Network Function Control Aaron Gember-Jacobson , Chaithan Prakash, - - PowerPoint PPT Presentation

▶
network function control
SMART_READER_LITE
LIVE PREVIEW

Network Function Control Aaron Gember-Jacobson , Chaithan Prakash, - - PowerPoint PPT Presentation

Nov 04, 2022 471 likes •929 views

OpenNF: Enabling Innovation in Network Function Control Aaron Gember-Jacobson , Chaithan Prakash, Raajay Viswanathan, Robert Grandl, Junaid Khalid, Sourav Das, Aditya Akella 1 Network functions (NFs) Perform sophisticated stateful actions

slide-1
SLIDE 1

Aaron Gember-Jacobson, Chaithan Prakash, Raajay Viswanathan, Robert Grandl, Junaid Khalid, Sourav Das, Aditya Akella

1

OpenNF: Enabling Innovation in Network Function Control

slide-2
SLIDE 2

Network functions (NFs)

  • Perform sophisticated stateful

actions on packets/flows

  • Important goals:
  • 1. Satisfy SLAs
  • 2. Minimize costs
  • 3. Act correctly

2

slide-3
SLIDE 3

NF trends

  • Network Functions Virtualization (NFV)

3

Intrusion detection system (IDS) Caching proxy WAN

  • ptimizer
slide-4
SLIDE 4

NF trends

  • Network Functions Virtualization (NFV)

→ dynamically allocate NF instances

3

Hypervisor

slide-5
SLIDE 5

NF trends

  • Network Functions Virtualization (NFV)

→ dynamically allocate NF instances

  • Software-defined Networking

→ dynamically reroute flows

3

Hypervisor

slide-6
SLIDE 6

NF trends

  • Network Functions Virtualization (NFV)

→ dynamically allocate NF instances

  • Software-defined Networking

→ dynamically reroute flows Dynamic reallocation

  • f packet processing

e.g., elastic NF scaling

3

Hypervisor

slide-7
SLIDE 7

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows Reroute existing flows Wait for flows to die

4

Packet loss

slide-8
SLIDE 8

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows Reroute existing flows Wait for flows to die

4

Packet loss SLA: <1%

slide-9
SLIDE 9

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows Reroute existing flows Wait for flows to die

4

?

Packet loss SLA: <1%

slide-10
SLIDE 10

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows Reroute existing flows Wait for flows to die

4

?

Packet loss SLA: <1%

slide-11
SLIDE 11

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows Reroute existing flows Wait for flows to die

4

?

Packet loss

slide-12
SLIDE 12

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows Reroute existing flows Wait for flows to die

4

?

Packet loss

slide-13
SLIDE 13

Why NFV + SDN falls short

  • 1. SLAs 2. Cost 3. Accuracy

Reroute new flows Reroute existing flows Wait for flows to die

4

?

Packet loss

slide-14
SLIDE 14

SLAs + cost + accuracy: What do we need?

  • Quickly move, copy, or share internal NF state

alongside updates to network forwarding state

  • Guarantees: loss-free, order-preserving, …

5

   … 1 2 3 …

Also applies to other scenarios

slide-15
SLIDE 15

Outline

  • Motivation and requirements
  • Challenges
  • OpenNF architecture
  • Evaluation

6

slide-16
SLIDE 16
  • 1. Supporting many NFs with minimal changes
  • 2. Dealing with race conditions
  • 3. Bounding overhead

Challenges

7

slide-17
SLIDE 17

OpenNF overview

8

NF State Manager Flow Manager

OpenNF Controller

Control Application

move/copy/share state export/import State

slide-18
SLIDE 18

State created or updated by an NF applies to either a single flow or a collection of flows

NF state taxonomy

9

Connection Connection TcpAnalyzer HttpAnalyzer TcpAnalyzer HttpAnalyzer

Per-flow state

ConnCount

Multi-flow state All-flows state

Statistics

slide-19
SLIDE 19

NF API: export/import state

  • Functions: get, put, delete

10

No need to expose/change internal state organization! Filter

Per Multi All

Scope NF get put

slide-20
SLIDE 20

Control operations: move

11

NF State Manager Control Application

move (port=80, IDS1, IDS2)

Flow Manager IDS2 IDS1

slide-21
SLIDE 21

Control operations: move

11

NF State Manager Control Application

move (port=80, IDS1, IDS2) get(per, port=80) [Chunk1] [Chunk2]

Flow Manager IDS2 IDS1

slide-22
SLIDE 22

Control operations: move

11

NF State Manager Control Application

move (port=80, IDS1, IDS2) get(per, port=80) [Chunk1] del(per, port=80) [Chunk2]

Flow Manager IDS2 IDS1

slide-23
SLIDE 23

Control operations: move

11

NF State Manager Control Application

move (port=80, IDS1, IDS2) get(per, port=80) [Chunk1] put (per, Chunk1) del(per, port=80) [Chunk2] put (per, Chunk2)

Flow Manager IDS2 IDS1

slide-24
SLIDE 24

Control operations: move

11

NF State Manager Control Application

move (port=80, IDS1, IDS2) get(per, port=80) [Chunk1] put (per, Chunk1) del(per, port=80) [Chunk2] put (per, Chunk2) forward(port=80, IDS2)

Flow Manager IDS2 IDS1 Also provide copy and share

slide-25
SLIDE 25

Malware hash check

Lost updates during move

12

B1 R1

IDS2 IDS1

move(red,Bro1 ,Bro2 )

slide-26
SLIDE 26

Malware hash check

Lost updates during move

12

B1 R1

IDS2 IDS1

move(red,Bro1 ,Bro2 )

slide-27
SLIDE 27

Malware hash check

Lost updates during move

12

B1 R1 R2

Missing state

IDS2 IDS1

move(red,Bro1 ,Bro2 )

slide-28
SLIDE 28

Malware hash check

Lost updates during move

12

B1 R1 R2

Missing state

IDS2 IDS1

move(red,Bro1 ,Bro2 )

slide-29
SLIDE 29

Malware hash check

Lost updates during move

12

B1 R1 R2

Missing state

IDS2 IDS1

move(red,Bro1 ,Bro2 )

slide-30
SLIDE 30

Malware hash check

Lost updates during move

12

B1 R1 R2

Missing state

IDS2 IDS1

move(red,Bro1 ,Bro2 ) Missing updates

R3

slide-31
SLIDE 31

Malware hash check

Lost updates during move

12

B1 R1 R2

Missing state

IDS2 IDS1

move(red,Bro1 ,Bro2 ) Missing updates

Loss-free: All state updates should be reflected in the transferred state, and all packets should be processed

R3

slide-32
SLIDE 32

NF API: observe/prevent updates using events

13

Only need to change an NF’s receive packet function!

R1

NF

slide-33
SLIDE 33

Use events for loss-free move

14

IDS2 IDS1

R1

slide-34
SLIDE 34
  • 1. enableEvents(red,noproc) on IDS1

Use events for loss-free move

14

IDS2 IDS1

NoProc R1

slide-35
SLIDE 35
  • 1. enableEvents(red,noproc) on IDS1
  • 2. get/delete on IDS1

Use events for loss-free move

14

IDS2 IDS1

NoProc R1

slide-36
SLIDE 36
  • 1. enableEvents(red,noproc) on IDS1
  • 2. get/delete on IDS1

Use events for loss-free move

14

IDS2 IDS1

NoProc R1 R2

slide-37
SLIDE 37
  • 1. enableEvents(red,noproc) on IDS1
  • 2. get/delete on IDS1
  • 3. Buffer events at controller

Use events for loss-free move

14

IDS2 IDS1

NoProc R1 R2

slide-38
SLIDE 38
  • 1. enableEvents(red,noproc) on IDS1
  • 2. get/delete on IDS1
  • 3. Buffer events at controller
  • 4. put on IDS2

Use events for loss-free move

14

IDS2 IDS1

NoProc R1 R2

slide-39
SLIDE 39
  • 1. enableEvents(red,noproc) on IDS1
  • 2. get/delete on IDS1
  • 3. Buffer events at controller
  • 4. put on IDS2
  • 5. Flush packets in

events to IDS2

Use events for loss-free move

14

IDS2 IDS1

NoProc R1 R1,R2

slide-40
SLIDE 40
  • 1. enableEvents(red,noproc) on IDS1
  • 2. get/delete on IDS1
  • 3. Buffer events at controller
  • 4. put on IDS2
  • 5. Flush packets in

events to IDS2

  • 6. Update

forwarding

Use events for loss-free move

14

IDS2 IDS1

NoProc R1 R1,R2

slide-41
SLIDE 41
  • 1. enableEvents(red,noproc) on IDS1
  • 2. get/delete on IDS1
  • 3. Buffer events at controller
  • 4. put on IDS2
  • 5. Flush packets in

events to IDS2

  • 6. Update

forwarding

Use events for loss-free move

14

IDS2 IDS1

NoProc R1 R1,R2 R1,R2,R3

slide-42
SLIDE 42

Implementation

  • Controller (3.8K lines of Java)
  • Communication library (2.6K lines of C)
  • Modified NFs (3-8% increase in code)

15

Bro IDS iptables Squid Cache PRADS

slide-43
SLIDE 43

Evaluation: benefits for elastic scaling

  • Bro IDS processing 10K pkts/sec

– At 180 sec: move HTTP flows (489) to new IDS – At 360 sec: move back to old IDS

  • SLAs: 260ms to move (loss-free)
  • Accuracy: same log entries as using one IDS

– VM replication: incorrect log entries

  • Cost: scale in after state is moved

– Wait for flows to die: scale in delayed 25+ minutes

16

slide-44
SLIDE 44
  • Realizing SLAs + cost + accuracy

requires quick, safe control of internal network function state

  • OpenNF provides flexible and efficient

control with few modifications to NFs

Conclusion

17

Learn more and try it! http://opennf.cs.wisc.edu