Pub Date : 2016-11-01DOI: 10.1109/NFV-SDN.2016.7919498
Ji Yang, Xiaowei Yang, Zhenyu Zhou, Xin Wu, Theophilus A. Benson, Chengchen Hu
Software Defined Networking (SDN) uses a logically centralized controller to replace the distributed control plane in a traditional network. One of the central challenges faced by the SDN paradigm is the scalability of the logical controller. As a network grows in size, the computational and communication demand faced by a controller may soon exceed the capabilities of a commodity server. In this work, we revisit the task division of labour between the controller and switches, and propose FOCUS, an architecture that offloads a specific subset of control functions, i.e., stable local functions, to the switches' software stack. We implemented a prototype of FOCUS and analyzed the benefits of converting several SDN applications. Due to space restrictions, we only present results for ARP, LLDP and elephant flow detection. Our initial results are promising and they show that FOCUS can reduce a controller's communication overhead by 50% to nearly 100%, and the computational overhead from 80% to 98%. Furthermore, we observe that FOCUS offloading to the switches saves switch CPU because FOCUS reduces the overheads for communication with the controller.
SDN (Software Defined Networking)是一种通过逻辑上集中的控制器来代替传统网络中的分布式控制平面的网络。SDN范例面临的主要挑战之一是逻辑控制器的可伸缩性。随着网络规模的增长，控制器所面临的计算和通信需求可能很快就会超过商用服务器的能力。在这项工作中，我们重新审视了控制器和交换机之间的任务分工，并提出了FOCUS，这是一种将控制功能的特定子集(即稳定的本地功能)卸载到交换机软件堆栈的架构。我们实现了FOCUS的原型，并分析了转换多个SDN应用程序的好处。由于篇幅限制，我们只给出了ARP、LLDP和象流检测的结果。我们的初步结果是有希望的，他们表明FOCUS可以将控制器的通信开销减少50%到近100%，计算开销从80%到98%。此外，我们观察到FOCUS卸载到交换机可以节省交换机CPU，因为FOCUS减少了与控制器通信的开销。
{"title":"FOCUS: Function Offloading from a Controller to Utilize Switch power","authors":"Ji Yang, Xiaowei Yang, Zhenyu Zhou, Xin Wu, Theophilus A. Benson, Chengchen Hu","doi":"10.1109/NFV-SDN.2016.7919498","DOIUrl":"https://doi.org/10.1109/NFV-SDN.2016.7919498","url":null,"abstract":"Software Defined Networking (SDN) uses a logically centralized controller to replace the distributed control plane in a traditional network. One of the central challenges faced by the SDN paradigm is the scalability of the logical controller. As a network grows in size, the computational and communication demand faced by a controller may soon exceed the capabilities of a commodity server. In this work, we revisit the task division of labour between the controller and switches, and propose FOCUS, an architecture that offloads a specific subset of control functions, i.e., stable local functions, to the switches' software stack. We implemented a prototype of FOCUS and analyzed the benefits of converting several SDN applications. Due to space restrictions, we only present results for ARP, LLDP and elephant flow detection. Our initial results are promising and they show that FOCUS can reduce a controller's communication overhead by 50% to nearly 100%, and the computational overhead from 80% to 98%. Furthermore, we observe that FOCUS offloading to the switches saves switch CPU because FOCUS reduces the overheads for communication with the controller.","PeriodicalId":448203,"journal":{"name":"2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN)","volume":"29 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124484925","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-11-01DOI: 10.1109/NFV-SDN.2016.7919504
Hao Wang, J. Schmitt
The goals of load balancing are diverse. We may distribute the load to servers in order to achieve the same utilizations or average latencies. However, these goods are not a perfect fit in virtualized or software-defined networks. First, it is more difficult to assume homogeneous server capacities. Even for two (virtualized) functions with the same capacities, the capacities seen by the customer might be heterogeneous simply because they belong to different providers, are shared by others, or locate themselves differently and the communication costs are different. Heterogeneous server capacity will blur the aim of keeping the same utilizations. Second, usually the metric of latency in those networks is the (stochastic) bound instead of average value. In this paper, we parameterize the server capacities, and use the stochastic latency bound as the metric to further support inferring load balancing. We also model the load balancing process as a Markov-modulated process and observe the influence of its parameters onto achieving balance. The proposed model will benefit the load balancing function implementation and infrastructure design in virtualized or software-defined networks.
{"title":"Load balancing - towards balanced delay guarantees in NFV/SDN","authors":"Hao Wang, J. Schmitt","doi":"10.1109/NFV-SDN.2016.7919504","DOIUrl":"https://doi.org/10.1109/NFV-SDN.2016.7919504","url":null,"abstract":"The goals of load balancing are diverse. We may distribute the load to servers in order to achieve the same utilizations or average latencies. However, these goods are not a perfect fit in virtualized or software-defined networks. First, it is more difficult to assume homogeneous server capacities. Even for two (virtualized) functions with the same capacities, the capacities seen by the customer might be heterogeneous simply because they belong to different providers, are shared by others, or locate themselves differently and the communication costs are different. Heterogeneous server capacity will blur the aim of keeping the same utilizations. Second, usually the metric of latency in those networks is the (stochastic) bound instead of average value. In this paper, we parameterize the server capacities, and use the stochastic latency bound as the metric to further support inferring load balancing. We also model the load balancing process as a Markov-modulated process and observe the influence of its parameters onto achieving balance. The proposed model will benefit the load balancing function implementation and infrastructure design in virtualized or software-defined networks.","PeriodicalId":448203,"journal":{"name":"2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN)","volume":"77 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132353825","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-11-01DOI: 10.1109/NFV-SDN.2016.7919494
Liran Sidki, Y. Ben-Shimol, Akiva Sadovski
Software-Defined Networking (SDN) enables decoupling of the data plane from the control plane on network devices. This approach differs from the traditional networking architecture where both planes reside on the same network device. SDN offers flexibility, centralized control, reduced complexity and a dramatic decrease in network systems and equipment costs. OpenFlow (OF) is a widely used protocol for establishing communication between the control and data planes for SDN. Reliance on a single controller might not be feasible since the controller is a single point-of-failure (SPOF) in the network. In this paper, we propose to approach the issue of fault-tolerance by using a slave controller architecture with local mechanisms of virtual controller redundancy and synchronization between the controllers. Our prototype implementation enables the network to cope with control plane crashes in the controllers without changing the OF protocol between controllers and switches.
SDN (Software-Defined Networking)实现了网络设备上数据平面和控制平面的解耦。这种方法不同于传统的网络架构，在传统的网络架构中，两个平面都位于同一网络设备上。SDN提供了灵活性，集中控制，降低了复杂性，并大大降低了网络系统和设备成本。OpenFlow (OF)是目前广泛应用的SDN控制平面和数据平面之间的通信协议。依赖单个控制器可能不可行，因为控制器是网络中的单故障点(SPOF)。在本文中，我们提出通过使用具有虚拟控制器冗余和控制器之间同步的本地机制的从控制器架构来解决容错问题。我们的原型实现使网络能够在不改变控制器和交换机之间的OF协议的情况下处理控制器中的控制平面崩溃。
{"title":"Fault tolerant mechanisms for SDN controllers","authors":"Liran Sidki, Y. Ben-Shimol, Akiva Sadovski","doi":"10.1109/NFV-SDN.2016.7919494","DOIUrl":"https://doi.org/10.1109/NFV-SDN.2016.7919494","url":null,"abstract":"Software-Defined Networking (SDN) enables decoupling of the data plane from the control plane on network devices. This approach differs from the traditional networking architecture where both planes reside on the same network device. SDN offers flexibility, centralized control, reduced complexity and a dramatic decrease in network systems and equipment costs. OpenFlow (OF) is a widely used protocol for establishing communication between the control and data planes for SDN. Reliance on a single controller might not be feasible since the controller is a single point-of-failure (SPOF) in the network. In this paper, we propose to approach the issue of fault-tolerance by using a slave controller architecture with local mechanisms of virtual controller redundancy and synchronization between the controllers. Our prototype implementation enables the network to cope with control plane crashes in the controllers without changing the OF protocol between controllers and switches.","PeriodicalId":448203,"journal":{"name":"2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN)","volume":"5 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"132977702","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-10-08DOI: 10.1109/NFV-SDN.2016.7919475
Arash Shaghaghi, M. Kâafar, Sandra Scott-Hayward, S. Kanhere, Sanjay Jha
In this paper, we coin the term Policy Enforcement as a Service (PEPS), which enables the provision of innovative inter-layer and inter-domain Access Control. We leverage the architecture of Software-Defined-Network (SDN) to introduce a common network-level enforcement point, which is made available to a range of access control systems. With our PEPS model, it is possible to have a ‘defense in depth’ protection model and drop unsuccessful access requests before engaging the data provider (e.g. a database system). Moreover, the current implementation of access control within the ‘trusted’ perimeter of an organization is no longer a restriction so that the potential for novel, distributed and cooperative security services can be realized. We conduct an analysis of the security requirements and technical challenges for implementing Policy Enforcement as a Service. To illustrate the benefits of our proposal in practice, we include a report on our prototype PEPS-enabled location-based access control.
{"title":"Towards Policy Enforcement Point as a Service (PEPS)","authors":"Arash Shaghaghi, M. Kâafar, Sandra Scott-Hayward, S. Kanhere, Sanjay Jha","doi":"10.1109/NFV-SDN.2016.7919475","DOIUrl":"https://doi.org/10.1109/NFV-SDN.2016.7919475","url":null,"abstract":"In this paper, we coin the term Policy Enforcement as a Service (PEPS), which enables the provision of innovative inter-layer and inter-domain Access Control. We leverage the architecture of Software-Defined-Network (SDN) to introduce a common network-level enforcement point, which is made available to a range of access control systems. With our PEPS model, it is possible to have a ‘defense in depth’ protection model and drop unsuccessful access requests before engaging the data provider (e.g. a database system). Moreover, the current implementation of access control within the ‘trusted’ perimeter of an organization is no longer a restriction so that the potential for novel, distributed and cooperative security services can be realized. We conduct an analysis of the security requirements and technical challenges for implementing Policy Enforcement as a Service. To illustrate the benefits of our proposal in practice, we include a report on our prototype PEPS-enabled location-based access control.","PeriodicalId":448203,"journal":{"name":"2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN)","volume":"50 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-10-08","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122262974","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2016-06-20DOI: 10.1109/NFV-SDN.2016.7919490
Manuel Peuster, H. Karl, S. V. Rossem
Virtualized network services consisting of multiple individual network functions are already today deployed across multiple sites, so called multi-PoP (points of presence) environments. This allows to improve service performance by optimizing its placement in the network. But prototyping and testing of these complex distributed software systems becomes extremely challenging. The reason is that not only the network service as such has to be tested but also its integration with management and orchestration systems. Existing solutions, like simulators, basic network emulators, or local cloud testbeds, do not support all aspects of these tasks. To this end, we introduce MeDICINE, a novel NFV prototyping platform that is able to execute production-ready network functions, provided as software containers, in an emulated multi-PoP environment. These network functions can be controlled by any third-party management and orchestration system that connects to our platform through standard interfaces. Based on this, a developer can use our platform to prototype and test complex network services in a realistic environment running on his laptop.
{"title":"MeDICINE: Rapid prototyping of production-ready network services in multi-PoP environments","authors":"Manuel Peuster, H. Karl, S. V. Rossem","doi":"10.1109/NFV-SDN.2016.7919490","DOIUrl":"https://doi.org/10.1109/NFV-SDN.2016.7919490","url":null,"abstract":"Virtualized network services consisting of multiple individual network functions are already today deployed across multiple sites, so called multi-PoP (points of presence) environments. This allows to improve service performance by optimizing its placement in the network. But prototyping and testing of these complex distributed software systems becomes extremely challenging. The reason is that not only the network service as such has to be tested but also its integration with management and orchestration systems. Existing solutions, like simulators, basic network emulators, or local cloud testbeds, do not support all aspects of these tasks. To this end, we introduce MeDICINE, a novel NFV prototyping platform that is able to execute production-ready network functions, provided as software containers, in an emulated multi-PoP environment. These network functions can be controlled by any third-party management and orchestration system that connects to our platform through standard interfaces. Based on this, a developer can use our platform to prototype and test complex network services in a realistic environment running on his laptop.","PeriodicalId":448203,"journal":{"name":"2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN)","volume":"37 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-06-20","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130260446","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
As Communication Service Providers (CSPs) adopt the Network Function Virtualization (NFV) paradigm they need to transition their network function capacity to a virtualized infrastructure with different Network Functions (NFs) running on a set of heterogeneous servers. This paper describes a novel technique for allocating server resources (compute, storage and network) for a given set of Virtual Network Function (VNF) requirements. Our approach helps the telecommunication providers decide the most effective way to run several VNFs on servers with different performance characteristics. Our analysis of prior VNF performance characterization on heterogeneous/different server resource allocations shows that the ability to arbitrarily create many VNFs among different servers' resource allocations leads to a comparative advantage among servers. We propose a VNF resource allocation method called COMPARE that maximizes the total throughput of the system by formulating this resource allocation problem as a comparative advantage problem among heterogeneous servers. There are several applications for using the VNF resource allocation from COMPARE including transitioning current Telco deployments to NFV based solutions and providing initial VNF placement for Service Function Chain (SFC) provisioning. We use analytic proof and illustrative examples to demonstrate optimality of COMPARE algorithm.
{"title":"COMPARE: Comparative Advantage driven resource allocation for Virtual Network Functions","authors":"B. Huberman, P. Sharma","doi":"10.2139/ssrn.2745661","DOIUrl":"https://doi.org/10.2139/ssrn.2745661","url":null,"abstract":"As Communication Service Providers (CSPs) adopt the Network Function Virtualization (NFV) paradigm they need to transition their network function capacity to a virtualized infrastructure with different Network Functions (NFs) running on a set of heterogeneous servers. This paper describes a novel technique for allocating server resources (compute, storage and network) for a given set of Virtual Network Function (VNF) requirements. Our approach helps the telecommunication providers decide the most effective way to run several VNFs on servers with different performance characteristics. Our analysis of prior VNF performance characterization on heterogeneous/different server resource allocations shows that the ability to arbitrarily create many VNFs among different servers' resource allocations leads to a comparative advantage among servers. We propose a VNF resource allocation method called COMPARE that maximizes the total throughput of the system by formulating this resource allocation problem as a comparative advantage problem among heterogeneous servers. There are several applications for using the VNF resource allocation from COMPARE including transitioning current Telco deployments to NFV based solutions and providing initial VNF placement for Service Function Chain (SFC) provisioning. We use analytic proof and illustrative examples to demonstrate optimality of COMPARE algorithm.","PeriodicalId":448203,"journal":{"name":"2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN)","volume":"67 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2016-03-09","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122383431","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 1900-01-01DOI: 10.1109/NFV-SDN.2016.7919476
Jacob H. Cox, R. Clark, H. Owen
Controllers for software defined networks (SDNs) are quickly maturing to offer network operators more intuitive programming frameworks and greater abstractions for network application development. Likewise, many security solutions now exist within SDN environments for detecting and blocking clients who violate network policies. However, many of these solutions stop at triggering the security measure and give little thought to amending it. As a consequence, once the violation is addressed, no clear path exists for reinstating the flagged client beyond having the network operator reset the controller or manually implement a state change via an external command. This presents a burden for the network and its clients and administrators. Hence, we present a security policy transition framework for revoking security measures in an SDN environment once said measures are activated.
{"title":"Security policy transition framework for Software Defined networks","authors":"Jacob H. Cox, R. Clark, H. Owen","doi":"10.1109/NFV-SDN.2016.7919476","DOIUrl":"https://doi.org/10.1109/NFV-SDN.2016.7919476","url":null,"abstract":"Controllers for software defined networks (SDNs) are quickly maturing to offer network operators more intuitive programming frameworks and greater abstractions for network application development. Likewise, many security solutions now exist within SDN environments for detecting and blocking clients who violate network policies. However, many of these solutions stop at triggering the security measure and give little thought to amending it. As a consequence, once the violation is addressed, no clear path exists for reinstating the flagged client beyond having the network operator reset the controller or manually implement a state change via an external command. This presents a burden for the network and its clients and administrators. Hence, we present a security policy transition framework for revoking security measures in an SDN environment once said measures are activated.","PeriodicalId":448203,"journal":{"name":"2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN)","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131814311","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 1900-01-01DOI: 10.1109/NFV-SDN.2016.7919487
Michael Till Beck, J. F. Botero, Kai Samelin
Network Functions Virtualization (NFV) is an emerging initiative where standard IT virtualization evolves to consolidate network functions onto high volume servers, switches and storage that can be located anywhere in the network. One of the main challenges to implement NFV is the problem of allocating Virtual Network Functions (VNFs) on top of the physical network infrastructure. Up to now, existing approaches dealing with this problem have not considered the possibility of failures in this infrastructure. This paper discusses several measures on how backup resources can be integrated into the embedding of VNFs in order to protect network services from failures; furthermore, a resource allocation algorithm is proposed that considers resilience constraints. The algorithm exploits the benefits of sharing backup network resources in order to reduce the resource cost spent for providing resilient allocations.
{"title":"Resilient allocation of service Function chains","authors":"Michael Till Beck, J. F. Botero, Kai Samelin","doi":"10.1109/NFV-SDN.2016.7919487","DOIUrl":"https://doi.org/10.1109/NFV-SDN.2016.7919487","url":null,"abstract":"Network Functions Virtualization (NFV) is an emerging initiative where standard IT virtualization evolves to consolidate network functions onto high volume servers, switches and storage that can be located anywhere in the network. One of the main challenges to implement NFV is the problem of allocating Virtual Network Functions (VNFs) on top of the physical network infrastructure. Up to now, existing approaches dealing with this problem have not considered the possibility of failures in this infrastructure. This paper discusses several measures on how backup resources can be integrated into the embedding of VNFs in order to protect network services from failures; furthermore, a resource allocation algorithm is proposed that considers resilience constraints. The algorithm exploits the benefits of sharing backup network resources in order to reduce the resource cost spent for providing resilient allocations.","PeriodicalId":448203,"journal":{"name":"2016 IEEE Conference on Network Function Virtualization and Software Defined Networks (NFV-SDN)","volume":"124 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"1900-01-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124457193","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
京公网安备 11010802042870号
京ICP备2023020795号-1
扫码关注我们
求助内容：
应助结果提醒方式：