InKeV

Abstract

InKeV is a network virtualization platform based on eBPF, an in-kernel execution engine recently upstreamed into linux kernel. InKeV's key contribution is that it enables in-kernel programmability and configuration of virtualized network functions, allowing to create a distributed virtual network across all edges hosting tenant workloads. Despite high performance demands of production environments, existing virtualization solutions have largely static in-kernel components due to the difficulty of developing and maintaining kernel modules and their years-long feature delivery time. The resulting compromise is either in programmability of network functions that rely on the data plane, such as payload processing, or in performance, due to expensive user-/kernel-space context switching. InKeV addresses these concerns: The use of eBPF allows it to dynamically insert programmable network functions into a running kernel, requiring neither to package a custom-kernel nor to hope for acceptance in mainline kernel. Its novel stitching feature allows to flexibly configure complete virtual networks by creating a graph of network functions inside the kernel. Our evaluation reports on the flexibility of InKeV, and in-kernel implementation benefits such as low-latency and impressive flow creation rate.

Composing eBPF Programs Made Easy With HIKe and eCLAT

“…Another approach for using eBPF inside the NFV world is provided by Zaafar et al with their InKeV framework [41]. InKeV is a network virtualization platform based on eBPF, devoted to foster programmability and configuration of virtualized networks through the creation of a graph of network functions inside the kernel.…”

High-performance Intrusion Detection Systemusing eBPF with Machine Learning algorithms

“…These features include load balancing [21], key-value storage [22], application level filtering [23], and DDoS mitigation [24]. In-KeV [25] is a framework for developing network services that run within the kernel. eBPF creates in-kernel Service Function Chains (SFC) via tail calls.…”