Network Function Virtualization Research Articles

Challenges Regarding Network Neutrality for Commercial Deployment of 5G Networks

The paper aims to analyze the impact of equal data treatment applied in the European Union (EU) on the commercial deployment of the upcoming wireless standards such as 5G and beyond. The analysis of the different network neutrality involves several aspects, including engineering, social, economic and political aspects. Considering recent advancements in wireless networks like Network Function Virtualization or Network Slicing, this opens new research possibilities to analyze how various models influence aspects like the profitability of modern standards. To perform the study, a broad literature review and five interviews with the stakeholders from the industry have been done. Then, the knowledge has been segmented and interpreted so that an analysis of the net neutrality on future wireless standards has been given.

Extended data plane architecture for in-network security services in software-defined networks

Software-Defined Networking (SDN)-based Network Function Virtualization (NFV) technologies improve the dependability and resilience of networks by enabling administrators to spawn and scale-up traffic management and security services in response to dynamic network conditions. However, in practice, they often suffer from poor performance and require complex configurations because network packets must be ‘detoured’ to each virtualized security service, which expends bandwidth and increases network propagation delay. To address these challenges, we propose a new SDN-based data plane architecture, called DPX (Data Plane eXtension), that natively supports in-network security services. The DPX action model reduces redundant processing caused by frequent packet parsing and provides administrators with a simplified (and less error-prone) method for configuring security services into the network. DPX also increases the efficiency of enforcing complex security policies by introducing a novel technique called action clustering, which aggregates security actions from multiple flows into a small number of synthetic rules. Also, the application of action clustering (i.e., advanced and global) provides more diverse policies and network-wide detection. We present an implementation of DPX in hardware using NetFPGA-SUME and in software using Open vSwitch. We evaluate the performance of the DPX prototype and the efficacy of its flow-table simplifications against a range of complex network policies exposed to line rates of 10 Gbps.

FPGA-CPU Architecture Accelerated Regular Expression Matching With Fast Preprocessing

Abstract Regular Expression Matching (REM) is the core of Deep Packet Inspection (DPI), which is important for various network security applications. The burgeoning Software Defined Network and Network Function Virtualization technologies make the network evolve more dynamic, which brings serious challenges for DPI engines to achieve high matching performance with fast rule-set update capability. To meet these challenges, this paper proposes a heterogeneous Field Programmable Gate Array (FPGA)-Central Processing Unit (CPU) architecture to accelerate Deterministic Finite Automaton (DFA)-based REM with high preprocessing performance. Firstly, a novel regex decomposition technique is proposed to solve the DFA state explosion problem, which splits each regex into one prefix and several postfixes. Secondly, heterogeneous architecture is presented to collaboratively handle regex matching, in which prefixes are matched in parallel in an FPGA and postfixes are matched in a CPU. To further improve the matching performance, several well-designed DFA compression techniques and regex decomposition optimizations are proposed. Our design has been implemented in a DPI prototype employing a medium-end FPGA. Extensive experiments are conducted to evaluate the performance. Results reveal that our proposed architecture achieves 6.33 Gbps matching throughput on the Snort rule-set (v3.0), which is close to state-of-the-art FPGA NFA-based schemes. However, the rule-set preprocessing time is significantly reduced to <7 minutes, compared with up to several hours of FPGA NFA-based countermeasures.

Software-defined network aided lightweight group key management for resource-constrained Internet of Things devices

Software-Defined Network (SDN) and Network Function Virtualization (NFV) are key enablers for provisioning dynamic, virtual security services on demand. This article, presents a novel Group Key Management scheme for Low-Resource Devices (GKM-LRD) with SDN aided trusted key management server as a central server to provide key management service to groups formed in Internet of Things (IoT) applications. In addition to the group key management scheme, a lightweight packet key-based communication system is proposed to make the data traffic reliable. Packet keys are short sized keys acquiring the lifetime of a packet. Even though the key is short sized, the security strength comes from its short lifetime. The proposed GKM-LRD is evaluated in terms of computation load, communication load, storage and scalability in comparison with the existing group key management schemes. The computation load, communication load and storage load is reduced by 80%, 17.25% and 20% respectively in comparison with the existing system assuring the scheme as lightweight and applicable for IoT devices. The proposed packet key-based communication scheme is compared with an existing Diffie-Hellman based packet key system. The results show the system is comparatively lightweight with computation load reduced by 74.8%. The security analysis of the proposed scheme proves that the scheme ensures forward secrecy, backward secrecy and resistance to man-in-the-middle and replay attacks.

Graph Neural Networks for Intelligent Modelling in Network Management and Orchestration: A Survey on Communications

The advancing applications based on machine learning and deep learning in communication networks have been exponentially increasing in the system architectures of enabled software-defined networking, network functions virtualization, and other wired/wireless networks. With data exposure capabilities of graph-structured network topologies and underlying data plane information, the state-of-the-art deep learning approach, graph neural networks (GNN), has been applied to understand multi-scale deep correlations, offer generalization capability, improve the accuracy metrics of prediction modelling, and empower state representation for deep reinforcement learning (DRL) agents in future intelligent network management and orchestration. This paper contributes a taxonomy of recent studies using GNN-based approaches to optimize the control policies, including offloading strategies, routing optimization, virtual network function orchestration, and resource allocation. The algorithm designs of converged DRL and GNN are reviewed throughout the selected studies by presenting the state generalization, GNN-assisted action selection, and reward valuation cooperating with GNN outputs. We also survey the GNN-empowered application deployment in the autonomous control of optical networks, Internet of Healthcare Things, Internet of Vehicles, Industrial Internet of Things, and other smart city applications. Finally, we provide a potential discussion on research challenges and future directions.

Priority based dynamic spectrum management using Virtual Utility Functions in Cognitive Radio enabled Internet of Things

Fast growth of wireless devices in IoT (Internet of Things), industry 5.0 and 6G cellular networks, is dealing with the challenge of spectrum scarcity and uneven utilization of available resources. To achieve Ambient Intelligence (AmI) in IoT communication network, dynamic utilization of available network resources, is a challenge faced by resource constraint IoT devices. Cognitive radio technology enables these devices to intelligently sense the free spectrum holes and smartly manage available channels opportunistically. To jointly deal with the challenge of spectrum scarcity and application specific network service provision, we propose a novel multi-attribute based two-tier framework called Cognitive Radio Efficient Spectrum Utilization (CR-ESU) which integrates the concept of Network Function Virtualization (NFV) as Virtual Utility Functions (VUFs) with cognitive radio enabled IoT devices to achieve the dynamic and flexible network services as well as spectral efficiency. The proposed framework is one of the pioneer works that incorporate the two ground breaking technologies, NFV and CRN to create a smart and flexible CR-enabled IoT network. CR-ESU also ensures the best channel selection using Dynamic Channel Reservation (DCR) scheme to decrease the channel switching rate. Continuous Time Markov Chain (CTMC) model is used for network modeling and mathematical expression formation. Promising results show the potential of CR-ESU framework to form a reconfigurable and efficient network.

The Effects of High-Performance Cloud System for Network Function Virtualization

Since ETSI introduced the architectural framework of network function virtualization (NFV), telecom operators have paid more attention to the synergy of NFV and cloud computing. With the integration of the NFV cloud platform, telecom operators decouple network functions from the dedicated hardware and run virtualized network functions (VNFs) on the cloud. However, virtualization degrades the performance of VNF, resulting in violating the performance requirements of the telecom industry. Most of the existing works were not conducted in a cloud computing environment, and fewer studies focused on the usage of enhanced platform awareness (EPA) features. Furthermore, few works analyze the performance of the service function chain on a practical cloud. This paper facilitates the OpenStack cloud with different EPA features to investigate the performance effects of VNFs on the cloud. A comprehensive test framework is proposed to evaluate the verification of functionality, performance, and application testing. Empirical results show that the cloud system under test fulfills the requirements of service level agreement in Rally Sanity testcases. The throughput of OVS-DPDK is up to 8.2 times as high as that of OVS in the performance test. Meanwhile, the hardware-assisted solution, SR-IOV, achieves the throughput at near the line rate in the end-to-end scenario. For the application test, the successful call rate for the vIMS service is improved by up to 14% while applying the EPA features on the cloud.

Framework for Efficient Auto-Scaling of Virtual Network Functions in a Cloud Environment.

Network Function Virtualization (NFV) offers an alternate method to design, deploy and manage network services. The NFV decouples network functions from the dedicated hardware and moves them to the virtual servers so that they can run in the software. One of the major strengths of the NFV is its ability to dynamically extend or reduce resources allocated to Virtual Network Functions (VNF) as needed and at run-time. There is a need for a comprehensive metering component in the cloud to store and process the metrics/samples for efficient auto-scaling or load-management of the VNF. In this paper, we propose an integrating framework for efficient auto-scaling of VNF using Gnocchi; a time-series database that is integrated within the framework to store, handle and index the time-series data. The objective of this study is to validate the efficacy of employing Gnocchi for auto-scaling of VNF, in terms of aggregated data points, database size, data recovery speed, and memory consumption. The employed methodology is to perform a detailed empirical analysis of the proposed framework by deploying a fully functional cloud to implement NFV architecture using several OpenStack components including Gnocchi. Our results show a significant improvement over the legacy Ceilometer configuration in terms of lower metering storage size, less memory utilization in processing and management of metrics, and reduced time delay in retrieving the monitoring data to evaluate alarms for the auto-scaling of VNF.

SPIDER: An availability‐aware framework for the service function chain placement in distributed scenarios

AbstractThe network function virtualization (NFV) paradigm replaces hardware‐dependent network functions by virtual network functions (VNFs) that can be deployed in commodity hardware, including legacy servers. Consequently, the use of NFV is expected to reduce operating and capital expenses, as well as improve service deployment operation and management flexibility. For many use cases, the VNFs must be visited and invoked following a specific order of execution in order to compose a complete network service, named service function chain (SFC). Nonetheless, despite the benefits from NFV and SFC virtualization technologies, their introduction must not harm network performance and service availability. On the one hand, redundancy is seen by network service planners as a mechanism well established to combat availability issues. At same time, there is a goal to optimize resource utilization in order to reduce operational expenditure. In this article, we share our experience in the design use of a framework, named SPIDER, focused on SFC placement that considers the network infrastructure condition and the required SFC availability to define the placement strategy. The SPIDER monitors the status of infrastructure nodes and links and defines which servers the VNFs should be placed on and the number of redundant replicas needed. We present a proof‐of‐concept of SPIDER using Kubernetes to launch the VNFs as containers. We also use Kubernetes to forward the traffic between the VNFs, composing the service chain. We perform experiments to evaluate the runtime of SPIDER and the SFC delay under different network conditions.

Latency control in service chaining using P4-based data plane programmability

Service chaining is becoming one of the most considered service deployment frameworks in the context of Network Function Virtualization (NFV) in edge and data center environments, conveniently supported by automatic connectivity configurations offered by Software Defined Networking (SDN). Current research on the topic is focusing on how to guarantee Quality of Service (QoS) in terms of guaranteed end-to-end latency for time critical services. Indeed, latency issues may depend on intra-server virtualization inefficiencies, leading to Virtual Network Function (VNF) delivery delays, or by congestion events occurring at intermediate network elements connecting VNFs. Latency control requires stateful information such as flow delay measurements at a per-packet level, typically not available at traditional SDN switches or inside the VNF. This paper proposes the adoption of SDN data plane programmability exploiting the P4 language and presents two P4 pipeline solutions, suitable for both intra-rack and inter-rack service chain deployments, to automatically check the path latency experienced by selected high priority flows, also resorting to the recent in-band telemetry applications. The programmable pipelines enforce proactive in-network functions, such as priority change or drop actions, in order to guarantee a bound SFC segment latency delivery, including both the network and the segment VNFs. The proposed solutions are implemented and evaluated in a network testbed employing programmable software switches showing their effectiveness in guaranteeing the configured end-to-end latency, and the limited effort in terms of additional processing at the P4 switch. The evaluation is carried out using the reference P4 software switch, i.e., BMv2. The aim is to validate the full P4 capabilities and the code feasibility in terms of scalability, load and resource impact and added intra-switch latency. The experimental results show the proposed approach scales with the number of forwarded flows and achieves per-segment latency control enforcement in both congested and non-congested scenarios with a very limited impact on the switch extra-latency, exploiting finer per-packet tuning of drop and priority change simply applicable through flow entry configuration. Applicability analysis on hardware switches guaranteeing line rate performance are provided.

Intelligent Virtual Resource Allocation of QoS-Guaranteed Slices in B5G-Enabled VANETs for Intelligent Transportation Systems

5G communication technologies and networks help researchers and engineers look into intelligent transportation systems (ITS) with a new eye, including vehicular ad hoc networks (VANET) application. Network function virtualization (NFV) and network slicing (NS) are accepted as two most promising technologies towards the agile and elastic network architecture of 5G and beyond 5G (B5G). However, previous researchers studied NFV and NS separately. In addition, learning technologies, such as reinforcement leaning (RL), graph-based learning, emerge so as to enhance the network intelligence and resource allocation in recent years. Inspired from these, we jointly explore intelligent resource allocation issue within B5G-enabled VANETs. At first, the novel virtual resource allocation framework supporting NFV and NS for providing quality of service (QoS)-guaranteed slices is constructed. Then, we formulate the virtual resource allocation of slices as the optimization problem, having the goals of providing guaranteed QoS performance and maximizing the net profit. Considering the non convex attributes of the formulated optimization problem, we propose one intelligent and feasible algorithm instead, including the details of the proposed intelligent algorithm. We record the results in order to validate the feasibility and highlights of our proposed algorithm. For example, our intelligent algorithm has the slice acceptance advantage of 5%, comparing with the best existing work.

Optimal Embedding of Aggregated Service Function Tree

Many hardware-based security middleboxes have been deployed in the networks to defend against different threats. However, these hardware middleboxes are hard to upgrade or migrate. The emergence of network functions virtualization (NFV), which realizes various security functions in the form of virtual network functions (VNFs), brings many benefits to network security. To improve the security level further, several VNFs are coordinated in a pre-defined order to form service function chains (SFCs). It is expected that the SFCs are embedded properly with low cost, including the VNF setup cost and the flow routing cost. In this paper, we find that when an SFC is required by multiple flows for the identical network security threats, the total cost could be reduced by embedding an aggregated service function tree (ASFT) instead of multiple independent SFCs. We formally characterize the integer programming model of this problem and prove that it is NP-hard. Then we propose a performance-guaranteed approximation algorithm and prove that the algorithm could find the optimal solution in a special case. Extensive experiments indicate that our method can reduce the total cost by <inline-formula><tex-math notation="LaTeX">$22.0\%$</tex-math></inline-formula> and <inline-formula><tex-math notation="LaTeX">$24.1\%$</tex-math></inline-formula> against two compared algorithms, respectively.

Machine Learning Assisted Security Analysis of 5G-Network-Connected Systems

The core network architecture of telecommunication systems has undergone a paradigm shift in the fifth-generation (5G) networks. 5G networks have transitioned to software-defined infrastructures, thereby reducing their dependence on hardware-based network functions. New technologies, like network function virtualization and software-defined networking, have been incorporated in the 5G core network (5GCN) architecture to enable this transition. This transition has significantly improved network efficiency, performance, and robustness. However, this has also made the core network more vulnerable, as software systems are generally easier to compromise than hardware systems. This article presents a comprehensive security analysis framework for the 5GCN. The novelty of this approach lies in the creation and analysis of attack graphs of the software-defined and virtualized 5GCN through machine learning. This analysis points to 119 novel possible exploits in the 5GCN. We demonstrate that these potential exploits of 5GCN vulnerabilities generate five novel attacks on the 5G Authentication and Key Agreement protocol. We combine the attacks at the network, protocol, and application layers to generate complex attack vectors. In a case study, we use these attack vectors to find four novel security loopholes in WhatsApp running on a 5G network.

Service Function Chains Deployment for 5G Slice With Bandwidth Coupling

Network function virtualization (NFV) technology is the key technology to solve the flexibility problem of 5G network. Multiple service function chains (SFCs) that coexist on physical infrastructure within a slice share the resources of the infrastructure. Therefore, how to allocate resources to an SFC under QoS constraints and further, how to build a resource sharing model among multiple SFCs are significant. In this letter, we jointly consider the above problems and propose a coupling bandwidth resource allocation model (CBRA) for the resource sharing of multiple SFCs. In this model, we define the effective coupling bandwidth increment(ECBI) based on the statistical feature of traffic and construct the homogeneous traffic flows on the infrastructure within the slice as the coupled traffic. Furthermore, based on the CBRA model, we establish an integer linear programming (ILP) problem aiming at minimizing resource occupancy to solve the SFCs deployment and realize the joint resource allocation of multiple SFCs. Simulation results show that the deployment algorithm can achieve QoS guarantee and effectively save bandwidth for homogeneous business.

Tapping into NFV Environment for Opportunistic Serverless Edge Function Deployment

Even with Network Function Virtualization (NFV), many commodity network servers have spare cycles. Despite that they are small and irregularly occur, spare cycles are fit for deploying short-lived serverless computing functions at the network edge. In this work, we perform detailed analyses of the benefits and limitations of co-locating serverless functions on NFV-ready servers. We propose <i>NEMO</i> , a novel platform that enables efficient serverless edge function deployment in the NFV environment. NEMO can intelligently harvest spare cycles of network functions to warm up the serverless functions and speed up the function invocation in an agile manner. Besides, NEMO can judiciously manage the thread conflict in a resource-limited environment. We build a prototype of NEMO. Our thorough evaluations show that NEMO can harvest up to 41% spare cycles and achieve about 12.5 <inline-formula><tex-math notation="LaTeX">$\sim$</tex-math></inline-formula> 25X performance improvement compared with straightforward co-location.

Resource consumption and security-aware multi-tenant service function chain deployment based on hypergraph matching

Network function virtualization (NFV) technology enables cloud service providers (CSPs) to deploy their service function chains (SFCs) into the common shared physical infrastructures to operate the network or cloud service. However, designing a suitable placement scheme for multi-tenant SFCs to balance resource consumption with performance and security is a tricky issue. In this paper, we first proposed security constraints based on physical isolation and formulated the problem of reasonably placing multi-tenant SFCs subject to multiple constraints to minimize resource consumption. The proposed problem is more intractable than previous works because of the extra introduced security constraints. To solve it, a new non-uniform weighted hypergraph construction approach is proposed by defining hyperedge weights to represent the resource consumption on one SFC. A hypergraph matching algorithm is proposed to find the maximum weight subset of hypergraphs whose vertices do not intersect to give a high degree of physical isolation by dealing with the conflict graphs . Simulation results show that the proposed hypergraph matching algorithm outperforms the comparison schemes in terms of the resource consumption while satisfying the security requirements.

IntOpt: In-band Network Telemetry optimization framework to monitor network slices using P4

The emergence of Network Functions Virtualization (NFV) is being heralded as an enabler of the recent technologies such as 5G/6G, IoT and heterogeneous networks. Existing NFV monitoring frameworks either do not have the capabilities to express the range of telemetry items needed to perform management or do not scale to large traffic volumes and rates. We present IntOpt, a scalable and expressive telemetry system designed for flexible NFV monitoring using active probing and P4. IntOpt allows us to specify monitoring requirements for individual service chain, which are mapped to telemetry item collection jobs that fetch the required telemetry items from P4 programmable data-plane elements. We propose mixed integer linear program (MILP) as well as a simulated annealing based random greedy (SARG) meta-heuristic approach to minimize the overhead due to active probing and collection of telemetry items. Using P4-FPGA, we benchmark the overhead for telemetry collection. Our numerical evaluation shows that the proposed approach can reduce monitoring overheads by 39% and monitoring delays by 57%. Such optimization may as well enable existing expressive monitoring frameworks to scale for larger real-time networks.

Open 5G campus networks: key drivers for 6G innovations

5G was designed to enable and unify Industrial Internet communication. Emerging 5G campus networks, in particular, provide a flexible communication infrastructure option addressing the specific needs of industry verticals regarding low latency, resilience, security, and operation models. Network Function Virtualization (NFV) and Edge Computing have paved the way for vendor-independent, customized, and scalable network designs for the past decade. Today, Open Radio Access Network (Open RAN) principles extend this architectural thinking toward an innovative and open 5G end-to-end infrastructure. 5G campus networks, in particular, might benefit from this envisaged openness. One key driver for boosting the global interest in private campus networks was the allocation of a dedicated 5G spectrum in Germany in 2019. In addition to permanent spectrum allocations for static campus network deployments, nomadic ad hoc campus network deployments using novel mechanisms, such as dynamic spectrum access and trading, also emerge. Both network types are enabled by the inherent flexibility of combining or disaggregating the desired open 5G RAN and core components in appropriate network deployments.Building upon years of experience in developing and operating 5G network cores and 5G testbeds, the authors provide an overview of the emerging global campus network market, available spectrum options, use cases for nomadic campus network deployments, and the need for open campus networks and open end-to-end technology testbeds. Utilizing the Fraunhofer FOKUS Open5GCore, the 5G Playground testbed, and the 5G+ Nomadic Node as examples, the paper sketches a blueprint for campus networks for international, applied research and development. Ending with an outlook on the evolution of campus networks, namely the transition toward higher spectrums and the integration of non-terrestrial networks, but also the adoption of more agile software principles and the deeper integration of AI/ML technologies for network control and management, it will become obvious that open campus network innovations will pave the way toward 6G.

Security in 5G and beyond recent advances and future challenges

Abstract5G, 6G, and beyond (xG) technologies aim at delivering emerging services with new requirements and challenges, enabling full and hyper mobile connectivity over the world. These beyond 5G networks are expected to ensure better quality of service, very high data rate, improved network security, high capacity, low latency, and low cost. In order to meet these objectives, a number of key enabler technologies have been proposed including massive multiple input multiple output, small cells, mobile edge computing, software defined network, network function virtualization, heterogeneous networks, network slicing, cloud radio access network, ultra‐dense network, energy efficiency, and spectrum sharing. Although, the potential interest of these technologies in the network, they opened the door to many security concerns and challenges making the network security one of the primary concerns of the future wireless communication networks. In this article, we investigated the recent advancements on the xG security issues resulted by each key enabler technologies. We analyzed how to secure the network while meeting the emerging promising services, users' demands, and service requirements. We also discussed how the security issues raised by these emerging technologies can be mitigated for efficient and secure communication.

Optical Network Management by ONOS-Based SDN Controller

The possibilities to manage the optical network with a logically centralized SDN control plane based on the Open Network Operating System (ONOS) are investigated. The structure of the controller and its main functional blocks are considered ensuring the collection of information about the state of network elements, the solution of the main control tasks, interaction of control systems built on different technological bases, are considered. The role and place of the open network operating system in the controller structure are shown, the description of the ONOS multilevel architecture in the form of a set of functional modules is given, the purpose and functions of the ONOS subsystems are analyzed, protocols and interfaces making it possible to present the SDN network as a model are described. The peculiarity of the model is that the managed network can be represented as a set of virtual network functions. Therefore, the control process becomes independent of which vendor's equipment was used to build the network, as well as whether the network is built on real physical elements or virtual ones. Using the ONOS allows you to build a logical centralized control plane in the SDN networks. The existing set of functional modules, services and interfaces in the ONOS allows you to perform optical network management tasks. For the further development of the ONOS, it is necessary to develop mathematical models and methods for the optimal solution of control problems in various operating conditions, which will become application-level software modules in the future.