1. OpenBox: A Software-Defined Framework for Developing, Deploying, and Managing Network Functions
Yotam Harchol
The Hebrew University of Jerusalem
Joint work with Anat Bremler-Barr (IDC) and David Hay (HUJI)
How to bring software defined networking to network functions and why
Separate control/data?
To appear in ACM SIGCOMM 2016
A preliminary version of this work was published in ACM SIGCOMM HotMiddleboxes 2015

2. Software-Defined Networking
40%-60% of the appliances are not switches / routers!
[Sherry & Ratnasamy, ‘12]
Logically-centralized control: Smart, slow
Management Plane: Human time scale
Firewalls
Intrusion detection
Network anti-virus
Leakage prevention
Caching
Load balancing
Billing
NAT
Encoders
Gateways
SSL termination
TCP optimization …
SDN
Controller
API to data plane
(e.g., OpenFlow)
There is a revolution in the world: SDN
Great idea: Nicira, Barefoot
We bring SDN to middleboxes
We implemented this
Control Plane: Distributed algorithms
Data Plane: Packet streaming
Switches:
Dumb, fast
Data Plane: Packet streaming and processing

3. Network Functions Expensive to own and to operate
Hard to manage – separate vendors
No elastic scaling
Complex - dominate overall network performance
"Network function" is a general term for all those appliances in the network that are not doing forwarding (not switches/routers)

4. Software-Defined Solutions
Forwarding plane (switches, routers):
High cost
Limited management
No multi-tenancy
Limited functionality and limited innovation
Complex distributed algorithms
Forwarding plane (switches, routers):
High cost
Limited management
No multi-tenancy
Limited functionality and limited innovation
Complex distributed algorithms
Solution: SDN / OpenFlow
Network Functions (Middleboxes):
Higher cost
Limited and separate management
Limited provisioning and scalability
No multi-tenancy
Limited functionality and limited innovation
Similar processing steps, no re-use
Our solution: OpenBox
Network Functions (Middleboxes):
Higher cost
Limited and separate management
Limited provisioning and scalability
No multi-tenancy
Limited functionality and limited innovation
Similar processing steps, no re-use
OpenBox
Controller
SDN
Controller
NFV only targets cost and provisioning/scalability
OBI
OBI
OBI

5. Challenges Northbound API / language for specifying NF logic
Logically-centralized controller that unifies logic of multiple network functions from multiple tenants
Communication protocol between controller and data plane
Specification of data plane instances
Support for hardware accelerators
Dynamically extend the protocol
Network Functions
Northbound API
What is the right decoupling between ctrl and data plane
Logically-Centralized Controller
Control Plane
Southbound Protocol
Data Plane
Data Plane Instances

6. OpenBox OpenBox: A new protocol
Decouples network function control from their data plane
Unifies data plane of multiple network functions
Benefits:
Easier, unified control
Better performance
Scalability
Flexible deployment
Multi-tenancy
Innovation
OpenBox
Applications
Northbound API
OpenBox
Controller
Control Plane
OpenBox Protocol
Data Plane
OpenBox Service Instances
github.com/OpenBoxProject

7. A Different View of Network Functions
Previous works: Network Function = monolithic closed unit
Traffic Steering (e.g., SIMPLE [Sigcomm ‘13])
Placement and Virtualization (e.g., CoMb [NSDI ’12])
NFV orchestration (e.g., OpenStack, OpenMano, Statos, E2 [SOSP ‘15])
State Management (e.g., OpenNF [Sigcomm ‘14])
Runtime Platform (e.g., xOMB [ANCS ‘12], SDM [INFOCOM ‘14])
OpenBox: Network Function = logical application
Most processing steps are shared among many types of network functions
Some steps can be done once for multiple applications
Some of them tried to provide frameworks with similar management goals as ours
But their basic building block is a NF
We say - it's an application - let's look inside
OpenBox
Applications
OpenBox
Controller

8. What Network Functions Do?
Firewall:
Read Packets
Header Classifier
Drop
Alert
Output
Load Balancer:
Read Packets
Header Classifier
Rewrite Header
Output
Intrusion Prevention System:
Read Packets
Header Classifier
Drop
Alert
DPI
Output

9. Most network functions do very similar processing steps
Observation:
Most network functions do very similar processing steps
But there is no re-use…

10. What Network Functions Do?
Read Packets
Store Packet
Restore Packet
Caching
HTML Normalizer
JavaScript Normalizer
XML Normalizer
Normalization
Alert
Log
Reporting
Output
Drop
Terminals
Header Classifier
DPI
Classification
FIFO Queue
Front Drop Queue
RED Queue
Leaky Bucket
Queue Management
Gzip Decompress
Gzip Compress
De/compression
Talk about NB API
Begin Transaction
Rollback Transaction
Commit Transaction
Transactions
VLAN Pop
VLAN Push
Rewrite Header
Header Modification

11. Northbound API Specify processing graph and block configuration NB API
Read Packets
Header Classifier
Drop
Alert
Output
Rewrite Header
DPI
OpenBox
Applications
Specify processing graph and block configuration
Events,
Load information
NB API
OpenBox
Controller
WE WANT
OpenBox Protocol
Control Plane
Data Plane
OpenBox Service Instances

12. Logically-Centralized Controller
Multiple tenants run multiple applications for multiple policies in the same network
No data sharing between applications
OpenBox
Applications
NB API
SDN Protocol
SDN Switches
SDN
Controller
Network-wide view
Automatic scaling, provisioning, placement, and steering
OpenBox
Controller
WE WANT
OpenBox Protocol
Control Plane
Data Plane
OpenBox Service Instances

13. OpenBox Service Instance
OpenBox Data Plane
Read Packets
Store Packet
Restore Packet
Caching
HTML Normalizer
JavaScript Normalizer
XML Normalizer
Normalization
Alert
Log
Reporting
Output
Drop
Terminals
Header Classifier
DPI
Classification
OpenBox Service Instance
Virtual or Physical
FIFO Queue
Front Drop Queue
RED Queue
Leaky Bucket
Queue Management
Gzip Decompress
Gzip Compress
De/compression
Begin Transaction
Rollback Transaction
Commit Transaction
Transactions
Provides data plane services to realize the logic of network functions
Controlled by the logically-centralized OpenBox controller
VLAN Pop
VLAN Push
Rewrite Header
Header Modification

14. Distributed Data Plane
Alert
DPI
Header Classifier
Rewrite Header
Metadata
OpenBox Service Instance
Hardware
(TCAM)
E.g., an OpenFlow switch with encapsulation features
OpenBox Service Instance
Software

15. Split Processing Graph
HW Instance:
Read Packets
Header Classifier
Write Metadata
Encapsulate Metadata
Output
Drop
SW Instance:
DPI
CHANGE GRAPH!!
DPI
Drop
Read Packets
Decapsulate Metadata
Read Metadata
DPI
Alert
Output

16. OpenBox Service Instance OpenBox Service Instance
Extensible Data Plane
Media Encoder
OpenBox
Controller
OpenBox Service Instance
Hardware
Implementation
Supports encapsulation
OpenBox Service Instance
Software
A new software module can be injected from control plane without modifying or re-deploying software in data plane

17. Scalable & Reliable Data Plane
Scalability
Provisioning
Reliability
OpenBox
Controller
Provision
OBI
OBI
OBI
OBI
OBI
OBI
OBI
OBI
OBI
OBI
OBI
OBI

18. Performance ≈ Diameter of Graph (# of classifiers)
Naïve Graph Merge
Firewall:
Read Packets
Header Classifier
Drop
Alert
Output
Concatenated Processing Graph:
Header Classifier
Drop
Alert
(IPS)
DPI
Output
Read Packets
(Firewall)
Intrusion Prevention System:
Read Packets
Header Classifier
Drop
Alert
DPI
Output
Performance ≈ Diameter of Graph (# of classifiers)

19. Shorter Diameter (less classifiers)
Graph Merge Algorithm
Merged Processing Graph:
Alert (Firewall)
DPI
Alert (Firewall)
DPI
Read Packets
Header Classifier
Alert (Firewall)
DPI
Alert (IPS)
Output
It may not always be good to merge, controller can determine when it is good
Alert (Firewall)
Drop
Shorter Diameter (less classifiers)

20. Implementation github.com/OpenBoxProject Java-based Controller
App
App
App
App
Java-based Controller
Northbound API
REST client/server
Graph Aggregator
Network Manager
Management API
REST
REST API
Generic wrapper for execution engines (Python)
Translation Engine
Click-based execution engine (C++)
TCP
Software OpenBox Service Instance

21. Performance Improvement
VM1
Firewall
VM2
IPS
Without OpenBox
VM1
OBI1: FW+IPS
VM2
OBI2: FW+IPS
With OpenBox
Standalone VM
NF Pipeline
-35%
+86%

22. Conclusions
Network functions are currently a real challenge in large scale networks
OpenBox decouples the data plane processing from network function control logic and:
Reduces costs
Enhances performance
Improves scalability
Increases reliability
Provides multi-tenancy
Allows easier innovation
OpenBox
Applications
NB API
OpenBox
Controller
OpenBox Protocol
Control Plane
Data Plane
OpenBox Service Instances

23. Questions?
Thank You!