235 research outputs found
High performance network function virtualization for user-oriented services
No full textThe Network Function Virtualization (NFV) paradigm proposes to transform those network functions today running on dedicated and often closed appliances (e.g., firewall, wan accelerator) into pure software images, called Virtual Network Functions (VNFs), which can be consolidated and executed on high-volume standard servers. In this context, this dissertation focuses on the possibility of enabling each single end user (and not only network operators) to set up network services by means of NFV, allowing him to custoimize the set of services that are active on his Internet connection. This goal mainly requires to address flexibility and performance issues. Regarding to the former, it is important: (i) to support services including both network (e.g., firewall) and cloud (e.g., storage server) applications; (ii) to allow the user to define the service with an intuitive and high-level abstraction, hiding infrastructure-layer details. Instead, with respect to performance, multiple software-based services operating on the user's traffic should not introduce penalties in the user's Internet experience. This dissertation solves the above issues by proposing a number of improvements in the context of Network Function Virtualization, both in terms of high level models and architectures to define and instantiate network services, and in terms of mechanisms to efficiently interconnect VNFs. Experimental results demonstrate that the goal of allowing end users to deploy services operating on their own traffic is feasible without impacting the Internet experienc
Enabling precise traffic filtering based on protocol encapsulation rules
No full textCurrent packet filters have a limited support for expressions based on protocol encapsulation relationships and some constraints are not supported at all, such as the value of the IP source address in the inner header of an IP-in-IP packet. This limitation may be critical for a wide range of packet filtering applications, as the number of possible encapsulations is steadily increasing and network operators cannot define exactly which packets they are interested in. This paper proposes a new formalism, called eXtended Finite State Automata with Predicates (xpFSA), that provides an efficient implementation of filtering expressions, supporting both constraints on protocol encapsulations and the composition of multiple filtering expressions. Furthermore, it defines a novel algorithm that can be used to automatically detect tunneled packets. Our algorithms are validated through a large set of tests assessing both the performance of the filtering generation process and the efficiency of the actual packet filtering code when dealing with real network packets
Customizing Data-plane Processing in Edge Routers
No full textWhile OpenFlow enables the customization of the control plane of a router, currently no solutions are available for the customization of the data plane. This paper presents a prototype that offers to third parties (even end-users) the possibility to install their own applications on the data plane of a router, particularly the ones operating at the edge of the network. This paper presents the motivation of the idea, the reason why we use OpenFlow even if it does not seem appropriate for the data plane, the architecture and the implementation of our prototype, and a first characterization of the system running in our la
Moving Applications from the Host to the Network: Experiences, Challenges and Findings
No full textSome recent works propose to extend network devices (e.g., routers) with the possibility to execute additional user-provisioned software operating on the data-plane. This enables network devices to be enriched with new functionalities, potentially decided at run-time directly by the end users. This paper focuses on one of such programmable routing platform and presents our experience in developing new software (namely, a parental control service) in that environment. In addition, we describe also two extensions to our platform that were needed to accommodate the necessity of our applications
Defining a generic OR-VNFM interface for configuring network functions
No full textThe ETSI model defines a generic architecture to deploy and configure virtual network functions. While many efforts from both academia and industry focus on the problem of deploying those virtual network functions, little attention has been given to the interface needed to configure such applications. This paper explores the problem of dynamically configuring virtual network functions and proposes an implementation for the ETSI MANO OR-VNFM interface that supports generic network functions by exploiting a message bus and YANG models
End-to-end service orchestration across SDN and cloud computing domains
No full textThis paper presents an open-source orchestration framework that deploys end-to-end services across OpenStack-managed data centers and SDN networks controlled either by ONOS or OpenDaylight. The proposed framework improves existing software in two directions. First, it exploits SDN domains not only to implement traffic steering, but also to execute selected network functions (e.g., NAT). Second, it can deploy a service by partitioning the original service graph into multiple subgraphs, each one instantiated in a different domain, dynamically connected by means of traffic steering rules and parameters (e.g. VLAN IDs) negotiated at run-time
Filtering Network Traffic Based on Protocol Encapsulation Rules
No full textPacket filtering is a technology at the foundation of many traffic analysis tasks. While languages and tools for packet filtering have been available for many years, none of them supports filters operating on the encapsulation relationships found in each packet. This represents a problem as the number of possible encapsulations used to transport traffic is steadily increasing and we cannot define exactly which packets have to be captured. This paper presents our early work on an algorithm that models protocol filtering patterns (including encapsulation constraints) as Finite State Automata and supports the composition of multiple expressions within the same filter. The resulting, optimized filter is then translated into executable code. The above filtering algorithms are available in the NetBee open source library, which provides some basic tools for handling network packets (e.g., a tcpdump-like program) and APIs to build more advanced tool
Supporting Fine-Grained Network Functions through Intel DPDK
No full textNetwork Functions Virtualization (NFV) aims to transform network functions into software images, executed on standard, high-volume hardware. This paper focuses on the case in which a massive number of (tiny) network function instances are executed simultaneously on the same server and presents our experience in the design of the components that move the traffic across those functions, based on the primitives offered by the Intel DPDK framework. This paper proposes different possible architectures, it characterizes the resulting implementations, and it evaluates their applicability under different constraints
A Transparent Highway for inter-Virtual Network Function Communication with Open vSwitch
No full textThis paper presents a software architecture that can dynamically and transparently establish direct communication paths between DPDK-based virtual network functions executed in virtual machines, by recognizing new point-to-point connections in traffic steering rules. We demonstrate the huge advantages of this architecture in terms of performance and the possibility to implement it with localized modifications in Open vSwitch and DPDK, without touching the VNF
Transparent Optimization of Inter-Virtual Network Function Communication in Open vSwitch
No full textThis paper proposes an architecture that can optimize inter-VM communication in an NFV environment through the creation of direct channels between virtual machines. Particularly, our prototype can transparently optimize the data transfer between virtual machines running DPDK applications by dynamically recognizing the existence of point-to-point connections in the traffic steering rules, reverting back to the traditional VM-to-switch-to-VM approach when the optimization is no longer possible. This paper demonstrates the huge advantages of this architecture and the possibility to implement it with localized modifications mainly in Open vSwitch, without touching the applications inside the VMs
- …
