10 research outputs found
Hyper-NF: synthesizing chains of virtualized network functions
Middleboxes are essential to the functioning of today's internet. They are for instance used to secure networks, to enhance performances (e.g., throughput, scalability or end-user latency) or to monitor traffic. Although middleboxes are usually deployed through expensive dedicated hardware, the past 15 years has seen the emergence of a new paradigm: network function virtualisation (NFV). In the NFV context, middleboxes are implemented in software on commodity hardware, thus reducing costs and increasing flexibility. Some of the most recent work even boast performances that are equals to those of hardware middleboxes (e.g., line-rate throughput). However, none of the frameworks that we could find were suited to implement chains of virtualised middleboxes. Indeed, it is often the case that a packet must cross numerous middleboxes when traversing the internet. In order for an NFV deployment to scale out and reduce the network overhead, one would wish to be able to deploy all these middleboxes on the same physical machine. We provide an evaluation of a state-of-the-art NFV framework that shows that the throughput of a chain of 8 middleboxes running on the same server can be as much as 5 times smaller than the throughput of a single middlebox. We then introduce Hyper-NF, a new NFV framework specifically designed for implementing chains of virtualised middleboxes. Hyper-NF eliminates redundant packet and I/O operations. Given a chain of middleboxes, it uses graph search and set theory to generate a single equivalent middlebox that only uses one read and one write operation per packet. Experimentation with middlebox deployments inspired from real-world use cases shows that Hyper-NF achieve constant throughput and latency despite the increasing number of chained middleboxes. Thus, it achieves considerably better performances than traditional deployments. On a chain of 8 virtualised middleboxes, Hyper-NF has a 5 times higher throughput, a 10 times lower latency and uses 8.5 times less CPU cycles per packet.Middleboxes Àr absolut nödvÀndiga i internet idag. De behövs för att sÀkra nÀtverken, för att förbÀttra prestanda (till exempel genomströmning, fördröjning eller skalbarhet) eller för att övervaka nÀtverkstraffik. Middleboxes brukar vara byggd med dyrt och dedikerad hÄrdvara men ett nytt paradigm utvecklades in senaste Ären: virtualisering av nÀtverksfunktioner (en: Network Function Virtualization - NFV). I NFV, middleboxes skaffas av flexibel mjukvara pÄ billig rÄvara hÄrdvara. NÄgra aktuella ramar Àven ger samma prestanda som hÄrdvara middleboxes (t.ex. genomströmning med linjehastighet). Denna ramar Àr dock inte lÀmpade för att genomföra kedjor av virtualiserade middleboxes. Ett nÀtverkspaket mÄste ofta gÄ igenom mÄnga middleboxes nÀr det korsar internet. DÀrför skulle det vara bÀttre att utplacera flera virtuella middleboxes pÄ samma maskin. SÄ skulle man minska belastningen pÄ nÀtverket och NFV-utplacering skulle kunna skala ut. Vi visar att Àven med en state of the art NFV-ram, genomströmningen av en kedjor av 8 middleboxes som körs pÄ samma dator Àr 5 gÄnger mindre Àn den av en enda virtuell middlebox. Vi introducerar Hyper-NF, en ny NFV-ram som vi speciellt utformade för att genomföra kedjor av virtualiserade middleboxes. Hyper-NF eliminerar redundanta I/O och pakets verksamhet. Det förvandlar en kedja av middleboxes till en enda middlebox med liknande funktionalitet genom mÀngdteori och graf sökning. Den producerade middlebox anvÀnder bara ett lÀs och ett skriv operation per paket. Vi testade Hyper-NF med middlebox-utplacering som inspirerades av verkliga anvÀndningsfall. Hyper-NF uppnÄr konstant prestanda (genomströmning och fördröjning) Àven om vi öka antalet middleboxes i kedjan. Det Àr alltsÄ betydligt bÀttre Àn traditionella ramar. PÄ en kedja av 8 virtualiserade middleboxes har Hyper-NF en 5 gÄnger högre genomströmning, en 10 gÄnger lÀgre latens och anvÀnder 8,5 gÄnger mindre CPU-cykler per paket
Du routage centré contenu pour l'internet des objets
As the Internet of Things (IoT) has brought upon new communication patterns and challenges, Information-Centric Networking (ICN) has been touted as a potential solution. To confirm that hypothesis, the fundamental issue of routing and forwarding in the ICN-IoT must be addressed. This thesis investigates this topic across the IoT architecture.First, a scheme to securely forward ICN interests packets based on geographic coordinates is proposed for low-power wireless sensor networks (WSN). Its efficiency is compared to an optimized flooding-based scheme similar to current ICN-WSN approaches in terms of deployability and scalability using an analytical model. Realistic data for the model is derived from a mixture of simulation, literature study, and experiments on state-of-the-art sensor boards. Geographic forwarding is shown to halve the memory footprint of the ICN stack on reference deployments and to yield significant energy savings, especially for dynamic topologies. Second, ICN is used to enhance admission control (AC) to fixed-capacity Edge-computing platforms to guarantee request-completion time for latency-constrained applications. The LRU-AC, a request-aware AC strategy based on online learning of the request popularity distribution through a Least-Recently-Used (LRU) filter, is proposed. Using a queueing model, the LRU-AC is shown to decrease the number of requests that must be offloaded to the Cloud. An implementation of the LRU-AC on FPGA hardware is then proposed, using Ageing Bloom Filters (ABF) to provide a compact memory representation. The validity of using ABFs for the LRU-AC is proven through analytical modelling. The implementation provides high throughput and low latency.Finally, the management and virtualization of ICN-IoT networks are considered.vICN (virtualized ICN), a unified intent-based framework for network configuration and management that uses recent progress in resource isolation and virtualization techniques is introduced. It offers a single, flexible and scalable platform to serve different purposes, ranging from reproducible large-scale research experimentation to demonstrations with emulated and/or physical devices and network resources and to real deployments of ICN in existing IP networks.Les rĂ©seaux centrĂ©s contenus (ICN) sont considĂ©rĂ©s comme une solution aux nouveaux dĂ©fis et modes de communication liĂ©s Ă l'Ă©mergence de l'Internet des Objets (IoT). Pour confirmer cette hypothĂšse, la problĂ©matique fondamentale du routage sur les rĂ©seaux ICN-IoT doit ĂȘtre abordĂ©e. Cette thĂšse traite de ce sujet Ă travers l'architecture IoT.PremiĂšrement, une mĂ©thode sĂ©curisĂ©e est introduite pour acheminer des paquets ICN Ă partir de coordonnĂ©es gĂ©ographiques dans un rĂ©seau sans-fil de capteurs Ă faible puissance. Elle est comparĂ©e Ă une inondation optimisĂ©e du rĂ©seau inspirĂ©e des approches existant dans la littĂ©rature. En particulier, leur faisabilitĂ© et passage Ă l'Ă©chelle sont Ă©valuĂ©s via un modĂšle mathĂ©matique. Le modĂšle est paramĂ©trĂ© grĂące Ă des donnĂ©es rĂ©alistes issues de simulation, de la littĂ©rature, et d'expĂ©riences sur des capteurs. Il est montrĂ© que le routage gĂ©ographique permet de diviser la mĂ©moire nĂ©cessaire sur les capteurs par deux et de rĂ©duire considĂ©rablement le coĂ»t Ă©nergĂ©tique du routage, en particulier pour des topologies dynamiques.Ensuite, ICN est utilisĂ© pour contrĂŽler l'admission Ă une plate-forme de calcul de type Fog afin de garantir le temps de rĂ©ponse. La stratĂ©gie de contrĂŽle d'admission proposĂ©e, le LRU-AC, utilise l'algorithme Least-Recently-Used (LRU) pour apprendre en direct la distribution de popularitĂ© des requĂȘtes. Son efficacitĂ© est dĂ©montrĂ©e grĂące Ă un modĂšle fondĂ© sur un rĂ©seau de files d'attente. Une implĂ©mentation du LRU-AC est proposĂ©, utilisant des filtres de Bloom pour satisfaire aux contraintes des cartes FPGA. Son bien-fondĂ© est prouvĂ© par un modĂšle mathĂ©matique et son efficacitĂ© en termes de latence et dĂ©bit dĂ©montrĂ©e.Enfin, on prĂ©sente vICN, un outil pour la gestion et la virtualisation de rĂ©seaux ICN-IoT. Il s'agit d'une plate-forme qui unifie la configuration et la gestion des rĂ©seaux et des applications en exploitant les progrĂšs des techniques d'isolation et de virtualisation. vICN est flexible, passe Ă l'Ă©chelle, et peut remplir diffĂ©rents buts : expĂ©riences Ă grande Ă©chelle reproductibles pour la recherche, dĂ©monstrations mĂ©langeant machines Ă©mulĂ©es et physiques, et dĂ©ploiements rĂ©els des technologies ICN dans les rĂ©seaux IP existants
SLICT: Secure Localized Information Centric Things
While the potential advantages of geographic forwarding in wireless sensor networks (WSN) have been demonstrated for a while now, research in applying Information Centric Networking (ICN) has only gained momentum in the last few years. In this paper, we bridge these two worlds by proposing an ICN-compliant and secure implementation of geographic forwarding for ICN. We implement as a proof of concept the Greedy Perimeter Stateless Routing (GPSR) algorithm and compare its performance to that of vanilla ICN forwarding. We also evaluate the cost of security in 802.15.4 networks in terms of energy, memory and CPU footprint. We show that in sparse but large networks, GPSR outperforms vanilla ICN forwarding in both memory footprint and CPU consumption. However, GPSR is more energy intensive because of the cost of communications
On the Cost of Secure Association of Information Centric Things
Information Centric Networking (ICN) paradigms nicely fit the world of wireless sensors, whose devices have tight constraints. In this poster, we compare two alternative designs for secure association of new IoT devices in existing ICN deployments, which are based on asymmetric and symmetric cryptography respectively. While the security properties of both approaches are equivalent, an interesting trade-off arises between properties of the protocol vs properties of its implementation in current IoT boards. Indeed, while the asymmetric-keys based approach incurs a lower traffic overhead (of about 30%), we find that its implementation is significantly more energy- and time-consuming due to the cost of cryptographic operations (it requires up to 41x more energy and 8x more time)
Joint Monitorless Load-Balancing and Autoscaling for Zero-Wait-Time in Data Centers
International audienceCloud architectures achieve scaling through two main functions: (i) load-balancers, which dispatch queries among replicated virtualized application instances, and (ii) autoscalers, which automatically adjust the number of replicated instances to accommodate variations in load patterns. These functions are often provided through centralized load monitoring, incurring operational complexity. This paper introduces a unified and centralized-monitoring-free architecture achieving both autoscaling and load-balancing, reducing operational overhead while increasing response time performance. Application instances are virtually ordered in a chain, and new queries are forwarded along this chain until an instance, based on its local load, accepts the query. Autoscaling is triggered by the last application instance, which inspects its average load and infers if its chain is under-or over-provisioned. An analytical model of the system is derived, and proves that the proposed technique can achieve asymptotic zero-wait time with high (and controlable) probability. This result is confirmed by extensive simulations, which highlight close-toideal performance in terms of both response time and resource costs
On the Cost of Geographic Forwarding for Information-Centric Things
International audienc
SNF: synthesizing high performance NFV service chains
In this paper we introduce SNF, a framework that synthesizes (S) network function (NF) service chains by eliminating redundant I/O and repeated elements, while consolidating stateful cross layer packet operations across the chain. SNF uses graph composition and set theory to determine traffic classes handled by a service chain composed of multiple elements. It then synthesizes each traffic class using a minimal set of new elements that apply single-read-single-write and early-discard operations. Our SNF prototype takes a baseline state of the art network functions virtualization (NFV) framework to the level of performance required for practical NFV service deployments. Software-based SNF realizes long (up to 10 NFs) and stateful service chains that achieve line-rate 40 Gbps throughput (up to 8.5x greater than the baseline NFV framework). Hardware-assisted SNF, using a commodity OpenFlow switch, shows that our approach scales at 40 Gbps for Internet Service Provider-level NFV deployments
Distributed under Creative Commons CC-BY 4.0 SNF: synthesizing high performance NFV service chains
ABSTRACT In this paper we introduce SNF, a framework that synthesizes (S) network function (NF) service chains by eliminating redundant I/O and repeated elements, while consolidating stateful cross layer packet operations across the chain. SNF uses graph composition and set theory to determine traffic classes handled by a service chain composed of multiple elements. It then synthesizes each traffic class using a minimal set of new elements that apply single-read-single-write and early-discard operations. Our SNF prototype takes a baseline state of the art network functions virtualization (NFV) framework to the level of performance required for practical NFV service deployments. Software-based SNF realizes long (up to 10 NFs) and stateful service chains that achieve line-rate 40 Gbps throughput (up to 8.5x greater than the baseline NFV framework). Hardware-assisted SNF, using a commodity OpenFlow switch, shows that our approach scales at 40 Gbps for Internet Service Provider-level NFV deployments. Subjects Computer Networks and Communication