论文部分内容阅读
基于网络功能虚拟化(NFV)的安全服务功能链(NS-SFC)面临着严峻的性能挑战。为了优化性能,提出了基于TCP Offloading的虚拟网络安全服务功能链——TOChain,解决了重复收发网络包问题;提出了面向吞吐率保证的强同步周期性CPU调度算法,在VNF与用户虚拟机混合部署的场景下实现网络吞吐率性能保证与调度公平性。基于KVM虚拟化平台实现了原型系统,并对由防火墙、入侵防御系统和应用层防火墙三种VNF构成的NS-SFC进行了不同负载下的性能测试。结果显示,与传统SFC相比TOChain能够以较低的CPU资源占用率达到更高、更稳定的网络性能;在轻度和中度网络流量负载下,采用强同步周期性调度算法都能够达到与所设定的吞吐率极为接近的网络性能,即便是在重度负载下,也能实现用户虚拟机间的调度公平性。
Network Services Virtualization (NFV) -based Security Services Function Chain (NS-SFC) faces serious performance challenges. In order to optimize the performance, this paper proposes a network-based secure service function chain called TOChain based on TCP Offloading, which solves the problem of repeated sending and receiving network packets. A strong synchronous periodic CPU scheduling algorithm for throughput guarantee is proposed. When VNF and user virtual machine are mixed Achieve network throughput performance assurance and scheduling fairness in deployed scenarios. Based on the KVM virtualization platform, a prototype system was implemented and the NS-SFCs under different loadings were tested for the performance of NS-SFCs consisting of firewalls, intrusion prevention systems and application layer firewalls. The results show that compared with traditional SFC, TOChain can achieve higher and more stable network performance with lower CPU resource utilization. With mild and moderate network traffic load, the strong periodic scheduling algorithm can reach The set throughput is very close to the network performance, even in the heavy load, but also to achieve the fairness between the user virtual machine scheduling.