Network function virtualization (NFV) technology significantly changes the traditional communication network environments by providing network functions as virtual network functions (VNFs) on commercial off-the-shelf (COTS) servers. Moreover, for using VNFs in a pre-determined sequence to provide each network service, service chaining is essential. A VNF can provide multiple service chains with the corresponding network function, reducing the number of VNFs. However, VNFs might be the source or the target of a cyberattack. If the node where the VNF is installed is attacked, the VNF would also be easily attacked because of its security vulnerabilities. Contrarily, a malicious VNF may attack the node where it is installed, and other VNFs installed on the node may also be attacked. Few studies have been done on the security of VNFs and nodes for service chaining. This study proposes a service chain construction with security-level management. The security-level management concept is introduced to built many service chains. Moreover, the cost optimization problem for service chaining is formulated and the heuristic algorithm is proposed. We demonstrate the effectiveness of the proposed method under certain network topologies using numerical examples.

This paper proposes a virtual network function (VNF) placement model considering both availability and probabilistic protection for the service delay to minimize the service deployment cost. Both availability and service delay are key requirements of services; a service provider handles the VNF placement problem with the goal of minimizing the service deployment cost while meeting these and other requirements. The previous works do not consider the delay of each route which the service can take when considering both availability and delay in the VNF placement problem; only the maximum delay was considered. We introduce probabilistic protection for service delay to minimize the service deployment cost with availability. The proposed model considers that the probability that the service delay, which consists of networking delay between hosts and processing delay in each VNF, exceeds its threshold is constrained within a given value; it also considers that the availability is constrained within a given value. We develop a two-stage heuristic algorithm to solve the VNF placement problem; it decides primary VNF placement by solving mixed-integer second-order cone programming in the first stage and backup VNF placement in the second stage. We observe that the proposed model reduces the service deployment cost compared to a baseline that considers the maximum delay by up to 12%, and that it obtains a feasible solution while the baseline does not in some examined situations.

This paper investigates a service deployment model for network function virtualization which handles per-flow priority to minimize the deployment cost. Service providers need to implement network services each of which consists of one or more virtual network functions (VNFs) with satisfying requirements of service delays. In our previous work, we studied the service deployment model with per-host priority; flows belonging to the same service, for the same VNF, and handled on the same host have the same priority. We formulated the model as an optimization problem, and developed a heuristic algorithm named FlexSize to solve it in practical time. In this paper, we address per-flow priority, in which flows of the same service, VNF, and host have different priorities. In addition, we expand FlexSize to handle per-flow priority. We evaluate per-flow and per-host priorities, and the numerical results show that per-flow priority reduces deployment cost compared with per-host priority.

This paper proposes a backup resource allocation model for virtual network functions (VNFs) to minimize the total allocated computing capacity for backup with considering the service delay. If failures occur to primary hosts, the VNFs in failed hosts are recovered by backup hosts whose allocation is pre-determined. We introduce probabilistic protection, where the probability that the protection by a backup host fails is limited within a given value; it allows backup resource sharing to reduce the total allocated computing capacity. The previous work does not consider the service delay constraint in the backup resource allocation problem. The proposed model considers that the probability that the service delay, which consists of networking delay between hosts and processing delay in each VNF, exceeds its threshold is constrained within a given value. We introduce a basic algorithm to solve our formulated delay-constraint optimization problem. In a problem with the size that cannot be solved within an acceptable computation time limit by the basic algorithm, we develop a simulated annealing algorithm incorporating Yen's algorithm to handle the delay constraint heuristically. We observe that both algorithms in the proposed model reduce the total allocated computing capacity by up to 56.3% compared to a baseline; the simulated annealing algorithm can get feasible solutions in problems where the basic algorithm cannot.

With the network function virtualization technology, a middlebox can be deployed as software on commercial servers rather than on dedicated physical servers. A backup server is necessary to ensure the normal operation of the middlebox. The workload can affect the failure rate of backup server; the impact of workload-dependent failure rate on backup server allocation considering unavailability has not been extensively studied. This paper proposes a shared backup allocation model of middlebox with consideration of the workload-dependent failure rate of backup server. Backup resources on a backup server can be assigned to multiple functions. We observe that a function has four possible states and analyze the state transitions within the system. Through the queuing approach, we compute the probability of each function being available or unavailable for a certain assignment, and obtain the unavailability of each function. The proposed model is designed to find an assignment that minimizes the maximum unavailability among functions. We develop a simulated annealing algorithm to solve this problem. We evaluate and compare the performances of proposed and baseline models under different experimental conditions. Based on the results, we observe that, compared to the baseline model, the proposed model reduces the maximum unavailability by an average of 29% in our examined cases.

Service chaining is attracting attention as a promising technology for providing a variety of network services by applying virtual network functions (VNFs) that can be instantiated on commercial off-the-shelf servers. The data transmission for each service chain has to satisfy the quality of service (QoS) requirements in terms of the loss probability and transmission delay, and hence the amount of resources for each VNF is expected to be sufficient for satisfying the QoS. However, the increase in the amount of VNF resources results in a high cost for improving the QoS. To reduce the cost of utilizing a VNF, sharing VNF instances through multiple service chains is an effective approach. However, the number of packets arriving at the VNF instance is increased, resulting in a degradation of the QoS. It is therefore important to select VNF instances shared by multiple service chains and to determine the amount of resources for the selected VNFs. In this paper, we propose a cost-effective service chain construction with a VNF sharing model. In the proposed method, each VNF is modeled as an M/M/1/K queueing model to evaluate the relationship between the amount of resources and the loss probability. The proposed method determines the VNF sharing, the VNF placement, the amount of resources for each VNF, and the transmission route of each service chain. For the optimization problem, these are applied according to our proposed heuristic algorithm. We evaluate the performance of the proposed method through a simulation. From the numerical examples, we show the effectiveness of the proposed method under certain network topologies.

For beyond 5G era, in network function virtualization (NFV) environments, service chaining can be utilized to provide the flexible network infrastructures needed to support the creation of various application services. In this paper, we propose a dynamic service chain construction based on model predictive control (MPC) to utilize network resources. In the proposed method, the number of data packets in the buffer at each node is modeled as a dynamical system for MPC. Then, we formulate an optimization problem with the predicted amount of traffic injecting into each service chain from users for the dynamical system. In the optimization problem, the transmission route of each service chain, the node where each VNF is placed, and the amount of resources for each VNF are determined simultaneously by using MPC so that the amount of resources allocated to VNFs and the number of VNF migrations are minimized. In addition, the performance of data transmission is also controlled by considering the maximum amount of data packets stored in buffers. The performance of the proposed method is evaluated by simulation, and the effectiveness of the proposed method with different parameter values is investigated.

In network function virtualization (NFV) environments, service chaining is an emerging technology that enables network operators to provide network service dynamically and flexibly by using virtual network function (VNF). In the service chaining, a service chain is expected to be constructed based on VNF performances such as dependences among VNFs and traffic changing effects in VNFs. For achieving optimal data transmission services in NFV environments, we focus on the optimal service chain construction based on VNF performances so that both the maximum amount of traffic on links and the total number of VNF instances are decreased. In this paper, at first, an optimization problem is formulated for determining placements of VNFs and a route for each service chain. The service chains can be constructed by solving this optimization problem with an optimization software or meta-heuristic algorithm. Then, for the optimization problem, we propose a heuristic service chain construction algorithm. By using our proposed algorithm, the service chains can be constructed appropriately more quickly. We evaluate the performance of the proposed heuristic algorithm with simulation, and we investigate the effectiveness of the heuristic algorithm from the performance comparison. From some numerical examples, we show that the proposed heuristic algorithm is effective to decrease the amount of traffic and the number of VNF instances. Moreover, it is shown that our proposed heuristic algorithm can construct service chains quickly.

Network function virtualization (NFV) enables network operators to flexibly provide diverse virtualized functions for services such as Internet of things (IoT) and mobile applications. To meet multiple quality of service (QoS) requirements against time-varying network environments, infrastructure providers must dynamically adjust the amount of computational resources, such as CPU, assigned to virtual network functions (VNFs). To provide agile resource control and adaptiveness, predicting the virtual server load via machine learning technologies is an effective approach to the proactive control of network systems. In this paper, we propose an adjustment mechanism for regressors based on forgetting and dynamic ensemble executed in a shorter time than that of our previous work. The framework includes a reducing training data method based on sparse model regression. By making a short list of training data derived from the sparse regression model, the relearning time can be reduced to about 57% without degrading provisioning accuracy.

The need of telecommunications operators to reduce Capital and Operational Expenditures in networks which traffic is continuously growing has made them search for new alternatives to simplify and automate their procedures. Because of the different transport network segments and multiple layers, the deployment of end-to-end services is a complex task. Also, because of the multiple vendor existence, the control plane has not been fully homogenized, making end-to-end connectivity services a manual and slow process, and the allocation of computing resources across the entire network a difficult task. The new massive capacity requested by Data Centers and the new 5G connectivity services will urge for a better solution to orchestrate the transport network and the distributed computing resources. This article presents and demonstrates a Network Slicing solution together with an end-to-end service orchestration for transport networks. The Network Slicing solution permits the co-existence of virtual networks (one per service) over the same physical network to ensure the specific service requirements. The network orchestrator allows automated end-to-end services across multi-layer multi-domain network segments making use of the standard Transport API (TAPI) data model for both l0 and l2 layers. Both solutions will allow to keep up with beyond 5G services and the higher and faster demand of network and computing resources.

The performance of packet processing applications is dependent on the memory access speed of network systems. Table lookup requires fast memory access and is one of the most common processes in various packet processing applications, which can be a dominant performance bottleneck. Therefore, in Network Function Virtualization (NFV)-aware environments, on-chip fast cache memories of a CPU of general-purpose hardware become critical to achieve high performance packet processing speeds of over tens of Gbps. Also, multiple types of applications and complex applications are executed in the same system simultaneously in carrier network systems, which require adequate cache memory capacities as well. In this paper, we propose a packet processing architecture that utilizes interleaved 3 Dimensional (3D)-stacked Dynamic Random Access Memory (DRAM) devices as off-chip Last Level Cache (LLC) in addition to several levels of dedicated cache memories of each CPU core. Entries of a lookup table are distributed in every bank and vault to utilize both bank interleaving and vault-level memory parallelism. Frequently accessed entries in 3D-stacked DRAM are also cached in on-chip dedicated cache memories of each CPU core. The evaluation results show that the proposed architecture reduces the memory access latency by 57%, and increases the throughput by 100% while reducing the blocking probability but about 10% compared to the architecture with shared on-chip LLC. These results indicate that 3D-stacked DRAM can be practical as off-chip LLC in parallel packet processing systems.

In resource-constrained network function virtualization (NFV) environments, it is expected that data throughput for service chains is maintained by using virtual network functions (VNFs) effectively. In this paper, we formulate an optimization problem for maximizing the total data throughput in resource-constrained NFV environments. Moreover, based on our formulated optimization problem, we propose a heuristic service chain construction algorithm for maximizing the total data throughput. This algorithm also determines the placement of VNFs, the amount of resources for each VNF, and the transmission route for each service chain. It is expected that the heuristic algorithm can construct service chains more quickly than the meta-heuristic algorithm. We evaluate the performance of the proposed methods with simulations, and we investigate the effectiveness of our proposed heuristic algorithm through a performance comparison. Numerical examples show that our proposed methods can construct service chains so as to maximize the total data throughput regardless of the number of service chains, the amount of traffic, and network topologies.

A Service Function Chain (SFC) is an ordered sequence of virtual network functions (VNFs) to provide network service. Most existing SFC orchestration schemes, however, cannot optimize the resources allocation while guaranteeing the service delay constraint. To fulfill this goal, we propose a Layered Graph based SFC Orchestration Scheme (LGOS). LGOS converts both the cost of resource and the related delay into the link weights in the layered graph, which helps abstract the SFC orchestration problem as a shortest path problem. Then a simulated annealing based batch processing algorithm is designed for SFC requests set. Through extensive evaluations, we demonstrated that our scheme can reduce the end-to-end delay and the operational expenditure by 21.6% and 13.7% at least, and the acceptance ratio of requests set can be improved by 22.3%, compared with other algorithms.

Network function virtualization (NFV) achieves the flexibility of network service provisioning by using virtualization technology. However, NFV is exposed to a serious security threat known as cross-VM cache timing attacks. In this letter, we look into real security impacts on network virtualization. Specifically, we present two kinds of practical cache timing attacks on virtualized firewalls and routers. We also propose some countermeasures to mitigate such attacks on virtualized network functions.

Information-Centric Networking (ICN) can offer rich functionalities to the network, e.g, in-network caching, and name-based forwarding. Incremental deployment of ICN is a key challenge that enable smooth migration from current IP network to ICN. We can say that Network Function Virtualization (NFV) must be one of the key technologies to achieve this deployment because of its flexibility to support new network functions. However, when we consider the ICN deployment with NFV, there exist two performance issues, processing delay of name-based forwarding and computational overhead of virtual machine. In this paper we proposed a NFV infrastructure-assisted ICN packet forwarding by integrating the name look-up to the Open vSwitch. The contributions are twofold: 1) First, we provide the novel name look-up scheme that can forward ICN packets without costly longest prefix match searching. 2) Second, we design the ICN packet forwarding scheme that integrates the partial name look-up into the virtualization infrastructure to mitigate computation overhead.

As IT systems, including network systems using SDN/NFV technologies, become large-scaled and complicated, the cost of system management also increases rapidly. Network operators have to maintain their workflow in constructing and consistently updating such complex systems, and thus these management tasks in generating system update plan are desired to be automated. Declarative system update with state space search is a promising approach to enable this automation, however, the current methods is not enough scalable to practical systems. In this paper, we propose a novel heuristic approach to greatly reduce computation time to solve system update procedure for practical systems. Our heuristics accounts for structural bottleneck of the system update and advance search to resolve bottlenecks of current system states. This paper includes the following contributions: (1) formal definition of a novel heuristic function specialized to system update for A* search algorithm, (2) proofs that our heuristic function is consistent, i.e., A* algorithm with our heuristics returns a correct optimal solution and can omit repeatedly expansion of nodes in search spaces, and (3) results of performance evaluation of our heuristics. We evaluate the proposed algorithm in two cases; upgrading running hypervisor and rolling update of running VMs. The results show that computation time to solve system update plan for a system with 100 VMs does not exceed several minutes, whereas the conventional algorithm is only applicable for a very small system.

Network function virtualization improves the flexibility of infrastructure resource allocation but the application of commodity facilities arouses new challenges for systematic reliability. To meet the carrier-class reliability demanded from the 5G mobile core, several studies have tackled backup schemes for the virtual network function deployment. However, the existing backup schemes usually sacrifice the efficiency of resource allocation and prevent the sharing of infrastructure resources. To solve the dilemma of balancing the high level demands of reliability and resource allocation in mobile networks, this paper proposes an approach for the problem of pooling deployment of virtualized network functions in virtual EPC network. First, taking pooling of VNFs into account, we design a virtual network topology for virtual EPC. Second, a node-splitting algorithm is proposed to make best use of substrate network resources. Finally, we realize the dynamic adjustment of pooling across different domains. Compared to the conventional virtual topology design and mapping method (JTDM), this approach can achieve fine-grained management and overall scheduling of node resources; guarantee systematic reliability and optimize global view of network. It is proven by a network topology instance provided by SNDlib that the approach can reduce total resource cost of the virtual network and increase the ratio of request acceptance while satisfy the high-demand reliability of the system.

Today's enterprise, data-center, and internet-service-provider networks deploy different types of network devices, including switches, routers, and middleboxes such as network address translation and firewalls. These devices are vertically integrated monolithic systems. Software-defined networking (SDN) and network function virtualization (NFV) are promising technologies for dis-aggregating vertically integrated systems into components by using “softwarization”. Software-defined networking separates the control plane from the data plane of switch and router, while NFV decouples high-layer service functions (SFs) or Network Functions (NFs) implemented in the data plane of a middlebox and enables the innovation of policy implementation by using SF chaining. Even though there have been several survey studies in this area, this area is continuing to grow rapidly. In this paper, we present a recent survey of this area. In particular, we survey research activities in the areas of re-architecting middleboxes, state management, high-performance platforms, service chaining, resource management, and trouble shooting. Efforts in these research areas will enable the development of future virtual-network-function platforms and innovation in service management while maintaining acceptable capital and operational expenditure.

The objectives of this survey are to provide an in-depth coverage of a few selected research papers that have made significant contributions to the development of Network Function Virtualization (NFV), and to provide readers insights into the key advantages and disadvantages of NFV and Software Defined Networks (SDN) when compared to traditional networks. The research papers covered are classified into four categories: NFV Infrastructure (NFVI), Network Functions (NFs), Management And Network Orchestration (MANO), and service chaining. The NFVI papers describe “framework” software that implement common functions, such as dynamic scaling and load balancing, required by NF developers. Papers on NFs are classified as offering solutions for software switches or middleboxes. MANO papers covered in this survey are primarily on resource allocation (virtual network embedding), which is an orchestrator function. Finally, service chaining papers that offer examples and extensions are reviewed. Our conclusions are that with the current level of investment in NFV from cloud and Internet service providers, the promised cost savings are likely to be realized, though many challenges remain.

Network virtualization environments (NVEs) are emerging to meet the increasing diversity of demands by Internet users where a virtual network (VN) can be constructed to accommodate each specific application service. In the future Internet, diverse service providers (SPs) will provide application services on their own VNs running across diverse infrastructure providers (InPs) that provide physical resources in an NVE. To realize both efficient resource utilization and good QoS of each individual service in such environments, SPs should perform adaptive control on network and computational resources in dynamic and competitive resource sharing, instead of explicit and sufficient reservation of physical resources for their VNs. On the other hand, two novel concepts, software-defined networking (SDN) and network function virtualization (NFV), have emerged to facilitate the efficient use of network and computational resources, flexible provisioning, network programmability, unified management, etc., which enable us to implement adaptive resource control. In this paper, therefore, we propose an architectural design of network orchestration for enabling SPs to maintain QoS of their applications aggressively by means of resource control on their VNs efficiently, by introducing virtual network provider (VNP) between InPs and SPs as 3-tier model, and by integrating SDN and NFV functionalities into NVE framework. We define new north-bound interfaces (NBIs) for resource requests, resource upgrades, resource programming, and alert notifications while using the standard OpenFlow interfaces for resource control on users' traffic flows. The feasibility of the proposed architecture is demonstrated through network experiments using a prototype implementation and a sample application service on nation-wide testbed networks, the JGN-X and RISE.