Improving the Deployment of Multi-Tenant Containerized Network Function Acceleration

The increasing amount of real-time communication in multimedia as well as industrial applications (e.g., Internet of Things or Edge Computing) has fostered the demand for low-latency network services. To further reduce the latency perceived by applications, technologies to drive parts of service functions deeper into the network have been developed. This includes network programmability solutions like Software-defined Net-working and programmable data planes, e.g., smart network interfaces and switches that provide parts of the application directly at the network edge (i.e., closer to the end user). Accordingly, custom tenant code supporting these virtualized network functions at the edge can be run directly in the data plane or in the network operating system (NOS). Containerized network functions (CNFs) have been developed to become a lightweight and increasingly prevalent virtualization form. However, network and edge computing infrastructures are used by multiple tenants running individual network functions that should not interfere and cause a negative impact on each other, while still ensuring mentioned low-latency requirements. Isolation must be assured even if direct hardware access is granted to accelerate or augment network services. This paper introduces an approach to improve the isolation of CNFs for multiple tenants by controlling the deployment of custom in-network code as well as limiting side effects of runtime updates on other tenants. To decrease the complexity of deploying new accelerated CNFs, a manifest named Tenant Definition Code (TDC) is presented. The benefits of this approach are discussed by means of accelerated machine learning in CNFs as an exemplary use case.