O paradigma Network Function Virtualization (NFV) promete tornar as redes de computadores mais escaláveis e flexíveis, através do desacoplamento das funções de rede de hardware dedicado e fornecedor específico. No entanto, funções de rede computacionalmente intensivas podem ser difíceis de virtualizar sem degradação de desempenho. Neste contexto, Field-Programmable Gate Arrays (FPGAs) têm se mostrado uma boa opção para aceleração por hardware de funções de rede virtuais que requerem alta vazão, sem se desviar do conceito de uma infraestrutura NFV que visa alta flexibilidade. A avaliação de expressões regulares é um mecanismo importante e computacionalmente intensivo, usado para realizar Deep Packet Inpection, que pode ser acelerado por FPGA para atender aos requisitos de desempenho. Esta solução, no entanto, apresenta novos desafios em relação aos requisitos de confiabilidade. Particularmente para FPGAs baseados em SRAM, soft errors na memória de configuração são uma ameaça de confiabilidade significativa. Neste trabalho, apresentamos um mecanismo de tolerância a falhas abrangente para lidar com falhas de configuração na funcionalidade de módulos de avaliação de expressões regulares baseados em FPGA. Além disso, é introduzido um mecanismo de correção de erros que considera o posicionamento desses módulos no FPGA para reduzir o tempo de reparo do sistema, melhorando a confiabilidade e a disponibilidade. Os resultados experimentais mostram que a taxa de falha geral e o tempo de reparo do sistema podem ser reduzidos em 95% e 90%, respectivamente, com custos de área e performance admissíveis. / The Network Function Virtualization (NFV) paradigm promises to make computer networks more scalable and flexible by decoupling the network functions (NFs) from dedicated and vendor-specific hardware. However, network and compute intensive NFs may be difficult to virtualize without performance degradation. In this context, Field-Programmable Gate Arrays (FPGAs) have been shown to be a good option for hardware acceleration of virtual NFs that require high throughput, without deviating from the concept of an NFV infrastructure which aims at high flexibility. Regular expression matching is an important and compute intensive mechanism used to perform Deep Packet Inspection, which can be FPGA-accelerated to meet performance constraints. This solution, however, introduces new challenges regarding dependability requirements. Particularly for SRAM-based FPGAs, soft errors on the configuration memory are a significant dependability threat. In this work we present a comprehensive fault tolerance mechanism to deal with configuration faults on the functionality of FPGA-based regular expression matching engines. Moreover, a placement-aware scrubbing mechanism is introduced to reduce the system repair time, improving the system reliability and availability. Experimental results show that the overall failure rate and the system mean time to repair can be reduced in 95% and 90%, respectively, with manageable area and performance costs.

Les prestataires de service réseau doivent faire face à la demande croissante des besoins des utilisateurs, en particulier vers une plus grande flexibilité et toujours plus de capacité. La "softwerisation" et la "cloudification" des composants du réseau offrent une solution prometteuse pour obtenir l'agilité nécessaire afin de répondre dynamiquement à l'exigence au niveau de la consommation des ressources. Cette vision se traduit par le déploiement de la Virtualisation des Fonctions Réseau (NFV) où les Fonctions de Réseau Virtuels (VNFs) peuvent être associées pour créer des services réseau. Cette thèse étudie la problématique de l'allocation de ressources dans un système NFV afin de minimiser son coût sous contraintes sur l'interconnectivité entre les VNF, les ressources du système et les exigences de service. La principale considération est la réduction du coût global du déploiement en ressources informatiques. Nous étudions également d'autres objectifs à satisfaire tels que la migration des fonctions réseau et la gestion de la congestion. Notre premier objectif est d'augmenter notre compréhension de la performance d'un système NFV en étudiant le placement et le routage des fonctions réseau. Nous formalisons le problème dans une approche globale en tenant compte d'un large ensemble de paramètres pertinents. Nous prendrons en compte les cas statiques (Hors Ligne) et dynamiques (En Ligne) du problème. Nous proposons et analysons trois algorithmes heuristiques: deux sont conçus pour traiter de grandes dimensions du scenario "Hors Ligne" et le dernier est conçu pour résoudre le scénario "En Ligne". Les résultats montrent que notre solution surpasse l'état de l'art par rapport à l'indicateur de performance critique. Nous évaluons également l'impact de la migration d'une série de demandes simultanées et proposons une technique de migration simple pour ce système dynamique. A la lumière de ces premiers résultats, nous étendons notre étude afin d'améliorer l'efficacité de notre solution en proposant un modèle plus simple. La seconde partie de notre étude se concentre sur l'optimisation de l'utilisation des ressources d'un système NFV. La principale distinction est que nous pouvons appliquer le modèle à un système dynamique avec de grandes instances. De plus, nous fournissons également une méthode originale pour engendrer de fortes inégalités afin d'améliorer la résolution de la programmation linéaire (LP) dans un espace de dimension supérieur. Les résultats obtenus n'améliorent pas seulement le modèle, mais promettent aussi de pouvoir être utiliser efficacement dans d'autres modèles. Une troisième contribution de notre travail concerne le problème de routage dans NFV. En effet, une évolution importante des besoins des utilisateurs est représentée par la demande d'accès croissante aux ressources réseau, de stockage et de calcul afin de combiner dynamiquement le niveau de consommation de ressources avec leurs besoins de service. Par conséquent, nous nous intéressons au routage efficace d'une demande utilisateur à travers les noeuds qui traitent les fonctions impliquées dans une chaîne de services donnée. Nous proposons une formulation originale de ce problème basée sur la construction d'un réseau étendu. Nous formulons une solution mathématique exacte et proposons plusieurs algorithmes approximatifs tenant compte les principaux paramètres du système. Nous conclurons en soulignant les contributions principales de notre travail et proposons quelques pistes pour des travaux futurs. / Network service providers have to cope with the growing on-demand need from end-users as well as the diversity of usage. The "softwerization" and "loudification" of the network components offer a promising solution to achieve the agility necessary to dynamically match the servcice requirements with the level of resource consumption. Cloud-based solutions promises an economy of scale and simpler management. Virtualizing the many network appliances offers the flexibility to adapt to the varying service demand. This materializes with the deployment of Network Functions Virtualization (NFV) where Virtual Network Functions (VNFs) may be chained together to create network services. This dissertation studies the resource allocation problem in an NFV system for minimizing its cost under constraints on interconnectivity among VNFs, system resources, and service requirements. The main consideration is the reduction of the overall deployment cost while efficiently utilizing the available resources. In addition, a number of other important constraints are considered such as migration and congestion. Our first goal is to increase our understanding of the performance of an NFV system with respect to network functions placement and routing. We formalize the problem in a comprehensive maner taking into account a broad set of relevant parameters. The static (OFFLINE) and dynamic (ONLINE) cases are considered. We propose and analyze three heuristic algorithms: two for handling large dimensions of the OFFLINE problem and one designed to address the ONLINE scenario. The results show that our solution outperforms the state of the art with respect to critical performance index. We also evaluate the impact of migrating a set of running demands, and propose a simple migration technique for the dynamic system. We extend this work by proposing a simpler model to improve the performance of our solution. The second part of our work focuses on minimizing the resource utilization of an NFV system. The main distinctive point is that we can apply the model to a dynamic system with large instances. Moreover, we also provide an interesting method for generating some strong inequalities to improve the Linear Programming (LP) solving in a higher dimensional space. The obtained results are not only making the model easier but also can be used efficiently in other models. A third contribution focuses specifically on the routing problem in NFV. An important evolution of the users’ needs is represented by the dynamic on-demand access to network, vstorage and compute resources. Therefore, routing efficiently a demand across nodes handling the functions involved in a given service chain constitutes the a novel problem that we address in this last section. We provide an original formulation of this problem based on the construction of an expanded network. We derive the exact mathematical formulation and propose several approximate algorithms taking into account the main system’s parameters. We conclude by deriving some interesting insights both about the algorithms and the network performance. We finally conclude with our main findings and highlight many avenues for future work.

The advent of 5th generation of mobile networks (5G) will introduce some new challenges for the transport network. Different strategies can be employed by the network providers to address these challenges with the aim to achieve an efficient utilization of network resources. The most feasible option to achieve this goal is to introduce intelligence in the transport infrastructure by designing a flexible and programmable transport network. Network function virtualization (NFV) and dynamic resource sharing (DRS) are two possible techniques for realizing a flexible transport network. NFV allows to dynamically push network functions to different locations in the network, while DRS allows for sharing transport resources in a flexible manner. Both of these strategies can be realized by employing a programmable control framework based on software defined networking (SDN), which has implications on both the network data and control planes. However, this thesis specifically focuses on the data plane aspects of NFV and the control plane aspects of DRS. Considering the network caching as a specific example of network function, the data plane aspects of NFV are studied in terms of different architectural options for cache placement in order to see which options are the most efficient in terms of network power consumption and cost. The results presented in this thesis show that placing large-sized caches farther in the network for a large group of users is the most efficient approach. The control plane aspects of DRS are analyzed in terms of which provisioning strategy should be used for sharing a limited amount of transport resources. The analysis is presented for both a single-tenant case (i.e., where the role of service and network provider is played by the same entity), and a multi-tenant case (i.e., where a network provider manages the resources assigned to different service providers in an intelligent way). The results show that DRS performs much better than the conventional static approach (i.e., without sharing of resources), which translates into significant cost savings for the network providers. / <p>QC 20161115</p>

The Internet of Things (IoT) concept has been realised with the advent of Machineto-Machine (M2M) communication through which the vision of future Internet has been revolutionised. IPv6 over Low power Wireless Personal Area Networks (6LoWPAN) provides feasible IPv6 connectivity to previously isolated environments, e.g. wireless M2M sensors and actuator networks. This thesis's contributions include a novel mathematical model, energy-efficient algorithms, and a centralised software controller for dynamic consolidation of programmability features in cloud-based M2M networks. A new generalised joint mathematical model has been proposed for performance analysis of the 6LoWPAN MAC and PHY layers. The proposed model differs from existing analytical models as it precisely adopts the 6LoWPAN specifications introduced by the Internet Engineering Task Force (IETF) working group. The proposed approach is based on Markov chain modelling and validated through Monte-Carlo simulation. In addition, an intelligent mechanism has been proposed for optimal 6LoWPAN MAC layer parameters set selection. The proposed mechanism depends on Artificial Neural Network (ANN), Genetic Algorithm (GA), and Particles Swarm Optimisation (PSO). Simulation results show that utilising the optimal MAC parameters improve the 6LoWPAN network throughput by 52-63% and reduce end-to-end delay by 54-65%. This thesis focuses on energy-efficient data extraction and dissemination in a wireless M2M sensor network based on 6LoWPAN. A new scalable and self-organised clustering technique with a smart sleep scheduler has been proposed for prolonging M2M network's lifetime and enhancing network connectivity. These solutions succeed in overcoming performance degradation and unbalanced energy consumption problems in homogeneous and heterogeneous sensor networks. Simulation results show that by adopting the proposed schemes in multiple mobile sink sensory field will improve the total aggregated packets by 38-167% and extend network lifetime by 30-78%. Proof-of-concept real-time hardware testbed experiments are used to verify the effectiveness of Software-Defined Networking (SDN), Network Function Virtualisation (NFV) and cloud computing on a 6LoWPAN network. The implemented testbed is based on open standards development boards (i.e. Arduino), with one sink, which is the M2M 6LoWPAN gateway, where the network coordinator and the customised SDN controller operated. Experimental results indicate that the proposed approach reduces network discovery time by 60% and extends the node lifetime by 65% in comparison with the traditional 6LoWPAN network. Finally, the thesis is concluded with an overall picture of the research conducted and some suggestions for future work.

No description available.

Virtualization on top of high-performance servers has enabled the virtualization of network functions like caching, deep packet inspection, etc. Such Network Function Virtualization (NFV) is used to dynamically adapt to changes in network traffic and application popularity. We demonstrate how the combination of Software Defined Networking (SDN) and NFV can support the parallel operation of different Internet architectures on top of the same physical hardware. We introduce our architecture for this approach in an actual test setup, using CloudLab resources. We start of our evaluation in a small setup where we evaluate the feasibility of the SDN and NFV architecture and incrementally increase the complexity of the setup to run a live video streaming application. We use two vastly different protocol stacks, namely TCP/IP and NDN to demonstrate the capability of our approach. The evaluation of our approach shows that it introduces a new level of flexibility when it comes to operation of different Internet architectures on top of the same physical network and with this flexibility provides the ability to switch between the two protocol stacks depending on the application.

L'émergence de la technologie de virtualisation des fonctions réseau (NFV) a suscité un vif intérêt autour de la conception, la gestion et le déploiement de services réseau de manière flexible, automatisée et indépendante du fournisseur. La mise en œuvre de la technologie NFV devrait être une solution profitable pour les fournisseurs de services et les clients. Cependant, ce changement de paradigme, amorcé par NFV, nécessite un abandon progressif des services réseau fournis à travers des équipements dédiés. En contrepartie, un environnement totalement ou partiellement virtualisé est proposé pour instancier dynamiquement et à la demande des modules logiciels appelés fonctions de réseau virtuelles (VNF). Cette évolution soulève un ensemble de défis liés au déploiement et à l'exploitation de services, tels que l'orchestration et la gestion, la résilience des services, le contrôle de la qualité de service (QoS), l’approvisionnement des ressources, etc. En outre, la question centrale à résoudre dans le contexte NFV est la suivante : « comment placer et chaîner effacement des fonctions virtuelles d’un service afin de fournir un niveau de qualité demandé par le client tout en optimisant l'utilisation des ressources par le fournisseur de services ? ”.Ainsi, cette thèse étudie la problématique du placement et du chaînage des VNF en tenant compte de certaines exigences de service telles que le délai de bout en bout, la disponibilité du service et la consommation d'énergie, et propose un ensemble d'algorithmes et de mécanismes visant à optimiser le déploiement des services demandés/fournis. Nos contributions dans cette thèse sont triples. Premièrement, nous proposons deux algorithmes de placement et de chaînage de VNF sensibles au délai de bout-en-bout pour des applications temps-réel. Les algorithmes proposés visent à respecter le délai approprié de bout-en-bout qui dépend du service déployé (exemples : VoIP, Streaming, etc.). Deuxièmement, nous présentons une analyse comparative de la disponibilité des services et nous proposons deux mécanismes de placement et de chaînage de VNF pour garantir un niveau prédéfini de disponibilité. L’objectif est de fournir des services résilients en ajustant avec précision les paramètres du schéma de protection (nombre, type, emplacement et taille des instances VNF) nécessaires pour atteindre ce niveau de disponibilité en dépit des défaillances du réseau. Enfin, nous proposons une architecture générale qui explore la possibilité d’étendre le paradigme de la virtualisation à l’Internet des objets (IoT). À cette fin, nous définissons un mécanisme de placement et de chaînage respectant les contraintes énergétiques pour des services IoT. Notre architecture propose de découpler et de virtualiser les fonctionnalités inhérentes à un objet connecté de l’équipement IoT physique. En étendant NFV au domaine IoT, notre solution ouvre de nouvelles perspectives d’application en supportant de nouveaux cas d’usages. / The emergence of Network Function Virtualization (NFV) technology has aroused keen interest to design, manage and deploy network services in a flexible, automated and vendor-agnostic manner. Implementing NFV technology is expected to be a win-win solution for both service providers and costumers. However, this paradigm shift, sparked by NFV, calls for a progressive abandon of network services that are provided as hardware appliance and rather it proposes a fully or partially virtualized environment that offers software modules called Virtual Network Functions (VNFs). This shift rises a set of challenges related to service deployment and operation such as orchestration and management, service resiliency, Quality of Service (QoS) and resource provisioning among others. Furthermore, the core question that needs to be solved within NFV context is “What is the best way to place and chain VNFs that form a service in order to meet Service Level Agreement requirements (costumer side) while optimizing resource usage (service provider side)?”.This thesis investigates the problem of VNF Placement and Chaining considering service requirements such as end-to-end delay, service availability and energy consumption and proposes a set of algorithms and mechanisms that aim to achieve an optimized deployment of the requested/provided services. Our contributions in this thesis are threefold. First, we propose a delay-aware Placement and Chaining algorithms for delay-sensitive applications over NFV networks. The proposed algorithms aim to meet the appropriate end-to-end delay defined according to the deployed service (VoIP, Streaming, etc.). Second, we provide a comprehensive service availability benchmarking and we propose two availability-aware mechanisms for VNFs chain. The aim is to provide resilient service provisioning by fine-tuning the parameters of the protection scheme (the number, the type, the placement and the size of the spare instances) needed to reach a predefined availability level, despite network failures. Finally, we propose a framework architecture that explores the possibility to extend the virtualization paradigm to Internet of Things (IoT). Toward this end, we define an energy-aware Placement and Chaining for IoT services where inherent IoT functionalities are decoupled from specific dedicated IoT devices and instantiated on-demand. By bringing together NFV and IoT paradigms, this extension opens new perspectives and push toward designing new use cases.

La détection tardive des menaces à la sécurité entraîne une augmentation significative du risque de dommages irréparables, invalidant toute tentative de défense. En conséquence, la détection rapide des menaces en temps réel est obligatoire pour l'administration de la sécurité. De plus, la fonction de virtualisation de la fonction réseau (NFV) offre de nouvelles opportunités pour des solutions de sécurité efficaces et à faible coût. Nous proposons un système de détection de menaces rapide et efficace basé sur des algorithmes de traitement de flux et d'apprentissage automatique. Les principales contributions de ce travail sont : i) un nouveau système de détection des menaces de surveillance basé sur le traitement en continu, ii) deux ensembles de données, d'abord un ensemble de données de sécurité synthétiques contenant à la fois du trafic légitime et malveillant, et le deuxième, une semaine de trafic réel d'un opérateur de télécommunications à Rio de Janeiro, au Brésil, iii) un algorithme de pré-traitement de données, un algorithme de normalisation et un algorithme de sélection de caractéristiques rapides basé sur la corrélation entre des variables, iv) une fonction de réseau virtualisé dans une plate-forme Open Source pour fournir un service de détection des menaces en temps réel, v) placement quasi-optimal des capteurs grâce à une heuristique proposée pour positionner stratégiquement les capteurs dans l'infrastructure du réseau, avec un nombre minimal de capteurs, et enfin vi) un algorithme glouton qui alloue à la demande une séquence de fonctions de réseau virtuel. / The late detection of security threats causes a significant increase in the risk of irreparable damages, disabling any defense attempt. As a consequence, fast real-time threat detection is mandatory for security administration. In addition, Network Function Virtualization (NFV) provides new opportunities for efficient and low-cost security solutions. We propose a fast and efficient threat detection system based on stream processing and machine learning algorithms. The main contributions of this work are i) a novel monitoring threat detection system based on streaming processing, ii) two datasets, first a dataset of synthetic security data containing both legitimate and malicious traffic, and the second, a week of real traffic of a telecommunications operator in Rio de Janeiro, Brazil, iii) a data pre-processing algorithm, a normalizing algorithm and an algorithm for fast feature selection based on the correlation between variables, iv) a virtualized network function in an Open source Platform for providing a real-time threat detection service, v) near-optimal placement of sensors through a proposed heuristic for strategically positioning sensors in the network infrastructure, with a minimum number of sensors, and finally vi) a greedy algorithm that allocates on demand a sequence of virtual network functions.

With advancements in the mobile network architecture, from the Fourth Generation to the Fifth Generation, a vast number of new use cases becomes available. Many use cases require cloud-based services, where a service is deployed close to the user. For a user to communicate with a service, it connects to the mobile network base station, Fifth Generation Core network and then to the service. When the user changes physical location, the mobile network and the service must apply mobility techniques. This is to prevent tromboned traffic and provide low latency between user and service. When a handover occurs, so that a user’s attachment point to the mobile network is changed from the one base station to another and the User Plane Function changes, the cloud-based service may have to seamlessly move from one cloud to another as well. In this thesis, a Service mobility framework is proposed and implemented, which enables service live migration between edge clouds and it provides simple RESTful APIs. The evaluation of the framework shows that the proposed implementation adds low delays to the total migration time and the service downtime is also shown to be low in the case of video streaming with no service interruption. / Med framsteg i det mobila nätverkets arkitektur, sett från den Fjärde Generationen till den Femte Generationen, så blir nya användningsområden tillgängliga. Bland de nya användningsområdena inkluderas molnbaserade tjänster, där tjänster är placerade nära användare, dessutom har vissa områden behov av dessa molnbaserade tjänster. För att en användare ska kunna kommunicera med en tjänst så måste den först ansluta till det mobila nätverkets basstationer och sedan till Femte Generationens kärnnätverk, för att sedan kunna kommunicera med tjänsten. När användaren förflyttar sig från en plats till en annan, så måste det mobila nätverket och tjänsten tillämpa rörlighetstekniker, som förflyttning av tjänsten. Förflyttningen är för att förhindra trombonerad trafik och att förse låg latens mellan användare och tjänst. När en överlämning sker, d.v.s att en användares kopplingspunkt till det mobila nätverket ändras, från en basstation till en annan, och att User Plane Function ändras, så kan även den molnbaserade tjänsten förflytta sig sömlöst från ett moln till ett annat. I denna avhandling presenteras ett tjänströrlighetsramverk som möjliggör tjänströrlighet mellan moln och erbjuder enkla RESTfulla API:er. Evaluering av ramverket visar att implementationen bidrar med låga fördröjningar till den totala migrations tiden samt att tjänster med videoströmming har lågt driftstopp utan tjänstavbrott.

Critical infrastructure networks (CIN) are essential systems that provide key socio-eco-nomical services. They can be classified into different sectors such as energy supply, in-formation and communication, water, food, health, transport, among others. Their pro-tection from hazards and constant improvements are crucial for ensuring the appropriate operation of a society and economy. In this context, the current study focused on analyzing the factors affecting the function-ing of one particular CIN in the water sector: the urban drainage networks (UDNs). More specifically, the present research focused on evaluating how does the structure of UDNs influence their function. Concepts and methods from complex network theory were used to evaluate structural properties of sewers systems and function was evaluated in terms wastewater flow quantitates and occurrence of node flooding and combined sewer over-flow (CSOs) events, considered as indicators if network performance. Initial results suggested that network metrics can be used as surrogate variables of UDNs main functions, i.e. transport and collection of wastewater. However, efficiency of this de-pended on the type of layout, i.e. physical arrangement of the network. Following studies focused then on developing a graph-theory based method to quantify the structure of an UDN and use it to evaluate the influence of layout on its function. Results suggested that sewer networks with a more meshed layout had a better performance, i.e. adverse events such as urban pluvial flooding and CSO discharges were less likely to occur, than UDNs with a branched layout. Furthermore, transitioning from a tree-like structure to a more meshed system was identified to be a cost-efficient measure for urban flooding manage-ment. It is concluded that the structure of an UDN, in terms of its layout, has a strong influence on its performance and therefore on its resilience. It is expected that the obtained results could serve as support for better management and operational actions of UDNs and could also serve as basis for the development of a new structural resiliency analysis based mainly on the UDN configuration.:1. General Introduction 2. Centrality and Shortest Path Length measures for the functional analysis of Urban Drainage Networks 3. Meshness of sewer networks and its implications for flooding occurrence 4. The Role of Sewer Network Structure on the Occurrence and Magnitude of Combined Sewer Overflows (CSOs) 5. Determination of Optimal Meshness of Sewer Network Based On a Cost-Benefit Analysis 6. Influence of Meshness on Urban Drainage Networks Resilience and its Implications 7. Conclusions and Outlook 8. Supplementary Information