XenFlow: An XDP/eBPF-Based Multi-Tenant NFV Framework Considering System Security and High-Performance

Network Function Virtualization (NFV) offers flexibility but poses a critical challenge in multi-tenant environments: ensuring fairness (resource usage limits) and system security (memory/packet isolation) for each tenant. Existing NFV frameworks commonly rely on kernel bypass technologies, achieving high performance by sacrificing the kernel’s essential fairness and system security guarantees needed for a safe multi-tenant environment. This paper proposes XenFlow, an NFV framework designed to resolve the conflict between performance and both fairness and system security. By leveraging the eXpress Data Path (XDP), XenFlow places Network Functions (NFs) in both the kernel and user spaces and operates without bypassing the kernel. To provide fairness and system security to tenants, XenFlow leverages the verification mechanism of XDP in the kernel space and uses containers and intra-process memory isolation techniques in the user space. Within the fair and secure foundation described above, XenFlow achieves high performance by realizing packet zero-copy, a capability that existing NFV frameworks using XDP have not attained. Evaluation results show that XenFlow achieves 2.3-8.1 times higher throughput than existing NFV frameworks using XDP, thanks to packet zero-copy. Whereas the throughput of XenFlow is 62-84% of an NFV framework using kernel bypass technologies, this is a deliberate trade-off. XenFlow successfully prioritizes fairness and system security over peak performance, establishing a trustworthy multi-tenant environment that is fundamentally incompatible with performance-centric designs.