Unikernel Service Chaining in NFV Architecture

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current service chaining technologies face inefficiencies in packet switching, high resource overhead, and security vulnerabilities due to the use of virtual machines and containers, which hinder scalability and resiliency in virtualized environments, especially in SDN-based systems.

Innovation Solution

Implementing a service chain using on-demand instantiation of unikernels managed by a hypervisor, with a 'lightning' module that configures and stitches together micro-services within a virtual router, enabling zero-footprint operation and eliminating the need for SDN traffic steering through zero-copy shared memory, thereby reducing resource usage and enhancing security.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If virtual machines or containers are used for service chaining, then service functionality is provided, but resource overhead increases and security vulnerabilities arise due to full kernel usage

Engineering Contradiction:

Improveservice functionalityVSAvoidresource overhead

Core Design Contradiction:

ReliabilityVSUse of energy by moving object

Solution Approach 1:

The patent extracts only the necessary service functionality from full virtual machines and containers, implementing unikernels that contain only the specific service code required. This eliminates the full operating system kernel and unnecessary components, providing service functionality while dramatically reducing resource overhead by removing unused code and dependencies.

Inventive Principle:

Principle #2Taking out (Extraction)

Solution Approach 2:

The patent applies local quality by creating specialized unikernels for different services, where each unikernel is optimized with only the specific code and dependencies needed for that particular service. This localized optimization reduces resource overhead for each service instance while maintaining the required functionality, rather than using a generic full OS for all services.

Inventive Principle:

Principle #3Local quality

2Reliability

If virtual machines or containers are used for service chaining, then service functionality is provided, but security vulnerabilities increase due to large attack surface

Engineering Contradiction:

Improveservice functionalityVSAvoidsecurity vulnerabilities

Core Design Contradiction:

ReliabilityVSObject-affected harmful factors

Solution Approach 1:

The patent extracts and removes unnecessary components, libraries, and code from the service runtime environment, creating minimalistic unikernels that contain only the essential service logic. This extraction process eliminates the large attack surface present in full VMs and containers, reducing security vulnerabilities while preserving the core service functionality.

Inventive Principle:

Principle #2Taking out (Extraction)

3Ease of manufacture

If containers are used for service chaining, then application deployment is simplified, but boot time increases and availability decreases

Engineering Contradiction:

Improveapplication deploymentVSAvoidboot time

Core Design Contradiction:

Ease of manufactureVSLoss of time

Solution Approach 1:

The patent implements disposable unikernels that can be rapidly instantiated and terminated. These lightweight objects are designed to be created quickly on-demand, providing service functionality for the duration of a session or request, then terminated when no longer needed. This approach minimizes boot time and improves availability compared to traditional containers that require lengthy startup sequences.

Inventive Principle:

Principle #27Cheap short-living objects (Disposable)

4Ease of operation

If SDN architecture is used for service chaining, then network control is centralized, but scalability and resiliency are compromised

Engineering Contradiction:

Improvenetwork controlVSAvoidscalability and resiliency

Core Design Contradiction:

Ease of operationVSAdaptability or versatility

Solution Approach 1:

The patent segments the centralized SDN controller into distributed service chaining functionality embedded within the network infrastructure. Instead of a single point of control, service chaining operations are distributed across multiple nodes, improving scalability and resiliency while maintaining operational simplicity through standardized interfaces and protocols.

Inventive Principle:

Principle #1Segmentation

Data Source

PatentEP3384386B1Enabling fine granular service chaining in a network-function virtualization architecture

Publication Date: 2021.01.06 TELEFONAKTIEBOLAGET LM ERICSSON (PUBL)

Figure 1
Figure 2
Figure 3A

AI summary

A network device implements a method for providing a service chain in a network by instantiating services on demand using a lightning module. The lightning module provides the services as applications executed by a unikernel where the unikernel is supported by a hypervisor. The method further includes receiving authentication, administration and accounting (AAA) service authentication of a user by the lightning module, instantiating a special unikernel to monitor a session for packets from the user, and instantiating service chain unikernels identified in at least one unikernel configuration file, in response to receiving a packet from the user.