Design and Implementation of a Data Plane for the OpenBox Framework Pavel Lazar March 2016 This research was supported by the European Research Council under the European Union’s Seventh Framework Programme (FP7/ )/ERC Grant agreement no

Outline OpenBox Background The OpenBox Framework OBI Design Challenges OBI Architecture OBI Implementation Performance Future Work Summary

Background - The problem Network Functions (Middleboxes: -High cost -Limited and separate management -Limited provisioning and scalability -No multi-tenancy -Limited functionality and limited innovation -Similar processing steps, no re-use

Background - The OpenBox solution Bring Software-Defined Control to the middlebox. Decouple network function control from their data plane Unifies data plane of multiple network functions. SDN Controller OpenBox Controller OBI

Read Packets Header Classifier Drop Alert Output Firewall: Read Packets Header Classifier Drop Alert Regex Classifier Output IPS Read Packets Header Classifier Drop Alert (IPS) Regex Classifier Output Alert (Firewall)

The OpenBox Framework OpenBox Protocol OpenBox Service Instances OpenBox Controller OpenBox Applications Control Plane Data Plane NB API

OBI OBI Design challenges OBC OpenBox Protocol Input Traffic Output Traffic

OBI Design challenges OBC OpenBox Protocol Input Traffic Output Traffic Generic Manager Execution Engine Configuration Builder Control Message Handling

OBI Architecture

OBI Architecture – Generic Manager

OBI Architecture – Execution Engine

OBI Implementation - Generic Manager

OBI Implementation –Set Graph Flow Example

OBI Execution Engine - Click Element is the basic building block Router: Elements connected by edges Describes possible packet flows

OBI Execution Engine – Click package OpenBox Package ChatterMessage PushMessage StringClassifier StringMatcher RegexClassifier RegexMatcher GroupRegexMatcher MultiCounter AutoMarkIPHeader NetworkDirectionSwap NetworkHeaderFieldsRewriter

OpenBox Processing Graph to Click Configuration FromDevice Header Payload Classifier Discard ToDevice Discard FromDevice AutoMark IpHeader Counter ToDevice Content Classifier RegexClassifier MultiCounter New Classifier New Click Classifier elements

Performance – Packet Processing Firewall – 4560 header rules: – Throughput: 840 Mbps, – Latency: 48us IPS – Snort rules (Header + Payload): – Throughput: 454 Mbps – Latency: 76 us

Performance – Time Measurements Startup time: 2.1 seconds Set Processing Graph*: 1250ms Global Stats: < 2ms Read Handler: 8ms Log message: < 2ms

Possible Future Work Implement additional blocks Add more elements Improve data flow between OBIs Add Execution Engine optimization inside the ConfigurationBuilder Implement Click packet processing improvement researches Or even, replace Click with a different engine (HW)

Summary Helped implementing the OpenBox Protocol Designed an OpenBox Instance architecture. Implemented an OBI to be used within the OpenBox project. Used Click as the Execution Engine. Easy to improve and add features