网络功能虚拟化场景下的并行加速

doi:10.11959/j.issn.1000-0801.2018216

摘要/Abstract

摘要：

在网络功能虚拟化场景下，每个网络功能都以软件的形式来实现。但传统的串行网络功能组链方式将带来极大的性能损耗。而如今针对网络功能进行加速的工作，主要集中在优化该串行链的每个组成成分上。提出了一个高性能的系统框架，通过让网络功能并行地对数据分组进行处理，提高网络功能虚拟化场景下服务链的整体性能。该系统由 3 个部分组成。首先，该系统为管理员提供了一个策略描述语言来直观地描述串行或并行的组链意图。然后，该系统的编排器智能地鉴别网络功能之间的依赖性，并基于所提供的策略，生成高性能的“服务图”。最后，该系统的底层实现通过执行轻量级的数据分组复制、分布式的并行分组转发和负载均衡后的数据分组合并来支持网络功能的并行处理。基于DPDK技术，在Linux容器中实现了该系统的原型机。通过实验验证可知，该系统能极大地减少真实世界中服务链的处理时延。

关键词: 网络功能虚拟化, 并行, 服务链

Abstract:

Software-based sequential service chains in network function virtualization (NFV) could introduce significant performance overhead.Current acceleration efforts for NFV mainly target on optimizing each component of the sequential service chain.However,based on the statistics from real world enterprise networks,it was observed that 53.8% network function (NF) pairs could work in parallel.In particular,41.5% NF pairs could be parallelized without causing extra resource overhead.NFP was presented,a high performance framework,that innovatively enabled network function parallelism to improve NFV performance.NFP consisted of three logical components.Firstly,NFP provided a policy specification scheme for operators to intuitively describe sequential or parallel NF chaining intents.Secondly,NFP orchestrator intelligently identified NF dependency and automatically compiled the policies into high performance service graphs.Thirdly,NFP infrastructure performed light-weight packet copying,distributed parallel packet delivery,and load-balanced merging of packet copies to support NF parallelism.An NFP prototype based on DPDK in Linux containers was implemented.The evaluation results show that NFP achieves significant latency reduction for real world service chains.

Key words: NFV, network function parallelism, service chain

毕军,孙晨,于恒. 网络功能虚拟化场景下的并行加速[J]. 电信科学, 2018, 34(7): 41-48.

Jun BI,Chen SUN,Heng YU. NFP:enabling network function parallelism in NFV[J]. Telecommunications Science, 2018, 34(7): 41-48.

图/表 6

图1

图2

表1

表2

图3

图4

参考文献 25

[1]	SHERRY J , HASAN S , SCOTT C ,et al. Making middleboxes someone else’s problem:network processing as a cloud service[J]. ACM SIGCOMM Computer Communication Review, 2012,42(4): 13-24.
[2]	QUINN P , NADEAU T . Service function chaining problem statement:draft-ietf-sfc-problem-statement-10[S]. 2014.
[3]	JOSEPH D A , TAVAKOLI A , STOICA I . A policy-aware switching layer for data centers[J]. ACM SIGCOMM Computer Communication Review, 2008,38(4): 51-62
[4]	IETF SFC WG. Service function chaining use cases in data centers[S]. 2015.
[5]	HAEFFNER W , NAPPER J , STIEMERLING M ,et al. Service function chaining use cases in mobile networks:draft-ietf-sfcuse-case-mobility-01[S]. 2014.
[6]	SEKAR V , EGI N , RATNASAMY S ,et al. Design and implementation of a consolidated middlebox architecture[C]// The 9th USENIX Conference on Networked Systems Design and Implementation(NSDI'12),April 25-27,2012,San Jose,CA,USA. New York:ACM Press, 2012:24.
[7]	BREMLER-BARR A , HARCHOL Y , HAY D . OpenBox:a software-defined framework for developing,deploying,and managing network functions[C]// The Workshop on Hot Topics in Middleboxes and Network Function Virtualization,August 22-26,2016,Florianópolis,Brazil. New York:ACM Press, 2016: 511-524.
[8]	HALPERN J , PIGNATARO C . Service function chaining (SFC) architecture:draft-ietf-sfc-architecture-07[S]. 2015.
[9]	QAZI Z A , TU C C , CHIANG L ,et al. SIMPLE-fying middlebox policy enforcement using SDN[J]. ACM SIGCOMM Computer Communication Review, 2013,43(4): 27-38.
[10]	ANWER B , BENSON T , FEAMSTER N ,et al. A slick control plane for network middleboxes[C]// ACM SIGCOMM Workshop on Hot Topics in Software Defined Networking,August 16,2013,Hongkong,China. New York:ACM Press, 2013: 147-148.
[11]	FAYAZBAKHSH S K , CHIANG L , SEKAR V ,et al. Enforcing network-wide policies in the presence of dynamic middlebox actions using flowtags[C]// Usenix Conference on Networked Systems Design and Implementation,USENIX Association (NSDI’14),April 2-4,2014,Seattle,WA,USA. New York:ACM Press, 2014: 533-546.
[12]	GEMBER-JACOBSON A , VISWANATHAN R , PRAKASH C ,et al. OpenNF:Enabling innovation in network function control[C]// The 2014 ACM Conference on SIGCOMM,August 17-22,2014,Chicago,Illinois,USA. New York:ACM Press, 2014: 163-174.
[13]	王歆平, 王茜, 刘恩慧 ,等. 基于 SDN 的按需智能路由系统研究与验证[J]. 电信科学, 2014,30(4): 8-14. WANG X P , WANG Q , LIU E H ,et al. Research and verification on SDN-based on-demand smart routing system[J]. Telecommunications Science, 2014,30(4): 8-14.
[14]	ETSI NFV ISG . Network functions virtualisation:an introduction,benefits,enablers,challenges and call for action[R]. 2012.
[15]	GANDHI R , LIU H H , HU Y C ,et al. Duet:cloud scale load balancing with hardware and software[C]// The 2014 ACM Conference on SIGCOMM,August 17-22,2014,Chicago,Illinois,USA. New York:ACM Press, 2014: 27-38.
[16]	LI B , TAN K , LUO L L ,et al. ClickNP:highly flexible and high-performance network processing with reconfigurable hardware[C]// The 2016 ACM Conference on SIGCOMM,August 22-26,2016,Florianópolis,Brazil. New York:ACM Press, 2016: 1-14.
[17]	PANDA A , HAN S , JANG K ,et al. NetBricks:taking the V out of NFV[C]// The 12th USENIX Conference on Operating Systems Design and Implementation (OSDI’16),November 2-4,2016,Savannah,GA,USA. New York:ACM Press, 2016: 203-216.
[18]	Intel.Data plane development kit[R]. 2018.
[19]	MARTINS J , AHMED M , RAICIU C ,et al. ClickOS and the artof network function virtualization[C]// USENIX Conference on Networked Systems Design and Implementation,April 2-4,2014,Seattle,WA,USA. New York:ACM Press, 2014: 459-473.
[20]	HWANG J , RAMAKRISHNAN K , WOOD T . NetVM:high performance and flexible networking using virtualization on commodity platforms[J]. IEEE Transactions on Network and Service Management, 2015,12(1): 34-47.
[21]	ZHANG W , LIU G , ZHANG W ,et al. OpenNetVM:a platform for high performance network service chains[C]// The Workshop on Hot Topics in Middleboxes and Network Function Virtualization,August 22-26,2016,Florianópolis,Brazil. New York:ACM Press, 2016: 26-31.
[22]	PALKAR S , LAN C , HAN S ,et al. E2:a framework for NFV applications[C]// Symposium on Operating Systems Principles,October 4-7,2015,Monterey,California,USA. New York:ACM Press, 2015: 121-136.
[23]	BREMLER-BARR A , HARCHOL Y , HAY D ,et al. Deep packet inspection as a service[C]// ACM International on Conference on Emerging Networking Experiments and Technologies,December 2-5,2014,Sydney,Australia. New York:ACM Press, 2014: 271-282.
[24]	BENSON T , AKELLA A , MALTZ D A . Network traffic characteristics of data centers in the wild[C]// 2010 Internet Measurement Conference,November 1-3,2010,Melbourne,Australia. New York:ACM Press, 2010: 267-280.
[25]	MERKEL D . Docker:lightweight linux containers for consistent development and deployment[J]. Linux Journal, 2014(239):2.

虚拟网络功能	产品	%	源IP地址	目的IP地址	源端口	目的端口	负载	增添/移除	丢弃
防火墙	iptables	26%	R	R	R	R			T
入侵检测系统	NIDS	20%	R	R	R	R	R
网关	Cisco MGX	19%	R	R
负载均衡器	F5,A10	10%	R/W	R/W	R	R
缓存器	Nginx	10%	R		R		R
虚拟专用网	OpenVPN	7%	R	R			R/W	T
地址转换器	iptables		R/W	R/W	R/W	R/W
流量代理	Squid		R/W	R/W
流量压缩器	Cisco IOS						R/W
流量整形器	Linux tc
监测器	NetFlow		R	R	R	R

描述方法	表达方式
图1 的传统串行服务组链描述方法	assign(VPN,1) assign(monitor,2) assign(FW,3) assign(LB,4)
图1 的策略语言服务组链描述方法	order(VPN,before,monitor) order(monitor,before,FW) order(FW,before,LB)
图2 的并行服务图组链描述方法	position(VPN,first) order(FW,before,LB) order(monitor,before,LB)