Search

Network function virtualization (NFV) is a powerful networking approach that leverages computing resources to perform a time-varying set of network processing functions. Although microprocessors can be used for this purpose, their performance limitations and lack of specialization present implementation challenges. In this article, we describe a new heterogeneous hardware-software NFV platform called CoNFV that provides scalability and programmability while supporting significant hardware-level parallelism and reconfiguration. Our computing platform takes advantage of both field-programmable gate arrays (FPGAs) and microprocessors to implement numerous virtual network functions (VNF) that can be dynamically customized to specific network flow needs. The most distinctive feature of our system is the use of global network state to coordinate NFV operations. Traffic management and hardware reconfiguration functions are performed by a global coordinator that allows for the rapid sharing of network function states and continuous evaluation of network function needs. With the help of state sharing mechanism offered by the coordinator, customer-defined VNF instances can be easily migrated between heterogeneous middleboxes as the network environment changes. A resource allocation and scheduling algorithm dynamically assesses resource deployments as network flows and conditions are updated. We show that our deployment algorithm can successfully reallocate FPGA and microprocessor resources in a fraction of a second in response to changes in network flow capacity and network security threats including intrusion.

Routing policy configuration plays a crucial role in determining the path that network traffic takes to reach a destination. Network administrators/operators typically decide the routing policy for their networks/routers independently. The paths/routes resulted from these independently configured routing policies might not necessarily meet the intent of the network administrators/operators. Even the very basic networkwide properties of the routing policies such as reachability between a pair of nodes need to be verified.In this paper, we propose a scheme that characterizes routingpolicy verification problems into a Satisfiability Modulo Theories (SMT) problems. The key idea is to formulate the SMT model in a policy-aware manner so as to reduce/eliminate the mutual dependencies between variables as much as possible. Further, we reduce the size of the generated SMT model through pruning. We implement and evaluate the policy-aware model through an outof-box SMT solver. The experimental results show that the policyaware model can reduce the time it takes to perform verification by as much as 100x even under a modest topology size. It takes only a few minutes to answer a query for a topology containing tens of thousands of nodes.

The rapid growth of computer systems which generate graph data necessitates employing privacy-preserving mechanisms to protect users' identity. Since structure-based de-anonymization attacks can reveal users' identity's even when the graph is simply anonymized by employing naive ID removal, recently, $k-$anonymity is proposed to secure users' privacy against the structure-based attack. Most of the work ensured graph privacy using fake edges, however, in some applications, edge addition or deletion might cause a significant change to the key property of the graph. Motivated by this fact, in this paper, we introduce a novel method which ensures privacy by adding fake nodes to the graph. First, we present a novel model which provides $k-$anonymity against one of the strongest attacks: seed-based attack. In this attack, the adversary knows the partial mapping between the main graph and the graph which is generated using the privacy-preserving mechanisms. We show that even if the adversary knows the mapping of all of the nodes except one, the last node can still have $k-$anonymity privacy. Then, we turn our attention to the privacy of the graphs generated by inter-domain routing against degree attacks in which the degree sequence of the graph is known to the adversary. To ensure the privacy of networks against this attack, we propose a novel method which tries to add fake nodes in a way that the degree of all nodes have the same expected value., Comment: Graph Privacy

To enable billions of devices to communicate with each other simultaneously, small end-to-end latency and high scalability and reliability are the essential characteristics for the Internet of Things (IoT). The transition from today's Internet to IoT has demanded a new information and communications infrastructure. In this paper we implement and deploy a scalable and reliable inter-domain infrastructure, LORIF proposed in our previous work, to meet the requirements of IoT. Based on two local network testbeds and an intercontinental network testbed, we evaluate the scalability, resilience, and mobility of LORIF. The results demonstrate that LORIF can provide low end-to-end latency and high scalability and reliability.

Network Functions (NFs) are deployed in networks for a variety of purposes, e.g. monitoring, security, or performance optimization. During packet processing, NF maintains the states of processed packets and/or manipulates packets based on these states. Some of these states are per-flow states while others are multi-flow states. With the emerging of network function virtualization (NFV), it is common to deploy an NF across multiple middleboxes for high processing capability. In this case, per-flow states can be maintained by each middlebox as its local states. The multi-flow states are global states that are shared among middleboxes. We propose a network function framework, Coordinator for Global States (CoGS), to scale a network function with global states across distributed middleboxes. A coordinator is adopted to manage global states for middleboxes. Meanwhile, each middlebox is able to access the states and process packets based on the global states. Our evaluation shows that the CoGS coordinator can handle more than 1 million state operations per second. With CoGS to manage the global states, the distributed NF achieves nearly linear scalability with a dozen of middleboxes.

Hierarchical addressing and locator/ID separation solutions have been proposed to address the scalability issue of the Internet. However, how to combine the two addressing schemes has not been received much attention. In this paper, we present an address encoding method to integrate hierarchical addressing and locator/ID separation. Our analysis and evaluation results show that the proposed encoding method could guarantee the scalability property, and alleviate the inefficiency of address space.

The Internet is facing the accelerating growth of routing table size. Backbone routers' routing table has already reached 512k entries, which has a negative effect on the scalability of the Internet. Hierarchical addressing and locator/ID separation solutions have been proposed to address the scalability issue. However, there has been little focus on how to efficiently represent hierarchical location addresses for a large scale distributed network, such as today's Internet. In this paper, we present a variable-length address encoding method to represent hierarchical location addresses. Our analysis and evaluation results show that 1) it is difficult to use fixed-length encoding to represent hierarchical location addresses for a large scale network; and 2) the proposed variable-length addresses could guarantee the scalability property of hierarchical addressing, and alleviate the inefficiency of address space due to fixed-length addresses.

Hierarchical address allocation and hierarchical routing design has long been suggested to reduce the forwarding information base (FIB) size in the Internet core. However, the hierarchical design is not put into practice. We implemented the hierarchical and automatic number allocation (HANA) protocol for allocation of IPv4 and IPv6 address spaces to autonomous systems (ASes) and the FIB size reduction. The HANA protocol allocates multiple address spaces to an AS from the upper ASes. Multihoming using multiple addresses provides an AS with multiple paths. That is, detour paths are inevitably prepared in advance, even when a network failure does not occur. In this paper, we provide the highest flexibility to HANA-based networking, namely, supporting variable-length addressing scheme. The variable-length addressing schemes suppress renumbering caused by the address space extension that occurs in the fixed-bit-length addressing schemes. In addition, we propose a new function of exchanging allocated numbers, and implement it in the current HANA system. The flexible HANA system provides locator allocation with low renumbering costs and realizes scalable addressing in future internetworking.

The Internet is facing the double-challenge of accelerating growth of routing table size and ever higher reliability requirements. Considerable progress has been made toward the scalability and reliability of the Internet. However, most of the proposals are only partial solutions that address some of the challenges. In this paper, we present a new addressing encoding scheme and a corresponding forwarding mechanism for Internet routing to solve the aforementioned problems. Underlying our design is a succinct data structure that allows us to compactly embed a set of addresses into packet headers. At the same time, the structure allows the data plane to efficiently extract multiple address information for the same destination without decompression. We provide time and space complexity analysis, and present experimental results evaluating the performance of our encoding method. It shows that the proposed encoding method can achieve a good compression factor without degrading packet-forwarding performance.

For service-based systems which are composed of multiple independent stakeholders, correctness cannot be ascertained statically. Continuous monitoring is required to assure that runtime behavior of the systems complies with specified properties. However, most existing work considers only the temporal constraints of messages exchanged between services, ignoring the actual data contents inside the messages. As a result, it is difficult to validate some dynamic properties such as how message data of interest is processed between different participants. To address this issue, this paper proposes an efficient, online monitoring approach to dynamically analyze data-centric properties in service-based systems. By introducing Par -BCL - a Parametric Behavior Constraint Language for Web services - various data-centric properties can be specified and monitored. To keep runtime overhead low, we statically analyze the monitored properties to generate parameter state machine, and combine two different indexing mechanisms to optimize the monitoring. The experiments show that the proposed approach is efficient.