Approximate and Incremental Network Function Placement

TL;DR

This paper introduces a new approximation algorithm for the incremental placement of network middleboxes, ensuring capacity and route constraints are met, with proven optimal bounds and extensions to weighted communication scenarios.

Contribution

It provides a rigorous proof of submodularity for the network function placement problem and develops a deterministic, incremental deployment algorithm with optimal approximation guarantees.

Findings

The algorithm effectively handles incremental middlebox deployment without relocating existing middleboxes.

The approximation bound achieved is proven to be optimal unless P=NP.

A new LP relaxation and randomized rounding approach are proposed for weighted communication scenarios.

Abstract

The virtualization and softwarization of modern computer networks introduces interesting new opportunities for a more flexible placement of network functions and middleboxes (firewalls, proxies, traffic optimizers, virtual switches, etc.). This paper studies approximation algorithms for the incremental deployment of a minimum number of middleboxes at optimal locations, such that capacity constraints at the middleboxes and length constraints on the communication routes are respected. Our main contribution is a new, purely combinatorial and rigorous proof for the submodularity of the function maximizing the number of communication requests that can be served by a given set of middleboxes. Our proof allows us to devise a deterministic approximation algorithm which uses an augmenting path approach to compute the submodular function. This algorithm does not require any changes to the locations of existing middleboxes or the preemption of previously served communication pairs when additional middleboxes are deployed, previously accepted communication pairs just can be handed over to another middlebox. It is hence particularly attractive for incremental deployments.We prove that the achieved polynomial-time approximation bound is optimal, unless P = NP. This paper also initiates the study of a weighted problem variant, in which entire groups of nodes need to communicate via a middlebox (e.g., a multiplexer or a shared object), possibly at different rates. We present an LP relaxation and randomized rounding algorithm for this problem, leveraging an interesting connection to scheduling.

Equations

$$\varphi (M_1\cup \{m\})-\varphi (M_1)\ge \varphi (M_2\cup \{m\})-\varphi (M_2).$$

$$\varphi (M_2\cup \{m\})-\varphi (M_2)=|A^{\Pi }(m)|.$$

$$\varphi (M_1\cup \{m\})-\varphi (M_1)\ge |A^{\Pi }(m)|.$$

$$\varphi (M_1\cup \{m\})-\varphi (M_1)\ge \varphi (M_2\cup \{m\})-\varphi (M_2),$$

$$\sum _{p\in P}{d}_p\cdot x_{up}\le \kappa \cdot x_u\forall u\in U.$$

Full text

I Introduction

Middleboxes are ubiquitous in modern computer networks and provide a wide spectrum of in-network functions related to security, performance, and policy compliance. It has recently been reported that the number of middleboxes in enterprise networks can be of the same order of magnitude as the number of routers [38].

While in-network functions were traditionally implemented in specialized hardware appliances and middleboxes, computer networks in general and middleboxes in particular become more and more software-defined and virtualized [18]: network functions can be implemented in software and deployed fast and flexibly on the virtualized network nodes, e.g., running in a virtual machine on a commodity x86 server. Modern computer networks also offer new flexibilities in terms of how traffic can be routed through middleboxes and virtualized data plane appliances (often called Virtual Network Functions, short VNFs) [36]. In particular, the advent of Software-Defined Network (SDN) technology allows network operators to steer traffic through middleboxes (or chains of middleboxes) using arbitrary routes, i.e., along routes which are not necessarily shortest paths, or not even loop-free [3, 34, 13, 33]. In fact, OpenFlow, the standard SDN protocol today, not only introduces a more flexible routing, but itself allows to implement basic middlebox functionality, on the switches [14]: an OpenFlow switch can match, and perform actions upon, not only layer-2, but also layer-3 and layer-4 header fields.

However, not much is known today about how to exploit these flexibilities algorithmically. A particularly interesting problem regards the question of where to deploy a minimum number of middleboxes such that basic routing and capacity constraints are fulfilled. Intuitively, the smaller the number of deployed network functions, the longer the routes via these functions, and a good tradeoff between deployment costs and additional latency must be found. Moreover, ideally, middleboxes should be incrementally deployable: when additional middleboxes are deployed, existing placements do not have to be changed. This is desirable especially in deployment scenarios with budget constraints, where an existing deployment has to be extended by new middleboxes.

I-A Our Contributions

We initiate the study of the natural problem of (incrementally) placing a minimum number of middleboxes or network functions.

Our main technical result is a deterministic and greedy (polynomial-time) $O(\log{(\min\{\kappa,n\})})$-approximation algorithm for the (incremental) middlebox placement problem in $n$-node networks where capacities are bounded by $\kappa$. The algorithm is attractive for incremental deployments: it does not require any changes to the locations of existing middleboxes or the preemption of previously served communication pairs when additional middleboxes are deployed.

At the heart of our algorithm lies a new and purely combinatorial proof of the submodularity of the function maximizing the number of pairs that can be served by a given set of middleboxes. The submodularity proof directly implies a deterministic approximation algorithm for the minimum middlebox deployment problem. We show that the derived approximation bound is asympotically optimal in the class of all polynomial-time algorithms, unless $P=\textit{NP}$.

This paper also initiates the discussion of two generalizations of the network function placement problem: (1) a model where not only node pairs but entire node groups need to be routed via certain network functions (e.g., a multiplexer or a shared object in a distributed cloud), and (2) a weighted model where nodes have arbitrary resource requirements. By leveraging a connection to scheduling, we show that these problems can also be approximated efficiently.

We believe that our model and approach has ramifications beyond middlebox deployment. For instance, our model also captures fundamental problems arising in the context of incremental SDN deployment (solving an open problem in [9, 29]) or distributed cloud computing where resources need to be allocated for large user groups.

We also initiate the study of a weighted problem variant, where entire groups of nodes need to communicate via a shared network function (e.g., a multiplexer of a multi-media conference application or a shared object), possibly at different rates. We present an LP relaxation and randomized rounding algorithm for this problem, establishing an interesting connection to scheduling.

I-B Novelty and Related Work

In this paper we are interested in algorithms which provide formal approximation guarantees. In contrast to classic covering problems [8, 15, 40]: (1) we are interested in the distance between communicating pairs, via the covering nodes, and not to the covering nodes; (2) we aim to support incremental deployments: middlebox locations selected earlier in time as well as the supported communication pairs should not have to be changed when deploying additional middleboxes; (3)  we consider a capacitated setting where the number of items which can be assigned to a node is bounded by $\kappa$.

To the best of our knowledge, so far, only heuristics or informal studies without complete or combinatorial proofs of the approximability [2, 25, 30, 38] as well as algorithms with an exponential runtime in the worst-case [20, 25], of the (incremental and non-incremental) middlebox deployment problem have been presented in the literature. Our work also differs from function chain embedding problems [12, 27, 11] which often revolve around other objectives such as maximum request admission or minimum link load.

Nevertheless, we in this paper show that we can build upon hardness results on uncapacitated covering problems [28] as well as Wolsey’s study of vertex and set covering problems with hard capacities [40]. An elegant alternative proof to Wolsey’s dual fitting approach, based on combinatorial arguments, is due to Chuzhoy and Naor [7]. In [7] the authors also show that using LP-relaxation approaches is generally difficult, as the integrality gap of a natural linear program for the weighted and capacitated vertex and set covering problems is unbounded.

Bibliographic Note. A preliminary version of this paper appeared in CCR [26].

I-C Putting Things into Perspective

Our problem is a natural one and, as mentioned, features some interesting connections to and has implications for classic (capacitated) problems. To make things more clear and put things into perspective, in the following, we will elaborate more on this relationship.

The generalized dominating set problem [4] asks for a set of dominating nodes of minimal cardinality, such that the distance from any network node to a dominator is at most $\ell$. In the capacitated version of the problem, the number of network nodes which can be dominated by a node is limited. Similarly, capacitated facility location problems [1, 5] ask for locations to deploy facilities, subject to capacity constraints, such that the number of facilities as well as the distance to the facilities are jointly optimized. In contrast to these problems where the distance to a dominator or facility from a given node is measured, in our middlebox deployment problem, we are interested in the distance (resp. stretch) between node pairs, via the middlebox. At first sight, one may intuitively expect that optimal solutions to dominating set or facility location problems are also good approximations for the middlebox deployment problem. However, this is not the case, as we illustrate in the following. Consider an optimal solution to the distance $\ell/2$ dominating set problem: since the distance to any dominator is at most $\ell/2$, the locations of the dominators are also feasible locations for the middleboxes: the route between two nodes via the dominator is at most $\ell/2+\ell/2=\ell$. However, the number of dominators in this solution can be much larger than the number of required middleboxes.

Consider the example in Figure 1: in a star network where communicating node pairs are located at the leaves, at depth 1 and $\ell-1$, and where node capacities are sufficiently high such that they do not constitute a bottleneck, a single middlebox $m$ in the center is sufficient. However, the stricter requirement that dominating nodes must be at distance at most $\ell/2$, results in a dominating set of cardinality $\Omega(n/\ell)$, i.e., $\Omega(n)$ for constant $\ell$.

While our discussion revolved around constraints on the length $\ell$, similar arguments and bounds also apply to the stretch, the main focus of this paper: the ratio of the length of the path through a middlebox, and the length of the shortest path between the communicating pair. To see this, simply modify the example in Figure 1 by adding a direct edge between each communicating pair $s_{i}$ and $t_{i}$. Let $c=\ell$. Then the length of the shortest path between each pair is one. The dominating nodes must be at distance at most $c/2$ from the communicating nodes. Consequently, the cardinality of the dominating set is $\Omega(n/c)$, i.e., $\Omega(n)$ for constant $c$; deploying one single middlebox $m$ at the center and routing the communication between each pair through $m$ results in paths of stretch $c$.

I-D Organization

The remainder of this paper is organized as follows. Section II introduces our model and discusses different use cases. In Section III we present our approximation algorithm together with its analysis. Section IV extends our study to weighted and group models. After reporting on our simulation results in Section V, we conclude our contribution in Section VI.

II Model and Use Cases

II-A Formal Model

We model the computer network as a graph connecting a set $V$ of $n=|V|$ nodes. The input to our problem is a set of communicating node pairs $P$: the route of each node pair $(s,t)\in P$ needs to traverse an instance of a middlebox resp. network function (e.g., a firewall). Node pairs do not have to be disjoint: nodes can participate in many communications simultaneously.

For the sake of generality, we assume that middleboxes can only be installed on a subset of nodes $U\subseteq V$. We will refer to the set of middleboxes locations (and equivalently, the set of middleboxes instances) by $M$, and we are interested in deploying a minimal number of middleboxes at legal locations $M\subseteq U$ such that:

Each pair $p=(s,t)\in P$ is assigned to an instance $m\in M$, denoted by $m=\mu(p)$. 2. 2.

For each pair $p=(s,t)\in P$, there is a route from $s$ via $m=\mu(p)$ to $t$ of length at most $\rho\cdot d(s,t)$, i.e., $d(s,m)+d(m,t)\leq\rho\cdot d(s,t)$, where $d(u,v)$ denotes the length of the shortest path between nodes $u,v\in V$ in the network $G$, and where $\rho\geq 1$ is called the stretch. For example, a stretch $\rho=1.2$ implies that the distance (and the latency accordingly) when routing via a middlebox is at most 20% more than the distance (and the latency accordingly) when connecting directly. Our approach supports many alternative constraints, e.g., on the maximal route length. 3. 3.

Capacities are respected: at most $\kappa$ node pairs can be served by any middlebox instance.

Our objective is to minimize the number of required middlebox instances, subject to the above constraints.

In this paper, we will also initiate the study of a weighted model, where different communication pairs have different demands, as well as a group model, where network functions need to serve entire groups of communication partners. See Figure 2 for an example.

II-B Use Cases

Let us give three concrete examples motivating our formal model.

Middlebox Deployment. Our model is mainly motivated by the middlebox placement flexibilities introduced in network function virtualized and software-defined networks. Deploying additional middleboxes, network processors or so-called “universal nodes” can be costly, and a good tradeoff should be found between deployment cost and routing efficiency. For example, today, network policies can often be defined in terms of adjacency matrices or big switch abstractions, specifying which traffic is allowed between an ingress port $s$ and an outgress network port $t$. In order to enforce such a policy, traffic from $s$ to $t$ needs to traverse a middlebox instance inspecting and classifying the flows. The location of every middlebox can be optimized, but is subject to the constraint that the route from $s$ to $t$ via the middlebox should not be much longer than the shortest path from $s$ to $t$.

Deploying Hybrid Software-Defined Networks. There is a wide consensus that the transition of existing networks to SDN will not be instantaneous, and that SDN technology will be deployed incrementally, for cost reasons and to gain confidence. The incremental OpenFlow switch deployment problem can be solved using waypointing (routing flows via OpenFlow switches); our paper solves the algorithmic problem in the Panopticon [25] system.

Distributed Cloud Computing. The first two use cases discussed above come with per-pair requirements: each communicating pair must traverse at least one function. However, there are also scenarios where entire groups $G_{i}$ of nodes need to share a waypoint: for example, a multiplexer of a group communication (a multi-media conference) or a shared object in a distributed system, e.g., a shared and collaborative editor: An example could be a distributed cloud application: imagine a set of users $G_{i}$ who would like to use a collaborative editor application à la Google Docs. The application should be hosted on a server which is located close to the users, i.e., minimizing the latency between user pairs.

III Approximation Algorithm

III-A Overview

This section presents a deterministic and polynomial-time $O(\log(\min\{n,\kappa\}))$-approximation algorithm for the middlebox deployment problem. Our algorithm is based on an efficient computation of a certain submodular set function: it defines the maximum number of pairs which can be covered by a given set of middleboxes. In a nutshell, the submodular function is computed efficiently using an augmenting path method on a certain bipartite graph, which also determines the corresponding assignment of communication pairs to the middleboxes. The augmenting path algorithm is based on a simple, linear-time breadth-first graph traversal. The augmenting path method is attractive and may be of independent interest: similarly to the flow-based approaches in the literature [6], it does not require changes to previously deployed middleboxes, but removes the disadvantage of [6] that the set of served communication pairs changes over time: an attractive property for incremental deployments.

Our solution with augmenting paths results (theoretically and practically) in significantly faster computations of the submodular function value as well as of the corresponding assignment compared to the flow based approach. In fact, computing all augmenting paths takes $O(|E|\min\{\sqrt{|V|},\kappa\})$ by using the Hopcroft-Karp algorithm [21] performing at most $O(\min\{\sqrt{|V|},\kappa\})$ breadth-first search and depth-first search traversals of the graph. Computing a maximum flow takes $O(|V||E|^{2})$ time by the Edmonds-Karp algorithm [10], $O(|V|^{3})$ time by the push-relabel algorithm of Goldberg and Tarjan [19], and $O(|V||E|)$ time by the algorithm of Orlin [31] (see [19] for an overview on efficient maximum flow algorithms).

Concretely, we can start with an empty set of middlebox locations $M=\emptyset$, and in each step, we add a middlebox at location $m$ to $M$, which maximizes the number of totally covered (by middleboxes at locations $M\cup\{m\}$) communicating pairs, without violating capacity and route stretch constraints. The algorithm terminates, when all pairs were successfully assigned to middlebox instances in $M$. More precisely, for any set of middlebox instances $M\subseteq U$, we define $\phi(M)$ to be the maximum number of communication pairs that can be assigned to $M$, given the capacity constraints at the nodes and the route stretch constraints. We show that $\phi$ is non-decreasing and submodular, and $\phi(M)$ – and the corresponding assignment of pairs to middlebox instances in $M$ – can be computed in polynomial time. This allows us to use Wolsey’s Theorem [40] to prove an approximation factor of $1+O(\log\phi_{\max})$, where $\phi_{\max}=\max_{m\in U}\phi(\{m\})$. Since in our case, $\phi_{\max}=\min\{\kappa,|P|\}$ and $|P|\leq n^{2}$, this implies that Algorithm 1 computes an $O(\log(\min\{\kappa,n\}))$-approximation for the minimum number of middlebox instances that can cover all pairs $P$ (i.e., all pairs can be assigned to the deployed middleboxes).

III-B Maximum Assignment

In order to compute function $\phi(M)$, for any $M\subseteq U$, we construct a bipartite graph $B(M)=(M\cup P,E)$, where $P$ is the set of communicating pairs. We will simply refer to the middlebox instances $m\in M$ and pairs $p\in P$ in the bipartite graph as the nodes. The edge set $E$ connects middlebox instances $m\in M$ to those communicating pairs $p\in P$ which can be routed via $m$ without exceeding the stretch constraint, i.e. $E=\{(m,p)\ :\ m\in M,p=(s,t)\in P,d(s,m)+d(m,t)\leq\rho\cdot d(s,t)\}$, where $d(u,v)$ denotes the length of shortest path between nodes $u$ and $v$ in the network. For each $p$, the set of such middlebox nodes can be computed in a pre-processing step by performing an all-pair shortest paths algorithm to calculate $d(u,v)$ for each $u,v$ in the network, and for each $p=(s,t)\in P$, selecting the nodes $m\in M$ with $d(s,m)+d(m,t)\leq\rho\cdot d(s,t)$.

A partial assignment $A(M)\subseteq B(M)$ of pairs $p\in P$ to middlebox instances in $M$ is a subgraph of $B(M)$, in which each $p\in P$ is connected to at most one middlebox $m\in M$ by an edge, i.e., $\deg_{A(M)}(p)\leq 1$ where $\deg$ denotes the degree. A pair $p\in P$ with $\deg_{A(M)}(p)=1$ is called an assigned pair and with $\deg_{A(M)}(p)=0$ an unassigned pair of a free pair. A partial assignment $A(M)$ without free pairs is called an assignment. The size $|A(M)|$ of a (partial) assignment $A(M)$ is defined as the number of edges in $A(M)$.

Our goal is to compute a partial assignment $A(M)$ of pairs $p\in P$ to middlebox instances in $M$ maximizing the number of assigned pairs. Accordingly, we distinguish between assignment edges $E_{A}$ and non-assignment edges $E_{\overline{A}}$, where $E_{A}\cup E_{\overline{A}}=E$ is a partition of the edge set $E$ of $B(M)$.

Our algorithm ensures that at any moment of time, the partial assignments are feasible, i.e., the assignment fulfills the following capacity constraints. The current load of a middlebox $m$ in $M$, denoted by $\lambda(m)$, is the number of communicating pairs served by $m$ according to the current partial assignment $A(M)$. Moreover, we define the free capacity $\kappa^{*}(m)$ of $m$ to be $\kappa^{*}(m)=\kappa-\lambda(m)$. A (partial) assignment $A(M)$ is feasible if and only if it does not violate capacities, i.e., $\lambda(v)\leq\kappa$, for all $v$ in any middlebox in $M$.

In order to compute the integer function $\phi(M)$, which is essentially the cardinality of a maximum feasible partial assignment $A^{*}(M)$, we make use of augmenting paths. Let $A(M)$ be a feasible partial assignment. An augmenting path $\pi=(v_{1},v_{2},\ldots,v_{j})$ relative to $A(M)$ in $B(M)$ starts at a middlebox $m\in M$ with free capacity, ends at a free pair $p\in P$, and alternates between assignment edges and non-assignment edges, i.e.,

$v_{1}\in M$ with $\kappa^{*}(v_{1})>0$ and $v_{j}\in P$ with $\deg_{A(M)}(v_{j})=0$, 2. 2.

$(v_{i},v_{i+1})\in B(M)\setminus A(M)$, for any odd $i$, 3. 3.

$(v_{i},v_{i+1})\in A(M)$, for any even $i$.

An augmenting path relative to $A(M)$ is a witness for a better partial assignment: The symmetric difference $A^{\prime}(M)=(A(M)\setminus\pi)\cup(\pi\setminus A(M))$ is also a (partial) assignment with size $|A^{\prime}(M)|=|A(M)|+1$. Due to the properties of the augmenting path, by this reassignment, one additional pair will be covered by the same set of middlebox instances, without violating node capacities: in $A(M)$, the first node had free capacity and the last node represents a free pair. Furthermore, the degree at each internal node of $\pi$ remains unchanged, since one incident assignment edge gets unassigned and one incident unassigned edge gets assigned. Therefore, the load of the internal nodes in $\pi$ remains unchanged. Conversely, suppose that a partial assignment $A(M)$ is not a maximum partial assignment. Let $A^{*}(M)$ be a maximum partial assignment. Consider the bipartite graph $X=(A(M)\cup A^{*}(M))\setminus(A(M)\cap A^{*}(M))$.

Figure 3 illustrates the greedy placement strategy and Figure 4 shows the augmenting path computation.

Note that an augmenting path must always exist for suboptimal covers. To see this, consider the following reduction to matching: replace each middlebox node with $\kappa$ many clones of capacity 1, and assign each pair $p\in P$ to the clones in the canonical way. Feasible assignments constitute a matching in this graph, with node degrees one. Given any suboptimal cover, we find a witness for a augmenting path as follows. We take the symmetric difference of the suboptimal and the optimal solution, which gives us a set of paths and cycles of even length. Thus, a path must exist where the optimal solution has one additional edge.

Augmenting paths can be computed efficiently, by simply performing breadth-first searches in $B(M)$, by using the nodes $m\in M$ with free capacities as the starting nodes.

III-C Submodularity

The set function $\phi:2^{U}\rightarrow\mathbb{N}$ is called non-decreasing iff $\phi(U_{1})\leq\phi(U_{2})$ for all $U_{1}\subseteq U_{2}\in 2^{U}$, and submodular iff $\phi(U_{1})+\phi(U_{2})\geq\phi(U_{1}\cap U_{2})+\phi(U_{1}\cup U_{2})$ for all $U_{1},U_{2}\in 2^{U}$. Equivalently, submodularity can be defined as follows (See, e.g. in [37] pp. 766): for any $U_{1},U_{2}\subseteq U$ with $U_{1}\subseteq U_{2}$ and every $u\in U\setminus U_{2}$, we have that $\phi(U_{1}\cup\{u\})-\phi(U_{1})\geq\phi(U_{2}\cup\{u\})-\phi(U_{2})$. This is in turn equivalent to: for every $U_{1}\subseteq U$ and $u_{1},u_{2}\in U\setminus U_{1}$ we have that $\phi(U_{1}\cup\{u_{1}\})+\phi(U_{1}\cup\{u_{2}\})\geq\phi(U_{1}\cup\{u_{1},u_{2}\})+\phi(U_{1})$.

Let $U_{1}\subseteq U_{2}$ be two arbitrary subsets of $U$. Consider a maximum assignment $A(U_{1})$ for $U_{1}$. Let $A(U_{2})$ be a maximum assignment for $U_{2}$ obtained from $A(U_{1})$ by adding the members $u_{2}\in U_{2}\setminus U_{1}$ to $U_{1}$ one-by-one, and performing the augmenting path method until we have a maximum assignment for the incremented set $U_{1}\cup\{u_{2}\}$. Let $A^{\Pi}(U_{1})$ be the projection of $A(U_{2})$ to $U_{1}$, i.e., for each $u_{1}\in U_{1}$, $p\in P$, the pair $p$ is assigned to $u_{1}$ in $A^{\Pi}(U_{1})$ if and only if $p$ is assigned to $u_{1}$ in $A(U_{2})$. First we show that $A^{\Pi}(U_{1})$ is a maximum assignment for $U_{1}$.

Lemma 1**.**

Let $A(U_{1})$ be a maximum assignment for $U_{1}$. Let $A(U_{2})$ be a maximum assignment for $U_{2}$ obtained from $A(U_{1})$ by adding all $u\in U_{2}\setminus U_{1}$ to $U_{1}$ one-by-one, and performing the augmenting path method until we have a maximum assignment for $U_{1}\cup\{u\}$. Let $A^{\Pi}(U_{1})$ be the projection of $A(U_{2})$ to $U_{1}$. Then $A^{\Pi}(U_{1})$ is a maximum assignment for $U_{1}$.

Proof.

By adding $u_{2}\in U_{2}\setminus U_{1}$ to $U_{1}$ and performing the augmenting path method until an augmenting path exists (i.e., until we obtain a maximum assignment for $U_{1}\cup\{u_{2}\}$), it holds that, for each $u_{1}\in U_{1}$, the number of pairs assigned to $u_{1}$ does not change: along the augmenting path each internal node has one incident assignment edge and one non-assignment edge. This also holds after exchanging the assignment edges and the non-assignment edges, i.e., each assignment edge on the augmenting path becomes a non-assignment edge and vice versa. The degrees of the start and end nodes increases by one. Consequently, the degree of each $u_{1}\in U_{1}$ in $A^{\Pi}(U_{1})$ is the same as in $A(U_{1})$. Since $A(U_{1})$ is a maximum assignment and each $u_{1}$ has the same degree in $A^{\Pi}(U_{1})$, $A^{\Pi}(U_{1})$ must be also a maximum assignment. ∎

Theorem 2**.**

Let $U$ be the set of all possible middlebox instance locations. Let $\phi:2^{U}\rightarrow\mathbb{N}$ be the set function, such that for $M\subseteq U$, $\phi(M)$ is the maximum number of pairs in $P$ that can be assigned to $M$ without violating the capacity constraints. Then $\phi$ is submodular.

Proof.

We show that for all $M_{1},M_{2}\subseteq U$, $M_{1}\subseteq M_{2}$ and for all $m\in U\setminus M_{2}$ we have that

[TABLE]

This is equivalent to the definition of the submodularity of $\phi$.

Consider a maximum assignment $A(M_{1})$ for $M_{1}$ and a maximum assignment $A(M_{2})$ for $M_{2}$ obtained from $A(M_{1})$ as described in Lemma 1. Now we add $m$ to $M_{2}$. Let $A(M_{2}\cup\{m\})$ be the maximum assignment for $M_{2}\cup\{m\}$ obtained from $A(M_{2})$ by adding $m$ to $M_{2}$ and performing the augmenting path method until we have a maximum assignment for $M_{2}\cup\{m\}$. Let $A^{\Pi}(M_{2})$ be the projection of $A(M_{2}\cup\{u\})$ to $M_{2}$ and let $A^{\Pi}(M_{1})$ be the projection of $A(M_{2}\cup\{u\})$ to $M_{1}$. Let $|A^{\Pi}(M_{2})|$ and $|A^{\Pi}(M_{1})|$ be the number of assigned pairs of $P$ in the assignments. By Lemma 1, $A^{\Pi}(M_{2})$ is a maximum assignment for $M_{2}$ and $A^{\Pi}(M_{1})$ is a maximum assignment for $M_{1}$. Therefore, $\phi(M_{2})=|A^{\Pi}(M_{2})|$ and $\phi(M_{1})=|A^{\Pi}(M_{1})|$. Furthermore, $\phi(M_{2}\cup\{u\})=|A(M_{2}\cup\{u\})|$.

Consider the pairs $P_{m}\subseteq P$ assigned to $m$ in the assignment $A(M_{2}\cup\{m\})$. Let $A^{\Pi}(m)$ be the projection of $A(M_{2}\cup\{m\})$ to $m$. Then $|A^{\Pi}(m)|=|P_{m}|$. Since $A^{\Pi}(M_{2})$ contains all elements that are assigned to any element of $M_{2}$ in $A(M_{2}\cup\{m\})$, clearly $|A(M_{2}\cup\{m\})|=|A^{\Pi}(M_{2})|+|A^{\Pi}(m)|$, and thus

[TABLE]

On the other side, the assignment $A^{*}(M_{1}\cup\{m\})$ which is obtained as the union of $A^{\Pi}(M_{1})$ and $A^{\Pi}(m)$ is a valid assignment for $M_{1}\cup\{m\}$. Therefore, $|A(M_{1}\cup\{m\})|\geq|A^{*}(M_{1}\cup\{m\})|=|A^{\Pi}(M_{1})|+|A^{\Pi}(m)|$, and thus

[TABLE]

Using (2) and (3) we obtain

[TABLE]

completing our proof. ∎

III-D The Algorithm

Essentially, Algorithm 1 starts with an empty set $M$ and cycles through the possible middlebox locations $m\in U\setminus M$, always deploying the middlebox resulting (with the already deployed ones) in the highest function value $\phi$.

Given the submodularity and the augmenting path construction, we have derived our main result. Per middlebox, an augmenting paths problem is solved. Using the Hopcroft-Karp algorithm, we can compute all (at most $\kappa$ many) augmenting paths starting at a newly added middlebox in time $O(\min\{\kappa,\sqrt{|V|}\}\cdot|E|)$, where $|V|$ denotes the number of nodes and $|E|$ the number of edges in $B(M)$.

Theorem 3**.**

Our greedy and incremental middlebox deployment algorithm computes a $O(\log{n})$-approximation.

III-E Lower Bound and Optimality

Theorem 3 is essentially the best we can hope for:

Theorem 4**.**

The middlebox deployment problem is NP-hard and cannot be approximated within $c\log n$, for some $c>0$ unless $P=NP$. Furthermore, it is not approximable within $(1-\epsilon)\ln n$, for any $\epsilon>0$, unless NP $\subset\mbox{\sc Dtime}(n^{\log\log n})$.

Proof.

We present a polynomial time reduction from the Minimum Set Cover (MSC) problem, defined as follows: Given a finite set $S$ of $n$ elements and a collection $C$ of subsets of $S$. A set cover for $S$ is a subset $C^{\prime}\subseteq C$ such that every element in $S$ is contained in at least one member of $C^{\prime}$. The objective is to minimize the cardinality of the set cover $C^{\prime}$.

Consider an instance of the MSC problem: let $S=\{v_{1},...,v_{n}\}$ be a set of $n$ elements, $C=\{S_{i}\subseteq S,i=1,...,m\}$. We define the instance of the corresponding middlebox deployment problem in a network $G=(V,E)$ with a set of communicating pairs $P$ and stretch $\rho=1$ as follows. For each element $v\in S$, we introduce two nodes $v_{s}$ and $v_{t}$ in $V$. For each subset $S_{i}\in C$, we introduce a node $v_{S_{i}}$ in $V$ as well. The edge set $E$ of the network $G=(V,E)$ is defined by the following rule: there is an edge $(v_{s},v_{S_{i}})\in E$ and an edge $(v_{S_{i}},v_{t})\in E$ iff the corresponding element $v$ is contained in $S_{i}$. The set of communicating pairs is defined as $P=\{(v_{s},v_{t}):v\in S\}$ and the set of potential middlebox locations is defined as $U=\{v_{S_{i}}:S_{i}\in C\}$. $G=(V,E)$ is a bipartite graph with partitions $U$ and $\{v_{s}:v\in S\}\cup\{v_{t}:v\in S\}$. If $v\in S$ is contained in a set $S_{i}\in C$ then there is a path of length 2 between the corresponding pair $(v_{s},v_{t})$ in $G$. This is also the shortest path between $v_{s}$ and $v_{t}$. In the middlebox deployment problem with stretch $\rho=1$, a set of nodes $M\subseteq U$ of minimum cardinality must be selected such that between each pair $(v_{s},v_{t})\in P$ there is a route of length of at most 2 and it contains at least one node of $M$. By the construction of the network, for each pair $(v_{s},v_{t})\in P$, there is a route $v_{s},v_{S_{i}},v_{t}$ of length 2 in $G$ if and only if $v\in S_{i}$. Let $M\subseteq U$ be a minimum cardinality solution of the middlebox deployment problem. The node set $M$ implies a minimum cardinality solution for the MSC problem and vice versa. This proves the NP-hardness of the problem.

The inapproximability results follow from the combination of the above reduction and the inapproximability results of the minimum set cover problem by Raz and Safra [35] and by Feige [15]. Raz and Safra [35] proved that the minimum set cover problem is not approximable within $c\log n$, for some $c>0$, unless $P=NP$. Feige [15] showed the inapproximability within $(1-\epsilon)\ln n$, for any $\epsilon>0$, unless $NP\subset\mbox{\sc Dtime}(n^{\log\log n})$. If we had a better approximation for the middlebox deployment problem, by the above reduction, we would have a better approximation factor for the minimum set cover problem, as well. ∎

IV Group and Weighted Variant

There are scenarios in which more than two nodes may have to share a network function. For example, consider the problem of placing a multiplexer for a group of users involved in a teleconference. Or imagine the problem of mapping a shared object or entire virtual server server of a multi-user game: in order to avoid state synchronization overheads, the users should be served from a single location which is also located close to all the users. Also in the context of distributed cloud computing, the problem of placing functionality for larger groups may be relevant. Moreover, so far we have assumed that all requests induce the same load. However, in reality, different communication pairs communicate at different rates, which may also result in different loads on the middleboxes.

In this section, we show that both the group assignment variant as well as the weighted pair request variant can be solved by exploiting an interesting connection to energy-efficient scheduling [16, 17, 23]. As we will see, in order to make this generalization, we will however need to sacrifice the incremental property. Moreover, we need a constant factor resource augmentation (concretely, a factor of 2).

Let $n$ be the total number of requests (set $R$), and let $p_{j}$ be the “price”, i.e., the load induced by assigning the $j$-th request to a middlebox: the request can be an arbitrarily weighted node pair or group of nodes. Our greedy algorithm runs in rounds, where in each round, the “most effective” middlebox, a middlebox at a location which maximizes a certain (submodular) function, is chosen and added to our solution set. Concretely, given a set $S$ of already deployed middleboxes, let $F(S)$ denote the maximum number of requests that can be processed by a set $S$ of middleboxes of capacity $\kappa$. Since computing $F(S)$ is NP-hard, we follow the work of [23] and compute a fractional solution using linear programming. The resulting fractional values will eventually be rounded. For every middlebox-request pair $(i,j)$, we introduce a binary variable $x_{i,j}$: it is 1, if request $j$ is assigned to middlebox location $i$, and 0 otherwise. As a preprocessing step, let us first delete (1) all requests $j$ with $p_{j}>\kappa$, i.e., requests which cannot be served by any middlebox anyway; (2) all request-middlebox pairs which would exceed stretch constraints; and (3) all request-middlebox pairs where the middlebox is not at a legal location. We set the corresponding $x_{i,j}$ values to 0. We will relax the $x_{i,j}$ variables, and define $f(S)$ to be the maximum weighted sum of requests that can be fractionally processed by a set $S$ of middleboxes. We can compute $f$ with Linear Program (LP) 2:

It follows from [16] that the relaxed function $f$ is submodular. We define $gain(i,S)=f(S\cup\{i\})-f(S)$ for any $S\subseteq U$, $i\in U$.

The greedy algorithm (Algorithm 3) adds middleboxes one-by-one, greedily selecting the one yielding the highest $gain(i,S)$. We stop when $f(S)>n-1$: stopping prematurely is needed due to the fractional solution of the relaxed approach [23]. In the end, we round the fractional solution using the approach by Shmoys and Tardos [39].

Given this transformation, we can apply [23] and obtain that following approximation: with an augmentation factor of 2, we can serve all requests with at most a logarithmic factor more middleboxes.

Theorem 5**.**

The weighted resp. group network function placement problem can be $(2,1+\ln n)$-approximated via the Generalized Greedy Algorithm in polynomial time, i.e., the number of deployed middleboxes is at most $(1+\ln n)$ times the minimum and the maximum load on each middlebox is at most $2\kappa$.

Relationship to Datacenter Scheduling. Let us now elaborate more on the interesting relationship of this problem to datacenter scheduling problems. In the datacenter scheduling problem [23], we are given a set of $m$ machines and $n$ jobs. The processing time of job $j$ on machine $i$ is $p_{i,j}$. Each machine $i$ has an activation cost $a_{i}$. The scheduling algorithm is given a total activation budget $A$, and needs to compute a subset of machines to activate which respect this budget constraint, and minimizes the makespan $T$: the length of the execution schedule.

We translate this problem to our problem as follows. The machines correspond to the $m$ possible middleboxes (set $M$ corresponds to all possible locations $U$), and the jobs correspond to the $n$ requests. The cost of assigning a group resp. a weighted request $j$ to a middlebox $i$ corresponds to $p_{i,j}$; since in our model, this cost only depends on the request $j$ but not on the middlebox $i$, we simply write $p_{j}$ instead of $p_{i,j}$. The activation cost $a_{i}$ corresponds to the deployment cost and is the same for all middleboxes; we set $a_{i}=1$.

In our algorithm, we greedily aim to select a subset of servers / middleboxes which maximize the (weighted sum of) covered requests. We need to cover all the requests, subject to middlebox capacity constraints $\kappa$, which correspond to the makespan.

V Evaluation

In order to complement our formal analysis, we conduct a simulation study comparing the approximation algorithms presented above to the respective optimal algorithms implemented using Integer Programming (IP). We evaluate our greedy approximation algorithm using the following metrics: (1) the number of installed middleboxes and (2) runtime. Furthermore, we explore the performance of the approximation algorithm for the weighted variant and when incrementally deploying single middleboxes.

All experiments were conducted on servers with two Intel XEON L5420 processors (8 cores overall) equipped with 16 GB RAM.

V-A Datasets

We have generated two datasets, one for the unweighted approximation algorithm presented in Section III and one for the weighted approximation algorithm presented in Section IV.

For the unweighted variant, we use real-world wide-area topologies obtained from the topology zoo collection [24]. As shown in Figure 5 (top), the topologies are either country-wide or continent-wide ISP, backbone, or – in case of Geant – research networks. The topologies were selected so that the number of nodes is equally spread across the range 20 to 82. Furthermore, the topologies provide detailed geographical information for nodes, such that communication latencies can be estimated based on the geographical distance.

For each graph, we generate instances as follows: Each of the $|V|\cdot(|V|-1)/2$ potential communication pairs is selected with probability $p$, set to $0.2$, $0.3$, or $0.4$, respectively. Hence, the number of expected communication pairs to be created overall is $p\cdot|V|\cdot(|V|-1)/2$.

To ensure comparability across topologies, all nodes are allowed to host middlebox functionality. The capacity $\kappa$ is set to $\lceil 2\cdot(|V|-1)\cdot p\rceil$: Hence, (in expectancy) around $|V|/4$ many middleboxes are likely to be necessary to serve the communication pairs. All communication pairs have the same (latency) stretch. Concretely we set the maximal allowed latency to $\{1.00,1.05,1.10,\dots 2.50\}$ times the latency of the shortest path between the nodes of the communication pair. For each topology and each probability, we generated $11$ scenarios uniformly at random, yielding more than 7,000 instances overall.

We employ a similar approach for the evaluation of the approximation algorithm for the weighted variant. Concretely, we consider four instances (see Figure 5 (bottom)) of the SNDlib [32], which already define communication pairs exhibiting a diverse demand structure. Analogously, we again consider stretches of $\{1.0,1.05,\dots,2.5\}$. To generate multiple instances from a single SNDlib instance, we sample requests by selecting each original communication pair independently at random with a probability of 0.5. We again allow to place middleboxes on all nodes in the network and set the capacity of each of the potential middlebox locations to $4\cdot D/|V|$, where $D$ denotes the cumulative demand of the chosen requests, such that at least $1/4$ many nodes must be equipped with middleboxes. We generate 3,100 scenarios in total by considering 31 different stretch parameters and considering 25 random generated instances for the four different topologies.

V-B Baseline Algorithms

Besides employing the approximation algorithms presented above, we use Integer Programs to compute optimal solutions. Integer Program (IP) 4 computes optimal solutions for the middlebox deployment problem with unitary demands111 The existence of a 0-1 integer linear program, together with our NP-hardness result, also proves the NP-completeness [22]. and works as follows:

For all potential middlebox locations $u\in U$, let $S_{u}$ be the set of pairs $P$ that can be routed through $u$ on a path of stretch at most $\rho$, i.e., $S_{u}=\{p=(s,t)\in P$ : $d(s,u)+d(u,t)\leq\rho\cdot d(s,t)\}$, where $d(v,w)$ denotes the length of the shortest path between nodes $v,w\in V$ in the network. $S_{u}$ can be precomputed efficiently. For all potential middlebox locations $u\in U$, we introduce the binary variable $x_{u}\in\{0,1\}$. The variable $x_{u}$ indicates that $u$ is selected as a middlebox node in the optimal solution $M$, i.e. $x_{u}=1\Leftrightarrow u\in M$. For all $u\in U$ and $p\in P$, we introduce the binary variable $x_{up}\in\{0,1\}$. The variable $x_{up}$ indicates that the pair $p=(s,t)\in P$ is assigned to the node $u\in U$, s.t. the path stretch from $s$ to $t$ through $u$ is at most $\rho$.

The Objective Function (4) requires that a minimum cardinality middlebox set must be selected. Constraints (4) declare that each pair $p=(s,t)\in P$ is assigned to exactly one node $u\in U$. Constraints (4) state that each pair $p=(s,t)\in P$ can only be assigned to a node $u\in U$ with $p\in S_{u}$. By the definition of $S_{u}$, the pair $p$ can be routed through $u$ via a path of stretch at most $\rho$. Constraints (4) describe that the capacity limit $\kappa$ must not be exceeded at any node, and nodes $u\in U$ which are not selected in the solution $M$ (where the corresponding variable $x_{u}$ becomes 0 in the solution) are not assigned to any pair $p\in P$.

This Integer Program can easily be adapted for the weighted (and or group) variant by adapting Constraint (4). Concretely, Constraint 4 needs to include the additional factor $d_{p}$, denoting the demand of request $p$:

[TABLE]

As we are also interested in studying the opportunities arising in incremental deployment scenarios, we also introduce IP 5 which computes the maximum assignment for any given number of middleboxes. Concretely, given a number $n\in\mathbb{N}$ of middleboxes to activate (see Constraint 5), the number of connected communication pairs is maximized (see Constraint 5), while ensuring that a communication pair may at most be assigned to exactly one middlebox (see Constraint 5).

We have implemented the IPs in Python using Gurobi 6.5.

V-C Runtime and Number of Middleboxes

We first study the runtime and the empirical approximation factor of the approximation algorithm 1 on the randomly generated topology zoo instances. To this end, we have implemented the greedy approximation algorithm in Python. Our implementation may use multi-threading for the computation of the middlebox-selection in Algorithm 1 (Lines 4-9). The computation of the Integer Program solutions is implemented via Gurobi 6.5 using a single thread.

In Figure 6 (right and bottom), the average runtime of the greedy (G) approximation algorithm with 1 and 8 threads, and the IP is depicted. In the middle plot the averaged runtimes are shown. Here, each data point represents the aggregate of $31\times 11=341$ experiments. The average runtime of the sequential greedy-algorithm lies below the one of the IP for 20 and 30 nodes, and the greedy algorithm with 8 threads clearly outperforms the IP on the topologies with 62, 71 and 82 nodes. On the largest topology the computation of the greedy algorithm can be sped up by a factor of around 5, by using 8 threads. Furthermore, the runtime of the IP is on the largest topology one magnitude higher than the one of the 8-threaded greedy algorithm. The left plot of Figure 6 depicts the runtime of the 8-threaded greedy variant and the IP on the largest topology as a function of the stretch. Starting at a stretch of 1.3, the runtime of the IP increases dramatically. This is due to the fact that by increasing the stretch, the number of potential middleboxes, serving a communication pair, increases. In fact, on the largest topology, the IP consisted of up to 90k variables.

Regarding the number of installed middleboxes, the left box plot of Figure 6 shows the approximation ratio, i.e., the number of middleboxes opened by the greedy algorithm divided by the optimal number of middleboxes computed by the IP. The median lies below 1.5 and the maximum is close to 1.8.

V-D Weighted Requests

Next, we study the performance of the approximation algorithm discussed in Section IV, for weighted problems (cf. Algorithm 3). As discussed in Section V-A, we use SNDlib instances exhibiting a diverse demand structure (see Figure 7 left). Again, we have implemented the generalized approximation algorithm and the corresponding adaption of Integer Program 4 in Python.

As a first result, the middle plot of Figure 7 shows the averaged relative number of deployed middleboxes of the greedy algorithm with respect to the optimal solution of the IP. The greedy approximation algorithm only seldomly opens – on average – more than 20% middleboxes more than the optimal algorithm. Note that, in some cases, the number of deployed middleboxes lies even beneath the optimal one. This is possible, as the considered algorithm may (cf. Figure 7 right) violate the middlebox capacity up to a factor of 2. Indeed, the approximation algorithm violates capacities in less than 25% of the cases (cf. Figure 7).

V-E Incremental Middlebox Activation

Lastly, we study scenarios in which middleboxes are added one after another. Concretely, we assume that all communication pairs are known in advance while the network operator can only incrementally install single middleboxes (e.g. due to the associated cost). The greedy algorithm always places one additional middlebox while not being allowed to change previously selected middlebox locations. We study the number of assigned communication pairs of the greedy algorithm compared to the optimum number of assignments when middlebox locations may be arbitrarily selected. To compute the optimum number of assignments the IP 5 is used.

We consider the same experimental setup as described in Section V-C (i.e. topology zoo instances), while constraining the probability to create communication pairs to $p=0.3$.

We present the results of this set of experiments in Figure 8. The left plot depicts the relative difference of assigned communication pairs when using the greedy algorithm compared to the IP baseline. Concretely, the relative difference is defined as $(\phi_{\mathrm{IP}}-\phi_{\mathrm{G}})/\phi_{\mathrm{IP}}$, where $\phi_{\mathrm{IP}}$ and $\phi_{\mathrm{G}}$ denotes the number of assigned communication pairs of the IP and the greedy algorithm, respectively. The rows of the left plot averages the results for all scenarios having the same number of minimal middleboxes to serve all communication pairs. The number of scenarios averaged in this way is depicted in the right plot of Figure 8: the number of scenarios for which 10 middleboxes suffice and which are averaged in the row 10 is for example around 520.

Considering any row, we see that the greedy algorithm assigns nearly always as many communication pairs until the number of middleboxes reaches the optimum (minimal) number of middleboxes. After coming close to the optimum number of middleboxes, the relative difference in assignments reaches a maximum valiue of $0.15$ and then diminishes only slightly with each additional greedily placed middlebox. The ability to (re-)place middleboxes in an arbitrary fashion hence only becomes important when sufficiently many middleboxes were already places to serve almost all communication pairs.

VI Summary and Conclusion

This paper initiated the study of the network function placement problem which is motivated by the increasing flexibilities of modern virtualized networked systems. Our main contribution is a combinatorial proof of the submodularity of this problem and an incremental log-approximation network function placement algorithm. We also initate the study of a randomized rounding approach for a weighted group-version of the problem. Our simulation results show that this approach computes a nearly optimal placement for real world network instances.

We understand our work as a first step, and believe that our paper opens several interesting directions for future research. In particular, it will be interesting to know whether good approximations exist for the incremental deployment of entire group requests.