1 service chaining for hybrid network function

1

Service Chaining for Hybrid Network FunctionHuawei Huang, Member, IEEE, Song Guo, Senior Member, IEEE, Jinsong Wu, Senior Member, IEEE,

and Jie Li, Senior Member, IEEE

Abstract—In the Service-Function-Chaining (SFC) enabled networks, various sophisticated policy-aware network functions, such asintrusion detection, access control and unified threat management, can be realized in either physical middleboxes or virtualizednetwork function (VNF) appliances. In this paper, we study the service chaining towards the hybrid SFC clouds, where both physicalappliances and VNF appliances provide services collaboratively. In such hybrid SFC networks, the challenge is how to efficiently steerthe service chains for traffic demands while matching their individual policy chains concurrently such that a utility associated with thetotal admitted traffic rate and the induced overheads can be maximized. We find such problem has not been well solved so far. To thisend, we devise a Markov Approximation (MA) based algorithm. The approximation property of the proposed algorithm is also proved.Extensive evaluation results show that the proposed MA algorithm can yield near-optimal solutions and outperform other benchmarkalgorithms significantly.

Index Terms—Service Function Chaining, Network Function, Middlebox, NFV, SDN, Traffic Steering, Markov Approximation.

F

1 INTRODUCTION

Service-Function-Chaining (SFC) [1], [2] provides simplifiedconfiguration and management such that the network ser-vice providers may flexibly realize a number of policies onsecurity, traffic engineering, access control, Quality of Ser-vice (QoS), packet modification, etc. Normally, a compositeservice policy associates with an ordered list of networkService Functions (SFs) called policy chain in this paper. Theexamples of network SF could be the traditional networkservices such as Firewall (FW), Network Address Translator(NAT), Load Balancer (LB), Deep Packet Inspection (DPI),Intrusion Detection System (IDS), as well as the application-customized functions such as HTTP header manipulation[3].

In the current steering models for service functions,the complexity of managing such policy-aware services issignificantly high. Therefore, the software-defined network-ing (SDN) [4], [5] enabled Network Function Virtualization(NFV) techniques [6]–[8] have been introduced to SFC.Although the rapidly-developed NFV has gained muchattention in recent years [9]–[13], the following facts shouldnot be ignored:

• Nearly half of all network elements (includingswitches, routers and network function appliances)are still the dedicated hardware-based middleboxes[10].

• The hardware-based dedicated middleboxes stillplay a critical role in today’s networks. For exam-ple, the ABI Research [14] forecasted that the globalenterprise network and data security market was es-timated to exceed USD $ 10 billion by 2016. It covers

Huawei Huang is a JSPS research fellow and attached to the University ofAizu, Japan. Email: [email protected] Guo (corresponding author) is with the Department of Computing, TheHong Kong Polytechnic University. Email: [email protected] Wu is with the Universidad de Chile, Chile. Email: [email protected] Li is with the University of Tsukuba, Japan. Email: [email protected]

3

5

7

1

0

2

SDN Controller

Controls all switches

A policy-chain.

FW LB

Content

NAT

Clients

…

FW1

FW2

4

6

8100 Mb/s

120 Mb/s

150 Mb/s

200

NAT2Client1

Client2

Client3

NAT1LB1

LB2

Virtual appliances

DPI2DPI1

Physical appliances

Fig. 1. An illustrative steering in a hybrid SFC network.

the secure routers, unified threat management ap-pliances, FWs, virtual private networks (VPNs), in-trusion detection/prevention systems, and networkaccess control.

• During the period of 2016-2020, Technavios analysts[15] have forecast a 11.38% CAGR (compound an-nual growth rate) for the global security appliancemarket, where the network security appliances in-clude both dedicated physical products and virtualnetwork appliances used to prevent a computer net-work from cyber attacks.

• A latest IHS Markit’s market tracker [16] has re-vealed that the revenue for data center, carrier appli-ances and virtual security appliances was USD $2.4billion in 2015, and it is set to increase 62% to USD$3.9 billion by 2020. The corresponding analysis [17]has shown that the emergence of SDN and NFV asdominant network trends is to stipulate enterpriseand service providers to seek the virtual appliancesand other software solutions.

• As further analyzed in a most latest ITProPortal

This is the author's version of an article that has been published in this journal. Changes were made to this version by the publisher prior to publication.The final version of record is available at http://dx.doi.org/10.1109/TCC.2017.2721401

Copyright (c) 2017 IEEE. Personal use is permitted. For any other purposes, permission must be obtained from the IEEE by emailing [email protected].

2

report [18], although a number of major networkequipment vendors such as Cisco have already an-nounced both support and platforms for NFV, it isunlikely for us to see a massive wholesale transitionto NFV in the near future. The reasons can be partlyattributed to: i) many network functions still rely onthe dedicated hardware, such as particular interfacecards or processors, until the Virtualized NetworkFunction (VNF) appliances running on off-the-shelf×86 hardware can catch up with the performanceof dedicated hardware appliances; ii) currently therehave been huge investments in traditional network-ing with a giant number of specialized hardwareappliances in use, making both service providersand end users reluctant to simply leap into totallyvirtualized environments at all levels of business.

Based on the facts shown above, as Sekar et al. men-tioned in [1], the foreseeable future will witness the hybridSFC networks, where the hardware-based physical networkfunction appliances and the VNF appliances coexist. It islikely that it takes time as the NFV becomes dominantin market and the investment in new dedicated hardwareplatforms declines slowly [18]. Therefore, in this paper,we focus on the steering of service chains for hybrid SFCnetworks. We will also show that our proposed approachcan be easily adapted to the pure NFV network scenarios.

In this paper, we call the traffic flow originating from aclient user a session. For example, in Fig. 1, three sessionsoriginate from Client1, Client2 and Client3, demanding 100megabits per second (Mb/s), 120 Mb/s and 150 Mb/s,respectively. Further, the flow between an Ingress/Egressswitch and an SF, or between two consecutive SFs alonga policy chain is called a segment. Typically, a segmenttransmits through a multi-hop routing path. As illustratedin Fig. 1, the segment that serves Client1, originates fromswitch 0, and traverses through links (0,2), (2,3), (3,7) and(7,8), and finally reaches the content server. In the large-scalenetworks, since the same type of SF is usually deployedwith multiple appliances at various network locations, thehardware resources such as CPU and memory cannot beamortized over all sessions easily [1], [6], [19], makingthe policy-aware appliance-selection and traffic engineer-ing critical issues in the SFC networks. For example, inthe context of SDN, the traffic engineering problems haveattracted notable research efforts [1], [7], [8], [13], [20]–[28].However, if the joint scheduling of appliance-decision andtraffic planning towards a specified set of segments hasnot been carefully performed, congestions may occur inthe overloaded appliances or bottleneck links, leading tothe high packet processing latency and the degradation ofadmitted traffic rate. Take the scheduling shown in Fig. 1 asan example. According to the shortest path scheme [21], thesession originated from Client3 will adopt the VNF appli-ances FW1 and LB1 via bottleneck link (3,7), thus resultingin congestion in this link. Therefore, in order to improve thetotal admitted traffic rate over all sessions, the congestedbottleneck link (3,7) should be avoided by reassigning thissession to the alternative VNF appliance FW2 and physicalappliance LB2 via links (3,5) and (5,6) as illustrated by thedash line in Fig. 1.

On the other hand, in the hybrid SFC networks, thephysical SF appliances and VNF appliances provide thenetwork services to consumers collaboratively. Note that, inthe perspective of service providers, the services providedby VNF appliances can be realized using virtual machines(VMs) either in the isolated proprietary cloud [29], or byrenting from NFV market, where the service vendors whoown network resources in data center are selling servicechains [12]. Since the service providers of SFC networkshave invested tremendously on the physical network func-tion appliances, the expenditure to launch and maintain theVNF appliances should be reduced as much as possible.

To this end, we are motivated to study a joint SF-applIance Determination and routing orchEstration (SIDE)problem for the hybrid SFC networks. The contributions ofour study can be summarized as follows:

• In the hybrid SFC networks, we study the SIDEproblem with the objective to maximize a weightedutility, which positively associates with the totaladmitted traffic rate over a specified set of targetsessions, negatively relates to the penalty of bothrouting and NFV market budget.

• We then design a polynomial near-optimal approxi-mation algorithm to solve the SIDE problem usingthe Markov approximation technique [30].

• Simulation results show that our proposed approachyields a close-to-optimal solution in a small-scalenetwork, and outperforms benchmark algorithmssignificantly in a Fattree datacenter network.

The remaining of the paper is organized as follows.Section 2 reviews related work. Section 3 states the systemmodel and problem definition. The proposed Markov ap-proximation based algorithm is presented in Section 4. Sec-tion 5 presents the performance evaluation results. Finally,section 6 concludes this work.

2 RELATED WORK

In recent years, the service function chaining has gainedmuch research attention. We classify the related work intothree categories.

The first category emphasizes on the routing pathscheduling with a given set of service chains, e.g., [19],[21], [31]. For instance, given a set of policy-aware trafficflows, Cao et al. [21] designed several steering algorithmsmainly finding the routing paths that visit an ordered listof network functions under SDN networks. Then, Huang etal. [31] conducted the traffic scheduling for SDN networksby only considering one type of middlebox in their systemmodel. In contrast, this paper focuses on a more practicalproblem, i.e., the steering for a hybrid service-function-chaining networks, where each user flow desires a uniquepolicy-chain consisting of a sequence of service functions.

The second category assumes that a set of pre-definedrouting paths within the network have been determined,and the placement of SF appliances is the primary concern[32]–[36]. For example, Zhang et al. [33] proposed a scalableSDN-based framework named StEERING for dynamicallyrouting traffic flows passing through the desired sequenceof network middleboxes. An algorithm that can select the



3

best locations for deploying services has been proposed.Later, given the network information and the specifiedpolicies, Liu et al. [34] investigated the middlebox place-ment problem, aiming to decide the optimal locations toplace middleboxes such that the end-to-end service delayand bandwidth occupation can be minimized simultane-ously. For minimizing the expensive optical-to-electronic-to-optical (O/E/O) conversions in the packet/optical dat-acenter networks while conducting the NFV chaining, Xiaet al. [35] proposed a heuristic algorithm that can efficientlyfind the placement solution for virtualized network func-tions such that the traversed pods by traffic flows could bereduced.

As the third category, a series of most recent work[12], [37], [38] explored the joint optimization towards thedeployment of network function appliances and the net-work resource allocation. For example, for maximizing thetotal admitted ratio for all user requests, Li et al. [38]implemented a system called NFV-RT, which can dynam-ically allocate network resources for NFV chaining. Then,a joint optimization problem associated with the applianceplacement and traffic routing was studied by Kuo et al.[37] recently. To solve it, an algorithm based on dynamicprogramming technique was proposed, dealing with trafficdemands sequentially. Finally, applying the auction mecha-nism, Gu et al. [12] designed a mechanism for NFV market,aiming to solve a social welfare maximization problem,where the provisioning of service chains in terms of allo-cating NFV resources efficiently in data center networks hasbeen carefully studied.

Via the classification of related work, we find that theexisting studies have devoted efforts to the traffic steeringproblem on either the pure middlebox based networks orthe NFV networks. The service chaining problem towardsthe hybrid network function clouds has not well been solvedso far. To the best of our knowledge, we are the first to studythis topic of interest.

3 PROBLEM STATEMENT

3.1 Background of SFCSFC is an emerging architecture under standardization con-siderations by the Internet Engineering Task Force (IETF). Itis viewed as a very useful conceptual tool that will promoteindustry move toward commercial implementation. Thegoal of SFC is to develop a set of architectural buildingblocks which enable network operators to create a servicetopology and initialize a service function path across thenetwork. Thus, SFC associates the placement of SFs, servicechain management, diagnostics and security models [39].

As illustrated in Fig. 2, the SDN based SFC architec-ture [2] mainly includes three layers: a) Management andOrchestration Layer, b) Virtualization Layer and c) PhysicalUnderlay Network Layer. In layer a), the Policy Chain De-scriptor accomplishes the task of enforcing the policy chain,and the central SFC control plane is in charge of commu-nicating with the ingress and egress nodes and locating SFnodes in the network. In layer b), a policy chain is primarilyconstituted with classifiers and SF nodes. Classifier is toidentify and then classify traffic in order to direct flowsinto a policy chain. SF node provides various network

Classifier

Control Plane / SDN Controller

Policy Chain Descriptor

SF1 SF2 SFn Classifier

End Point

Control Channels

Ph

ysical U

nd

erlay

Netw

ork

Man

agem

ent &

Orch

estration

…

Switch

(SFF)

Any topology

…

Policy Chain

End Point

Virtu

alization

Lay

er

E

Fig. 2. Architecture of SFC under the SDN-enabled cloud.

functionalities. Finally, in layer c), the underlay could be anytopology consisted of switch nodes, which are called servicefunction forwarders (SFFs) under SFC architecture.

3.2 System ModelWe consider an SDN-enabled SFC cloud network G =(V,E) with the set of SFFs V and the link set E. We denote Fthe set of all types of SFs in the network. In particular, boththe hardware-based dedicated physical middleboxes andthe VNF appliances are viewed as SF appliances (also calledinstances). Typically, we assume that service providers havealready deployed multiple appliances for each SF h ∈ F.Then, the set of all appliances of the service function his represented by Lh, in which the mth appliance of h isdenoted by h(m).

The set of all given sessions is denoted by D. For eachsession d ∈ D, network operators need to enforce the pre-defined service policy chain, which is represented by Yd, byfinding each appropriate appliance for each hop of servicefunction. For convenient formulation, we divide the policychain desired by session d ∈ D into a group of consecutivesegments, which is indicated by Gd. For example, if a policychain is shown as 〈Id, SF1, SF2, SF3, Ed〉, where Id andEd are the ingress SFF and egress SFF of d, respectively,the corresponding policy-chain segment set Gd should be〈(Id, SF1), (SF1, SF2), (SF2, SF3), (SF3, Ed)〉.

Following [40], we assume that controller pre-computesa set of candidate paths for each pair of switches. Since eachappliance is connected with a physical/virtuallized switchnode in real networks, the candidate paths for a pair ofswitches are also essentially the candidate paths for theappliance pair connected to such the pair of switches. AsFig. 3 shows, each user flow d corresponds to a uniqueservice policy chain. For each segment (h, k) ∈ Gd, networkoperator has to find a routing path for each determined SF-appliance pair (h(m), k(n)), where h(m) ∈ Lh, k(n) ∈ Lk.We use Pd

h(m),k(n), (h(m)∈Lh,k(n)∈Lk,(h,k)∈Gd,d∈D) to denotethe candidate path set for (h(m), k(n)).

The major notations used in this paper are aggregated inTable 1. With the information depicted above, we strive tosteer the service chains for the specified set of sessions.

3.3 The SIDE Problem3.3.1 Definition of VariablesWe first to define xdh(m) to indicate whether session d ∈D selects the appliance h(m) (∈ Lh) for the SF h(∈ Yd)



4

Service chain for flow d

Policy chain for

user flow d :Id

End Point 1 End Point 2

SFF SFF SFF

…

Multiple instances

for each SF

Instance

SF2

SFn

One-hop link in policy chain Multi-hop link in routing path

Ed

Id

Ed

Instance

SF1

Instance

Instance

Instance

Instance

Fig. 3. System model of service chaining.

TABLE 1Symbols and variables

Notations Description(V,E) network topology with SFF set V and link set E

F set of all type of network service functionsS set of all SF appliancesN set of all virtualized appliances of all SFsLh set of (physical & VNF) appliances of SF h ∈ FD a set of target sessions

Id/Ed ingress/egress SFF of session d ∈ D

Ydthe predefined policy chain for session d ∈ D, e.g.,a policy chain is shown as 〈Id, SF1, SF2, SF3, Ed〉

Gd set of segments in the policy chain of session d ∈ Dh(m) the mth appliance of SF h ∈ Lh

Pdh(m),k(n)

a set of candidate paths provided for the appliancepair (h(m), k(n)), (h, k) ∈ Gd, h(m) ∈ Lh, k(n) ∈ Lk

λd the demanding traffic rate of session d ∈ D

µs

the traffic processing capability of appliance s ∈ S,to physical appliances, it can be the total I/O rate;to VNF appliances, it could indicate the CPU-cyclesor power-budget of the cloud servers

re aggregated traffic rate on link e ∈ Eφe bandwidth capability of link e ∈ E|.| the size of a set within or the hop-number of a path

xdh(m)

binary variable indicating whether session d ∈ Dselects the appliance h(m) (∈ Lh, h ∈ Yd)

zd,ph(m),k(n)

binary variable indicating whether the appliancepair (h(m), k(n)) selects the candidate path

p ∈ Pdh(m),k(n)

, ∀d ∈ D

ξdbinary variable indicating whether session d ∈ D issatisfied with a feasible configuration

according to its desired policy chain:

xdh(m) =

1, if the session d selects the appliance h(m);0, otherwise.

Because every SF-appliance pair needs to select a routingpath, we then define another binary variable zd,ph(m),k(n)

to denote whether the appliance pair (h(m), k(n)) selectscandidate path p ∈ Pd

h(m),k(n) as its routing path:

zd,ph(m),k(n) =

1, if the appliance pair (h(m), k(n))

selects candidate path p for session d;0, otherwise.

Then, we define the other variable ξd to denote whethersession d ∈ D is satisfied with a feasible configuration:

ξd =

1, if a feasible configuration for d is found;0, otherwise.

3.3.2 ConstraintsThe first constraint claims that each SF in the policy chainshould select at most one SF-appliance for each session d.That is, ∑

h(m)∈Lh

xdh(m) ≤ 1,∀h ∈ Yd,∀d ∈ D. (1)

According to the policy chain of session d ∈ D, if d canbe satisfied with a feasible solution, we have:∑

h∈Yd

∑h(m)∈Lh

xdh(m) = ξd · |Yd|,∀d ∈ D, (2)

where |Yd| indicates the hop-number of SFs as well asIngress/Egress switches in the policy chain of sessiond. It can be seen that if the session d is satisfied, i.e.,ξd = 1, the total number of traversed SF-appliance(∑

h∈Yd

∑h(m)∈Lh

xdh(m)) should be equal to the number ofdesired SFs (including Id and Ed) along the policy chain ford.

Next, we shall consider the connection between any twoconsecutive policy-chain segments along a policy chain withthe goal to find a complete end-to-end routing path for eachsession. We use the following quadratic constraint (3) toachieve it.∑

h(m)∈Lh

k(n)∈Lk

∑p∈Pd

h(m),k(n)

zd,ph(m),k(n) = xdh(m) · xdk(n),

∀(h, k) ∈ Gd,∀d ∈ D.

(3)

By (3), xdh(m) · xdk(n) = 1 indicates that the SF appliancesh(m) and k(n) are determined, i.e., the SF-appliance pair(h(m), k(n)) exists. Thus, we need to choose one rout-ing path for this pair from the given candidate path setPdh(m),k(n).

In the physical data forwarding network, the aggregatedtraffic rate on each link e ∈ p(p∈Pd

h(m),k(n)) can be calculated

as:

re =∑d∈D

∑(h,k)∈Gd

∑h(m)∈Lh

k(n)∈Lk

∑p∈Pd

h(m),k(n)

zd,ph(m),k(n) · λd. (4)

Finally, the following two constraints specify that thelink bandwidth capability and appliance processing capabil-ity should not be exceeded. Note that, the formulation andour solution can be extended to versions under consideringthe multiple dimensional resources allocation, e.g., memoryand storage.

re ≤ φe,∀e ∈ E. (5)∑d∈D

xdh(m) · λd ≤ µh(m),∀h(m) ∈ Lh, ∀h ∈ F. (6)

3.3.3 Two-Term PenaltyWe consider a two-term penalty when we conduct the SFCin hybrid NFV networks.

Although the adoption of NFV techniques bring theflexible management, the cost to utilize the VNF appliancesshould be taken into account. Such cost can be measuredwith the expenditure that is charged by i) the budget forgeneral hardware (such as CPU, memory, storage) and



5

power consumption in the proprietary could servers, or ii)the rental spending from NFV market. We refer this termof penalty to the VNF overhead, when provisioning servicechains with the VNF appliances. Without loss of generality,we assume that the VNF overhead is proportional to therequired rate of traffic demand. Therefore, we can computethe VNF overhead as the following:

∆ =∑d∈D

∑h∈Yd

∑h(m)∈N

xdh(m) · λd. (7)

On the other hand, when conducting the traffic engineer-ing in SDN networks, the forwarding table space is the crit-ical resource due to the limited size in each high speed SDNswitch. Thus, the consumption of forwarding table space, aswell the configuration cost in SFFs should be also consideredin our SDN-based SFC networks. And we call such term ofconsumption related to SFF the routing cost. Note that, whenwe find the routing paths for an end-to-end policy chain,the routing cost is naturally assumed proportional to thenumber of traversed SFFs along the selected routing pathsfor all segments. Therefore, the second term of penalty canbe calculated as:

Ω =∑d∈D

∑(h,k)∈Gd

∑h(m)∈Lh

k(n)∈Lk

∑p∈Pd

h(m),k(n)

zd,ph(m),k(n) · |p|, (8)

where |p| indicates the hop-number of SFFs in the candidatepath p.

3.3.4 Utility MaximizationBasically, the SFC network operators always prefer to im-prove the overall admitted traffic rate by performing trafficengineering techniques [24]. On the other hand, the afore-mentioned two-term penalty need to be reduced simultane-ously. Finally, we formulate the SIDE problem as the follow-ing cost-efficient utility maximization problem using IntegerProgramming with Quadratic Constraints (IPQC), such thatthe joint utility U associated with admitted traffic rate andthe aforementioned two-term penalty is maximized.

SIDE : maxU =∑d∈D

λd · ξd − ν ·∆− ω · Ω

s.t. (1), (2), (3), (5) and (6).(9)

Note that, the term∑

d∈D λd · ξd calculates the totaladmitted traffic rate of all the satisfied sessions. The ν and ωin (9) represent the weight of the VNF overhead ∆ and routingcost Ω, respectively. The two weight parameters can be tunedfreely to indicate different penalty scales. Furthermore, aswe have mentioned that our formulation can be simplyshifted into the version that adapts to the total pure NFVenvironment just by enforcing S = N.

4 MARKOV APPROXIMATION BASED ALGORITHM

4.1 Insight of Applying Markov Approximation

Solely the traffic engineering problem with link capacityconstraints in the SIDE problem is essentially the multi-commodity flow problem [41], which is known as NP-complete[42], [43]. The appliance-selection makes this problem evenharder.

Since there is no computationally efficient solution in acentralized manner, we attempt to design a fast polynomialapproximation algorithm that solves the problem applyingthe framework of Markov Approximation (MA) [30], whichis a very efficient approach to solve the combinatorial op-timization problem. The most important characteristic ofsuch combinatorial optimization problem is that the localindividual decisions for each entity in the network composethe global solution of overall system. In our problem, thelocal decisions for each session include the selections of ap-pliance and routing path, and all local decisions construct aglobal solution for the entire hybrid SFC network. Therefore,we find that the proposed SIDE problem is essentially acombinatorial optimization problem.

In the following, we specify the two steps to designour Markov approximation based algorithm: the design ofMarkov-chain and its implementation.

4.2 Markov Chain Design

We let fXZ (shorten as f ) denote a feasible configura-tion of SIDE problem, i.e., f , xdh(m), z

d,ph(m),k(n),∀p ∈

Pdh(m),k(n),∀h(m) ∈ Lh,∀k(n) ∈ Lk,∀(h, k) ∈ Gd,∀d ∈ D,

and let F denote the set of all feasible configurations. Fur-ther, we also denote Uf as the system utility correspondingto a given configuration f . To better understand the log-sum-exp approximation, we let each configuration f ∈ Fassociate with a probability pf , which indicates the portionof time that the configuration f is in use. We then use p∗f∈Fto indicate the optimal probability solution for configura-tion f ∈ F . Then, applying the approximation frameworkproposed in [30], we have:

p∗f =exp(βUf )∑

f ′∈F exp(βUf ′ ),∀f ∈ F . (10)

where β is a positive constant and related to approximationperformance.

Now we design a Markov-Chain (shorten as MC) basedapproximate algorithm with a state space F of all feasibleconfigurations and a stationary distribution shown as p∗f in(10). In the implemented MC, if the transitions among statescan be tuned converging to the desired stationary distribu-tion p∗f , system can achieve near-optimal performance [30].

4.2.1 State-Space Structure

To construct a time-reversible MC with stationary distribu-tion p∗f , as illustrated in Fig. 4, we first let fXZ ∈ F denotea state in MC. Particularly, when any in-use appliance ofany SF is swapped, we say the system configuration transitsto fX′Z′ ∈ F from fXZ with the nonnegative transitionrate qff ′ . It should be noticed that, in the transition fXZ →fX′Z′ , the associated two in-use segment routing paths alsoneed to be changed. To each transition, the following twoconditions must be ensured: (a) in the constructed MC, anytwo states are reachable from each other, and (b) the detailedbalance equations [44] must be satisfied: p∗fqff ′ = p∗f ′qf ′f ,∀f, f ′ ∈ F , where f denotes fXZ , and f ′ indicates fX′Z′ .Based on the constructed state-space structure, we thenspecify the transition-matrix design.



6

fXZ...fX’Z’

f f ’ : Transition by swapping any SF-instance.

qf f ’...

Fig. 4. Transition between two adjacent states.

InitializationSets &

triggers a timer

Transits &

sends RESET signal

If a RESET signal

is received.

Timer counts

down to 0.

mer sen

Sets &

Jumps back

Fig. 5. The state machine of each session demonstrated for understand-ing algorithm 1.

4.2.2 Transition-Matrix DesignIn our design, with respect to variable xdh(m), i.e., the SF-appliance decision, we let the transition rate qff ′ be positivelycorrelated to the difference of system utilities under config-urations fXZ and fX′Z′ . That is:

qff ′ = exp(1

2β(UfX′Z′ − UfXZ

)− τ), (11)

where τ is a conditional non-negative constant. We canobserve that when UfX′Z′ − UfXZ

> 0, meaning that theperformance gap between fX′Z′ and fXZ increases, thetransition rate qff ′ will grow, and vice versa. Therefore, suchtransition rate designed in (11) is likely to lead the systemto a configuration with higher system utility.

4.3 Implementation of MC Guided Algorithm

The implementation based on our designed MC is shownas Alg. 1. Before execute Alg. 1, controller initializes adedicated computing thread for each session. Each threadfollows a general state machine shown as Fig. 5. Note that,all computing threads can execute on an SDN controller oron multiple logically centralized controllers. In particular,Alg. 1 is the main frame, which invokes two other support-ing algorithms, i.e., Alg. 2 and Alg. 3. The procedures ofAlg. 1, and the supporting algorithms as well are explainedas follows.

Initialization (Algorithm 2): If never find an appliancefor an SF h ∈ Yd, in line 3, computing thread randomlyselects a feasible appliance h(m) that satisfies resource con-straints (such as processing capability) from Lh. Then, asshown in line 8, a feasible routing path p is randomly pickedup from the candidate path set Pd

h(m),k(n) for the appliancepair (h(m), k(n)).

SetTimer (Algorithm 3): Suppose that m is the in-useappliance-index of SF h ∈ Yd. Firstly, thread checks thenumber of feasible not-in-use appliances for h, i.e., |σd

h|.If there is at least one feasible not-in-use appliance for h,the computing thread randomly selects a feasible one, theindex of which is denoted by m′. Then, computing threadneed to find two new paths if the appliance indicated bym′ is adopted. As shown in line 5 and line 7, two setof not-in-use candidate paths for the target appliance pair(g(l), h(m′)) and (h(m′), k(n)) are found, respectively. If at

Algorithm 1 Markov-Chain based Algorithm to solve SIDE1: execute Initialization (Alg. 2) for the entire system2: for ∀h ∈ Yd − Id, Ed,∀d ∈ D do3: SetTimer(h) by invoking Alg. 34: end for5: while system is running do6: /*Procedure Transition*/7: if T d

h expires then8: xdh(m) ← 0, xdh(m′) ← 1

9: zd,pg(l),h(m) ← 0, zd,p′

g(l),h(m′) ← 1

10: zd,ph(m),k(n) ← 0, zd,p′′

h(m′),k(n) ← 111: repeat SetTimer(h) invoking Alg. 312: send RESET(UfX′Z′ , d, h) signal to controller13: end if14: /*Procedure RESET*/15: if a RESET(Uf ′ , d, h) signal is received then16: UfX′Z′ ← Uf ′

17: refresh and start other timers T dh (∀d ∈ D\d,∀h ∈

Yd\Id, Ed, h) by invoking (12)18: end if19: end while

Algorithm 2 Initialization

Input: Pdh(m),k(n)|∀h(m)∈Lh,∀k(n)∈Lk,∀d∈D

Output: xdh(m), zd,ph(m),k(n)|∀h(m)∈Lh,∀k(n)∈Lk,∀(h,k)∈Gd,∀d∈D

1: for ∀h ∈ Yd,∀d ∈ D do2: if never find an appliance for SF h then3: xdh(m) ← 1, h(m) is randomly selected from Lh

4: end if5: end for6: for ∀(h, k) ∈ Gd,∀d ∈ D do7: if xdh(m) = 1 and xdk(n) = 1 then8: zd,ph(m),k(n) ← 1, where the feasible p is randomly

chosen from Pdh(m),k(n)

9: end if10: end for

least one candidate path is available in the two path sets(%dg(l),h(m′) and %dh(m′),k(n)) simultaneously, two new pathsp′ and p′′ will be randomly picked up, respectively. Next,line 12 computes the current system utility UfXZ

, while line13 calculates the “next” system utility UfX′Z′ if the newlyselected appliance as well as the routing paths are adoptedas m ← m′, p ← p′, p ← p′′. After this, an exponentiallydistributed random timer is generated independently witha mean value equal to (12), and begins to count down.

Transition: When the timer T dh expires, the dedicated

computing thread adopts the scheduled “next” applianceand the associated two paths that connect to the newappliance, according to line 7 to line 10. Next, the com-puting thread sets a timer for SF h again. Then, sendsRESET(UfX′Z′ , d, h) signal to controller for notifying suchswapping event with the updated system utility UfX′Z′ .

RESET: When controller receives a RESET(Uf ′ , d, h) sig-nal (line 15), which indicates SF h of session d has justswapped an appliance and yielded the new system utilityUf ′ . Then, as shown from line 16 to line 17, controllerrefreshes the timers T d

h (∀d ∈ D\d,∀h ∈ Yd\Id, Ed, h)



7

Algorithm 3 SetTimer for an SFInput: h|h∈Yd\Id,Ed,d∈DOutput: T d

h , m,m′, g(l), p, p′, k(n), p, p′′

1: m← current in-use appliance-index for SF h ∈ Yd

2: σdh ← feasible not-in-use appliance-indices for h

3: if |σdh| ≥ 1 then

4: m′ ← one appliance-index randomly selected from σhd

5: %dg(l),h(m′) ← all feasible not-in-use candidate pathsfor appliance pair (g(l), h(m′)) from Pd

g(l),h(m′), whereg(l)← arg(zdg(l),h(m) = 1), (g, h) ∈ Gd, g(l) ∈ Lg

6: p← current in-use path for (g(l), h(m))7: %dh(m′),k(n) ← all feasible not-in-use candidate paths

for appliance pair (h(m′), k(n)) from Pdh(m′),k(n),

where k(n) ← arg(zdh(m),k(n) = 1), (h, k) ∈Gd, k(n) ∈ Lk

8: p← current in-use path for (h(m), k(n))9: if |%dg(l),h(m′)| ≥ 1 and |%dh(m′),k(n)| ≥ 1 then

10: randomly select p′ ∈ %dg(l),h(m′)

11: randomly select p′′ ∈ %dh(m′),k(n)

12: UfXZ← U |m,p,p

13: UfX

′Z

′ ← U |m←m′,p←p′,p←p′′

14: generate a random exponentially distributed timerT dh for h with mean equal to

1

|σdh|

exp(τ − 1


)), (12)

and begin to count down15: end if16: end if

according to (12) with the updated Uf ′ and begins countingthem down.

Since Algorithm 1 contains several auxiliary algorithms,we can know its overall computing complexity if that ofeach supporting procedure or auxiliary algorithm is given.We then have the following results on the computing com-plexity of Algorithm 1.

Remark 1. In Algorithm 1, the computing complexity of Ini-tialization (Alg. 2), SetTimer (Alg. 3), Procedure RESET isO(∑

d∈D(|Yd|+ |Gd|)), O(∑

d∈D |Yd|), and O(∑

d∈D |Yd|),respectively.

Theorem 1. If there is no approximation error, Algorithm 1realizes a time-reversible Markov chain with the stationarydistribution shown in (10).

Proof: By the two conditions for constructing the statespace of the designed Markov chain, we see that all con-figurations can reach each other within a finite number oftransitions in terms of swapping in-use appliances. Therefore,the constructed MC is an ergodic Markov chain. In thefollowing proof, we show that the stationary distributionof the constructed Markov chain exactly follows equation(10).

By (12), we know that the waiting time of each con-figuration is exponentially distributed and the transitionprobability between different configurations is independentof time. Therefore, the states space that is represented by thetransition, and the corresponding transition rate between

any adjacent states compose a homogeneous continuous-time Markov chain.

Let Prf→f ′ (f, f′ ∈ F ) denote the probability that

system will transit to the state f′

when any timer T dh counts

down to zero. We also define Sf to represent the set ofneighbouring states with one-hop transition to the statef ∈ F . In order to compute Prf→f ′ , we have to know thesize of Sf , which is derived corresponding to the transition.From the timer setting in Algorithm 3, we know that the nextstate of the current configuration f has equal probability tobe any state f

′ ∈ Sf based on the following fact: whenthe computing thread selects the next feasible not-in-useappliance for the SF h ∈ Yd, there are |σd

h|(d∈D) choices.In consequence, we can calculate the size of state space Sf

as:|Sf | =

∑d∈D

∑h∈Yd

|σdh|.

Now, we can compute the probability Prf→f ′ in theway:

Prf→f ′ =1

|Sf |,∀f ∈ F ,∀f

′∈ Sf .

In the next step, we show that the state transition ratefrom f to f

′, i.e., qff ′ , satisfies (11) when f

′denotes fX′Z′ .

Given a current state fXZ , according to (12), each timerT dh (∀h ∈ Yd, d ∈ D) counts down with a rate:

ρdh = |σdh| exp(

1


)− τ). (13)

Therefore, system leaves state fXZ then enters to state fX′Z′

with the rate:

ρfXZ ,fX′Z′ =∑d∈D

∑h∈Yd

ρdh. (14)

With probability Prf→f ′ , system transits to a one-hopconnected neighbouring configuration f

′when leaving the

current configuration f . Therefore, we compute the transi-tion rate from f to f

′as follows:

qf,f ′ |(f=fXZ ,f ′=fX′Z′ ) = ρf,f ′ × Prf→f ′

=∑d∈D

∑h∈Yd

|σdh| exp(

1


)− τ)

· 1∑d∈D

∑h∈Yd

|σdh|

= exp(1


)− τ).

(15)

Finally, via combining (15) and (10), we can obtain thatp∗fqff ′ = p∗

f ′ qf ′f ,∀f, f′ ∈ F , i.e., the detailed balance equa-

tions hold in our designed MC. According to [44], the con-structed Markov chain is time-reversible and its stationarydistribution follows (10).

5 PERFORMANCE EVALUATION

To evaluate the performance of the proposed algorithm,this section presents the numerical simulations, which areconducted by a simulator implemented in Python. All al-gorithms are also realized in Python and executed on aWindows 64-bit computer with 8 Gigabytes (GB) RAM.



8

0 1 2

x 10−4

200

400

600

800

1000U

tility

Logical time (seconds)

OptimalMAMA(z)

(a) System utility

0 1 2

x 10−4

40

60

80

100

120

140

160

180

Ro

uti

ng

co

st


Optimal

MA

MA(z)

(b) Routing cost

0 1 2

x 10−4

0

100

200

300

400

VN

F o

verh

ead


OptimalMAMA(z)

(c) VNF overhead

Fig. 6. Performance comparison between the MA-based algorithms and the optimal solution under the Internet2 topology, where 6 physical and 6VNF appliances are deployed, φe∈E =2000 Mb/s, ν=1, ω=0.2, µs∈S=1000 Mb/s, 617 candidate paths are provided, with 9 traffic demands requiringa 3-hop service policy chain each.

6 7

8 9

10 11

12 13

14 15

16 17

18 19

20

22

21

23

2524

1 2 3 4 5

Aggregation

switches

Core

switches

Hosts,

SF-appliances

… … … … … … … … … …

Fig. 7. The Fat-tree topology used in the second group of simulations,where in total 900 candidate paths are provided for segment routing.

5.1 Simulation Settings

5.1.1 Settings for the first group of simulations

To show how close of performance of our proposed MAalgorithm to that of the optimal solution, a set of small-scalesimulations are first studied under the Internet2 topology[45], which is also shown in Fig. 1. In this suite of simula-tions, three types of SFs, i.e., NAT, FW and LB, are deployedin such network with 2 physical and 2 virtualized appliancesfor each type. In particular, the virtualized-appliance pairs(NAT1, LB1), (NAT4, FW4) and (LB3, FW3) simultaneouslyconnect to switches 2, 3 and 5, respectively. For routing,in total 617 candidate paths are provided for connectingsegments.

In addition, denoted by Optimal, the optimal solutionsare solved using the Gurobi 6.0 optimizer [46], which em-beds in many classical solvers including linear program-ming solver, quadratically constrained programming solverand mixed-integer linear programming solver. The solversin the Gurobi Optimizer are designed from the ground upto exploit modern architectures and multi-core processors,using the most advanced implementations of the latestalgorithms. It is worth noting that, the optimal solutionscan be only obtained in a small-scale simulation due to thehigh computing complexity of SIDE problem.

5.1.2 Settings for the second group of simulations

Then, another set of simulations are conducted using aFattree topology (shown as Fig. 7), which consists of 25nodes and 45 bidirectional links. As shown in Fig. 7, theset of aggregation switches with IDs 8, 9, 12, 13, 16, 17, 20,21, 24 and 25, serve as the ingress/Egress switches, which

directly connect to a number of hosts and SF-appliances(in either physical or virtualized). We specify five types ofSF: NAT, FW, LB, DPI and IDS, to construct the individualpolicy chain for each session. Without loss of generalities,the sequence of such 5 SFs in each policy chain is randomlygenerated. For each type of SF, 10 physical and 10 virtual-ized appliances are launched. Finally, 100 SF-appliances areaveragely distributed in the bottom of this topology. Thetraffic processing capability of each appliance is set to 1000Mb/s by default. We then generate several suites of trafficdemand trace with the rate of each session normalized to100 Mb/s. On the other hand, we provide each pair ofingress/Egress switches with 10 different candidate paths.Thus, 900 candidate paths in total are provided for thesegment routing.

5.1.3 Metrics consideredTo evaluate the performance of algorithms, we collect mul-tiple system metrics including the numerical system utility,routing cost, VNF overhead, Admitted Traffic Rate (ATR), andadmission ratio as well in simulations.

5.2 Representative Executions comparing with Opti-mal

We first to study the optimality-approximation propertyof the proposed algorithm via demonstrating the repre-sentative executions under the aforementioned Internet2topology. We also realize another version of MA algo-rithm as a benchmark, in which the transition is onlytriggered by the path-swapping, i.e., the change of vari-able zd,ph(m),k(n)(∀d, p, h(m), k(n)). We denote this version byMA(z). In the first group of simulations, the link capacityand the processing capability of appliances are set to 2000Mb/s and 1000 Mb/s, respectively. For Alg. 1, ν, ω, β andτ are set to 1, 0.2, 10 and 0, respectively. We then executealgorithms in 200 iterations, each of which consumes 1microsecond (1e-6 second) in logical time. Therefore, thetotal observation duration is 0.2 millisecond.

In Fig. 6, 6(a), 6(b) and 6(c) show the performance interms of utility, routing cost and VNF overhead, respectively.It can be observed that MA quickly converges to the Optimalat the 41 µs in terms of all metrics. Interestingly, althoughMA outperforms MA(z) significantly with respect to bothutility and VNF overhead, its performance in terms of routing



9

0 200 400 600 800 1000 1200

0

500

1000

1500

2000

2500

Util

ity

Iteration number

GA, CR=0.3, MR=0.01GA, CR=0.5, MR=0.05GA, CR=0.8, MR=0.1MA

0 50 100

0500

10001500

(a) System utility

0 200 400 600 800 1000 1200400

600

800

1000

1200

1400

1600

1800

Rou

ting

cost

Iteration number


0 50 100500

1000

(b) Routing cost

0 200 400 600 800 1000 12000

500

1000

1500

VN

F ov

erhe

ad

Iteration number


0 50 1000

500

1000

(c) VNF overhead

Fig. 8. Representative execution of algorithms under the Fattree topology, where φe∈E =20000 Mb/s, ν=1, ω=0.25, µs∈S=1000 Mb/s, 900 candidatepaths are provided, with 20 traffic demands requiring a 4-hop service policy chain each.

0 500 1000 1500 2000−5000

0

5000

Util

ity

Iteration number


0 50 100−1000

0

1000

2000

(a) System utility

0 500 1000 1500 2000

1000

1500

2000

2500

3000

3500

4000

4500R

outin

g co

st

Iteration number


0 50 1001500

2000

2500

3000

3500

(b) Routing cost

0 500 1000 1500 20000

500

1000

1500

2000

2500

3000

3500

VN

F ov

erhe

ad

Iteration number


0 50 1001000

1500

2000

2500

(c) VNF overhead


0 1000 2000 3000 4000 5000−10000

−5000

0

5000

Util

ity

Iteration number


0 20 40 60 80 100

−1000

0

1000

2000

(a) System utility

0 1000 2000 3000 4000 5000

2000

4000

6000

8000

10000

Rou

ting

cost

Iteration number


0 50 1004000

5000

6000

(b) Routing cost

0 1000 2000 3000 4000 50000

2000

4000

6000

8000V

NF

over

head

Iteration number


0 50 1003000

4000

5000

6000

(c) VNF overhead


cost shows similar to that of MA(z). Thus we can infer thatduring the decision of SF-appliance in Alg. 1, the candidatepaths inducing lower routing cost are also preferred to beselected automatically. However, MA(z) only swaps routingpath rather than SF-appliance, the VNF overhead does notchange at all time. Because the traffic processing capabilityof physical appliances is sufficient, the VNF overhead of MAalgorithm approaches to 0, same as Optimal shows.

5.3 Comparison with Genetic Algorithm

With the Fattree topology (Fig. 7), we then compare theperformance of the proposed MA algorithm with Genetic-based Algorithm (shorten as GA), which has been adoptby [9], [11], [32] to deploy service chains in NFV networks.In particular, the framework of the conventional GA isexpressed with Algorithm 4.

5.3.1 The framework of conventional genetic algorithm

In line 1 of Algorithm 4, we first to generate a group of initialpopulation, which is consisted of N random chromosomes.In the while loop, as shown in lines 4-6, algorithm conductsthe crossover operations on two chromosomes Ca and Cb

randomly selected from the population. As a result, two newchromosomes C ′a and C ′b are generated.

Then, in lines 8-10, algorithm performs mutation oper-ations over C ′a and C ′b, and yields two other new chromo-somes C ′′a and C ′′b . In each crossover or mutation operation,algorithm will adopt the new chromosome if it indicateshigher fitness value (utility).

After several rounds of execution, the update towardsthe holistic population will produce a group of chromo-somes that are with high fitness values.



10

3300 3600 4000 4300 46000

0.2

0.4

0.6

0.8

1C

DF

Utility

|policy chain| =3 |policy chain| =4 |policy chain| =5

(a) CDF of utility in the final convergedsolutions

200 400 600 800 1000 12000

0.2

0.4

0.6

0.8

1

CD

F

Routing cost


(b) CDF of routing cost in the final con-verged solutions

0 50 100 150 200 250 3000

0.2

0.4

0.6

0.8

1

CD

F

VNF overhead


(c) CDF of VNF overhead in the finalconverged solutions

Fig. 11. CDF of metrics in the final converged solutions of the proposed algorithm, while varying Policy-Chain Length under the Fattree topology,where φe∈E =20000 Mb/s, ν=1, ω=0.25, µs∈S=1000 Mb/s, 900 candidate paths are provided, with 100 traffic demands requiring a 3,4,5-hopservice policy chain each.

−1000 0 2000 40000

0.2

0.4

0.6

0.8

1

CD

F

Utility


(a) CDF of utility during 1500-iterations

500 1000 2000 3000 40000

0.2

0.4

0.6

0.8

1

CD

F

Routing cost


(b) CDF of routing cost during 1500-iterations

0 1000 2000 30000

0.2

0.4

0.6

0.8

1

CD

F

VNF overhead


(c) CDF of VNF overhead during1500-iterations

Fig. 12. CDF of metrics during the first 1500-iterations execution of the proposed algorithm while varying Policy-Chain Length under the Fattreetopology.

Algorithm 4 Framework of Conventional GAInput: Φ (the maximum number of execution rounds)

1: initialize a population G = C1, C2, ..., CN, which iscomposed of N chromosomes; round = 0;

2: while round ≤ Φ do3: randomly choose two chromosomes Ca and Cb;4: conduct crossover over Ca and Cb, and generate two

new chromosomes C ′a and C ′b;5: compute the fitness of the new chromosomes;6: replace Ca (Cb) with C ′a (C ′b), if the new one returns a

larger fitness value;7: C ′a, C

′b ← two remaining chromosomes after perform-

ing crossovers;8: conduct mutation for C ′a and C ′b, and generate other

two new ones C ′′a and C ′′b ;9: compute the fitness of the two new chromosomes;

10: replace C ′a (C ′b) with C ′′a (C ′′b ), if the new one has alarger fitness value;

11: round++;12: end while

5.3.2 Parameter settings for GA

In our implementation of such GA, each chromosome in-dicates the appliance selection solution for all traffic de-mands. Varying the combination of Crossing Rate (CR) andMutation Rate (MR) of chromosomes in GA within the set(CR, MR): (0.3, 0.01); (0.5, 0.05); (0.8, 0.1), we evaluate the

performance of GA with a population consisting of N=50chromosomes. Similar to our proposed MA algorithm, eachiteration in GA indicates a random number of appliance-swapping towards any traffic demand with equal prob-ability. The routing path for any segment is also chosenrandomly from the given candidate path set, once a pairof appliances has been determined.

5.3.3 Discussion of simulation resultsBy fixing φe∈E =20000 Mb/s, µs∈S =1000 Mb/s, ν = 1and ω = 0.25, Figs. 8, 9 and 10 demonstrate the repre-sentative execution results of GA and MA algorithm underthe number of traffic demand varying from 20, 50, 100,respectively. We can see that the utilities of all versions ofGA and MA algorithm have an improvement in the firstfew iterations. Correspondingly, both routing cost and VNFoverhead reduce quickly during the initial stage. AlthoughGA performs better than MA algorithm in the first 10-20iterations, it illustrates a very slow improvement after that.On the contrary, the performance of MA outperforms that ofGA in a very fast pace and achieves convergence eventually.For example, the utility of MA i) grows higher than thatof the versions of GA at the 12nd, 20th and 15th iterations,and ii) converges at the 310th, 880th and 2800th iterations,in the executions with 20, 50 and 100 traffic demands,respectively. We can further observe that the execution withmore traffic demands yields a longer convergence. Notethat, the logical execution time of MA algorithm is stillfixed to 1 µs. Therefore, even if with 100 traffic demands,



11

0 500 1000 1500

0

1000

2000

3000

4000U

tili

ty

Iteration number

MA, µs

= 5000

MA, µs

= 2000

MA, µs

= 500

MA, µs

= 400

MA, µs

= 300

MA, µs

= 200

(a) Utility

0 500 1000 1500

1000

1500

2000

2500

Ro

uti

ng

co

st

Iteration number

MA, µs

= 5000

MA, µs

= 2000

MA, µs

= 500

MA, µs

= 400

MA, µs

= 300

MA, µs

= 200

0 100 200

1000

2000

(b) Routing cost

0 500 1000 1500

500

1000

1500

2000

VN

F o

verh

ead

Iteration number

MA, µs

= 5000

MA, µs

= 2000

MA, µs

= 500

MA, µs

= 400

MA, µs

= 300

MA, µs

= 200

(c) VNF overhead

200 300 400 500 2000 50002000300040005000

AT

R

µs

200 300 400 500 2000 50000

0.5

1

Adm

issi

on r

atio

µs

(d) Average admitted traffic rate (Mb/s) and Admis-sion ratio

Fig. 13. Representative executions of algorithms under the Fattree topology, with 50 traffic demands requiring a 3-hop policy chain each.

the logical convergence time of MA algorithm is only 2.8ms. On the other hand, the metrics in terms of routing costand VNF overhead show the similar-converging but converseperformance comparing with utility under all algorithms.

5.4 Effect of Policy-Chain LengthUnder the almost same parameter settings with the suiteof simulations shown in Fig. 9, we study the effect of thelength of policy chain, by varying it for all traffic demandswithin 3, 4, 5. Particularly, we conduct 20 execution cases,each of which lasts for 1500 iteration under each setting.With the traced final converged solutions, we let Figs. 11(a),11(b) and 11(c) show the cumulative distribution function(CDF) of metrics in terms of utility, routing cost and VNFoverhead, respectively. It can be apparently observed thatthe utility shows as a decreasing function versus the lengthof policy chain, because the two terms of cost/overheadare increasing functions versus the policy-chain length. Forexample, as Fig. 11 shows, only 10% of all recorded utilitiesare lower than 4000 when the policy-chain length is 4.However, the percentages with policy-chain length 3 and5 are 100% and 5%, respectively. The reasons behind this areapparent: longer policy chain makes each traffic demandrequire more SF-appliances, and consume more bandwidthresource in the network links, thus resulting in higher VNFoverheads and routing costs. As shown in 11(b) and 11(c),we observe that the CDFs of the two terms of cost/overheadillustrate the similar but converse performance comparingwith utility.

Then, Fig. 12 demonstrates the CDFs of all recordedmetrics over all the 1500 iterations traced, and shows thesimilar performance of the three metrics as Fig. 11 hasshown. The explanation is also same and thus omitted here.

5.5 Effect of the Capability of SF-appliance

Note that, we do not show the performance of ATR andadmission ratio of each algorithm in the previous groupsof simulation, because the capacity of both appliance andnetwork link are sufficient. In this group of simulation, weevaluate the effect of the capacity of SF-appliance by varyingit within the range 200, 300, 400, 500, 2000, 5000Mb/s.

Under the almost same parameter settings with previoussimulations but with 50 traffic demands, each of whichdesires a 3-hop policy-chain, we study all the metrics duringthe 1500-iteration executions. Under varying settings ofappliance capability, Fig. 13(a), 13(b) and 13(c) still demon-strate the corresponding utilities, routing costs and VNFoverheads, respectively. In particular, Fig. 13(d) shows theaverage ATR and admission ratio performance under eachappliance capability.

From this suite of figures, we can clearly observe thati) higher appliance capability induces higher utility, ATRand admission ratio, and lower VNF overhead; ii) the per-formance under the sufficient appliance capability settingsshows similar; iii) the performance under the insufficient ap-pliance capability settings is hard to converge. For example,the executions when µs is equal to or higher than 500 Mb/s



12

have the similar outstanding performance in terms of allmetrics. But the other cases exhibit more severe fluctuationswith respect to utility and VNF overhead, when µs variesfrom 400 to 200. Interestingly, as 13(b) shows, the routingcosts under sufficient settings of appliance capability per-form almost the same. But, the cases under µs =300 andµs =200 are exceptions. The reason can be attributed tothat the admission ratio under such two cases are very low,leading to lower requirement of network link resources. Asa result, the final routing cost can be quickly converged,especially when µs = 200, comparing with other cases.

6 CONCLUSION AND FUTURE WORK

In this paper, we have studied a service chain steering prob-lem for hybrid SFC networks, where the traffic demandsare provisioned by both physical and virtualized networkfunction appliances. Then, a utility-maximization problemhas been formulated. To solve it, we have designed anapproximation algorithm using the Markov approximationtechnique. The approximation property of the proposedalgorithm also has been proved. Extensive numerical simu-lation results have revealed that the proposed MA algorithmcould yield close-to-optimal solutions and outperform otherbenchmark algorithms significantly in terms of utility. Sincethe hybrid SFC networks have intensive correlation withdata processing [47]–[49] in the era of big data, we plan toapply the proposed approach to meaningful big data basedservice provisions in our future work.

ACKNOWLEDGEMENT

This work was partially supported by JSPS KAK-ENHI under Grant Number 16J07062; CONICYT FONDEFID16i10466, “Cloud-based Automated Telemetric Cyber-physical Platform for Monitoring, Control, and Protec-tion of Maritime Resources using Data Analysis and Pro-cessing for Event Prediction”; and ERANet LAC ProjectELAC2015/T10-0761, “Enabling REsilient urban TRAns-portation systems in smart CiTes, (RETRACT)”.

REFERENCES

[1] V. Sekar, N. Egi, S. Ratnasamy, M. K. Reiter, and G. Shi, “Designand implementation of a consolidated middlebox architecture,” inProceedings of the 9th USENIX conference on NSDI, 2012, pp. 24–24.

[2] J. Halpern and C. Pignataro, “Service function chaining (sfc)architecture,” IETF, Tech. Rep., 2015.

[3] H. Hata, “A study of requirements for sdn switch platform,” inInternational Symposium on Intelligent Signal Processing and Commu-nications Systems (ISPACS), 2013, pp. 79–84.

[4] H. Huang, S. Guo, W. Liang, K. Li, B. Ye, and W. Zhuang, “Near-optimal routing protection for in-band software-defined heteroge-neous networks,” IEEE Journal on Selected Areas in Communications,vol. 34, no. 11, pp. 2918–2934, 2016.

[5] H. Huang, S. Guo, P. Li, W. Liang, and A. Y. Zomaya, “Costminimization for rule caching in software defined networking,”IEEE Transactions on Parallel and Distributed Systems, vol. 27, no. 4,pp. 1007–1016, 2016.

[6] Z. Xu, W. Liang, H. Meitian, J. Mike, and S. Guo, “Approxima-tion and online algorithms for nfv-enabled multicasting in sdns,”in IEEE International Conference on Distributed Computing Systems(ICDCS), June 2017.

[7] M. Huang, W. Liang, Z. Xu, M. Jia, and S. Guo, “Throughputmaximization in software-defined networks with consolidatedmiddleboxes,” in IEEE 41st Conference on Local Computer Networks(LCN), 2016, pp. 298–306.

[8] M. Huang, W. Liang, Z. Xu, W. Xu, S. Guo, and Y. Xu, “Dynamicrouting for network throughput maximization in software-definednetworks,” in 35th Annual IEEE International Conference on Com-puter Communications (INFOCOM), 2016.

[9] M. Yoshida, W. Shen, T. Kawabata, K. Minato, and W. Imajuku,“Morsa: A multi-objective resource scheduling algorithm for nfvinfrastructure,” in 16th Asia-Pacific Network Operations and Manage-ment Symposium (APNOMS), 2014, pp. 1–6.

[10] M. Bari, S. R. Chowdhury, R. Ahmed, R. Boutaba et al., “Onorchestrating virtual network functions in nfv,” arXiv preprintarXiv:1503.06377, 2015.

[11] F. Carpio, S. Dhahri, and A. Jukan, “Vnf placement withreplication for load balancing in nfv networks,” arXiv preprintarXiv:1610.08266, 2016.

[12] S. Gu, Z. Li, C. Wu, and C. Huang, “An efficient auction mecha-nism for service chains in the nfv market,” in Proc. IEEE Interna-tional Conference on Computer Communications (INFOCOM), 2016.

[13] Z. Xu, W. Liang, A. Galis, and Y. Ma, “Throughput maximizationand resource optimization in nfv-enabled networks,” in IEEEInternational Conference on Communications (ICC), May 2017.

[14] “Enterprise network and data security spending shows remark-able resilience, says abi research,” https://www.abiresearch.com.

[15] T.-I. Research, “Global security appliance market 2016-2020,”https://www.bharatbook.com, Apr. 2016.

[16] “Network security appliances & software market tracker - regional- q3 2016,” https://technology.ihs.com, Sep. 2016.

[17] J. Wilson, “Research note - network security a $10.8 billion marketin 2020,” https://technology.ihs.com, Oct. 2016.

[18] I. Barker, “Network function virtualisation (nfv): What businessesneed to know,” http://www.itproportal.com, Nov. 2016.

[19] S. K. Fayazbakhsh, V. Sekar, M. Yu, and J. C. Mogul, “Flow-tags: enforcing network-wide policies in the presence of dynamicmiddlebox actions,” in Proceedings of the second ACM SIGCOMMworkshop on HotSDN. ACM, 2013, pp. 19–24.

[20] H. Huang, P. Li, S. Guo, and B. Ye, “The joint optimization of rulesallocation and traffic engineering in software defined network,”in IEEE 22nd International Symposium of Quality of Service (IWQoS),2014, pp. 141–146.

[21] Z. Cao, M. Kodialam, and T. Lakshman, “Traffic steering insoftware defined networks: planning and online routing,” in Pro-ceedings of the 2014 ACM SIGCOMM workshop on Distributed cloudcomputing. ACM, 2014, pp. 65–70.

[22] H. Huang, P. Li, S. Guo, and W. Zhuang, “Software-definedwireless mesh networks: architecture and traffic orchestration,”IEEE Network, vol. 29, no. 4, pp. 24–30, 2015.

[23] M. Dong, H. Li, K. Ota, and J. Xiao, “Rule caching in sdn-enabledmobile access networks,” IEEE Network, vol. 29, no. 4, pp. 40–45,2015.

[24] H. Huang, S. Guo, P. Li, B. Ye, and I. Stojmenovic, “Joint optimiza-tion of rule placement and traffic engineering for qos provisioningin software defined network,” IEEE Transactions on Computers,vol. 64, no. 12, pp. 3488–3499, 2015.

[25] H. Li, M. Dong, and K. Ota, “Radio access network virtualizationfor the social internet of things,” IEEE Cloud Computing, vol. 2,no. 6, pp. 42–50, 2015.

[26] H. Huang, S. Guo, J. Wu, and J. Li, “Green datapath for tcam-based software-defined networks,” IEEE Communications Maga-zine, vol. 54, no. 11, pp. 194–201, 2016.

[27] H. Huang, P. Li, and S. Guo, “Traffic scheduling for deep packetinspection in software-defined networks,” Concurrency and Com-putation: Practice and Experience, 2016.

[28] K. Wang, Y. Wang, D. Zeng, and S. Guo, “An sdn-based ar-chitecture for next-generation wireless networks,” IEEE WirelessCommunications, vol. 24, no. 1, pp. 25–31, 2017.

[29] M. Baldi, R. Bonafiglia, F. Risso, and A. Sapio, “Modeling nativesoftware components as virtual network functions,” in Proc. of theACM SIGCOMM 2016 Conference. ACM, 2016, pp. 605–606.

[30] M. Chen, S. C. Liew, Z. Shao, and C. Kai, “Markov approximationfor combinatorial network optimization,” IEEE Transactions onInformation Theory, vol. 59, no. 10, pp. 6301–6327, 2013.

[31] H. Huang, S. Guo, J. Wu, and J. Li, “Joint middlebox selection androuting for software-defined networking,” in IEEE InternationalConference on Communications (ICC), 2016.

[32] M. Bouet, J. Leguay, and V. Conan, “Cost-based placement ofvirtualized deep packet inspection functions in sdn,” in Proc.Military Communications Conference (MILCOM), 2013, pp. 992–997.



13

[33] Y. Zhang, N. Beheshti, L. Beliveau, G. Lefebvre, R. Manghir-malani, R. Mishra, R. Patneyt, M. Shirazipour, R. Subrahmaniam,C. Truchan et al., “Steering: A software-defined networking forinline service chaining,” in Proc. IEEE International Conference onNetwork Protocols (ICNP), 2013, pp. 1–10.

[34] J. Liu, Y. Li, Y. Zhang, L. Su, and D. Jin, “Improve service chainingperformance with optimized middlebox placement,” IEEE Trans-actions on Services Computing, vol. PP, no. 99, 2015.

[35] M. Xia, M. Shirazipour, Y. Zhang, H. Green, and A. Takacs,“Network function placement for nfv chaining in packet/opticaldatacenters,” Journal of Lightwave Technology, vol. 33, no. 8, pp.1565–1570, 2015.

[36] R. Cohen, L. Lewin-Eytan, J. S. Naor, and D. Raz, “Near optimalplacement of virtual network functions,” in Proc. IEEE Conferenceon Computer Communications (INFOCOM), 2015, pp. 1346–1354.

[37] T. Kuo, B. Liou, K. C. Lin, and T. MingJer, “Deploying chainsof virtual network functions on the relation between link andserver usage,” in Proc. IEEE International Conference on ComputerCommunications (INFOCOM), 2016.

[38] Y. Li, L. Phan, and B. T. Loo, “Network functions virtualizationwith soft real-time guarantees,” in Proc. IEEE Conference on Com-puter Communications (INFOCOM), 2016.

[39] P. Quinn and T. Nadeau, “Problem statement for service functionchaining,” IETF, Tech. Rep., 2015.

[40] R. Cohen, L. Lewin-Eytan, J. S. Naor, and D. Raz, “On the effectof forwarding table size on sdn network utilization,” in Proceed-ings of IEEE International Conference on Computer Communications(INFOCOM), 2014, pp. 1734–1742.

[41] K. A. Ravindra, T. L. Magnanti, and J. B. Orlin, “Network flows:Theory, algorithms, and applications,” 1993.

[42] Z. Wang and J. Crowcroft, “Qos routing for supporting resourcereservation,” IEEE JSAC, September, 1996.

[43] X. Yuan, “Heuristic algorithms for multi-constrained quality-of-service routing,” IEEE/ACM Transactions on Networking, vol. 10,no. 2, pp. 244–256, 2002.

[44] F. P. Kelly, Reversibility and stochastic networks. Cambridge Uni-versity Press, 2011.

[45] “Network topologies,” http://www.av.it.pt/anp/on/refnet2.html.[46] G. Optimization, http://www.gurobi.com/.[47] K. Wang, Y. Shao, L. Shu, G. Han, and C. Zhu, “Ldpa: a local

data processing architecture in ambient assisted living communi-cations,” IEEE Communications Magazine, vol. 53, no. 1, pp. 56–63,2015.

[48] K. Wang, Y. Shao, L. Shu, C. Zhu, and Y. Zhang, “Mobile big datafault-tolerant processing for ehealth networks,” IEEE Network,vol. 30, no. 1, pp. 36–42, 2016.

[49] J. Wu, S. Guo, J. Li, and D. Zeng, “Big data meet green challenges:Greening big data,” IEEE Systems Journal, vol. 10, no. 3, pp. 873–887, 2016.

Huawei Huang (M’16) received his Ph.D. incomputer science from University of Aizu, Japan.His research interests mainly include optimiza-tion and algorithm design/analysis, particularly inthe fields of software-defined networking (SDN),big data, cloud computing, mobile computing,and green communication & computing. He isan IEEE member and a post-doctoral JSPS re-search fellow.

Song Guo (M’02-SM’11) is a Full Professorat Department of Computing, The Hong KongPolytechnic University. He received his Ph.D. incomputer science from University of Ottawa andwas a full professor with the University of Aizu,Japan. His research interests are mainly in theareas of big data, cloud computing, green com-munication and computing, wireless networks,and cyber-physical systems. He has publishedover 350 conference and journal papers in theseareas and received 5 best paper awards from

IEEE/ACM conferences. Dr. Guo has served in editorial boards of sev-eral prestigious journals, including IEEE Transactions on Parallel andDistributed Systems, IEEE Transactions on Emerging Topics in Comput-ing, IEEE Transactions on Sustainable Computing, IEEE Transactionson Green Communications and Networking, and IEEE Communications.He is an active volunteer as General/TPC Chair for 20+ internationalconferences and Chair/Vice-Chair for several IEEE Technical Commit-tees and SIGs. He is a senior member of IEEE, a senior member ofACM, and an IEEE Communications Society Distinguished Lecturer.

Jinsong Wu (SM’11) received his Ph.D. in De-partment of Electrical and Computer Engineer-ing, Queen’s University at Kingston, Canada in2006. He is elected Vice Chair -Technical Ac-tivities, IEEE Environmental Engineering Initia-tive, a pan-IEEE effort under IEEE TechnicalActivities Board (TAB). He was the Founderand Founding Chair of IEEE Technical Commit-tee on Green Communications and Computing(TCGCC). Jinsong Wu is also the co-founderand founding Vice-Chair of IEEE Technical Com-

mittee on Big Data (TCBD). He is the Founder and Editor of IEEE Serieson Green Communication and Computing Networks in IEEE Commu-nications Magazine. He is Area Editor in IEEE Transactions on GreenCommunications and Networking. He was Series Editor in the IEEEJournal of Selected Areas on Communications (JSAC) Series on GreenCommunications and Networking. He was the leading Editor and a co-author of the comprehensive book, entitled “Green Communications:Theoretical Fundamentals, Algorithms, and Applications”, published byCRC Press in September 2012. He is currently with Department ofElectrical Engineering, Universidad de Chile, Santiago, Chile as well asSchool of Software, Central South University, China.

Jie Li (M’96-SM’04) received the BE degreein computer science from Zhejiang University,Hangzhou, China, the ME degree in elec-tronic engineering and communication systemsfrom China Academy of Posts and Telecom-munications, Beijing, China. He received theDrEng degree from the University of Electro-Communications, Tokyo, Japan. He has beenwith University of Tsukuba, Japan, where he is aprofessor in the Faculty of Engineering, Informa-tion and Systems. His research interests include

mobile distributed multimedia computing and networking, big data andcloud computing, OS, network security, modeling, and performanceevaluation of information systems. He received the Best Paper awardfrom IEEE NAECON97. He has served as a secretary for Study Groupon System Evaluation of IPSJ and on several editorial boards for IPSJJournal and so on, and on Steering Committees of the SIG of SystemEVAluation (EVA) of IPSJ, the SIG of DataBase System (DBS) of IPSJ,and the SIG of MoBiLe computing and ubiquitous communications(MBL) of IPSJ. He has been a cochair of several international symposiaand workshops. He has also served on the program committees for sev-eral international conferences such as IEEE ICDCS, IEEE INFOCOM,IEEE GLOBECOM, and IEEE MASS. He is a senior member of the IEEEand ACM, and a member of Information Processing Society of Japan(IPSJ).



1 service chaining for hybrid network function

Documents