THE HEBREW UNIVERSITY OF JERUSALEM OpenBox: A Software-Defined Framework for Developing, Deploying, and Managing Network Functions Yotam Harchol The Hebrew University of Jerusalem Joint work with Anat Bremler-Barr and David Hay Accepted to ACM SIGCOMM 2016 A preliminary version of this work was published in ACM SIGCOMM HotMiddleboxes This research was supported by the European Research Council ERC Grant agreement no , the Israeli Centers of Research Excellence (I-CORE) program (Center No. 4/11), and the Neptune Consortium.

Network Function Virtualization Network Functions (e.g., middleboxes): Expensive HW No scalability or provisioning Separate management 2 Admins want: Cheap HW Scalability Auto provisioning Central management Network Function Virtualization (NFV): Make middleboxes virtual (SW VMs) Deploy on general purpose servers, scale and provision Steer traffic correctly using SDN or other techniques

Software-Defined Networks SDN so far: Control the forwarding But the network is not only forwarding! 3

Software-Defined Solutions 4 SDN Controller OpenBox Controller OBI Forwarding plane (switches, routers): -High cost -Limited management -No multi-tenancy -Limited functionality and limited innovation -Complex distributed algorithms Forwarding plane (switches, routers): -High cost -Limited management -No multi-tenancy -Limited functionality and limited innovation -Complex distributed algorithms Solution: SDN / OpenFlow Network Functions (Middleboxes): -Higher cost -Limited and separate management -Limited provisioning and scalability -No multi-tenancy -Limited functionality and limited innovation -Similar processing steps, no re-use Network Functions (Middleboxes): -Higher cost -Limited and separate management -Limited provisioning and scalability -No multi-tenancy -Limited functionality and limited innovation -Similar processing steps, no re-use Our solution: OpenBox

OpenBox OpenBox: A new protocol Decouples network function control from their data plane Unifies data plane of multiple network functions Benefits: Easier, unified control Better performance Scalable Flexible Multi-tenancy Innovation 5 OpenBox Controller OpenBox Applications Control Plane Data Plane OpenBox Service Instances OpenBox Protocol Northbound API

A Different View of Middleboxes Previous works: Middlebox = monolithic closed unit – Middlebox Traffic Steering (e.g., SIMPLE [Sigcomm ‘13], Stratos) – Middlebox Virtualization (e.g., ComB [NSDI ’12]) – Middlebox State Management (e.g., OpenNF [Sigcomm ‘14]) – Middlebox Runtime Platform (e.g., xOMB [ANCS ‘12], SDM [INFOCOM ‘14]) OpenBox: Middlebox = logical application – Most processing steps are shared among many types of middlebox applications – Some steps can be done once for multiple applications 6 OpenBox Controller OpenBox Applications

What Network Functions Do? 7 Firewall: Read Packets Header Classifier Drop Alert Output Load Balancer: Read Packets Header Classifier Rewrite Header Output Intrusion Prevention System: Read Packets Header Classifier Drop Alert DPI Output

What Network Functions Do? 8 Read Packets Header Classifier DPI Classification VLAN Pop VLAN Push Rewrite Header Header Modification Begin Transaction Rollback Transaction Commit Transaction Transactions Gzip Decompress Gzip Compress De/compression HTML Normalizer JavaScript Normalizer XML Normalizer Normalization Store Packet Restore Packet Caching Alert Log Reporting Output Drop Terminals FIFO Queue Front Drop Queue RED Queue Leaky Bucket Queue Management

OpenBox Data Plane 9 Read Packets Header Classifier DPI Classification VLAN Pop VLAN Push Rewrite Header Header Modification Begin Transaction Rollback Transaction Commit Transaction Transactions Gzip Decompress Gzip Compress De/compression HTML Normalizer JavaScript Normalizer XML Normalizer Normalization Store Packet Restore Packet Caching Alert Log Reporting Output Drop Terminals FIFO Queue Front Drop Queue RED Queue Leaky Bucket Queue Management OpenBox Service Instance Virtual or Physical Provides data plane services to realize the logic of network functions Controlled by the logically-centralized OpenBox controller

Network Function  OpenBox Application Each application defines: – A graph (DAG) of processing blocks – Configuration for each processing blocks Northbound API allows: – Specifying processing blocks and config – Reacting to events in the network (e.g., change configuration and placement according to load information) – Injecting new modules to OBI (when supported by OBI) 10 OpenBox Protocol OpenBox Service Instances OpenBox Controller OpenBox Applications Control Plane Data Plane NB API

(Logically-)Centralized Control Aggregates multiple OpenBox applications – Creates a Virtual Processing Graph that aggregates multiple processing graphs – Based on order and priority of applications, and location in network Provides a central management – Network-wide view of NFs – Multiple tenants run multiple applications for multiple policies in the same network – Applications do not share data Automatic scaling, provisioning, and placement based on load information from data plane 11 OpenBox Protocol OpenBox Service Instances OpenBox Controller OpenBox Applications Control Plane Data Plane NB API

Naïve Graph Merge 12 Firewall: Read Packets Header Classifier Drop Alert Output Intrusion Prevention System: Read Packets Header Classifier Drop Alert DPI Output Header Classifier Drop Alert (IPS) DPI Output Read Packets Header Classifier Drop Alert (Firewall) Concatenated Processing Graph: Performance ≈ Diameter of Graph

Graph Merge Algorithm 13 Firewall: Read Packets Header Classifier Drop Alert Output Intrusion Prevention System: Read Packets Header Classifier Drop Alert DPI Output Input Graphs:

Graph Merge Algorithm 14 Firewall: Read Packets Header Classifier Drop Alert Output Intrusion Prevention System: Read Packets Header Classifier Drop Alert DPI Output Step 1: Normalize graphs to trees Output Alert Output Drop Output

Graph Merge Algorithm 15 Read Packets Header Classifier Drop Alert (Firewall) Header Classifier Drop Alert (IPS) DPI Output Step 2: Concatenate graphs Alert (IPS) Alert (IPS) Output Drop Output Header Classifier Drop Alert (IPS) DPI Output Alert (IPS) Alert (IPS) Output Drop Output

Graph Merge Algorithm 16 Read Packets Header Classifier Drop Alert (Firewall) Header Classifier Drop Alert (IPS) DPI Output Step 3: Merge classifiers Alert (IPS) Alert (IPS) Output Drop Output Header Classifier Drop Alert (IPS) DPI Output Alert (IPS) Alert (IPS) Output Drop Output

Graph Merge Algorithm 17 Read Packets Header Classifier Drop Alert (Firewall) Header Classifier Drop Alert (IPS) DPI Output Step 3: Merge classifiers Alert (IPS) Alert (IPS) Output Drop Output Drop Alert (IPS) DPI Output Alert (IPS) Alert (IPS) Output Drop Output

Graph Merge Algorithm 18 Read Packets Header Classifier Drop Alert (Firewall) Drop Alert (IPS) DPI Output Step 3: Merge classifiers Alert (IPS) Alert (IPS) Output Drop Output Drop Alert (IPS) DPI Output Alert (IPS) Alert (IPS) Output Drop Output Alert (Firewall) Alert (Firewall) Alert (Firewall)

Graph Merge Algorithm 19 Read Packets Header Classifier Drop Alert (Firewall) Drop Alert (IPS) DPI Output Step 4: Remove redundant block copies (and rewire connectors accordingly) Alert (IPS) Alert (IPS) Output Drop Output Drop Alert (IPS) DPI Output Alert (IPS) Alert (IPS) Output DPI Drop Output Alert (Firewall) Alert (Firewall) Alert (Firewall)

Graph Merge Algorithm 20 Merged Processing Graph: Read Packets Header Classifier Drop Alert (IPS) DPI Output Alert (Firewall) Shorter Diameter

OpenBox Protocol: Connection Setup 21 Hello SetParametersRequest SetParametersResponse AddCustomModuleRequest AddCustomModuleResponse BarrierRequest SetProcessingGraphRequest SetProcessingGraphResponse BarrierRequest Controller Service Instance

OpenBox Protocol – Block Definition 22

OpenBox Protocol: Block Hierarchy 23 HeaderClassifier TCAMClassifier TrieClassifier Controller Service Instance Hello … Supported blocks: HeaderClassifier: [TCAMClassifier, TrieClassifier] Hello … Supported blocks: HeaderClassifier: [TCAMClassifier, TrieClassifier] SetProcessingGraphRequest … Use TCAMClassifier in graph SetProcessingGraphRequest … Use TCAMClassifier in graph

Distributed Data Plane OpenBox Service Instance Software OpenBox Service Instance Hardware (TCAM) E.g., an OpenFlow switch with encapsulation features Header Classifier Alert Payload Classifier Rewrite Header Metadata

Extensible Data Plane OpenBox Service Instance Software OpenBox Service Instance Hardware Implementation Header Classifier Alert Payload Classifier Rewrite Header Media Encoder OpenBox Controller A new software module can be injected from control plane without modifying or re-deploying software in data plane

Scalable & Reliable Data Plane Easy provisioning of new OBIs by simply running more VMs (VNFs) – Even for hardware-assisted tasks, can use software VMs as a backup for peak times OBIs can report load information to controller, to allow centralized control over provisioning Increases reliability – quickly respond to crashes 26 OBI

Implementation 27 Java-based Controller Generic Python wrapper for execution engines Click-based execution engine

Performance Improvement 28 VM1 Firewall VM2 IPS VM1 Firewall1 VM2 Firewall2 VM1 OBI1 VM2 OBI2 Without OpenBox With OpenBox

Conclusions Network functions are currently a real challenge in datacenter, operator, and enterprise networks OpenBox decouples the data plane processing from network function logic and: – Reduces costs of management – Enhances performance – Improves scalability – Increases reliability – Provides multi-tenancy – Allows easier innovation and lets new players into the game 29 OpenBox Protocol OpenBox Service Instances OpenBox Controller OpenBox Applications Control Plane Data Plane NB API

THANK YOU! Questions? 30