Network Function Virtualization Systems Research Articles

Layer-Aware Containerized Service Orchestration in Edge Networks

Edge computing provides computational resources in the vicinity of end-users to reduce delay compared to traditional remote clouds. However, the capacity of edge resources usually is not sufficient for the required computational demands. Therefore, it is necessary to design methods for employing these resources in an efficient manner. On the other hand, network function virtualization (NFV) is a promising solution to use the network resources in a more flexible way than traditional schemes. Although more focus has been on realization of NFV systems via virtual machines so far, recent studies show that container-based solutions can improve efficiency thanks to lightweight implementation and layered structure of containers. Nonetheless, to the best of our knowledge, there is no comprehensive study on the problem of orchestrating services composed of a chain of containerized network functions in edge networks. In this paper, we consider this scenario when service requests are submitted to the system and address important aspects of this problem such as downloading and sharing container layers and steering traffic among network functions. We present the formulation of the problem as an integer linear program (ILP) and prove its NP-hardness. Then, to handle this problem, we propose RCCO, a polynomial-time algorithm based on ideas from deterministic and randomized rounding framework. Our results from extensive evaluations show that the bandwidth consumption of the proposed algorithm compared to the optimal algorithm is higher by only about 4% while it can outperform baselines from literature by more than 37%.

Gaviss : Boosting the Performance of GPU-Accelerated NFV Systems via Data Sharing

GPUs have demonstrated the capability of significantly improving the performance of network functions (NF). In an Network Function Virtualization (NFV) system, multiple NFs form a service chain to provide services. However, NFs in state-of-the-art GPU-accelerated NFV systems still utilize a GPU independently where each NF needs to transfer data to the GPU memory for acceleration. As a result, a packet might be transferred into the GPU memory by each NF when it passes through the service chain. We find these expensive and repetitive transfers are the main factor that limits the overall performance of an NFV system. We propose Gaviss, a GPU-accelerated NFV system with effective data sharing. By sharing packets in the GPU memory among network functions, a packet needs to be transferred to the GPU only once, eliminating the performance overhead caused by repetitive transfers. Extensive experimental results show that Gaviss can improve the overall throughput by 2.6-13.2× and reduce the latency by up to 37.9%, when compared with state-of-the-art approaches. Moreover, Gaviss also demonstrates up to 2.5× higher price-performance ratio than CPU-based implementations, making GPUs competitive for building NFV systems.

Misuse Patterns from the Threat of Modification of Non-Control Data in Network Function Virtualization

Network Function Virtualization (NFV) is a virtual network model, the goal of which is a cost-efficient transition of the hardware infrastructure into a flexible and reliable software platform. However, this transition comes at the cost of more security threats. A key part of this virtualization environment is the hypervisor, which emulates the hardware resources to provide a runtime environment for virtual machines (VMs). The hypervisor is considered a major attack vector and must be secured to ensure network service continuity. The virtualization environment contains critical non-control data where compromise could lead to several misuses, including information leakage and privilege and resource modification. In this paper, we present a misuse pattern for an attack that exploits the security vulnerabilities of the hypervisor to compromise the integrity of non-control data in the NFV environment. Misuse patterns are used to describe how attacks are carried out from the attackers’ perspective. The threat of modification of non-control data can lead to several misuses, and in this paper, we discuss three of them. The defenses to this attack can be incorporated into the Security Reference Architecture (SRA) of the NFV system to prevent these misuses.

Service Chain Composition With Resource Failures in NFV Systems: A Game-Theoretic Perspective

For systems that are based on network function virtualization (NFV), it remains a key challenge to conduct effective service chain composition with the lowest request latency and the minimum network congestion. In such an NFV system, users are usually non-cooperative, i.e., they compete with each other to optimize their own benefits. However, existing solutions often ignore such non-cooperative behaviors of users. What is more, they may fall short in the face of unexpected resource failures such as breakdown of virtual machines and loss of connections to users. In this article, we formulate the service chain composition problem with resource failures in NFV systems as a non-cooperative game , and show that such a game is a weighted potential game , aiming to search for the optimal Nash equilibrium (NE). By adopting Markov approximation techniques, we devise a distributed scheme called MH-SCCA, which achieves a provably near-optimal NE and adapts to resource failures in a timely manner. For comparison, we also propose two baseline schemes (DRL-SCCA and MCTS-SCCA) for centralized service chain composition that are based on deep reinforcement learning (DRL) and Monte Carlo tree search (MCTS) techniques, respectively. Our simulation results demonstrate the effectiveness of the three proposed schemes in terms of both latency reduction and congestion mitigation, as well as the adaptivity of MH-SCCA when faced with resource failures.

An Online Algorithm for VNF Service Chain Scaling in Datacenters

Built on top of virtualization technologies, network function virtualization (NFV) provides flexible and scalable software implementation of various network functions. Virtual network functions (VNFs), which are network functions implemented as virtual machines, are chained together to provide network services. Dynamic deployment of VNFs while satisfying incoming network traffic demand is the key to cost optimization of an NFV system. Besides considering server resource capacity and incoming traffic rates, an optimal scaling policy needs to strike a balance between VNF’s operational costs, the costs for maintaining VNF instances, and VNF deployment costs, additional costs when setting up new VNF instances on a server. This paper targets dynamic scaling of VNF instances in a cloud data center where multiple VNF chains are running. We propose an online scaling algorithm to adjust the deployment of VNF instances according to time-varying traffic demand, ensuring a good competitive ratio. Through theoretical analysis and trace-driven simulation, we demonstrate effectiveness of the proposed online VNF scaling algorithm.

A Network Function Virtualization System for Detecting Malware in Large IoT Based Networks

The exponential growth in the use of Internet of Things (IoT) devices has introduced numerous challenges, in particular dealing with new security threats. In addition, for connecting heterogeneous devices using different protocols, large networks need resilient software-based security systems that can defend against unprecedented attacks for which the traditional security countermeasures prove to be ineffective. Furthermore, to deal with the ever growing onslaught on data and networks, modern security systems need to utilize novel machine learning mechanisms. This paper proposes a software-based architecture that provides network function virtualization (NFV) capability to combat malware spread for heterogeneous IoT networks. To build a scalable and generalized Intrusion Detection System (IDS), we propose for these networks a RNN-LSTM learning model that can predict malware attacks in a timely manner for the NFV to deploy appropriate countermeasures. In addition, we investigate the scalability of the network and discuss how the generalized IDS can deal with a broad range of malwares that can be detected. The analysis utilizes the susceptible (S), exposed (E), infected (I), and resistant (R) (SEIR) epidemic model to moniter the spread of the malware attack and subsequently provides patching to the system. Our analysis focuses primarily on the feasibility and the performance evaluation of the proposed integrated RNN-LSTM and NFV architecture.

Model-driven process enactment for NFV systems with MAPLE

The network functions virtualization (NFV) advent is making way for the rapid deployment of network services (NS) for telecoms. Automation of network service management is one of the main challenges currently faced by the NFV community. Explicitly defining a process for the design, deployment, and management of network services and automating it is therefore highly desirable and beneficial for NFV systems. The use of model-driven orchestration means has been advocated in this context. As part of this effort to support automated process execution, we propose a process enactment approach with NFV systems as the target application domain. Our process enactment approach is megamodel-based. An integrated process modelling and enactment environment, MAPLE, has been built into Papyrus for this purpose. Process modelling is carried out with UML activity diagrams. The enactment environment transforms the process model to a model transformation chain, and then orchestrates it with the use of megamodels. In this paper, we present our approach and environment MAPLE, its recent extension with new features as well as application to an enriched case study consisting of NS design and onboarding process.

Design and Placements of Virtualized Network Functions for Dynamically Changing Service Requests Based on a Core/Periphery Structure

Network Function Virtualization (NFV) is a system that provides application services by connecting virtual network functions (VNFs), and is expected to accommodate new service requests through the development of new VNF and connection with existing ones. Because VNFs are implemented by software, their design and placement are important problems for the NFV system, which reduce the current and future system costs. In this article, we investigate the design principles and the placement policies that reduce the cost of designing and developing VNFs for accommodating new service requests. As for the design policy, we introduce a Core/Periphery-Based Design (CPBD) that utilizes the core/periphery concept for developing VNFs. In CPBD, “core” VNFs are developed in advance and repeatedly used to accommodate future service requests. While “core” VNFs are common to current and future service requests, “periphery” VNFs are developed and customized for each service request. Next, we investigate the placement policies of VNFs for CPBD to fully utilize the nature of their core/periphery structure. In addition, we examine the Center-Located Core/Periphery placement (CLCP) policy and the Geographically-Distributed Core/Periphery placement (GDCP) policy, and evaluate the long-term cost of the NFV system under resource restrictions to run VNFs. Our results show that CPBD reduces the long-term cost of design and development of VNFs by 23% compared to the design with no core VNFs. Moreover, in the case of no resource restrictions, both CLCP and GDCP reduce the long-term costs of placing and connecting VNFs by 15% compared to the existing VNF placement algorithm. With resource constraints, GDCP reduces the long-term costs over CLCP by 11%.

<italic>NFVactor</italic>: A Resilient NFV System Using the Distributed Actor Model

Resilience functionality, including failure resilience and flow migration, is of pivotal importance in practical network function virtualization (NFV) systems. However, existing failure recovery procedures incur high packet processing delay due to heavyweight process checkpointing, while flow migration has poor performance due to centralized control. This paper proposes NFVactor , a novel NFV system that aims to provide lightweight failure resilience and high-performance flow migration. NFVactor enables these by using actor model to provide a per-flow execution environment, so that each flow can replicate and migrate itself with improved parallelism, while the efficiency of the actor model is guaranteed by a carefully designed runtime system. Moreover, NFVactor achieves transparent resilience: once a new network function (NF) is implemented for NFVactor , the NF automatically acquires resilience support. Our evaluation result shows that NFVactor achieves 10-Gbps packet processing, flow migration completion time that is 144 times faster than the existing system, and packet processing delay stabilized at around 20 $\mu \text{s}$ during replication.

Deploying CPU-Intensive Applications on MEC in NFV Systems: The Immersive Video Use Case

Multi-access Edge Computing (MEC) will be a technology pillar of forthcoming 5G networks. Nonetheless, there is a great interest in also deploying MEC solutions in current 4G infrastructures. MEC enables data processing in proximity to end users. Thus, latency can be minimized, high data rates locally achieved, and real-time information about radio link status or consumer geographical position exploited to develop high-value services. To consolidate network elements and edge applications on the same virtualization infrastructure, network operators aim to combine MEC with Network Function Virtualization (NFV). However, MEC in NFV integration is not fully established yet: in fact, various architectural issues are currently open, even at standardization level. This paper describes a novel MEC in an NFV system which successfully combines, at management level, MEC functional blocks with an NFV Orchestrator, and can neutrally support any “over the top” Mobile Edge application with minimal integration effort. A specific ME app combined with an end-user app for the provision of immersive video services is presented. To provide low latency, CPU-intensive services to end users, the proposed architecture exploits High-Performance Computing resources embedded in the edge infrastructure. Experimental results showing the effectiveness of the proposed architecture are reported and discussed.

Simultaneous wavelength and format conversion in SDN/NFV for flexible optical network based on FWM in SOA

We propose an all-optical wavelength and format conversion model (CM) for a dynamic data center interconnect node and coherent passive optical network (PON) optical network unit (ONU) in software-defined networking and network function virtualization system based on four-wave mixing in a semiconductor optical amplifier. Five wavelength converted DQPSK signals and two format converted DPSK signals are generated; the performances of the generated signals for two strategies of setting CM in the data center interconnect node and coherent PON ONU, which are over 10 km fiber transmission, have been verified. All of the converted signals are with a power penalty less than 2.2 dB at FEC threshold of 3.8 × 10 − 3, and the optimum bias current of SOA is 300 mA.

VTB-RTRRP: Variable Threshold Based Response Time Reliability Real-Time Prediction

To provide high quality of network service, the response time reliability (RTR), the probability that the response time of a service is within the maximum allowable time determined by users, attracts researchers from both academic and industry. For those networked systems that can adjust their configuration adaptively, such as cloud computing systems, ad hoc networks, and network function virtualization systems, it is essential to predict the RTR of the system, and use the prediction result as a constraint to optimize the system configuration, e.g., tradeoff between reliability and energy efficiency. In general, the RTR changes along with the workload of the system. Due to the complex communication process, it is not easy to derive the analytical model between workload and RTR, and the maximum response time that users can tolerate also changes with the system workload according to users' experience. This paper proposes a variable thresholdbased RTR real-time prediction framework based on data-driven approaches to forecast the RTR for networked systems. In this framework, the response time threshold varies with the workload, reflecting both users' acceptable and perceived response time, and a real-time updating model between workload and RTR is built for RTR prediction based on the latest monitored dada. Finally, a communication network is taken as the example to validate the effectiveness of the proposed method from different perspectives. The experimental results illustrate that this continually updating model can obtain more accurate RTR prediction.

On the Placement of VNF Managers in Large-Scale and Distributed NFV Systems

The European Telecommunications Standards Institute management and orchestration framework is designed to enable automated management of the network services and their corresponding virtualized network functions (VNFs). In that context, the network function virtualization (NFV) orchestrator (NFVO) manages the lifecycle of the network services and coordinates with the VNF managers (VNFMs) which manage the VNFs lifecycle. In large-scale and distributed NFV deployments, these management functions face critical challenges such as delays, and variations in VNFs workload. Placing NFVO and VNFM in a large-scale distributed NFV deployment is therefore a very challenging problem due to the potential negative impact on performance and operational cost. However, to the best of our knowledge, the problem has not yet been addressed in the literature. This paper is a first step toward a solution to the overall problem. It focuses on the VNFM placement and aims at minimizing the operational cost without violating the performance requirements. We call this the VNFM placement problem (MPP). We provide an integer linear programming formulation and propose a tabu search algorithm to solve larger instances of the MPP. We evaluate our algorithm in a real-world large-scale scenario. The results show that it leads to significant reductions in the operational cost of large-scale distributed NFV deployments.

Network function virtualization: through the looking-glass

The fields of networking and telecommunications are presently witnessing the transition of a number of Network Function Virtualization (NFV) principles and techniques from research into practice. This survey attempts to capture the NFV phenomenon in its multi-faceted historical development over the last two decades, by answering the question “What are the main goals of NFV systems?” and by highlighting the advantages and technical limits of NFV in supporting those goals. By focusing on the whys and hows of NFV, we propose a reasoned overview of the most significant design elements of NFV as a complementary synthesis to the analytical taxonomies of papers and standards that are usually found in survey documents.

A System Architecture for Real-time Anomaly Detection in Large-scale NFV Systems

Virtualization as a key IT technology has developed to a predominant model in data centers in recent years. The flexibility regarding scaling-out and migration of virtual machines for seamless maintenance has enabled a new level of continuous operation and changed service provisioning significantly. Meanwhile, services from domains striving for highest possible availability – e.g. from the telecommunications domain – are adopting this approach as well and are investing significant efforts into the development of Network Function Virtualization (NFV). However, the availability requirements for such infrastructures are much higher than typical for IT services built upon standard software with off-the-shelf hardware. They require sophisticated methods and mechanisms for fast detection and recovery of failures. This paper presents a set of methods and an implemented prototype for anomaly detection in cloud-based infrastructures with specific focus on the deployment of virtualized network functions. The framework is built upon OpenStack, which is the current de-facto standard of open-source cloud software and aims at increasing the availability and fault tolerance level by providing an extensive monitoring and analysis pipeline able to detect failures or degraded performance in real-time. The indicators for anomalies are created using supervised and non-supervised classification methods and preliminary experimental measurements showed a high percentage of correctly identified anomaly situations. After a successful failure detection, a set of pre-defined countermeasures is activated in order to mask or repair outages or situations with degraded performance.