these requirements. In this paper, we study the Differentiated Routing Problem considering SFC (DRP-SFC) in SDN and NFV-enabled network. We formulate the DRP-SFC as a Binary Integer Programming (BIP) model aiming to minimize the resource consumption costs of flows with SFC requests. Then a novel routing algorithm, Resource Aware Routing Algorithm (RA-RA), is proposed to solve the DRP-SFC. Performance evaluation shows that RA-RA can efficiently solve the DRP-SFC and surpass the performance of other existing algorithms in acceptance rate, throughput, hop count and load balancing.

Joint optimization of Service Chain Graph Design and Mapping in NFV-enabled networks

SDN-based service function chaining mechanism and service prototype implementation in NFV scenario

Attack-aware Security Function Management

Network Slicing (NS) technique is comprehensively reshaping the next-generation communication networks (e.g. 5G, 6G). Software-Defined Networking (SDN) and Network Functions Virtualization (NFV) predominantly control the flow of service functions on NS to incorporate versatile applications as per user demands. In the virtualized-Software Defined Networking vSDN environment, a chain of well-defined virtual network functions (VNFs) are installed on Service Function Chains (SFCs) by multiple Internet Service Providers (ISPs) concurrently. Generation, allocation, re-allocation, release and destroying associative VNFs on SFC is an extremely difficult task while keeping high selection accuracy. Towards solving this fundamental issue, in this work, we have proposed a multi-layered SFC formation for adaptive VNF allocation on dynamic slices. We have formulated an ILP to address the VNF-EAP (VNF-Embedding and Allocation Problem) over real network topology (AT&T Topology). Leveraging machine learning techniques we have shown an intelligent VNF selection mechanism to optimize resource utilization. The performance evaluation shows remarkable efficiency on ML-driven dynamic VNF selections over static allocations on SFCs by halving resource usage. Further, we have also studied a VNF typecasting technique for service backup on outage slices in the field of disaster management activities.

Network Function Virtualization (NFV) technology facilitates flexible and fast service provisioning by deploying network functions in wished positions and chaining order as Service Function Chain (SFC). Empirically, if the processing inside some Virtual Network Functions (VNFs) does not relate to each other, parallel chaining them can further improve the performance, such as reducing the end-to-end hops of SFCs. However, it is often ignored that parallel deploy VNFs will also introduce additional VNFs to replicate, distribute, and merge data. This will add hops and increase resource consumption. Will parallel deployment of VNFs in SFCs necessarily bring benefits? Regarding multiple parallel forms of an SFC, which one is the best? Further, how does the service process of the NFV network affect the parallel decisions of VNFs? In this paper, we design an NFV orchestrator, DP-NFVO, to maximize the revenue of NFV Service Providers and provide quantitative insights into the impact of parallel VNFs deploy-ment. Precisely, we first refine existing VNF parallelism rules and discuss the impact of VNF parallelism on latency and resource consumption, and analyze the optimal form of parallelism for SFCs. Second, we decompose the service request process in NFV networks into multiple stages and provide a joint model of VNF parallelism and deployment. Further, we design a VNF online deployment and parallelism decision policy for DP-NFVO based on Proximal Policy Optimization (PPO) to maximize revenue. Finally, we demonstrate the effectiveness and adaptability of DP-NFVO on parallel processing and the requests service process with extensive experiments.