Search

The goal of the EU-funded UNICORE project is to develop a common code-base and toolchain that will enable software developers to rapidly create secure, portable, scalable, high-performance solutions starting from existing applications. The key to this is to compile an application into very light-weight virtual machines – known as unikernels – where there is no traditional operating system, only the specific bits of operating system functionality that the application needs. The resulting unikernels can then be deployed and run on standard high-volume servers or cloud computing infrastructure. The objective of this deliverable is to describe the current architecture of the toolchain as well as the different tools that have been developed to build and orchestrate unikernels. The current toolchain contains two fully-functional tools (dependency analysis tool and automatic build tool) that have been tested with different schemes and configurations. Others tools are still in research and will be released in a next milestone.

To cope with the growing performance needs of security appliances in datacenters or the network edge, current middlebox functionalities such as stateful firewalls, NATs, DPI, content-aware optimizers or load-balancers are self-contained software. They avoid OS services as those are not tailored for NFV and use most of the time RAW sockets, or specific I/O frameworks (DPDK, Netmap, ...) to receive raw packets. In this work, we present a system specifically designed to run a pipeline of VNFs. The system combines the classification and sessions needs of the VNFs. We build an abstract view of flows and use it to implement support for seamless inspection and modification of the content of any flows (such as TCP or HTTP), automatically reflecting a consistent view, across layers, of flows modified on-the-fly. This brings together the advantage of reusing software components with the performance provided by state-of-the-art high-speed NFV frameworks that force reimplementing protocol specifics in each application. We show unique considerations about factorizing session management and multi-protocol support for high-speed in-the-middle inspection and modification of flows. The system also offers automatic, session-aware parallelism to handle a large number of flows.

International audience; Les processeurs multi-coeurs sur PC, en même temps que les progrès récents sur la performance de la mémoire et des bus, suggèrent un candidat idéal pour la construction d'architectures de routeurs purement logicielles qui soient flexibles et en même temps performantes. Dans cet article, nous présentons une architec- ture de commutation de paquets pour les routeurs logiciels ou virtuels dont l'objectif principal est de prévenir des accès mémoire coûteux tout en utilisant les ressources CPU disponibles au mieux pour traiter et commuter les paquets. Nous présentons premièrement le principe d'arbre de commutation dont la fonction est de gar- der les paquets commutés dans la même hiérarchie de cache du processeur. Nous identifions ensuite la source de contention principale des performances de commutation comme l'accès concurrent aux interfaces de sorties puis analysons les gains potentiels de performance en utilisant un verrou sur les interfaces de sortie ainsi qu'un mécanisme de retour sur l'état des queues du routeur. Finalement, nous proposons et évaluons une modification des arbres de commutation qui permet de contourner la contention due au partage des interfaces de sortie par les arbres.

More than forty years since the creation of the first ARPANet nodes, the Internet continues to evolve. The recent decade has seen the introduction of new types of devices that are multi-connected: smartphones and tablets. These devices often have both a WiFi and a mobile data connection. Unfortunately, the TCP/IP protocols were designed 30 years ago when devices only used a single interface. As smart devices are multi-connected, users expect that their applications can seamlessly handover from WiFi to 3G. This mismatch between what the protocols provide and what the user expects therefore impacts the user experience. Recently, a new extension to TCP, called Multipath TCP (MPTCP), has been proposed and standardized. MPTCP allows a single connection to use multiple interfaces at the same time actually adding the missing mobility feature to TCP. This extension, as every new protocol/extension, suffers from the chicken-and-egg problem. To use MPTCP both clients and servers have to support it. This PhD thesis focuses on the deployability of MPTCP and evaluates its benefits in different network environments. First we evaluate the benefits of using MPTCP on a smartphone as to show that indeed MPTCP improves the end user experience. Second we evaluate if MPTCP can be used on the Internet by identifying middleboxes that could prevent it from being used. We then propose to solve the chicken-and-egg problem by deploying protocol converters on the Internet that translate TCP to MPTCP. This converter gives incentive to smartphone vendors to implement MPTCP on their devices and use it to improve the customer experience. Finally, we propose a new load balancing technique that improves the link usage in data centers. (FSA - Sciences de l) -- UCL, 2014

The IP protocol suite has been initallyi designed to provide best effort reachability among the nodes of a network or an inter-network. The goal was to design a set of routing solutions that would allow routers to automatically provide end-to-end connectivity among hosts. Also, the solution was meant to recover the connectivity upon the failure of one or multiple devices supporting the service, without the need of manual, slow, and error-prone reconfigurations. In other words, the requirement was to have an Internet that "converges" on its own. Along with the "Internet Boom", network availability expectations increased, as e-business emerged and companies started to associate loss of Internet connectivity with loss of customers... and money. So, Internet Service Providers (ISPs) relied on best practice rules for the design and the configuration of their networks, in order to improve their Quality of Service. The goal of this thesis is to complement the IP routing suite so as to improve its resiliency. It provides enhancements to routing protocols that reduce the IP packet losses when an IP network reacts to a change of its topology. It also provides techniques that allow ISPs to perform reconfigurations of their networks that do not lead to packet losses. (FSA 3)--UCL, 2007

Berichte aus der Kommunikationstechnik, 061, ISBN:3-8322-2651-6

Since its inception in the 60's, the Internet has evolved from a nationwide network interconnecting a handful of nodes, to a worldwide system interconnecting billion of devices. While the network has dramatically expanded in size, it has also grown in term of adoption. In the age of the Internet of Things, everything and everyone is heavily connected to the interconnected network. This growth came with a cost for service providers: the user's expectation in terms of reliability and performances. To achieve reliability and performance, network operators and engineers designed redundant systems and tried to balance the load across the network's different paths. While adding redundant paths into the network was already a challenge, a greater one awaited: efficiently using them. This thesis is a contribution to improve different solutions and leverage the path diversity, especially in datacenters and enterprise networks. First, we improve Multipath TCP to make it compatible with current load-balancers, solving a problem that has been hindering its deployment. Furthermore, we show that the same approach enables anycast Multipath TCP services, a major benefit given the difficulty of deploying anycast TCP services. We implement these modifications in the Linux kernel and demonstrate its benefits with several micro-benchmarks. We also enable network functions that operate on the bytestream rather than on a per-packet basis by extending the implementation of IPv6 Segment Routing. This enables network architects to design end-to-end services as a series of in-network functions. The measurements realized with our implementation in the Linux kernel indicate that our architecture is well suited to support middle-boxes that process bytestreams. Finally, this thesis leverages eBPF and IPv6 Segment routing to allow transport protocols to benefit from the path diversity in datacenters and enterprise networks. We implement this architecture and shows that eBPF can be used to dynamically change the path used by a TCP ow with IPv6 Segment routing. This enables improvements to transport protocols by allowing their internal state (Round-Trip-Time, loss rate, ...) to influence the path used in the network. To allow these ideas to have an impact, the contributions of this thesis have been implemented and evaluated. The code is open source and the suggested modifications to the protocols have been standardized by the IETF. These contributions open new perspectives to efficiently use the multi-path networks of the 21th century. (FSA - Sciences de l'ingénieur) -- UCL, 2019

The constant rise of Over-The-Top video consumption nowadays challenges the current Internetarchitecture. As an overwhelming majority of the bandwidth today is dedicated to the deliveryof video contents, Internet actors such as Content Providers, Content Delivery Network, InternetService Providers are forced to optimize their networks to support the Quality of Experience expectedby the End-Users . Such costly specialized networks participate to the so-called "ossification" of theInternet whichmakes the architecture harder to update, as the placement and dimensioning of linksand middleboxes may be hard to change in the future to support new use cases. Fortunately, thetrend of Virtualizating and Softwarizing the networks pushed by major Telco operators, vendors andstandardization bodies has given hopes that the computing and networking infrastructure can beeasily re-purposed. The agility promoted by technologies such as Network Function Virtualizationand Software Defined Networking makes it possible for middleboxes to be deployed as VirtualNetwork Functions that can run on "commercial off-the-shelf" hardware while having the networkmanaged by a logically centralized controller deploying network configurations on programmableforwarding devices.The goal of this thesis is to show how content distribution can be collaboratively improved thanksto Network Softwarization. First, we propose CDN-as-a-Service (CDNaaS), a complete solution tovirtualize a Content Delivery Network on top of a VNF-as-a-Service platform, adopted and evaluatedat large scale in the FP7 T-Nova European project. We elaborate on the interfaces, architecture anddesign choices made to implement the platform to support performance, automatic scaling andre-usability. Then, we propose two collaboration models allowing the content delivery actors to workjointly on improving End-User Quality of experience while fostering a healthy competition and a fairbalance of revenue. Finally, we study the challenges of NFV resource allocation for the vCDN serviceand propose several heuristics and algorithms to optimize the proposed solution in a cost-effectiveway. This thesis paves the way towards a collaborative content distribution allowing End-Users toaccess their content with the highest standards while contributing to a sound development of theInternet., L’augmentation constante de la consommation de vidéos par des services par contournement(Over-The-Top) met à mal l’architecture actuelle d’Internet. Alors qu’une écrasante majorité de labande passante aujourd’hui est allouée à la livraison de contenus, les acteurs de l’Internet, tels queles fournisseurs de contenus, les réseaux de distribution de contenus et les fournisseurs d’accès sontobligés d’optimiser leurs réseaux pour supporter la qualité d’expérience attendue par l’utilisateurfinal. Ces réseaux couteux et spécialisés participent à l’ossification de l’Internet, rendant l’évolutionde son architecture plus difficile à moyen terme. En effet, un choix trop spécifique de dimensionnementdes liens et de la localisation des middle-boxes peut être un frein à une mise à jour ultérieureen vue du support de nouveaux cas d’utilisation. Heureusement, les technologies de virtualisationrécemment promues par les grands opérateurs Internet, les vendeurs de solutions et les organismesde standardisation, permettent une réelle programmabilité du réseau et une plus grande versatilitédans les usages de nouveaux équipements. En effet, l’agilité apportée par ces technologies permet ledéploiement de Fonctions Réseaux Virtuelles (VNF, Virtual Network Functions) pouvant s’exécutersur des serveurs de série à bas coût. Quant au Software-Defined Networking , il rend possible unegestion du réseau logiquement centralisée permettant la programmation des commutateurs.L’objectif de cette thèse est de montrer comment la distribution de contenu peut être amélioréecollaborativement à l’aide de la programmabilité de réseaux. Tout d’abord, nous proposons CDNaaS,une solution complète de réseau de livraison de contenu déployée sur une plateforme de "fonctionsréseaux en tant que service" adoptée et évaluée à large échelle dans le cadre du projet Européen FP7T-NOVA. Nous précisons les interfaces, l’architecture et les choix de conception fait pour développerla plateforme afin de fournir performance, auto-dimensionnement et réutilisabilité. Puis, nous proposonsdeux modèles de collaboration permettant aux acteurs de la livraison de contenu de travaillerensemble afin d’augmenter la qualité d’expérience pour l’utilisateur final, tout en promouvant unecompétition saine et une répartition équilibrée de la valeur ajoutée. Finalement, nous étudions lesdéfis liés à l’allocation de ressources virtuelles dans le cas d’un service vCDN, et proposons plusieursheuristiques et algorithmes permettant l’optimisation du coût du service.Cette thèse ouvre la voie à une distribution de contenu collaborative permettant aux utilisateursd’accéder à leurs contenus avec un haut standard de qualité, tout en contribuant à un développementsain de l’Internet.