1. Design and Implementation of a Data Plane for the OpenBox Framework Pavel Lazar March 2016 This research was supported by the European Research Council under the European Union’s Seventh Framework Programme (FP7/2007- 2013)/ERC Grant agreement no 259085.

2. Outline OpenBox Background The OpenBox Framework OBI Design Challenges OBI Architecture OBI Implementation Performance Future Work Summary

3. Background - The problem Network Functions (Middleboxes: -High cost -Limited and separate management -Limited provisioning and scalability -No multi-tenancy -Limited functionality and limited innovation -Similar processing steps, no re-use

4. Background - The OpenBox solution Bring Software-Defined Control to the middlebox. Decouple network function control from their data plane Unifies data plane of multiple network functions. SDN Controller OpenBox Controller OBI

5. Read Packets Header Classifier Drop Alert Output Firewall: Read Packets Header Classifier Drop Alert Regex Classifier Output IPS Read Packets Header Classifier Drop Alert (IPS) Regex Classifier Output Alert (Firewall)

6. The OpenBox Framework OpenBox Protocol OpenBox Service Instances OpenBox Controller OpenBox Applications Control Plane Data Plane NB API

7. OBI OBI Design challenges OBC OpenBox Protocol Input Traffic Output Traffic

8. OBI Design challenges OBC OpenBox Protocol Input Traffic Output Traffic Generic Manager Execution Engine Configuration Builder Control Message Handling

9. OBI Architecture

10. OBI Architecture – Generic Manager

11. OBI Architecture – Execution Engine

12. OBI Implementation - Generic Manager

13. OBI Implementation –Set Graph Flow Example 1 2 3 4 5 6 7 8 9 10

14. OBI Execution Engine - Click Element is the basic building block Router: Elements connected by edges Describes possible packet flows

15. OBI Execution Engine – Click package OpenBox Package ChatterMessage PushMessage StringClassifier StringMatcher RegexClassifier RegexMatcher GroupRegexMatcher MultiCounter AutoMarkIPHeader NetworkDirectionSwap NetworkHeaderFieldsRewriter

16. OpenBox Processing Graph to Click Configuration FromDevice Header Payload Classifier Discard ToDevice Discard FromDevice AutoMark IpHeader Counter ToDevice Content Classifier RegexClassifier MultiCounter New Classifier New Click Classifier elements

17. Performance – Packet Processing Firewall – 4560 header rules: – Throughput: 840 Mbps, – Latency: 48us IPS – Snort rules (Header + Payload): – Throughput: 454 Mbps – Latency: 76 us

18. Performance – Time Measurements Startup time: 2.1 seconds Set Processing Graph*: 1250ms Global Stats: < 2ms Read Handler: 8ms Log message: < 2ms

19. Possible Future Work Implement additional blocks Add more elements Improve data flow between OBIs Add Execution Engine optimization inside the ConfigurationBuilder Implement Click packet processing improvement researches Or even, replace Click with a different engine (HW)

20. Summary Helped implementing the OpenBox Protocol Designed an OpenBox Instance architecture. Implemented an OBI to be used within the OpenBox project. Used Click as the Execution Engine. Easy to improve and add features