EPI Framework: Approach for Traffic Redirection Through Containerised Network Functions

Utilising programmable infrastructures is a promising approach to support secure data-sharing across healthcare domains of different capabilities in terms of network and security. The EPI¹ (Enabling Personalised Interventions) framework automates the setup of the underlying infrastructure while considering different requirements communicated by the EPI components, such as logic area generator and policy management system.In our approach to dynamically provide collaborative environments, we containerise network functions (VFs), that are shipped out and instantiated at the edge of the network. We use container-based Virtual Network Function (VNFs) to accomplish fast deployment, high reusability, and low-performance overhead.Traffic interception and redirection through the chain of containerised network functions is a core feature of our framework. In this paper, we focus on the implementation and design of this tool for packet interception and redirection. We evaluate the performance of two approaches: an NGINX-based reverse proxy method and a SOCKS protocol-based method. We benchmark them to determine the overhead compared to a direct data-sharing session with no proxy. We conclude that the reverse proxy performs better in terms of overhead. Nonetheless, the SOCKS-based method works on a lower network level support all traffic types and offer a higher processing rate. We compare the methods according to other performance parameters. Subsequently, the choice of method will depend on the application performance requirements.