Efficient traffic monitoring in 5G Core Network

(1)

IN

DEGREE PROJECT COMPUTER SCIENCE AND ENGINEERING, SECOND CYCLE, 30 CREDITS

STOCKHOLM SWEDEN 2020,

Efficient traffic monitoring in 5G Core Network

MASSIMO GIRONDI

KTH ROYAL INSTITUTE OF TECHNOLOGY

SCHOOL OF ELECTRICAL ENGINEERING AND COMPUTER SCIENCE

(2)

(3)

Efficient traffic monitoring in 5G Core Network

Massimo Girondi

Degree Project in Computer Science and Engineering

Hosting Company Ericsson AB

Industrial supervisor András Zahemszky

Examiner Ben Slimane Academic supervisor Ki Won Sung

KTH Royal Institute of Technology

School of Electrical Engineering and Computer Science

Stockholm - 2020/06/16

(4)

(5)

Abstract

5G is an enabler to several new use cases. To support all of them, the network infrastructure must be flexible and it should adapt to the different situations.

This feature is powered by SDN, NFV, and Automation, three of the main pillars on which the 5G network is built.

Traditional network management approaches may not be suitable for the 5G Core Network User Plane, which holds strict requirements in terms of latency and throughput. Therefore, Artificial Intelligence agents have been proposed to manage the 5G in a more efficient manner, delivering a more optimized allocation of the resources. This approach requires real-time monitoring of the data passing by the Core Network, a feature not standardized by the current protocols.

In this thesis, the design of a monitoring protocol for the 5G Core Network User Plane has been studied, focusing on precise measurement of latencies. Then, a In-band Network Telemetry (INT) framework has been implemented on top of a User Plane Function prototype. The prototype is built on top of a novel User Plane implementation, based on chaining of atomic functions called micro-UPFs (µUPFs).

While the main focus of this work has been latency measurement, packet counters, byte counters and Inter Packet Gap values can be collected from the framework, proving the main KPIs of a 5G User Plane. The INT framework has been implemented through two new µUPFs, one for updating the INT metadata and one for collecting them. These metadata are attached to the user packets as GTP-U extended header, maintaining compatibility with the standard protocol.

Moreover, the implemented framework allows high flexibility through dynamic tuning of the parameters, providing mechanisms to reduce the amount of telemetry data generated and, thus, the system overhead.

The framework has been tested on a physical setup of four server machines, abstracting a Core Network User Plane, connected with 10 Gbps NICs. In all the tests performed, the performances of the User Plane are affected by the new functionalities only when INT metadata are inserted very frequently. The results show that is possible to monitor the three main KPIs of a 5G User Plane without heavily limiting the system performances.

(6)

Keywords

5G, Core Network, Network Monitoring, In-band Network Telemetry, Latency measurement

(7)

Sammanfattning

5G är en möjliggörare för flera nya användningsfall: för att stödja dem alla måste nätverksinfrastrukturen vara flexibel och den ska anpassa sig till de olika situatio- nerna. Denna funktion drivs av SDN, NFV och Automation, tre av de viktigaste pelarna som 5G-nätverket är byggt på.

Traditionella nätverkshanteringsstrategier kanske inte passar för 5G Core Network, som har strikta krav när det gäller latens och genomströmning. Därför har Artificial Intelligence-agenter föreslagits att hantera 5G på ett mer effek- tivt sätt, vilket ger en mer optimerad fördelning av resurserna. Detta tillväga- gångssätt kräver realtidsövervakning av data som passerar via Core Network, en funktion som inte standardiseras med de aktuella protokollen.

I denna avhandling har utformningen av ett övervakningsprotokoll för 5G Co- re Network User Plane studerats med fokus på exakt mätning av latenser. Sedan har ett in-band Network Telemetry (INT) -ramverk implementerats ovanpå en prototyp för User Plane Function. Denna prototyp utnyttjade Chain Controller- arkitekturen, en ny användarplan-implementering baserad på kedjan av atom- funktioner som kallas µUPF.

Medan huvudfokuset för detta arbete har varit latensmätning, kan paketräk- nare, byttäknare och Inter Packet Gap-värden samlas in från ramverket, vilket bevisar de viktigaste KPI: erna i ett 5G-nätverk. INT-ramverket har implementerats genom två nya µUPF, en för att uppdatera INT-metadata och en för att samla dem. Dessa metadata är anslutna till användarpaketen som GTP-U utökad rubrik, bibehållande kompatibilitet med standardprotokollet. Dessutom tillåter det implementerade ramverket hög flexibilitet som tillåter dynamisk in- ställning av parametrarna, tillhandahåller mekanismer för att minska mängden telemetri-data som genereras och därmed systemomkostnaderna.

Ramverket har testats på en fysisk installation av fyra servermaskiner som abstraherar ett Core Network User Plane, anslutet med 10 Gbps NIC. I samt- liga tester påverkas testbäddens prestationer av de nya funktionerna först när INT-metadata sätts in mycket ofta. Resultaten visar att det är möjligt att över- vaka de tre huvudsakliga KPI: erna i ett 5G-nätverk utan att starkt begränsa systemprestanda.

(8)

(9)

Aknowledgments

I would like to thank András Zahemszky, my supervisor at Ericsson Research, together with the whole Core Network division for the possibility to work on this interesting and innovative topic about 5G.

I’m also very grateful to Ki Won Sung, my supervisor at KTH and Ben Slimane, my examiner, for having guided me along the whole process, with important feedbacks.

I would also like to thank the EIT Digital Master School that gave me the op- portunity to visit a different country, Sweden, and experience a diverse academic environment.

Finally, a mention to my friends, who supported me during these years, and to my family, that made this entire journey possible.

Stockholm, 2020/06/16

(10)

(11)

List of Figures

2.1 Network Slicing example with two use cases.. . . . 12

2.2 Basic 5G architecture components . . . . 15

2.3 Example of multiple PDU Sessions. . . . 20

2.4 Example of UPF chaining. . . . 22

2.5 Chain Controller in the 5G architecture . . . . 27

2.6 Chain Controller Architecture with 2 sites . . . . 28

2.7 µUPFs chaining with two UP nodes . . . . 30

2.8 In-band Telemetry approach . . . . 33

3.1 UpLink intermediate timestamps. . . . 36

3.2 DownLink intermediate timestamps . . . . 36

3.3 Loss of packets with telemetry metadata. . . . 46

4.1 GTP-U header with extension . . . . 49

4.2 GTP-U header with INT headers. . . . 52

4.3 Bit structures of the monitored parameter and its components . . . . 54

4.4 Position and structure of INT actions inside a single UP node. . . . 58

4.5 Update and Collect actions with update and aggregation rates set to 2 . . . . 58

5.1 A typical network testing setup with a Traffic Generator. . . . 63

5.2 The simulated Core Network setup. . . . 65

5.3 Containers that compose the environment . . . . 66

5.4 The simplified Core Network implemented in the physical testbed (UpLink traffic) . 68 5.5 Core Network UP nodes allocation and their mapping to the physical servers (UpLink traffic). . . . 69

5.6 Core Network UP nodes allocation and their mapping to the physical servers (UpLink traffic) with network simulation. . . . 70

6.1 Throughput and RTT versus offered bandwidth . . . . 74

6.2 Performances for different values of parameters, with aggregation set to 1 (send for every metadata received).. . . . 78

6.3 Throughput for different update and aggregation values for parameters=15 (all parameters). . . . 79

6.4 Throughput for different packet sizes, all parameters. . . . 79

6.5 Throughput over time for parameters=15 (all parameters) . . . . 80

(16)

6.6 Performances for different update and aggregation rates, parameters=7 . . . . 81 6.7 Flamegraph resulting from update=1, aggregation=1, parameters=7. . . . 82 6.8 Performances for different amount of monitored flows, parameters=7,

aggregation=1. . . . 84

(17)

1 | Introduction

Mobile networks have faced a huge development from the first major deployments in the late 1980s, passing from a voice-oriented service to a data-oriented one, with a deep revolution in both the Radio and Data segments of the network.

Together with the evolution of the radio and transport technologies, a deep revolution has involved the management and the operation of these networks, passing from manually designed and configured infrastructures to systems that can self-manage themselves, equipped with advanced intelligence to achieve a high flexibility. All of these capabilities has been adopted by all the recent standards. The so-called 5G system is currently the latest revision of the mobile network standards, based on the release 15^th, published by the 3GPP Consortium in 2019 [1].

Mobile networks have been envisioned as one key feature in the development of future technologies, opening the path to new products and new use-cases. To support all of them, a flexible and efficient network is required, involving the update of the standards that regulate the mobile networks. Indeed, the 3GPP periodically issues updates of their standards, taking into account advancements in the technology or in the requirements [2].

Under this scenario, the research activities in the field of Mobile Networks are a paramount activity to open the path to new specifications and to fulfill the requests of users and operators.

Operating a network infrastructure is a critical task that requires a high knowledge of the data passing by the system. To obtain this type of information, general network monitoring solution have been developed in the last 20 years, especially focusing on big Data Center network infrastructures. On the other way, no standard has been defined by the 3GPP to retrieve real-time monitoring data from the mobile network. Moreover, only aggregated counters are available, providing information with a not suitable frequency for real-time oper- ations. With a better and real-time knowledge of the traffic that passes through a network, Data Driven approaches to design and manage the network may be followed, obtaining a more efficient and optimized infrastructure. This is one of the main tracks on which Ericsson is operating, evolving from traditional networks to automated and Artificial Intelligence powered systems [3], [4].

(18)

1.1 Problem statement

In this thesis, the main problem to be solved is the monitoring of data in the 5G Core Network, with particular focus on the User Plane. The main reason for that is the lack of efficient and standardized systems in the current release [5] to provide fine-grained statistics on the data that are carried across the network.

This feature will open the path to a more precise and advanced techniques to manage and operate the network, potentially reducing both the Capital and Operation Capital Expenditures.

1.2 Background

The 5G ecosystem is designed to support different use-cases [6] and, to support all of them, a very flexible and intelligent network architecture is required.

To achieve this goal, the 5G system is designed to take full advantage of Soft- ware Defined Networks (SDN) and Network Functions Virtualization (NFV), integrating everything into a unique system, based on an IP-oriented physical infrastructure [7]. In order reach the best optimization of the resources and to prevent bottle-necks and other network problems, all the modern networks (e.g.

longer routes or packet losses) are supposed to integrate some self-healing systems, which can monitor the status of the resources and act accordingly, steering the deployments of new infrastructures to the concept of Knowledge-Defined- Networking [8], [9].

Automation is one of the key drivers of 5G [10] and, through the concept of Self-Organizing-Networks, the life-cycle costs of the infrastructure are envisioned to decrease, as it has been experienced by operators that adopted it in LTE networks [11].

Therefore, automation in the next-generation mobile networks would assume a strategic role, requiring advanced agents to coordinate and manage the infrastructure. These would be, ideally, powered by Artificial Intelligence algorithms [12]. However, all Artificial Intelligence algorithms require a large base of data to be trained against, in order to obtain systems that can take reliable and correct actions. Thus, monitoring of flows and other metrics in the 5G Core Network represent one of the enablers for this technology.

1.2.1 Motivations

Self management of the Core Network is a paramount requirement for a flexible and robust 5G network. However, to obtain an efficient and powerful Artificial Intelligence (AI) agent that can manage the network, a lot of data is required.

(19)

1.2. Background 3

These real-time data are required both for the initial training of the agent and for an efficient operation of it, which should rely on a vast amount of real-time information to take correct and effective decisions. Therefore, the collection of diagnostic and monitoring data from the 5G infrastructure is required to provide enough information to this agent.

The latest 5G standard, Release 15 [1], provides some monitoring and diagnostic functionalities, which could be used by the network tenant to monitor and better manage the infrastructure. Beside the standards, some vendors have introduced monitoring functionalities in their equipment, usually to power a pro- prietary monitoring system.

However, these data are usually aggregated and does not provide enough details, as needed by the system pictured above, which require precise monitoring of the data flows passing by the network. Furthermore, the time resolution of these data is usually around tens of seconds, resulting in the impossibility of taking quick and real time decisions.

On the other hand, generic network monitoring solutions have been developed during the last years, with a close integration with SDN architectures and cloud- based technologies. The majority of these solutions are intended to monitor a generic data network, like the one of a Data Center or the Access Network of a traditional landline ISP, and none of these could be directly applied in a 5G Core Network. A brief overview of these technologies is provided in Section 2.12.

For detailed and efficient monitoring, the integration of new monitoring functionalities in the 5G building blocks is of primary importance. It could be realized in the form of NVFs that can be integrated with the other 5G elements, following the general guidelines used by the 5G standard. The main goal is to obtain a system that can provide detailed metrics and statistics about the data that travel across the network, with a particular focus on the main Key Performance Indicators (KPIs) of 5G: throughput, latency and packet-loss [6].

In order to obtain useful metrics tofeed (and train) the AI-based agent, these should be generated with a high granularity (namely, on a user- or application- basis) and the precision (in terms of time resolution and aggregation) should be customizable. For instance, the mobile operator (or the monitoring system by itself) should be able to change the frequency of the reports and the monitored parameters accordingly to the data that are traveling across the network. Ide- ally, this could be done in real-time when certain traffic flows are identified or particular metrics are hit. A similar approach has been explored in [13], where a dynamic monitoring system for 5G has been proposed.

(20)

Another possible usage of these metrics is applications optimization, which may be done by some vendors by looking at the precise statistics of the traffic distribution and the users’ behavior, with higher precision than a standard, server-side, monitoring.

Finally, the monitoring data could also be used by the infrastructure tenants to demonstrate the compliance with the Service Level Agreements and, in order to fulfill them, to identify efficiently and precisely the sources of the problems that can cause the non-compliance.

1.3 Research questions

The main research question that has lead the work behind this thesis is

Is it possible to efficiently monitor the user data in the 5G Core Network User Plane?

To answer this main question, some sub-questions have been derived:

What is possible to monitor in the User Plane? One of the main points of this research is to understand which parameters can be monitored in a 5G infrastructure. Usually, the three main parameters that are analyzed in similar solutions are throughput, latency and packet-loss but, in a Core Network, other parameters may be interesting. The frequency and the time resolution of the parameters has been investigated, together with the amount of data produced by the system. These points could steer the development of the final AI agent.

How to implement the monitoring? In order to answer all the questions, an implementation of a prototype of the designed solution has been done. Imple- mentation choices have been taken after a crytical literature and system review.

These choices has led to the design of the prototype.

What are the trade-offs? As in any real-world application, trade-offs are an omnipresent element. In particular, the trade-offs between time resolution and overhead has been analyzed, with the aim to determine a suitable monitoring frequency. This should prevent the framework to not introduce too much overhead in the system. Similarly, the impact on the total system throughput has

(21)

1.4. Purpose 5

been analyzed, showing how the testbed throughput has been affected by the introduction of the new functionalities.

1.4 Purpose

The main purpose of this thesis is to research and investigate about the absence of effective monitoring functionalities in the 5G standards. This results in the implementation of a solution (or, rather, a prototype of it) that can provide enough useful data, which may be exploited for research on AI powered networks.

As already discussed in Section1.2.1, the main benefits that can result from this solution are:

• Detailed collection of metrics about the users traffic.

• Precise statistical modeling of the network behavior.

• Effective detection of network faults.

• More efficient and optimized Core Networks.

1.5 Goals

The goals of this thesis can be elaborated as:

• Research about different monitoring techniques which may be used in a 5G Core Network.

• Design a monitoring solution for the 5G User Plane.

• Implement a prototype of this solution.

• Study the performances and the impact on the 5G KPIs through a simplified 5G network topology.

• Evaluate the precision of the data and the trade-off between performances and precision.

1.6 Ethics and Sustainability

On the sustainability side, the implementation of Self Organizing Networks should lead to more efficient and optimized infrastructures, which will result in a minor OPEX and CAPEX waste for the operators [11]. Moreover, thanks to

(22)

the higher optimization that can be achieved, less energy should be required to operate the infrastructure, reducing the environmental footprint of mobile networks. Energy efficiency is, indeed, a key feature of the 5G system.

With this new source of telemetry data, equipment manufacturers can adapt their products to a more realistic application scenario, resulting in more efficient solutions and deployments.

From a social and legal point of view, the monitoring may hit the boundaries imposed by the Terms of Service (ToS) of the operators about the collection of data. Even if statistical data are already collected by the operators, this new solution may involve the adaptation of the above ToS in order to comply with the actual legislation.

Finally, a great effort should be put to protect the privacy of the user, especially when this system is applied in countries with data-protection rules, like the GDPR [14] in Europe. Thus, operators and tenants should enforce strict policies on who can see the collected data and with which detail level. Moreover, a different level of data aggregation should be provided to the different consumers, avoiding the distribution of unnecessary sensitive data.

1.7 Methodology

In order to achieve the goals stated in Section1.5, the thesis can be articulated into five different phases:

Solution design In this first phase, after a literature review about the state- of-the-art methods of network monitoring and about the 5G Core Network architecture, an initial solution has been designed, together with the solution and the test platform.

5G User Plane deployment To test the developed functionalities in a real- world like scenario, a simplified User Plane system has been setup in a virtual environment. This consists in a subset of Network Functions belonging both to User Plane and Control Plane. This system has been used to test the correct deployment of the prototype and its functionalities (namely, if all the components work correctly after introducing the new functionalities). This prototype is based on a novel concept of Core Network User Plane decomposition into smaller entities, called µUPFs, introduced in [15]

and discussed in Section 2.9.

Minimal, High Performance, testbed implementation In order to mea-

(23)

1.8. Delimitations 7

sure the impact on the main KPIs of the 5G User Plane, a minimal testbed has been implemented, consisting only in some User Plane nodes, and a Traffic Generator engine. This setup, which is far from a real-world scenario, made possible to measurements about the performances of the µUPF under study with and without the monitoring functionalities. Moreover, by limiting the possible elements that may influence the measurements, the validity of the tests has been improved.

Solution implementation After the design phase, an iterative process has been performed to implement the desired functionalities, in a bottom-up approach. The implementation involved the main µUPF block, alongside with the algorithms and the configuration files that are needed in the global architecture to use these new functionalities. During this phase, the 5G UP prototype and physical testbed have been used to test the functionalities Performance evaluation Taking advantage of the minimal testbed, an evalu-

ation of the performances of the system has been conducted, through the collection of quantitative data that have been analyzed through automatic procedures.

1.8 Delimitations

Since all the analysis performed in this thesis have been done in a controlled, simulated environment, the results may not be directly applicable to a real-world scenario. In particular, the quantity of the traffic and the characteristics of it, even if modeled with statistical means, may not represent a realistic environment.

However, if a correct methodology and a rigorous testing method is followed, we can assume that the results obtained are valid, until the opposite is proven. The testing of these functionalities in a real environment and with real traffic samples certainly represents a good starting point for a future work.

1.9 Contributions

The main contributions of this thesis consist in the development of the monitoring functionalities, in the form of a µUPF. The µUPF concept is part of the actual research topic at Ericsson and will be explained with more details in Section 2.9.

Along with these functionalities, a data-collection system has been designed, in order to store the collected data and made them useful for other applications.

However, since this is not the main purpose of this work, the implementation of

(24)

this system has been limited to a minimal prototype, used only for testing the implemented functonalities.

1.10 Thesis outline

In Chapter2, a general overview of the 5G system and the main technologies involved in the work will be given. The design of the system is described in Chap- ter 3, while some implementation details are discussed in 4. The experimental setup and methodology, which lead to the major results reported in Chapter6, is described in Chapter5. Finally, in Chapter7the main conclusions are discussed, along with some hints for future works.

(25)

2 | _Background

In this chapter, some basic concepts of 5G and its Core Network are explained, in order to give a general overview of the field and to introduce some concepts that have been used in this thesis.

The reader already familiar with the 5G concepts could jump directly to Section 2.8, where the relevant technologies used in this work are treated.

2.1 5G: a new family of technologies

The 5G architecture is the last evolution of the mobile networking and it is currently been deployed in several locations around the world. Thanks to the last achievements in both the radio and network areas, a brand-new set of use- cases and applications have been introduced, with a major focus on three main scenarios [6], [16], [17]:

Enhanced Mobile BroadBand (eMBB) , focusing on end-user experience with mobile devices, providing a higher throughput, lower latency and a better support for a high density areas.

Ultra-Reliable-Low latency communications (URLLC) , addressing crit- ical traffic with particular requirements in terms of latency and reliability, like vehicular networks.

Massive machine type communications (mMTC) , targeting the large amount of machine-to-machine traffic that will arise due to the growth of IoT devices [16], [18].

To support each scenario, an integration of the best technologies available is needed, with a great effort for the optimization of the resources and the flexibility of the system. In particular, this approach will create an architecture that can support all the different cases with a common physical infrastructure, by exploiting mechanisms like virtualization and cloudification of the services.

(26)

2.2 Enabling technologies

The 5G system is not just an evolution of the previous technologies, but can be seen as a major disruptive revolution, which will change some paradigms on which traditional mobile networks are based.

In order to better understand the topic, a brief overview of the most important technologies adopted in it is compulsory. In the next sections, some of these are analyzed.

2.2.1 Software Defined Networking

Software Defined Networking is a fairly new approach to networking where the network configuration and monitoring takes place in an environment more similar to a cloud than to traditional networking [19]. In this approach, the network devices are controlled by a central authority, which hold the task to control the different network devices, instead of relying on a per-device, distributed, configuration. This change transforms the network in a more flexible technology, opening the path to programmable and self organizing networks.

To implement this technology, an auxiliary network layer, called Control Plane, is used for the transport of the signaling and management messages.

The rest of the data-traffic, in contrast, travels across the so-called Data Plane, which is implemented on top of the devices configured through the Data Plane.

A deeper description of the concept of separation, applied to the 5G architecture, will be given in Section 2.3.

One of the first approaches to SDN has been the OpenFlow protocol [20], with many other protocols and controllers developed in the last years. Although, the OpenFlow eco-system is considered the de facto standard for SDN systems.

The SDN concept has been exploited by the 5GC to provide an easy-to- maintain network which can be provisioned and managed remotely from a central location and in an automated manner, reducing the operating costs and the maintenance time.

2.2.2 Network Functions Virtualization

While traditional networks rely on a strict relationship between hardware and functionalities, in a NFV-based network the different functionalities are not linked to the physical devices but, rather, are executed in general-purpose, commodity servers. This concept has been extensively studied by the ETSI ISG NFV community, through over 100 publications [21].

(27)

2.2. Enabling technologies 11

To better explain the concept, consider a standard router device. In a traditional network, the router functionalities are executed in a dedicated, specialized, device: the router. With the NFV approach, instead, these can be executed in a commodity server or, more frequently, in a virtual environment [22].

This decoupling allows a great flexibility with respect to traditional networking, allowing the tenant to scale the different resources of a network accordingly to the actual load or to the requirements for a specific use-case. Thus, the deployment of a network can be easily scaled and adapted by allocating more resources to the physical system and by creating more instances of the desired functions.

This approach is usually deployed in strict conjunction with the SDN technology: the network becomes a big, programmable, system which can be easy managed and adapted accordingly to the use-case scenario.

It’s worth noting that the SDN and the NFV concepts are not dependent from each other. Indeed, it’s possible to deploy standard network devices configured with a SDN approach and to configure a NFV system without a SDN configuration system. However, the two technologies can take advantage of each other, expressing the best functionalities when deployed together.

2.2.3 Network slicing

There is no standardized definition for Network Slicing, even if the majority of authors agree on the idea of considering it as the separation of network traffic across several logical networks, all running on the same physical infrastructure.

In the 5G architecture, Network Slicing is the enabler of some key characteristics of the system [23], improving scalability and flexibility.

In particular, the Network Slicing allows the creation of multiple logical end- to-end networks on top of the same physical infrastructure, serving different customers or use-cases. For instance, different slices can be specialized in some areas (e.g. IoT, mMTC, URLLC,...) [17].

Each network slice can involve a different set of physical nodes, with different functionalities placed into different position of the network infrastructure. For instance, the number of nodes processing the user packets can be increased in the case of a eMBB slice, whereas a URLLC slice will be optimized to achieve a lower latency (e.g. by allocating the nodes on the edge of the network). This approach is also paramount when a Mobile Edge Computing [24] functionality is required, as well as the case of Local Data Network that should be available only to some specific devices or users.

(28)

The 3GPP definition of network slicing takes into account also the radio resources, which can be allocated differently for each network slice. Thus, different slices can have different scheduling in the Radio domain, allowing a higher or lower throughput. This is also concerned with the Quality-of-Service policies, which can issue some specific rules for the slice selection or for its characteriza- tion. A complete analysis of network slicing is proposed in [25], while a quick reference for it may be found on [26].

An example of Network Slicing is reported in Figure2.1. We can note as not all the nodes of the Physical infrastructure are used from all the slices, whereas some nodes are used from all the slices. The Figure represents both the case of two different Use Cases (eMBB and mMTC) and the isolation of the networks for two different customers or services, as shown by the two separate layersmMTC1 and mMTC2.

mMTC1

mMTC2

eMBB

Physical

Infrastructure

Figure 2.1: Network Slicing example with two use cases.

Another application of Network Slicing, introduced with the LTE EPC, is the separation of Control and User Plane, delivering the two types of traffic on different logical networks. This approach will be discussed in the following section.

(29)

2.3. User Plane and Control Plane 13

2.3 User Plane and Control Plane

A key concept in a 5G network is the separation between the Control Plane (CP) and the User Plane (UP), an evolution of the LTE CUPS concept.

While comparing the EPC and the 5GC with their predecessor, the GPRS system, the separation between user data and the control communication inside the core network is a major difference. This was introduced to allow a better scalability of the network components which, in the 5GC are represented by the different Network Functions and, overall, a greater flexibility.

Usually, we refer to the User Plane as the network slice where the data communications between the User Equipments (UEs) and the Data Networks (DNs) are processed. On the other hand, the Control Plane is the network slice where all the signaling communications take place, allowing the collaboration of the different NFs to deliver the service to the users.

This decoupling took a major importance after the explosion of the Over- The-Top services like video streaming and social media, with very different char- acterization w.r.t. traditional network applications (e.g. web browsing), allowing the network components to be scaled separately accordingly to the load.

CP/UP separation can be seen as an orthogonal counterpart of the Network Slicing concept, described in Section 2.2.3. Indeed, in CUPS the network is divided in two portions with different data traffics and different nodes, whereas the Network Slicing provide the ability to host more services or customers in the same physical infrastructure. Hence, there could be multiple control/user plane instances, one for each plane. Nevertheless, multiple network slices can share the same Control Plane Network Functions, e.g. where the Network slices are managed by the same operator and designed for the same scenario.

In the 5G system, the User Plane is composed by the User Equipment and the UPF, whereas all the other nodes are connected to the Control Plane. From the UE perspective, usually, the User Plane is transparent and the packets sent from the UE are, basically, delivered to the Data Network without intermediate hops.

All the communications between the UE and the other nodes on the Control Plane take place on across the gNodeB, the UPF and the AMF, the only nodes interconnected between the two planes. A better description of the messages and the interactions exchanged between the nodes is given in Section 2.7, while the network functions are described in Section 2.5.3.

(30)

2.4 New Radio and the 5G Core Network

The 5G system, similarly to the LTE, can be logically divided into two portions: the Access Network (AN) and the Core Network (CN). As the names suggest, the first one is the part where the User Equipments (UEs) are connected, representing the link between them and the rest of infrastructure. The main goal of the CN is to provide access to one or more Data Network (DN), delivering routing to it and all the auxiliary Network Functions. The target DN can be a generic one (e.g. Internet) or an operator specific deployment (e.g. an IMS network or a Local Area Data Network).

The most common type of AN used by the 5G system is the Radio Access Net- work (RAN), which exploit similar technologies to LTE to provide radio access to the UEs, referred by the standard as 5G New Radio (NR). However, several non-3GPP technologies can be used to access to the 5G Core Network (5GC), allowing a greater flexibility w.r.t. traditional mobile networks. For example, Wi-Fi access points can be used by the UE, increasing the availability of the services. Moreover, with the Non Standalone Architecture, the LTE EUTRAN may also be used to access the Core Network

The 5G CN and the 5G New Radio can be identified as the successors of the LTE EUTRAN and EPC. However, several innovations have been introduced in this evolution, making it a disruptive step.

A representation of the main entities involved in the 5G architecture is reported in Figure 2.2. The dashed lines represent indirect communications (the ones that need other nodes to deliver the messages), while the green blocks are Network Functions, part only of the Control Plane, talking to each other through the Service Based Architecture. More details about the Control Plane and User Plane are discussed in Section 2.3, while the Service Base Architecture is analyzed in Section 2.5.2.

In every 5G deployment some other nodes are required for complete functionalities. However, since they are not treated in this thesis and to keep the model simple, they are not represented in the figure.

Since this work focuses more on the Core Network, the NR will not be exam- ined in details. The interested reader could refer to [27] for a deeper analysis of it.

(31)

2.5. 5G Core Network 15

NEF PCF AUSF

SMF AMF

UE

gNB UPF UPF DN

Uu

N3 N9 N6

N1

N2 N4 N4

N3

Core Network New Radio

Figure 2.2: Basic 5G architecture components

2.5 5G Core Network

The CN is probably the most critical component of the 5G architecture: it is expected to handle large traffic volumes while ensuring low latencies and, usually, it needs to comply with strict Service Level Agreements (SLAs). Moreover, due to the diversity of the services that can be hosted on the 5GS, different capabilities need to be provided, depending on the different cases. All of these features should be guaranteed in any load situation, resulting in a complex task.

Similarly to the previous generations, the 5GC is based on several components that interacts with each other, providing different functions. Later on this chapter, some relevant components will be analyzed.

Thanks to modern technologies like the Software Defined Networks (SDNs) and Network Function Virtualization (NFV), the 5GC is usually implemented on top of a virtual environment, providing easier scalability with respect to a bare- metal environment, where the single Network Function would be implemented by separated physical machines. This approach, together with cloud technologies, containers and microservices are at the base of the development of the 5G Core Network, creating a very flexible and adaptable infrastructure.

In modern deployments, the physical infrastructure can be sliced for different use-cases or customers, through the principle of Network Slicing, as discussed in Section 2.2.3.

2.5.1 The interaction with the Access Network

One of main goal of the 5GC is to provide a future-proof implementation.

Therefore, a brand-new set of interfaces between the Access Network and the

(32)

5GC has been specified, providing support also to other access technologies not standardized by the 3GPP, such fixed access or Wi-Fi.

The N1 interface represents the communication point between the UE and the Control Plane, while the messages between the RAN and the Control Plane are exchanged above the N2 interface. For what regards the User Data, these are transmitted across the N3 interface, which links the User Plane with the Radio Access Network. More details on the different components of the 5G Core Network architecture are reported in Section 2.5.3, while a global interaction schema is reported in Section 2.7

2.5.2 The Service Based Architecture

As seen in Section2.3, the 5GC is decoupled in User and Control plane. For the first portion, a traditional interface-based approach, inherited for the LTE EPC, is adopted. Meanwhile, the Control Plane uses a Service Based Architec- ture, based on a different paradigm.

In 5G, as already discussed, the network functionalities are spread across multiple Network Functions (NFs). These consume services offered by other NFs, while providing some to the other nodes. We refer to this architecture as the Service Based Architecture (SBA), as opposed to the Point-To-Point one, which is deeply described in [28]. In this scenario, all the signaling between the Net- work Functions happen on top of RESTful HTTP API, allowing a more flexible extensibility of the network. This flexibility is allowed by the relatively simple Service Based Interface w.r.t. the complex and detailed protocol specification usually required in the Point-To-Point approach of previous generations.

When two functions communicate through the SBA, two different roles are assigned. One of the two functions, the producer, provides a service, while the other, the consumer, requests it and wait a response from the first one. Each function can be both a consumer or a producer while interacting with the other functions (e.g. it can request information to other nodes while serving a request to a NF).

On such architecture, an important role is assigned to theNetwork Repository Function (NRF), which holds all the information about the available functions in the network. Any function (or, in general, service) connected to the 5GC needs to register itself to the NRF. Thus, the address of at least one NRF need to be configured in each function. Whenever another service is required by a network function, a request will be made to the NRF in order to discover the available ones. This happens, for example, when a new device connects to the network

(33)

2.5. 5G Core Network 17

and needs to send some data: the system will setup the service by asking the NRF the candidates instances that can fulfill the request.

2.5.3 The core components

After a brief overview of the architecture, it is time to introduce some key Network Functions of 5GC, which are mandatory in any 5G deployment.

Some other NF are needed in any 5GC deployment, but they are not a heavily involved in this work. The interested reader could refer to [28] for a nice overview, while in [27] provides a more extensive overview about the radio interface.

gNB The gNB is the Next Generation NodeB, which represent the natural evolution of the LTE eNodeB. Strictly speaking, the gNB is not part of the 5GC but, rather, it belongs to the 5G NR. However, since it is a key component in the studied scenario, it is important to understand its role. A gNB is essentially a Base Station equipped with NR support and, thus, enabled to work with the 5G infrastructure. This node represents the connection point between the end- user UE and the rest of the network. It is responsible to manage the RAN, allocating the Radio resources and scheduling correctly the radio/time resources to accommodate the different users. From this node, the other Network Functions on the 5GC can be reached and the data connections could be established.

AMF The AMF is the Access and Mobility Management Function, which holds the task to manage the access and the mobility of the UE across the network. This is responsible for authenticating the users, allowing them to register to the network and allowing the mobility across different radio cells.

Moreover, it holds the task to wake up idle devices when there are data to be transmitted to them, requesting the transmission of specific messages to the gNB.

The main difference with its LTE counterpart, the MME, is that the sessions are not managed by the AMF: this task is demanded to the SMF. Similarly, the authentication is done by the AUSF function.

SMF A crucial role is demanded to the SMF, the Session Management Function. Here, the UE-related sessions are managed, allocating the CN re- sources and also the IP addresses. The SMF does not communicate directly with the UE: the AMF is responsible to relay all the communications. The SMF also select the most appropriate UPF for serving the user and can perform charging-related functionalities. The PCF (Policy Control Function) may

(34)

be consulted by the SMF in order to retrieve Policies and decide which services or resources should be allocated for the user.

UPF The UPF is the User Plane Function, the most relevant component for this work. Here, the user data are forwarded and processed, acting as a gateway toward the rest of the world. In other words, the packets toward the UE coming from Internet are routed, based on the destination IP, to the UPF. The UPF, then, will process the packets and encapsulate them in a GTP-U tunnel, which will transport the user packets across the AN to reach the UE. Furthermore, policies retrieved from the PCF could be applied and charging reports are sent to the SMF. Traffic inspection and QoS are also applied here, following the same policies retrieved from the PCF. Moreover, it also buffers packets to idle devices, delivering them as soon as the UEs move from idle to connected state.

The UPF will be covered with more details in Section 2.6.

PCF The PCF is the Policy Control Function and it is the repository where all the policy information are stored. In particular, it holds the policies about which resources can be allocated to the users, the QoS, charging control and priority rules. Moreover, it can provide rules to the UE via the AMF about the session continuity, the available non-3GPP networks, network slices and other rules.

NEF The purpose of the Network Exposure Function is to provide the ability to external Application Functions (AFs) to interact actively with the network. Thanks to simple API interface offered by the SBA, an external application can retrieve statistics about the state of the network. The NEF can monitor some special events and offer the ability to external, authorized, applications to provision information about the network behavior. For example, some applications could predict the UE behavior and requests optimization of the system for particular situations. Other use-cases involve the request of specific QoS for certain applications or different charging for them. In a standard 5GC there could be more than one NEF, each one implementing a subset of functionalities or managing only a portion of the CN.

(35)

2.6. User Plane Function 19

2.6 User Plane Function

As mentioned above, the User Plane Function is one of the key component of this work. Hence, a deeper analysis of it will be given here.

The main purpose of the UPF is to process the User Equipment data-packets and to route them to and from the rest of the world. In other words, this is the gateway between the external network (e.g. Internet) and the User Equipment.

We usually refer to the external networks as Data Networks (DNs).

Internet is not the only DN that can be reached by a UE through the UPF:

application specific DN or operator restricted networks can be accessed as well (e.g. the IMS for VoIP). Another type of DN that can be connected to the 5G CN are the so-called Local Area Data Networks (LADNs), portions of local networks where specific servers are deployed and which enable the Edge Computing technology [24] and vertical scenarios like factory automation.

2.6.1 The PDU Session

One of the main purposes of the 5G network is to provide data access to some external Data Network. This service, in the 5G domain, is provided through the PDU Session. At high level, we can describe the PDU Session as the association between the UE and the target DN, while at bottom level we can define is as the service that transport PDUs (Protocol Data Units, e.g. the user packets) across the User Plane.

Based on a sequence of tunnels, the PDU Session encapsulates the UE packets between it and the UPF, allowing some important features in the 5G environment, like mobility and non-3GPP network access. Generally, the PDU Session is based on an IP tunneling protocol, such as the GPRS Tunneling Protocol (GTP) [29]. These tunnels, which carry only the UE data and not the signaling messages, are terminated by the gNB and the UPF in charge of that particular UE.

Thus, the PDU Session (and the related tunnel) need to be established before starting the communications, accordingly to the information provided by the SMF (which will collaborate with other NFs in order to establish the session).

Usually, for IP based PDU sessions, the IP address for the UE is allocated during the establishment. However, the standard provides also the ability to deliver Ethernet-based services, which require a different establishment procedure.

From the user perspective, this tunneling is transparent and provides to the UE a stable IP, which can be used to communicate with the world. Furthermore,

(36)

thanks to this mechanism, the UE can move across different Base Stations, maintaining the same IP and without breaking the communications.

The physical devices that implements the 5GC, like switches and routers, are not aware of the PDU sessions but, rather, they operate on the external headers which encapsulates the UE traffic. Namely, these devices treats UDP packets that transports the GTP-U encapsulated user packets (PDUs). Nevertheless, some basic optimization could be done even on this encapsulated traffic, usually with the Differentiated Service approach.

The PDU Session can be seen as an evolution of the LTE PDN Connection.

Indeed, it provides the same functionalities, with the P-GW replaced by its successor, the UPF.

2.6.1.1 More than one PDU Session

When a UE needs to access different services on different DNs, it can require the establishment of different PDU Sessions. This scenario can be applied when a device needs e.g. to access to Internet while using some services on a dedicated DN or while it is using the operator’s IMS. In this case, the SMF will establish different PDU sessions, which will allow the UE to communicate with multiple UPFs, providing connectivity to the different end-points. The UE is in charge of requesting this service and to route the packets to the right PDU Session. Note that for each PDU Session, the UE may obtain a different IP, accordingly to the subnet of the DN where the PDU Session ends.

In Figure2.3 a case where two PDUs have been established is reported: the UE is responsible to route its packet to the correct UPF accordingly to the destination of the packets.

UE UPF

DN 1 DN 2

UPF

Figure 2.3: Example of multiple PDU Sessions

(37)

2.6.1.2 Inside a PDU Session

A PDU Session, in the standard RAN-based environment, can be logically separated into two subsequent components: the Data Radio Bearer and the N3 tunnel. Namely, the first is responsible for the radio resource reservation inside the RAN, while the last has the task to carry the user data between the gNodeB and the UPF, across the N3 interface.

Inside a single PDU Session there could be more than one Data Radio Bearer, which may have different data rate characteristics or carry different types of traffic. To accomplish to this task, a PDU selection is performed both from the UE (in UpLink) and from the UPF (in DownLink), through a set of rules or policies.

This modularity is also an enabler for the Quality-of-Service functionalities available in the 5GS. A description of QoS in the 5G system can be found in [26].

2.6.2 UPF Chaining

Usually, the PDU Session path involves only one UPF. However, the 5GC standard allows multiple UPFs to be chained together, dividing the load and the functionality among them. These are not different type of Network Functions but, rather, different functional roles of the same NF.

When multiple UPFs are involved, we usually refer to the UPF terminating the N6 tunnel (the one towards the DN) as thePSA-UPF (PDU Session Anchor), while the intermediate UPFs inserted in the path are referred as Intermediate UPF, I-UPF.

Another role that can be assumed by a UPF is theUpLink Classifier (ULCL) or Branching Point (BP). In this case, the UPF is responsible to divide (and merge-up) the traffic that pass though it, e.g. in the case when two different DNs need to be reached within the same PDU Session.

2.6.2.1 UPF chaining with different functions

The simplest case of chaining is the one which involves more UPFs specialized in different tasks. For example, in a situation where both bandwidth control and charging need to be performed, two different UPFs can be set-up to perform the two tasks and to route the packets from one to the other. With this specialization, a higher efficiency could be achieved, as shown in [30]. This concept is at the basis of the µUPF and chain controller, exposed in Section 2.9.

(38)

UE UPF (ULCL) UPF

UPF (PSA) UPF (PSA)

DN 1 DN 2

Figure 2.4: Example of UPF chaining

An example of UPF chaining is reported in Figure 2.4: a ULCL UPF holds the task to separate the traffic directed to the two DNs, while two different UPFs have been deployed on the left path. On the other path, a single UPF has been placed, potentially performing all the roles executed from the other branch UPF pair. The red lines represent the GTP-U tunnels that have been established to transport the PDUs.

2.6.2.2 UPF chaining for mobility

When a UE is moving across different Cells, the 5GC should maintain for it the same IP, in order to not interrupt its connection. In order to provide this service, the connection with the assigned UPF (PSA) should be maintained.

However, due to network restrictions or security policies, the target UPF (PSA) may be not reachable from the new UE location. Thus, a new I-UPF will be selected by the AMF and, in order to maintain the connectivity, all the GTP-U packets will be routed toward the original UPF (PSA) by the intermediate one.

2.6.2.3 UPF chaining with Up-Link Classifier

The Up-Link Classifier (UL-CL) is a feature that allows a UPF to forward the data packets to different PDU Sessions. These actions are performed on

(39)

the basis of some filtering rules, which can cover several characteristics of the traffic (e.g. IP addresses, bandwidth and QoS requirements). This approach is important for the deployment of Mobile Edge Computing scenarios and Local Area Data Network (LADN), allowing multiple networks to be reached within the same PDU session. Similarly, it is the enabler for Content Delivery Networks and for delivering operator-specific services (e.g. IMS).

In this case, a first UPF equipped with a UL-CL will split the traffic towards the Data Networks, while on the reverse path (DownLink) it will merge the packets into the same PDU Session.

In general, the standard is flexible with the UPF roles, allowing the same UPF to execute multiple roles (e.g. a UL-CL UPF could be the PSA for one network and a I-UPF for another one).

2.6.3 Monitoring

Since all the user traffic passes across the UPF, firewall policies and traffic monitoring can be implemented in this NF. Some parameters that can be monitored in the UPF could be the throughput, the destination of the User traffic, and the load of the node. Thanks to these data, it is possible to optimize and im- prove the 5GC w.r.t. the users needs and the traffic characteristics. However, the current implementation of the UPF does not provide a standard way to extract these data from it, as already discussed in Section 1.2.1.

2.6.4 A typical UPF implementation

From an architectural point of view, the UPF can be considered, yet sim- plifying the concept, as a multi-layer switch or, more appropriately, a router.

Indeed, its functionalities consist mainly in forwarding packets to the correct destinations, either a DN, the UEs or another UPF. It is straightforward, then, to envision a UPF implementation using the SDN and NFV technologies in a modern virtualized environments.

As shown in works like [31], [32], the UPF can be easily implemented using technologies like OpenFlow [20], Click [33] or P4 [34]. To ensure user mobility and a better scalability, it is possible to integrate these with some other plat- forms like Docker [35] or OpenStack [36]. Hence, by using these systems, the scalability of the UPF nodes is not a complex task and can be easily performed by the hypervisor on charge of the environment, moving also the application state across the different instances. Furthermore, as shown in [31], a SDN-based implementation of the UPF could be a more optimized and adaptable solution

(40)

than a traditional one, even if an accurate planning of the location of these instances need to be done, in order to minimize the latency introduced by the virtualization.

However, the functionalities of the UPF are not limited to the data forwarding. In particular, encapsulation, policy enforcing and QoS are some capabilities that should be embedded in this NF, surrounding the basic routing functionality.

2.7 A global interaction schema

After having analyzed the main components included in the 5G CN, it is possible to give a general overview on the interactions that happen between the different NFs when a new PDU Session is going to be established. For simplicity, some components and steps will be omitted in this description. The interested reader can refer to [28], [37], [38] for a complete description of the Session establishment procedure.

1. Initially, the UE connect to the Radio Access Network, which establish the connection and set up the radio resources. This is done after a negotia- tion between the gNB, the AMF, the SMF and the UDM, a phase called registration.

2. Then, the gNB requests to the AMF the establishment of a PDU Session, through the N1 interface.

3. The AMF communicate with the SMF in order to select the correct UPF, through the N11 interface. This communication takes place after the suc- cessful authentication and authorization procedure with AUSF, across the N12 interface. Some other message are exchanged with other NF in order to establish the authorizations and the capabilities of the user can be performed, too.

4. The SMF, after having established the requirements and the capabilities of the user through interaction with the UDM and the PCF, it requires the establishment of the PDU Session to the target UPF (across the N4 interface). Then, across the N11 interface, it asks the AMF to communicate to the RAN (through the N2 interface) to allocate the radio resources for the new PDU session.

5. Finally, if all the NF allocated the resources correctly and there wasn’t any problem, the PDU Session is established across the N3 interface, enabling the user to communicate.

Efficient traffic monitoring in 5G Core Network

Efficient traffic monitoring in 5G Core Network

MASSIMO GIRONDI

Efficient traffic monitoring in 5G Core Network

Massimo Girondi

Degree Project in Computer Science and Engineering

Hosting Company Ericsson AB

Industrial supervisor András Zahemszky

Examiner Ben Slimane Academic supervisor Ki Won Sung

KTH Royal Institute of Technology

School of Electrical Engineering and Computer Science

Stockholm - 2020/06/16

Abstract

Keywords

Sammanfattning

Aknowledgments

Table of Contents

List of Figures

1 | Introduction

1.1 Problem statement

1.2 Background

1.2.1 Motivations

1.3 Research questions

1.4 Purpose

1.5 Goals

1.6 Ethics and Sustainability

1.7 Methodology

1.8 Delimitations

1.9 Contributions

1.10 Thesis outline

2 | Background

2.1 5G: a new family of technologies

2.2 Enabling technologies

2.2.1 Software Defined Networking

2.2.2 Network Functions Virtualization

2.2.3 Network slicing

2.3 User Plane and Control Plane

2.4 New Radio and the 5G Core Network

2.5 5G Core Network

2.5.1 The interaction with the Access Network

2.5.2 The Service Based Architecture

2.5.3 The core components

2.6 User Plane Function

2.6.1 The PDU Session

2.6.2 UPF Chaining

2.6.3 Monitoring

2.6.4 A typical UPF implementation

2.7 A global interaction schema

2 | _Background