Robert Schmidt
email: robert.schmidt@eurecom.fr

Chia-Yu Chang
email: chia-yu.chang@eurecom.fr

Navid Nikaein
email: navid.nikaein@eurecom.fr

Slice Scheduling with QoS-Guarantee towards 5G

Future mobile networks are supposed to handle a variety of services with different requirements. Network slicing is considered to be a key enabler to cope with the increasing complexity of these networks. This includes slicing of the radio resources in order to use them efficiently. In this paper, we propose a radio resource slicing system for three types of slices with specific radio resource/quality of service (QoS) requirements. It enables co-existence of (1) rate-based/efficiency-oriented and (2) low-latency slices, as well as (3) slices with fixed allocations. Slice scheduling is based on utility functions with a prioritybased resource allocation. Using simulations, we validate the applicability of the proposed system, and demonstrate that both a guaranteed throughput and low delay for different slices at the same time is possible. Our system outperforms existing slicing solutions in terms of delay requirement satisfaction and efficient resource utilization.

I. INTRODUCTION

Recent years have witnessed a trend towards a serviceoriented fifth generation (5G) mobile network. The International Telecommunication Union (ITU) has identified some key usage scenarios alongside respective requirements in ITU-R M.2083-0 to be fulfilled. Besides the enhanced data rate for human-centric use cases, summarized as enhanced mobile broadband (eMBB), more device-centric use cases, like ultra-reliable and low latency communications (URLLC) and massive machine type communications (mMTC), will reshape the new 5G services in terms of latency and connection density. These services have partially conflicting objectives, and abstractions are needed to efficiently accommodate them within the same network infrastructure while coping with increasing complexity. This led to the proposal of network slicing (NGMN Alliance, "Description of network slicing concept") to create separated virtual spaces for multiple services to flexibly and efficiently use the network.

More specifically in the radio access network (RAN) domain, several virtual base stations (BSs) are built for each service with individual state, processing and resource [START_REF] Schmidt | FlexVRAN: A flexible controller for virtualized RAN over heterogeneous deployments[END_REF] on top of the underlying BS. Among these three elements, radio resources are the most scarce, and thus a slicing system has to strike the balance among different objectives, such as using the spectrum efficiently for many users while guaranteeing delivery for high-reliability users. In addition, a slicing system shall guarantee that (i) changes in one service do not affect the system and/or violate the service-level agreement (SLA) of other services, and (ii) redistribute unused resources to maximize resource efficiency.

As the origination of RAN slicing, network slicing considers a collection of logical overlay networks over a physical network [START_REF] Iyer | Automating diagnosis of cellular radio access network problems[END_REF]. Also, any action taken by one slice will not negatively affect other slices [START_REF] Taleb | On multi-access edge computing: A survey of the emerging 5G network edge cloud architecture and orchestration[END_REF], which is an ideal match for the vision of multiple services in 5G. In practice, several works study the RAN slicing in terms of resource allocation. In [START_REF] Ksentini | Toward enforcing network slicing on RAN: Flexibility and resources abstraction[END_REF], a proposed RAN slicing architecture allows radio resource management policies to be enforced at the level of physical resource blocks (PRBs) by a resource visor towards each slice. Orion [START_REF] Foukas | Orion: RAN slicing for a flexible and cost-effective multi-service mobile network architecture[END_REF] introduces the BS hypervisor to share the radio resources in terms of virtual resource blocks (vRBs) to be grouped and provided to the corresponding slice. The resource abstraction approach in [START_REF] Chang | Radio access network resource slicing for flexible service execution[END_REF] can support three types of resource requirements: PRB, vRB and virtual transport block. The NVS approach [START_REF] Kokku | NVS: A substrate for virtualizing wireless resources in cellular networks[END_REF] can slice the RAN domain resources for two types of resource requirements: data rate and vRBs. Nevertheless, none of above works consider the impacts of quality of service (QoS) on the RAN domain resources for three key types of resource requirements: physical resources, throughput, and latency.

This paper proposes a RAN slice scheduling framework with QoS guarantee to meet the performance requirements of different usage scenarios as identified by ITU. It introduces three types of slices with their associated formulated utility functions as: (a) fixed slices requesting dedicated physical resources, (b) dynamic slices asking for aggregate throughput like eMBB, and (c) on-demand slices demanding latency requirement like URLLC. Finally, it achieves QoS guarantee by applying a priority-based resource allocation tailored to each type of slice.

This paper is organized as follows. Section II outlines the considered multi-service slicing approach and then highlights some key challenges. In Section III, we present the proposed slicing system and formulate the corresponding utility function for each type of service and the associated three-step weightbased radio resource scheduler with QoS awareness. Finally, Section IV provides simulation results and reveals the effectiveness of the proposed framework in terms of guaranteeing QoS requirements.

II. SLICE REPRESENTATION AND CHALLENGES

A. Overview

In this work, we focus on the RAN domain, comprising several BSs, to be sliced for multiple network services. In practice, a slice descriptor will serve as a blueprint to craft a slice instance into the virtual base stations (vBSs), which is abstracted and embedded into the underlying BS and then exposed through the controller interface [START_REF] Schmidt | FlexVRAN: A flexible controller for virtualized RAN over heterogeneous deployments[END_REF]. On one hand, the slice descriptor formally addresses the requirements from the slice owner's perspective, such as the required guaranteed bit rate (GBR), to be applied to the corresponding vBS. On the other hand, from an operator's point of view, the objective is to embed as many vBSs as possible into the underlying BS, while satisfying their service requirements. To this end, a set of rules can be applied to the embedding operation to pursue these two goals simultaneously.

To fully represent a BS, we resort to a triple [START_REF] Schmidt | FlexVRAN: A flexible controller for virtualized RAN over heterogeneous deployments[END_REF] consisting of (i) resources1 , (ii) processing 2 , and (iii) state 3 . This triple within a vBS can be inferred from the SLA within the slice descriptor. For instance, the SLA can comprise the required resource parameters (e.g., the GBR or maximum delay threshold), processing parameters (e.g., isolated CP processing), and configuration parameters (e.g., customized admission control rules). According to these contents within the slice descriptor, the controller can perform admission control for the resource parameters and checks the feasibility for specified processing and configuration parameters. Finally, the vBS is created to reveal a slice-specific view of the BS to the slice owner.

B. Challenges of embedding vBS into BS

Within the aforementioned process overview, a number of challenges emerge during the procedure of embedding multiple vBSs into a single BS. Especially, most of the attention is given in the resource aspect as highlighted in Section I, and thus we highlight three major challenges as follows:

1) Requested resource isolation: For instance, emergency services will request dedicated radio resource to ensure complete isolation from others. 2) Efficient resource utilization: Taking the eMBB service as an example, it aims to pursue efficient resource utilization with loose requirements on delay and isolation. 3) Performance guarantee: The URLLC service will request hard delay guarantees that need to be maintained with sub-optimal resource utilization efficiency. To better depict these challenges of vBS embedding, we identify three corresponding slice resource requirement types, which will be elaborated in the following section.

III. QOS-AWARE RESOURCE SLICING FRAMEWORK

In this section, we first identify three types of resource requirements, then formulate the corresponding utility functions, and finally propose the weight-based QoS-aware resource slicing framework for the vBS embedding operation.

A. Three types of slice resource requirements

In particular, three types of slice resource requirements are of interest in this work:

• A fixed slice requests dedicated radio resources along time and frequency domains. Therefore, it is isolated from other slices and does not multiplex its resources with others. One example is the bandwidth parts (BWPs) defined in 5G (see 3GPP TS 38.211) that operate on disjoint parts of the spectrum with a given numerology. • A dynamic slice requests a share of resources in terms of aggregate throughput. It can be mapped to the eMBB usage scenario, and thus a precise radio resource allocation is less important than the efficient use of available resources for a guaranteed throughput. • An on-demand slice exhibits more stringent requirements in terms of latency, and hence it can be mapped to the URLLC scenario. Therefore, such slice should be assigned radio resources with short delay, in comparison with the dynamic slice.

Based on these slice resource requirements, we propose respective utility functions from which we will introduce a novel slice scheduling algorithm with QoS awareness.

B. Utility functions for different types of slice

Corresponding to the three types of slice resource requirements, we form three slice sets grouping the slices with respective types of resource requirements: K fix , K dyn , and K ond . As for the k-th slice, its utility function is represented either as

U k , V k , or W k , if k ∈ K fix , k ∈ K dyn or k ∈ K ond , respectively.
From the perspective of the operator, it aims to maximize the summation of utility functions from all instantiated slices, while still guaranteeing QoS requirements:

U = ∑ k∈Kfix U k + ∑ k∈Kdyn V k + ∑ k∈Kond W k .
(1)

1) Fixed slices: For a fixed slice k ∈ K fix , its SLA stipulates that such slice requests P k RBs in every scheduling interval, starting at RB P start k . To ensure that no overlapping between fixed slices occurs, extra admission control is required and will be elaborated in Section III-C. Then, the slice's utility function can be written as

U k = { 1 if RB range [P start k , P start k + P k ) allocated 0 otherwise , (2)
i.e., such slice can only be satisfied when the exact requested resources are allocated, as required in Section II-B.

2) Dynamic slices: We modify the formulation of bandwidth-based slices in [START_REF] Kokku | NVS: A substrate for virtualizing wireless resources in cellular networks[END_REF] to enable concurrent slice scheduling (multiple slices scheduled within the same subframe/slot). The SLA of a dynamic slice k ∈ K dyn requires a requested rate R k as well as a prioritization rate R ref k , both in bps. The former describes the rate that the slice shall achieve in the long run. It is measured through the slice's achieved cumulative rate r k in bps, and should fulfill r k ≥ R k . The prioritization rate serves as a reference which this slice should achieve within the scheduled RBs to maintain its resource efficiency. It is checked through the average per-RB rate rk .

For a BS with N RBs, we control the attempted allocation rate R ′ k which considers the resource efficiency via dividing the estimated allocation rate Rk = N • rk by the prioritization rate

R ref k : R ′ k = R k • min ( 1, Rk R ref k ) = R k • min ( 1, N • rk R ref k ) . (3)
Note that if Rk is above the reference rate R ref k , the requested rate R k is targeted. Otherwise, the requested rate is proportionally scaled down to get the attempted allocation rate R ′ k . The rationale behind R ′ k is to increase the resource efficiency, as tailored in the second challenge of Section II-B.

Finally, to achieve proportional fairness among different dynamic slices, the utility function can be expressed as

V k (r k ) = R ′ k N • rk log(r k ) . ( 4
)
3) On-demand slices: The SLA of an on-demand slice k ∈ K ond includes a delay-threshold ∆ k in milliseconds, a packet-loss probability δ k , and a long-run maximum resource share t k,max in terms of the ratio of RBs (i.e., 0 ≤ t k,max ≤ 1). Beyond the aforementioned SLA, for each slice scheduling interval, a slice signals the number of bits B k to be scheduled to satisfy its delay-threshold ∆ k . Based on the above parameters (i.e., B k and t k,max ) as well as measured statistics (e.g., channel quality, user number), an on-demand slice can estimate its delay bound of the scheduling process.

To maintain the above SLA, the operator measures the achieved resource share t k as a fraction of the N RBs, and the average per-RB transportation bit rate bk .

Finally, we can write the utility function using the similar approach for dynamic slices as:

W k (t k ) = B k N • bk log(t k ) = T k log(t k ), (5)
in which

T k = B k N • bk
represents the requested resource 4 . It is subject to t k,max as elaborated in Section III-C.

Since we follow the same formulation approach as for the dynamic slice, (4) and [START_REF] Foukas | Orion: RAN slicing for a flexible and cost-effective multi-service mobile network architecture[END_REF] show several similarities. Such observation is also found in [START_REF] Kokku | NVS: A substrate for virtualizing wireless resources in cellular networks[END_REF], and the maximization over these two utility functions can be shown to be equivalent 5 .

C. Proposed multi-slice scheduler with QoS-awareness

To utilize above utility functions, we hereby propose a multi-slice scheduler comprising three major steps:

1) Based on the SLA of fixed slices, we first allocate the dedicated requested resources. 2) Then, following the QoS requirements of on-demand slices, we allocate necessary resources. 3) Finally, we schedule resources for dynamic slices. Nevertheless, as mentioned in Section III-B, extra admission control is required prior to the creation of slices in order to ensure that the resource usage of all slices can be reasonably accommodated. Specifically, two constraints are applied. In the first constraint, we restrict that available N RBs can sustain Algorithm 1: Allocation of RBs for fixed slices.

Input : the resource requirements from all slice instances. Thus, we can write the ratio of requested resources from fixed slices as P k N , ∀k ∈ K fix , the allocated resource ratio for on-demand slice as t k , ∀k ∈ K ond , and the allocated resource ratio for dynamic slices as r k Rk , ∀k ∈ K dyn . Assuming that on-demand slices use their agreed maximum resource share t k = t k,max and dynamic slices the attempted rate r k = R ′ k , we have

SLA k = {P start k , P k },
∑ k∈Kfix P k N + ∑ k∈Kond t k,max + ∑ k∈Kdyn R ′ k Rk ≤ ∑ k∈Kfix P k N + ∑ k∈Kond t k,max + ∑ k∈Kdyn R k R ref k ≤ 1 (6)
where the first inequality follows from (3). This gives a sufficient condition on the slices' SLAs. In the second constraint, admission control needs to ensure that no fixed slice is overlapping with other fixed slices. By denoting [P start k , P start k +P k ) as the range of RBs allocated to the fixed slice k ∈ K fix , we can have the following restriction:

[P start i , P start i + P i ) ∩ [P start j , P start j + P j ) = ∅, ∀i ̸ = j . (7)
After admission control, we follow the aforementioned three steps for the scheduling operation. Note that we adapt a weight-based approach in each step, i.e., the weight for the k-th slice is w k , to maximize the marginal utility of different types of service requirements.

1) Fixed slices: As for the fixed slice, we can directly follow the resource requirements within the SLA, as shown in Algorithm 1. Note that the weights for all fixed slices are set as w k ← ∞, ∀k ∈ K fix , since they are guaranteed to be satisfied after applying [START_REF] Kokku | NVS: A substrate for virtualizing wireless resources in cellular networks[END_REF] in admission control.

2) On-demand slices: Before scheduling resources for ondemand slices, we first derive the weights w ′ k based on the marginal utility via a derivation approach:

w ′ k = d dt k W k (t k ) = T k t k = B k b k (8)
in which b k = N • bk • t k is the average transported bits during each scheduling interval for slice k. However, this weight ignores the QoS requirements between slices required in Section II-A. Therefore, we can apply a similar approach as the M-LWDF scheduler [START_REF] Andrews | Providing quality of service over a shared wireless link[END_REF] and multiply this weight with the QoS-related coefficients, i.e., the delay threshold ∆ k , the packet loss probability δ k , and the delay reported by the slice D k . Finally, the weight for slice k can be represented as:

w k = - log δ k ∆ k • D k • w ′ k = - log δ k ∆ k • D k • B k b k , ( 9
)
which will be used by our proposed algorithm to determine the scheduling ordering for on-demand slices. The average rate b k is approximated through an exponential moving average b exp k at the scheduling interval j:

b exp k,j = (1 -β) • b exp k,j-1 + β • b inst k,j-1 , ( 10
)
where b inst k,j-1 is the achieved rate at scheduling interval j -1, and β is a small positive constant.

Afterwards, we need to determine the amount of RBs to be allocated for each on-demand slice. A naive approach would be to limit each slice to its maximum share of resources of t k,max . However, this would penalize slices that did not request resources in the past, and we therefore resort to fulfill the maximum resource share over a moving time window. In this sense, more than t k,max resources can be scheduled in a single scheduling interval, if few or zero resources were requested before. To better represent such condition, we collect the historic resource usage ratio for the k-th slice at the j-th scheduling interval as t k,j , and denote the average resource usage ratio also at the j-th scheduling interval as tk,j with the following relations:

tk,j = 1 τ k τ k -1 ∑ i=0 t k,j ≈ ( 1 - 1 τ k ) tk,j-1 + 1 τ k t k,j . ( 11
)
Note that such average resource usage ratio is approximated through an exponential moving average via only taking the historic resource share within previous τ k scheduling intervals. We derive the maximally allowed resource share within the jth scheduling interval t k,j,max as:

tk,j ≤ ( 1 - 1 τ k ) tk,j-1 + 1 τ k t k,j,max = t k,max ⇒ t k,j,max = τ k • t k,max + (1 -τ k ) • tk,j-1 . ( 12
)
Finally, the assigned resources are limited by the maximally allowed resource share over time or the requested resources:

T ′ k,j = min(t k,j,max , T k ) . ( 13
)
In summary, as shown in Algorithm 2, on-demand slices are allocated in the order of their weight w k from (9) with a maximum resource share T ′ k,j from (13) at the j-th scheduling interval. A slice is not scheduled if B k = 0.

3) Dynamic slices: To efficiently schedule dynamic slices, we allocate the remaining RBs to the slice with the highest marginal utility among those that have data to send. Based on the utility function of the dynamic slice, we can deduce the scheduling weights w k using the derivative of the utility function. Note that the achieved rate r k is the product of average RB rate rk , the number of RB N , and the resource share t k of this slice:

w k = d dt k V k (r k ) = R ′ k N • rk • d dt k log(N • rk • t k ) = R ′ k N • rk • N • rk N • rk • t k = R ′ k r k . ( 14
)
Algorithm 2: Allocation of RBs for on-demand slices. Finally, as shown in Algorithm 3, the dynamic slice with the highest weight w k from ( 14) is allocated, where the achieved rate r k in (6) can be approximated through an exponential moving average r exp k,j for slice k in (15):

Input : B k , D k , SLA k = {t k,max , ∆ k , δ k },
r exp k,j = (1 -β) • r exp k,j-1 + β • r inst k,j-1 . (15)

IV. SIMULATION RESULTS

We implemented the proposed algorithm in a 3GPP LTEaligned simulator, written in Matlab, with the system parameters as described in 3GPP TS 36.212. 6 The simulations are done for a bandwidth of 5MHz (25 RBs) in a single antenna FDD mode. We consider a set of slices with a varying number of users. The scheduling is performed in two levels every subframe: (1) inter-slice scheduling with the proposed framework, and (2) intra-slice scheduling with a customized policy tailored to a slice requirement. In this paper, we focus on the downlink (DL) direction with variable wide-band channel qualities allowing dynamic modulation and coding scheme (MCS) per user and per subframe. Also, traffic profiles are defined on a per-user basis.

We first analyze the main slice requirements reusing the same methodology as defined in NVS [START_REF] Kokku | NVS: A substrate for virtualizing wireless resources in cellular networks[END_REF], and assess the results for a 3GPP LTE system. Then, we evaluate scenarios in which more stringent QoS constraints and a strict isolation are necessary. 1a. After one of the users of slice 2 dissociates, we can observe in Fig. 1b that slice 2 maintains the aggregate throughput by redistributing its resources, without any impact on slice 1.

2) Customization: It should be possible to customize slices to achieve a differentiated treatment of user data flows. We perform the same experiment of two dynamic slices with different schedulers: Slice 1 uses a proportional fair scheduler [START_REF] Capozzi | Downlink packet scheduling in LTE cellular networks: Key design issues and a survey[END_REF] allocating resources proportionally to a user's current achievable throughput and its past average throughput. On the other hand, slice 2 employs a blind equal throughput scheduler [START_REF] Capozzi | Downlink packet scheduling in LTE cellular networks: Key design issues and a survey[END_REF] that strives for achieving the same average throughput, regardless of per-user channel quality. Both slices have three users with different channel qualities (MCSs 18, 23, and 28) and backlogged traffic. Fig. 2 shows that slice 2 achieves a lower aggregate throughput compared to slice 1 (4.6 Mbps instead of 5.1 Mbps), which confirms the customization property of the proposed framework and its potential impact of the resulting per-user and per-slice performance.

3) Efficient resource utilization: One of the main goals of resource slicing is an efficient resource utilization, and unused radio resources should be redistributed if allowed by the SLA. In this experiment, we consider two cases with (i) static slicing with three perfectly isolated slices and a reservation P k of 28 %, 32 % and 40 % of bandwidth, similar to [START_REF] Ksentini | Toward enforcing network slicing on RAN: Flexibility and resources abstraction[END_REF], against (ii) three dynamic slices that dynamically share their resources and a reservation R k of 4.032 Mbps (corresponds to 20 %), 4.608 Mbps (32 %) and 5.76 Mbps (40 %), similar to [START_REF] Kokku | NVS: A substrate for virtualizing wireless resources in cellular networks[END_REF]. Each slice has one user that periodically downloads a large file. As can be seen in Fig. 3a, resources are wasted when not all users are active. In case two (Fig. 3b), resources can be shared between slices. This can lead to increased throughput for active slices, and the cell usage is improved. Another effect is that the cell becomes completely unloaded, implying energy saving potential.

B. Study of new scenario

1) Faster Delay Response: Within the prior work of NVS [START_REF] Kokku | NVS: A substrate for virtualizing wireless resources in cellular networks[END_REF], there exist two critical problems. First, NVS "penalizes" lightly loaded slices, typical for URLLC, by scaling them down (cf. ( 3)) since it can not distinguish between bad channel quality and lightly loaded slices. Second, a slice has no control over when it is assigned resources. Thus, no delay bound can be formed. To overcome these problems, we introduced the ondemand slice in the proposed framework for which resources are allocated when needed.

We deploy three dynamic slices with each 4.0 Mbps requested throughput R k (14.4 Mbps reference rate R ref k ) and serving two users each with backlogged traffic. We compare the impact of the resource assignments with respect to QoS for (i) the original NVS slices (equivalent to our dynamic slice) to that of (ii) the on-demand slice. In case (i), we deploy an additional dynamic slice for QoS-sensitive traffic with a requested throughput R k of 1.6 Mbps over a reference rate R ref k of 10 Mbps (corresponding to 16 %). In case (ii), we deploy an additional on-demand slice with a maximum resource share t k,max of 16 %. The averaging window τ k is set to 25 ms such that the slice can reuse previously unused resources.

Both additional slices serve four users with the same MCS 20. Each user requests packets of 255 B size and with 9 ms of allowed delay as for the 5G flow class 82 for delay-critical GBR traffic (see 3GPP TS 23.501). Packets arrive either in constant intervals of 10 ms and with 2 ms difference between the four users (denoted as CBR), or according to a Poisson Process with mean inter-arrival time 10 ms (corresponding to roughly 100 packets per user per second, denoted as VBR). We simulate 30 s.

Fig. 4a shows that the NVS-like slicing loses many packets for VBR traffic, since packets arriving grouped cannot be completely scheduled in the next scheduling window. The ondemand slices of the proposed framework, on the contrary, do not drop any packets at all. From Fig. 4b, it can also be observed that the on-demand slices use less resources as they request resources only when needed allowing efficient resource utilization. On the contrary, NVS slices are assigned a complete subframe for transmission which might not always be possible to fill. This could also result in down-scaling of the NVS slice. We report the packet scheduling delay as experienced by the users within a QoS-sensitive slice for non-dropped packets. Fig. 5a shows the cumulative distribution function (CDF) for the delay of packet transmissions. For CBR, our framework allows packet scheduling immediately after arrival, whereas NVS increases the delay to up to 5 ms. For VBR, we observe that our framework schedules packets reliably with 90 % of packets being scheduled before 1 ms and 99.9999 % before 8.0 ms7 for the considered traffic scenario. NVS achieves the same percentile after 9 ms for VBR traffic by dropping packets. This is due to non-responsive behavior of NVS in which slices are scheduled purely with respect to their past throughput and not the actual queue state. Fig. 5b reports the delay for scheduled packets over a time duration of 1 s. Note how spikes in delay for on-demand slices (due to high traffic intensity) seldom reach the average delay of the NVS approach.

Finally, we note that the above traffic patterns favor NVS, since lower traffic would automatically result in packet loss due to down-scaling or resource limitation, subject to SLA. On the contrary, for on-demand slices, low traffic and after inactivity, a higher averaging duration τ k in (12) can enable a more aggressive resource allocation.

In summary, we remark that the on-demand slice provides deterministic behavior subject to SLA when scheduling packets and thus greatly improves the latency and reliability of user data flows. Since the frame structure of 5G is highly similar, we expect analogous results if on-demand slices are scheduled on a slot basis (i.e., no mini-slot scheduling is employed).

2) Reaction to channel quality changes: As shown in Section IV-A1, individual dynamic slices are isolated from each other. Further, isolation of slices under changing channel qualities is ensured, as demonstrated in NVS [START_REF] Kokku | NVS: A substrate for virtualizing wireless resources in cellular networks[END_REF].

In the following, we investigate the impact of changing channel qualities on a mix of dynamic and on-demand slices. We consider two dynamic slices with each 5.0 Mbps requested throughput R k over a 12. an initial MCS 28. At 5 s, the channel quality of users of one slice drops to MCS 25; at 10 s, to MCS 22; and at 15 s, MCS returns to 28 (cf. Fig 6). Furthermore, there is an on-demand slice with a maximum resource reservation t k,max of 20 %. To increase the effect of increased delay due to decreased channel quality, we set the slice's resource averaging window τ k in (12) to 10 ms. This slice contains four users and a packet arrival identical to the Poisson Process in Section IV-B1. The user channel quality, initially at MCS 28, drops to 23, 18, 17, and 16, at 5 s, 10 s, 15 s, and 25 s, respectively. It returns to MCS 28 at 30 s. The strong degradation of quality in the on-demand slice is motivated by the assumption that the slice still seeks to serve even bad users with high reliability requirements. The dynamic slice might be able to average out user quality drops over all its users, maintaining a high efficiency.

As shown in Fig. 6, the dynamic slice with diminishing user channel quality initially experiences instability in the throughput before dropping due to low channel quality. Note how in both cases, an adaptation is almost immediate. When the user channel quality reestablishes, the throughput for this slice initially overshoots for two reasons. First, since the rate adaptation needs less radio resources for the same amount of data, free resources can be used to catch up the previously low throughput. Second, the moving average r exp k,j in (15) needs some time to adapt to the new, real throughput r k , thus artificially boosting the weight of the dynamic slice in (14).

For the on-demand slice, Fig. 6 plots average delays over 100 ms windows. Down to MCS 18, a drop in channel quality results in a stronger variation of channel delays; the lower the quality, the higher the variation. Since the lower channel quality results in a lower rate for transmission, packet transmissions for some packets tend to take longer themselves and queuing up subsequent transmissions. Note that the quality of the dynamic slices has no impact on the on-demand slices since the on-demand slices are scheduled preferentially. This can also be seen in Fig. 7, which shows almost no difference in the CDF for the time windows 10-15 and 15-20 s. Starting at 20 s (Fig. 6) for qualities lower than MCS 18, a strong increase in latency (and a loss of packets) is noticeable for a slight decrease in MCS. It can be supposed that a sweet spot is reached for the parameter settings (arrival rate, resource share t k,max , windowing duration τ k ) such that the slice can frequently not request more than its maximum resource share to guarantee a short delivery time. For a fixed arrival rate, the latency could be reduced by setting a higher resource share t k,max for this slice. However, this would constantly block resources in admission control and might create instability if overbooking is employed. Hence, it would be advisable to increase the windowing duration τ k such that the scheduler might be temporarily granted more resources temporarily. In summary, we note that on-demand slices have comparative, low scheduling delays down to a minimum channel quality for a given traffic pattern and parameter setting. Below this minimum quality, they show behavior similar to NVS-like or fixed slices (cf. Fig. 5a), since they are constantly restricted to their minimum resource share t k,max .

3) Behavior of on-demand slices: As already alluded in Section III-C, an on-demand slice is limited in the amount of RBs it can allocate to prevent that such a slice occupies all radio resources of the BS. In fact, a slice owner could fake the parameter B k to be very high which the inter-slice scheduler uses without further checks. Hence we introduced the averaging parameter τ k in (12) to limit an on-demand slice to its maximum allowed resource share t k,max , on average. This is shown in Fig. 8 where the on-demand slice uses almost all resources (at 30 ms), followed by no activity. However, as soon as it constantly requests resources, it is limited to its resource share t k,max = 0.2 (at 45 ms).

V. CONCLUSION

We presented a utility-based slice scheduling algorithm applicable to 4G and 5G systems to achieve QoS guarantees. It applies a priority-based resource allocation tailored to three types of slices, namely fixed slice, dynamic slice, and on-demand slice. Through extensive set of simulation, we demonstrated that the proposed framework maintains isolation, customization, and QoS guarantees, and significantly outperforms existing approaches, like NVS, in this respect.

Our framework is applicable to 5G since it uses a similar frame structure as 4G. However, 5G has additional means to accomodate low-latency services. In the future, we plan to evolve this work in the following directions: (i) considering 5G mini-slot scheduling within a slot, (ii) considering multiple BWPs with different numerologies, and (iii) integration with our FlexVRAN [START_REF] Schmidt | FlexVRAN: A flexible controller for virtualized RAN over heterogeneous deployments[END_REF] and OpenAirInterface [START_REF] Nikaein | OpenAirInterface: A flexible platform for 5G research[END_REF] platforms.

Figure 1 .Figure 2 .

 12 Figure 1. Isolation between two dynamic slices. (a) Initially, both slices have three users. (b) Then, one user in slice 2 disconnects, the slice increases peruser throughput while maintaining its aggregate throughput.

Figure 3 .

 3 Figure 3. Exemplary resource utilization for three slices. (a) Static resource reservation. (b) Dynamic resource reservation.

Figure 4 .

 4 Figure 4. Comparison of (a) number of lost packets and (b) percentage of used resources over total system resources for 10 s of simulation.

Figure 5 .Figure 6 .

 56 Figure 5. Comparison of delay of non-discarded packets between the proposed Framework (FW) and an NVS-like scheduling scheme (NVS): (a) CDF for CBR and VBR traffic. (b) Packet delays over 1 s simulated time for VBR traffic. Note the respective average delays, marked with horizontal lines.

Figure 7 .Figure 8 .

 78 Figure 7. Comparison of scheduling delay for changing user channel qualities.

  ∀k ∈ K fix Output: Allocation results for all fixed slices 1 forall k ∈ K fix do Allocate P k RBs starting from P start

	k	to slice k
	3 end

2

  b exp k , ∀k ∈ K fix Output: Allocation results for on-demand slices ∈ K fix 1 forall k ∈ K ond do Calculate w k as in (9) Allocation of RBs for dynamic slices. end 5 k max ← arg max k (w k ) 6 Allocate all remaining RBs to slice k max

	3	Calculate T ′ k as in (13)
	4 end
	5 K sorted ond ← sort K ond desc. by w k , and skip if B k = 0 6 forall k ∈ K sorted and while RBs available do ond 7 Allocate round(T ′ k • N ) RBs to slice k
	8 end
	Algorithm 3: Input : SLA k = {R k , R ref k }, r exp k , ∀k ∈ K dyn
		Output: Allocation results for dynamic slices ∈ K dyn
	1 forall k ∈ K dyn do 2 Update r exp k as in (15)

2 3 Calculate w k as in (14) 4

It describes the radio spectrum resources, consisting of bands, carriers, or available resource blocks (RBs).

It refers to the functional blocks to perform the necessary control plane (CP)/user plane (UP) operations, delimited through functional splits.

It refers to the status of CP/UP processing and the associated configuration.

Since the resource efficiency is not targeted by on-demand slices, the down-scaling operation of (3) is not applied here.

Due to space reasons, we encourage the readers to refer to Lemma 1 of[START_REF] Kokku | NVS: A substrate for virtualizing wireless resources in cellular networks[END_REF].

The code is available at https://gitlab.eurecom.fr/schmidtr/mac-slice-sim upon request.

This duration includes all packets for the considered packet error rate, and the maximum data burst volume would exclude packet bursts that cannot be handled. See TS 23.501.

ACKNOWLEDGMENT

This work received funding from the European Union's Horizon 2020 Framework Programme under grant agreement No. 762057 (5G-PICTURE) and No. 761913 (SliceNet).


Nasr-Eddine Ouldei Tebina

Nacer-Eddine Zergainoh

Paolo Maistri

X-Ray Fault Injection: Reviewing Defensive Approaches from a Security Perspective

Keywords: X-Rays, Fault attacks, TID effects

With the emergence of a novel fault injection technique based on nanofocused X-Ray beams, these attacks have been proven feasible even when using simple laboratory X-Ray sources. X-Rays can induce parametric shifts in MOS components, mostly at the level of oxides: if properly controlled, these shifts lead to reversible stuck-at faults. It is therefore established that X-Rays can indeed be considered a threat that needs to be addressed in the future when designing secure circuits. In this paper, we discuss how countermeasures issued from the state of the art can be exploited to mitigate or resist against this novel attack.

I. INTRODUCTION

The effects of Total Ionizing Dose (TID) radiations on Metal Oxide Semiconductor (MOS) circuits have been largely known and studied in the context of space and avionics applications. It has been known for years that highly energetic radiations such as X-Rays can be used as a mean to induce perturbations into a circuit, thus potentially affecting the reliability and the safety of systems operating in harsh environments [START_REF] Barnaby | Total-ionizing-dose effects in modern cmos technologies[END_REF]. However, it has been revealed only recently that they can be also a threat from a security point of view.

The works presented in [START_REF] Anceau | Nanofocused x-ray beam to reprogram secure circuits[END_REF] have demonstrated the feasibility of single transistor level attacks using synchrotronbased nanofocused X-Ray beams. Further advancements were presented in [START_REF] Maingault | Laboratory x-rays operando single bit attacks on flash memory cells[END_REF], which demonstrated the feasibility of such attacks using simple laboratory X-Ray sources. Tungsten or lead masks with microscopic holes, drilled using Focused Ion Beams (FIB), can be deposited on the target circuit. Only the region aligned with the hole is exposed to X-Rays, allowing for controlled illumination of the selected region.

The considered fault model for this technique and throughout this paper is a semi-permanent fault model. N-type MOS can be forced to a permanent conductive state, while P-type MOS can be forced to a permanent open state. This effect is nonetheless reversible and the normal state of the circuit can be restored by a simple heat annealing treatment. Semi-permanent faults, unlike transient injection methods such as laser or EM, rely on the accumulation of charges at the oxide levels in order to take effect, introducing a temporal imprecision factor lowering the temporal resolution of X-Ray beams. Currently, only attacks on memory have been explored since they don't require temporal synchronisation, but it is likely only matter of time before more advanced attacks are demonstrated. *Institute of Engineering Univ. Grenoble Alpes One of the advantages of using X-Rays is their high penetration capability, as it is possible to conduct such attacks from the front side without tampering with the circuit package. On the other hand, one of the downsides of X-Ray Fault Injection (XRFI) is the minimum required knowledge about the circuit layout in order to conduct an efficient attack. This, however, is a limitation that is shared by other fault injection techniques based on illumination, such as electromagnetic or laser attacks. This can be usually overcome by using infrared imaging in order to locate the most interesting regions to target [START_REF] Dutertre | Sensitivity to laser fault injection: Cmos fd-soi vs. cmos bulk[END_REF].

It is clear that XRFI might become a feasible threat to digital devices. In the literature, several solutions have been proposed to harden these devices against radiations, and in particular X-Rays. These works, however, are mostly oriented from a safety or reliability point of view, where the threat model is conservatively restrictive. On the other hand, the attacker model from the security perspective may be much more complex, allowing for much higher complexity in terms of spatial and temporal multiplicity. In this paper, we review the techniques used in TID and SEU protection for digital circuits, and discuss the viability of such techniques in a security context.

The paper is organized as follows. In section II, the necessary background on ionizing radiations and their effects on MOS circuits is detailed. In Section III we present a stateof-the-art on TID mitigation techniques. In section IV, the potential utility of Single Event Upset (SEU) countermeasures is evaluated in the scope of our fault model. In section V we discuss the potential threat model of X-Ray attacks and the viability of the current countermeasures against such model. The concluding section VI provides a summary for the main ideas discussed in this paper with some perspectives.

II. BACKGROUND

A. TID effects on MOS circuits

TID radiations such as X-Rays have an impact on the drain current I d (V G ) characteristic of MOS transistors [START_REF]Ionizing Radiation Effects in Electronics: From Memories to Imagers[END_REF]. This impact can be resumed in 3 parametric shifts of the transistor: a shift in the threshold voltage, an increased leakage current, and a trans-conductance degradation. Fig. 1 demonstrates the basic mechanisms behind hole trapping inside the oxide. First step is where the electron-hole pair is generated in the oxide due to the pair generation mechanism. Most of these pairs recombine almost immediately and the number of these recombinations is known as the charge yield. Electrons, due to their high mobility, are dissipated through the gate (anode) 978-1-6654-5938-9/22/$31.00 ©2022 IEEE when biased with a positive voltage. The remaining holes will start migrating towards the negative potential (cathode) in steps of localised states. These positive charges will then be trapped in defect sites which are found to be oxygen vacancies. The last step is the formation of interface traps, and the sign of these traps depends on the position of the Fermi level of the silicon. These interface traps can actively exchange charge carriers with the substrate. Fig. 2 shows the shift induced by charge and interface traps on the I d (V G ) characteristic of MOS transistors. It has been well known for years that ionizing dose exposure have an impact on short channel effects: for N-type MOS they are worsened; for P-type MOS they are reduced [START_REF] Schrankler | Cmos scaling implications for total dose radiation[END_REF]. However, in both cases it has been shown that the shift in the threshold voltage increases as the channel length decreases, this being known as Radiation Induced Short Channel Effects (RISCE) [START_REF] Faccio | Radiation-induced short channel (risce) and narrow channel (rince) effects in 65 and 130 nm mosfets[END_REF]. Studies also show that thinner gate oxides are more resistant against TID induced effects, since they provide less area to generate oxide traps. However, the continuous shrinking of CMOS channels has introduced a new concern, mostly caused by the charges trapped on the Shallow Trench Isolation (STI) oxides. These STI charges contribute to leakage currents in two ways: it can be intra-component (i.e., in the same transistor) [START_REF] Esqueda | Modeling inter-device leakage in 90 nm bulk cmos devices[END_REF] leakage that is between the source and the drain of the same transistor, also known as Radiation Induced Narrow Channel Effects (RINCE) [START_REF] Faccio | Radiation-induced edge effects in deep submicron cmos transistors[END_REF]; it can also be inter-component (between two transistors), as a parasitic path of charge carriers can be formed on the STI connecting two MOS transistors, leading to an increase in the leakage current [START_REF] Zebrev | Physics-based modeling of tid induced global static leakage in different cmos circuits[END_REF].

III. TID COUNTERMEASURES

A. Process level TID countermeasures 1) Oxide hardening techniques: Most Radiation Hardening By Process (RHBP) techniques target mostly oxide enhancements [START_REF] Mrstik | Hole and electron trapping in ion implanted thermal oxides and simox[END_REF]- [START_REF] Chen | Impact of sti indium implantation on reliability of gate oxide[END_REF].The implantation of holes or electrons into oxides [START_REF] Mrstik | Hole and electron trapping in ion implanted thermal oxides and simox[END_REF] has been found useful to reduce the V th shift induced by TID radiations. The mechanism behind this technique can be the direct implantation of elements into the oxide such as Al, Si, P, F [START_REF] Nishioka | Radiation hardened micron and submicron mosfets containing fluorinated oxides[END_REF] [14], or creating a thin layer of such materials in order to isolate the TID sensitive parts of the circuit such as the STI [START_REF] Peng | Radiation hardening by the modification of shallow trench isolation process in partially depleted soi mosfets[END_REF]. These studies also suggest that the quality of the doping profile is not only limited to the implant particle but additionally to the implantation conditions and thermal control of the procedure.

2) Silicon On Insulator (SOI): SOI response to TID effects has been thoroughly studied during the past years. Partially Depleted SOIs (PDSOI) have been found to be more TID resilient than Fully Depleted SOIs [START_REF] Rezzak | Total-ionizing-dose radiation response of 32 nm partially and 45 nm fully-depleted soi devices[END_REF]. Since in FDSOIs charge traps in the back gate are electrically coupled with the front gate [START_REF] Banna | Threshold voltage model for deep-submicrometer fully depleted soi mosfet's[END_REF], any accumulation on the back gate will have a direct impact on the Threshold voltage shift in the front gate. PDSOIs on the other hand, are known to have a neutral zone that acts as a decoupling intermediate between the front and the back gate, and a barrier for the source-drain leakage currents. Other SOI based TID hardening techniques have emerged during these past years, such as the use of a second SOI layer [START_REF] Huang | An effective method to compensate total ionizing doseinduced degradation on double-soi structure[END_REF] in order to compensate for the strong coupling effect in FDSOI between the front gate and the back gate. Back gate biasing [START_REF] Watkins | Mitigating total-ionizing-dose-induced thresholdvoltage shifts using back-gate biasing in 22-nm fd-soi transistors[END_REF] has also proven to be an efficient method of threshold shift compensation in SOI MOSFETs.

B. Layout level TID countermeasures

It is known that only NMOS transistors are concerned by the leakage paths created on their edges (see Fig. 3.a), hence different layouts have been proposed, other than the regular two edged layout transistor. The STI and the oxide gate spacers on the transistor are the main contributors to these leakages. STI charge traps effect is more important when the gate is narrower (Smaller W), while the effect of charge traps on the spacers is more accentuated when the gate is shorter (Smaller L). H-gate layout possesses, as the name indicates, an H shape gate (Fig. 3.b), usually with a P + extension over the STI in order to prevent leakage paths: it provides a promising resistance to STI induced leakage when compared to other layouts [START_REF] Liu | Total-dose-induced edge effect in soi nmos transistors with different layouts[END_REF], since the drain and source are not directly in contact with the STI walls. Another option is to use a ringed source/drain layout in order to reduce STI induced leakage, as its TID resistance is slightly less than an H-gate layout (Fig. 3.c). In order to eliminate TID induced leakage paths on the edges of a transistor, Enclosed Layout Transistors (ELT) [START_REF] Anelli | Radiation tolerant vlsi circuits in standard deep submicron cmos technologies for the lhc experiments: practical design aspects[END_REF] are the better candidate, where the drain or the source of the NMOS are fully enclosed by the other diffusion, thus eliminating any edge contact with the STI (Fig. 3.d).

C. System level TID countermeasures

The effects of radiation exposure on electronic circuits can be reduced by shielding its package or its whole system. The type of material used as a shield is chosen according to the type of radiation. A comparative study on the effectiveness of IC shields against space radiations [START_REF] Spratt | Effectiveness of ic shielded packages against space radiation[END_REF] suggests that low-K materials are the most effective against proton and electron radiations, whereas high-K materials such as Aluminium and Tungsten are better options for photon radiations.

IV. SEU COUNTERMEASURES

A typical XRFI scenario would be to determine promising fault injection spots using reverse engineering techniques, then the attacker may inject the desired faults in a relaxed state, and then perform data analysis on the faulty outputs. This type of faults is partially similar to a Single Event Upset (SEU) where a transistor remains stuck at a certain state. As a consequence, not only TID countermeasures apply to this type of model, but some SEU mitigation techniques as well.

A. Spatial redundancy

Spatial redundancy is the practice of physically replicating the logic of a circuit a number of times in order to detect or detect and correct an error. One of the most common techniques to deploy spatial redundancy is Triple Modular Redundancy (TMR), where the logic is triplicated and voters are employed to correct the error based on the majority. This implies that two out of three signals need to function properly in order to give the correct output. It is also possible to implement more than triplicate architectures. This method introduces large area and power consumption penalties.

B. Temporal redundancy

The concept of temporal redundancy is based on the sampling of the same data at different times and vote between them This method protects against SEU and transient events because of the extra temporal window. In addition to the trade-off in terms of area, temporal redundancy directly impacts the setup times due to the inserted delays, thus limiting the maximal operational frequency of the circuit.

C. Node hardened sequential circuits

The concept of spatial redundancy can be applied to design SEU hardened flip flops such as in [START_REF] Oliveira | A tmr scheme for seu mitigation in scan flip-flops[END_REF], or using temporal redundancy hardening such as in [START_REF] Mavis | Soft error rate mitigation techniques for modern microcircuits[END_REF]. Another concept for FF hardening exists, which is based on internal node hardening of the flip-flop. The most common node hardened design is the Dual Interlocked Storage Cell design (DICE). Which is composed by a succession of four cross coupled inverters. The logic state of each node is controlled by the two adjacent nodes If a perturbation occurs on a certain node, its propagation is turned off by the next node. This type of design is immune to what is called Single Node Upsets (SNU). However, it remains sensitive to Double Node Upsets (DNU) and more. Several designs have appeared over the years, original and hybrid designs that exploit redundancy mixed with node hardening methods. Muller C-element is also a popular technique to resist SEU: when the two inputs are at the same logical state, the output drives the same state as well, otherwise it retains its state.

D. FPGA specific countermeasures

FPGA circuitry is unique in a sense that it provides reprogramability and flexibility in terms of circuit design. In addition to digital circuits redundancy and SEU mitigation techniques discussed earlier, FPGAs provide some unique SEU countermeasures. For instance, through the Reliability-Oriented place and Route Algorithm (RORA) [START_REF] Sterpone | A new reliability-oriented place and route algorithm for sram-based fpgas[END_REF], the circuit is implemented in a way to avoid Multiple bit upsets. Another common FPGA SEU hardening technique is called Scrubbing [START_REF] Berg | Effectiveness of internal vs. external seu scrubbing mitigation strategies in a xilinx fpga: Design, test, and analysis[END_REF], where the Bitsream is continuously refreshed in order to avoid the accumulation of SEU in the logic.

E. Error Correcting Codes (ECC)

ECC, or sometimes referred to as Error Detection And Correction (EDAC), are algorithms deployed in order to constantly check the accuracy of the original data by adding some redundant data (eg, parity), and can be implemented in hardware or in software. ECC can be divided into two main families and a hybrid family: Linear Block Codes, Convolutional Codes and the hybrid Turbo or Concatenated codes. ECC is a wide field of study whose complexity goes beyond the scope of this paper. The main characteristic of such codes is the number of upsets they can detect and correct, and the area overhead they introduce [START_REF] Ryan | Channel Codes: Classical and Modern[END_REF].

V. DISCUSSION

We discuss here the effectiveness of the previously described countermeasures from the security point of view. TID countermeasures provide resistance against oxide charge accumulation side effects. As the process of XRFI is not time dependant, the target is illuminated until the fault appearance. Thus, most TID countermeasures cannot be considered a viable countermeasure to XRFI. Shielding is not advisable against this kind of attacks, as the adversary can physically bypass these measures in order to facilitate the attack. However, some countermeasures can be imagined against this type of attacks where shielding and another circuit-depackaging countermeasure are combined. TMR is very efficient against SEU, since the possibility of corrupting two of the same redundant logic is very low. However, in the context of our fault model, two voters out the three can be corrupted one at a time. Additionally, vulnerability against Side Channel Analysis increases. The only protection layer TMR provides versus XRFI is the difficulty to identify the components of the same redundant logic. Temporal redundancy is ineffective against the semi-permanent fault model, since the fault will persist even after the delayed sampling of the data. Node hardening is very efficient and widely used nowadays in space applications, even so it remains vulnerable to the highly targeted multiple attacks permitted by X-Ray beams. Some countermeasures can be imagined when combining node reinforced designs with TID resistance as it increases the complexity of the attack. For example, in case of a DNU attack on a SEU hardened FF, two X-Ray injections are required. If the perturbation of the TID resistant target for the second injection takes enough time, the first injection target might regain its original state due the reversibility effect of the fault (Annealing effect), causing the attack to fail. The reliability oriented Algorithm RORA can prove to be efficient X-Ray attacks since it deals with one of the main strengths of XRFI, which is the number of simultaneous perturbations that it can inject. On the other hand, scrubbing does not provide protection against persistent effects such as the semi-permanent fault model, as reloading the bitstream does not reverse the fault. ECC is highly efficient to protect information in memory, or sequential logic in general, but protecting the computational data path may be quite difficult, as the code must be propagated and predicted through the combinational logic independently of the main data. This may be a challenge for more complex (but efficient) codes if nonlinear operations must be computed.

VI. CONCLUSION

In this paper, we surveyed the state-of-the-art countermeasures of TID and SEU and discussed their potential effectiveness against the XRFI semi-permanent stuck-at model. TID countermeasures will always provide a certain level of resistance but not immunity against this type of attacks. SEU countermeasures, in particular Error Detecting Codes, have a big potential to provide viable ways to mitigate XRFI attacks on memories, but their efficacy is limited if data processing must be protected. Their suitability to security is in general debatable. More in detail, multiple event upsets mitigation capable methods are particularly effective, such as EDAC, RORA and node hardened circuits. It is clear that the need to develop new, XRFI specific, countermeasures will be required in the near future, due to the specificity of the XRFI fault model in terms of spatial and temporal characteristics.

Fig. 1 .Fig. 2 .

 12 Fig. 1. Energy band diagram schematic [5] demonstrating different mechanisms in a MOS structure under an ionizing dose (a) Pair generation by ionizing radiation (b) Transport of positive charge through localised states in oxide bulk (c) Hole trapping near S I /S I O 2 interface (d) Formation of interface traps inducing a threshold shift

Fig. 3 .

 3 Fig. 3. TID induced leakage paths in transistors : (a) Two-edged, (b) H-gate (c) Ringed-source (d) Enclosed-Layout

ACKNOWLEDGMENTS

This work has been partially funded by French National Research Agency in the frame of the ANR project MITIX (ANR-20-CE39-0012).