Correctness of Flow Migration for Service Function Chains

Network Functions (NFs) are responsible for ensuring security in the network, optimizing data traffic and balancing network load. NFs are chained to form Service Function Chains (SFCs). Flows may need to be migrated from a subset of NF instances (belonging to an SFC instance) to another for scaling out, scaling in, load balancing or software upgrades. When flows are migrated from an NF instance to another, states need to be migrated for the destination NF to function correctly. For the first time, we propose the correctness criteria for migration of a flow from an SFC instance to another. Existing algorithms for flow migration across NF instances require buffering packets. The amount of buffering required is not easily predictable, buffering is vulnerable to overflow attacks and do not tolerate packet bursts well. We propose an algorithm that does not require buffering or loss of packets, but causes reordering, for flow migration across SFC instances. The reordering that it causes is well managed by recent implementations of TCP, as is borne out by our experiments. Our simulations demonstrate that when a flow is migrated from an SFC instance with 2, 4, 6 and 8 NFs, the worst difference in the mean goodputs of cases with and without flow migration is only 3.6% and the best difference is 0.1%. Moreover, the implementations of NFs that are resistant to packet reordering strengthen our case.