F Letertre

N Daval

F Templier

E Bano

D Planson

L Di Cioccio

E Jalaguier

J M Bluet

T Billon

R Madar

J P Chante

SiC power devices onto QUASIC and SiCOI Smart-Cut  substrates : first demonstrations

Keywords: QUASIC, SICOI, SOI, wafer bonding, Smart-Cut , SiC, CVD epitaxy, Schottky diodes

Wafer bonding technologies have been recognized to provide new substrates structures suitable for the development of Si power devices. Among the multiple examples that could be listed, the possibility to generate PN junctions without thick epitaxial growth and lateral devices onto dielectrically isolated substrates such as SOI (Silicon On Insulator) are significant examples of the interest proposed by wafer bonding. Thin film substrates obtained with the Smart-Cut® technology such as SiCOI (SiC On Insulator) substrates for lateral devices and QUASIC substrates for vertical power devices have already been demonstrated. In this article, we review the recent developments in the field of SiC power devices using these two kinds of SiC Smart-Cut substrates. Lateral and vertical Schottky diodes have been processed onto SiCOI and QUASIC substrates as a demonstration of feasibility. Simulations, results and prospects are presented in this article.

Introduction

Previous works have been focused on the demonstration and characterization of SiCOI substrates (SiC On Insulator) and QUASIC substrates. In both cases, physical and electrical characterizations have proved that the crystallinity and main electrical features of the SiC transferred layer are not altered by the Smart-Cut® process [1]. Moreover, CVD epitaxial SiC regrowth performed using bulk like growth conditions is possible onto QUASIC substrates [START_REF] Letertre | QUASIC Smart-Cut ® substrates for high power devices[END_REF]. In this article, we will first focus on the fabrication and electrical characteristics of vertical Schottky diodes onto vertically conductive and epitaxially SiC regrown QUASIC substrates. Secondly, electrical simulation, fabrication and electrical results of lateral Schottky devices onto SICOI material will be presented and discussed.

QUASIC Substrates for vertical power devices

This substrate is designed to be compared with conventional 4H SiC low resistivity and low defectivity bulk substrates. Some convincing technical demonstrations have already been demonstrated onto QUASIC substrates. The possibility to grow high quality epilayer with good morphological and electrical properties is one main result. Secondly, the demonstration that the presence of the WSi2 bonding layer between the seed layer (transferred using the Smart-Cut® process) and the SiC carrier substrate induces no electrical degradation on the current path is also one main point [START_REF] Letertre | QUASIC Smart-Cut ® substrates for high power devices[END_REF]. A Schottky diode structure has been fabricated on one QUASIC substrate. The epitaxial stack has been grown in bulk like conditions in a horizontal cold wall reactor at atmospheric pressure and at a temperature of 1450°C. The epitaxial sequence comprises an N+ buffer layer directly grown on the transferred layer (1 µm thick, doping level 1e18 at/cm3), and an N -type drift region with a doping level around 1e16 at/cm3. The thickness of the drift layer is about 6 µm. The electrical resistivities of both the thin transferred layer and the SiC carrier substrate are assumed to be 0.03 ohm.cm. Finally, the electrical resistivity of the buried WSi2 layer is assumed to be 50 µohm.cm. A simple Schottky device has been then manufactured. Vertical Schottky diodes were then fabricated with titanium dots on top and titanium full sheet back side metallization followed by a 400 °C annealing.

The device has no edge termination but it is important to notice that the structure involves the SiC epitaxial layers of a 600V Schottky diode. The complete stack is summarized on figure 1.

Room temperature I(V) forward and reverse measurements

These measurements have been performed onto Schottky diodes of different surfaces (0.05 mm 2 and 2 mm 2 ). A four probes method has been used. I(V) characteristics are shown on figure 2. Small diodes (0.05 mm 2 ) exhibit classical rectifier behavior (figure 2a) whereas some large diodes (2 mm2) exhibit an excess forward current (figure 2b), in the exponential regime (below 1 V), probably induced by a two barriers behavior. In correlation, we observe a larger reverse current. This effect has been already observed for Ti / 4H SiC diodes onto commercial bulk SiC substrates [START_REF] Defives | Barrier Inhomogeneities and electrical characteristics of Ti/4H-SiC Schottky rectifiers[END_REF]. Several measurements performed on same diameter diodes along the wafer show that from one diode to another, the measured excess currents are not reproducible. Thus, the most probable reason for such an effect can be attributed to intrinsic material or metal/SiC interfacial defects on the grown structure. This behavior was observed onto commercial substrate [START_REF] Defives | Barrier Inhomogeneities and electrical characteristics of Ti/4H-SiC Schottky rectifiers[END_REF], but we cannot also exclude that this effect is not induced by the QUASIC substrate.

Figure 2a) I(V) on a 0.05 mm 2 device 2b) I(V) on a 2 mm 2 device with a double Schottky barriers behavior Figure 3a) Ideality factor variation with temperature 3b) SBH extraction for the 2mm² diode for the 2mm² diode These results show that for large diodes, the ideality factor tends to exhibit an ideal behavior at 500 K, reaching values near 1,2 whereas it is larger than 1.5 at 300 K. Moreover, the extraction of the SBH leads to a value above 1 eV at those high temperatures. These two results show that at 500 K, the diode exhibit nearly ideal behavior. The Ron value variation with temperature has also been measured. The measurement is reported in figure 4a. We also observe a strong variation with temperature with Ron value decreasing from 5 mΩ.cm 2 at 300 K down to 3 mΩ.cm 2 at 500 K.

Figure 4a) : Ron variation with temperature 4b) RT forward bias I(V) (S diode : 2 mm 2 )

Under high current operation (figure 4b), the 2 mm 2 diodes have shown that 2 amps of forward current can be obtained under 2.5 V bias. This value is quite far from previously published results and also commercially available devices but this result confirms that the QUASIC substrate structure is compatible with power application requiring large vertical current flow. The Schottky diodes manufactured onto this substrate are far from being optimized power devices because of the very simple technology applied and also the choice of metallization that do not provide best electrical characteristics. As an example of improvement, the use of Ni as a back side contact could help improving the electrical behavior of the devices. With using such an improved ohmic contact, we strongly believe that we would obtain state of the art on resistance (in the range of 1 mohm.cm 2 ). Nevertheless, this first result is a good demonstration of the technical viability of the QUASIC substrates though further improvements and understandings are necessary to optimize the design and fabrication of the substrate itself.

SiCOI Substrates for lateral power devices

SiCOI substrate consists of an active thin SiC layer insulated from the carrier substrate by a buried silicon oxide layer. Conversely to QUASIC substrate, SiCOI ones require lateral device design. As described in [START_REF] Arnold | Silicon On Insulator devices for high voltage and power IC applications[END_REF] for SOI substrates, both top single crystal and buried oxide layers thickness are important for interesting design possibilities in terms of field control (usually known as RESURF design). In the case of SiCOI substrates, thin single crystal SiC layers in the range of 0.2 -0.5 µm can be achieved on top of thick buried oxide. This kind of structure has been already characterized in terms of electrical properties of the transferred SiC thin film [1]. A typical value of N type doping level of 2e17 at/cm3 with low residual concentrations of compensating defects is demonstrated on top of an oxidized silicon substrate. This kind of structure would be ideal for the demonstration of the RESURF effect on SiC lateral devices.

Aiming a 600V Schottky diode on SiCOI substrate, we have performed electrical simulations, device architecture and process flow definitions, device fabrication and electrical tests. Simulations were carried out with MEDICI software, with most of Ruff SiC parameters [START_REF] Martin | SiC Devices: Physics and Numerical simulation[END_REF] and Konstantinov impact ionisation modelling [START_REF] Konstantinov | Ionisation rates and critical fields in 4H silicon carbide[END_REF]. The structure of the Schottky diode fabricated onto the thin SiCOI substrates is shown in figure 5. In this work we use a thin SiCOI substrate, which consists of an 2.10 17 cm -3 N type doped 4H SiC single crystal layer onto an insulated silicon carrier substrate. The transferred crystal is 500 nm thick above a 3 µm silicon dioxide layer. The handle substrate diameter was 4 inches allowing the fabrication process with our 4 inches silicon facilities. The processed SiCOI substrate is shown in figure 6, where the 1,35 inches SiC transferred layer is noticeable onto the large 4 inches carrier substrate (nowadays transferred SiC diameters are 2-3 inches). We have designed devices with three different lengths between anode and cathode contacts : 5 µm, 10 µm and 20 µm. According to simulation results, diodes are designed to sustain 600 V, which is a value calculated for an assumed SBH of 1,2 eV. Forward bias current is estimated to be 300 mA/cm for 2 V forward bias. The technical process basically contains the following steps. Cathode contact consists of a nickel sputtered layer Figure 6: 4 inches SiCOI processed substrate on a targeted N+ zone 110 nm thick at doping level as high as 7.10 19 cm -3 . The low resistivity SiC region for cathode contact was obtained by ion implantation and annealing. Anode contact on the sloped edge of the SiC layer was made by titanium sputtering and subsequent annealing at 400°C during 5 minutes. The fabrication process ended with a 10 µm polyimid secondary passivation opened on contacts. This SiCOI substrate has been fully processed onto a 4 inches silicon line including the standard photolithographic tools. Electrical tests have been performed to evaluate both forward and reverse characteristics of these lateral diodes. Figure 7 presents a picture of a device manufactured onto SiCOI substrate.

Electrical measurements

Figure 8 compares for the diode shown in figure 7, the calculated and experimental results on the forward and reverse modes. Die area of the diode is 1.1 mm² for active interdigited area of 0.4 mm². Results on forward mode (left) show that there is two-decade difference between simulation and results meaning the device having high on state resistance. We attribute it to a problem during post-implantation process leading to the partial etching of the N+ zone and leaving a huge ohmic contact resistance. Extracted Schottky barrier heights are closed to 1.2 eV, with an ideality factor of 1.2. Reverse characteristics are shown on the right part. Due to the active layer doping Nd-Na of 2.10 17 cm -3 , the reverse current is quite high, providing a forward/reverse ratio of 10 2 under 100 V. Nevertheless best components show a blocking voltage of 300 V and the reverse current is consistent with a reverse Ti/ SiC SBH of 0.9 eV. This low SBH instead of 1.2 eV fully explains the relatively low breakdown voltage of 300 V.

Evidence of RESURF effect on SiCOI

Resurf effect is identified by the influence of the substrate voltage on the electrical field crowding at the Schottky contact. Figure 9 shows the difference between the reverse current characteristics in case of a substrate connexion either to the anode or to the cathode. Assuming that the leakage current is a good representative of the electrical field, this chart demonstrates the RESURF design capability of the SiCOI substrate.

Conclusions

In this article, two Smart-Cut ® SiC substrates such as QUASIC and SiCOI are studied for Schottky diode fabrication. Those two substrates use a SiC top single layer ranging from a few hundreds of nanometers to several micrometers, providing silicon carbide power capabilities for devices fabrication with a crystalline quality comparable to SiC bulk substrates. SiCOI substrates potentially support full power system on a single chip and provide the possibility to design new devices not compatible with bulk substrates. QUASIC substrate have demonstrated to sustain a whole Schottky process. Simple fabricated diodes provide high current ratings up to 2 A. Further studies are needed to improve the electrical characteristics of the substrate itself, of the epitaxial layer grown on it. SiCOI substrates have successfully demonstrated their manufacturability in a 4 inch silicon line allowing technological processes such as ohmic and Schottky contacts, conventional etching, passivation. Those achievements lead to the demonstration of a SiC power Schottky diodes on 4 inches substrate. The presented results show that electrical performances are not yet fully satisfactory though encouraging. Studies are now directed toward thicker SiC structures to improve the electrical conductivity and towards SiC layers with lower doping concentration for increasing the blocking voltage. Those discrete electronics achievements are also useful to pave the way for Systems on Single Chip on SiCOI, which is a promising field of applications for those insulated substrate.

Figure 1 :

 1 Figure 1 : cross section of Schottky diode fabricated onto epilayer stack grown onto QUASIC substrate

2 )

 2 Further forward current measurements as a function of the temperature in the range of 200-500 K for the extraction of the ideality factor and SBH have been performed. The measurements are shown in figure3. The ideality factor has been extracted at each temperature by extracting the slope of the ln(I)(V) characteristics. The SBH is extracted from I(V) versus temperature measurements.

Figure 5 :

 5 Figure 5: cross sectional of diode structure designed onto thin SiCOI substrate and SEM view of the sloped Schottky contact. Physical and electrical parameters of the substrate are also given.

Figure 8 :

 8 Figure 8: comparison of electrical performances on lateral Schottky diodes between thermo-electrical simulations and experimental results (simulation with interfacial SiO 2 / SiC charges is included). Concerned diodes have an interelectrodes length of 10 µm and are developed on 2 mm (active area: 0,4 mm²).Left is forward and right is reverse measurements.

Figure 7 :

 7 Figure 7: snapshot of a 2 mm developed Schottky diode onto SiCOI

Acknowledgement

This work was partly supported by the French Ministry of Research and Education (Micro Nano Technologies Network). Special thanks to all the people that contributed to this work.


Narjess Ayari
email: narjess.ayari@orange-ftgroup.com

Denis Barbaron
email: denis.barbaron@orange-ftgroup.com

Laurent Lefèvre
email: laurent.lefevre@ens-lyon.fr

Evaluating Session-Aware Admission-Control Strategies to Improve the Profitability of Service Providers

In this paper, we investigate an economically motivated session-aware admission-control model for Internet servers subjected to future NGN session-oriented services. Our fundamental observation is that it is sometimes desirable to reject new sessions from some customers, so that others may be completed and thereby generate some revenue for the operator. Conversely, most of the already existing admission-control schemes, which operate either at the packet level or at the request level, may interrupt life-service sessions at any time during their lifespan. In this work, we evaluate novel service-oriented sessionaware admission-control strategies for controlling the acceptance of the offered network traffic to an Internet server. Conducted simulations target popular VoIP service. Simulation results demonstrate that responsive session-aware admission control improves the service provider's benefit and offers better QoS to subscribers. Particularly, we show that session-aware responsiveness provides network QoS in terms of completion of the service sessions independently of their durations.

I. INTRODUCTION

When overloaded, a processing server does not have sufficient resources to provide the service to all clients. It contributes to the poor QoS through sustaining heavy request queuing delays and prolonged processing time. Since a poor perceived performance is a foremost impediment to the success of any service, an operator needs to provide an acceptable QoS for the admitted network traffic. Therefore, not only does a processing server require enough processing resources, its resources also need to be prevented from overloading.

The concept of admission control is a well-known means to prevent a server or a network route from overloading. It consists of regulating the acceptance of the offered network traffic according to the usage of the controlled resources. Most state-of-the-art researches on that topic advocate sessionoblivious mechanisms where dropping requests pertaining to an accepted session can occur at any time during the session's lifespan. From an operator's perspective, this means that the server, which seems to sustain a high throughput, is in reality wasting its resources on failed or on interrupted sessions.

Conversely, the concept of customer session is of particular interest for many applications. For commercial web sites, for instance, a customer sends a number of HTTP requests to the web site during a single session. For the web site to be successful, it is important that as many customers as possible complete their sessions, since those customers may generate some revenue. Voice-over-IP is another emerging application requiring improved QoS. Firstly, from an economicallymotivated point of view, rejected or interrupted calls are not charged to customers, while resulting in an increasing number of angry clients. Secondly, they cause the operator's processing resources to be wasted. Since the overload of a call server or an intermediate gateway counts among the potential reasons for the interruption of ongoing calls, admission control is very desirable to guarantee an acceptable QoS for the admitted multiple flow-based VoIP calls.

Most of the already investigated admission-control mechanisms have focused on packet-level or on flow-level admission control [START_REF] Floyd | Random Early Detection for congestion avoidance[END_REF][START_REF] Hashem | Analysis of random drop for gateway congestion control[END_REF][START_REF] Chen | Providing differentiated services from an Internet server[END_REF][START_REF] Abdelzaher | Performance guarantee for Web server end-systems: a control theoretical approach[END_REF]. These strategies are particularly suitable for single flow-based sessions where a single subscriber session spans over a single flow over time.

In [START_REF] Ayari | A Session Aware Admission Control Scheme for next Generation IP Services[END_REF], we advocated an admission control architecture that uses deep packet inspection to provide session awareness to routers subjected to multiple flow-based NGN services. We focused on an engineering point of view and described the design of the architecture's building blocks. In this paper, we investigate a novel economically-justified session-aware admission-control paradigm to improving resource usage and profitability of session-oriented servers. Our fundamental observation is that it is desirable to reject new sessions from some customers, so that others may be completed successfully, and thereby generate some revenue for the service provider. Through simulations, we demonstrate that responsive sessionaware admission control improves the service provider's benefits and contributes to providing better QoS to subscribers. Particularly, we show that session-aware responsiveness provides network QoS in terms of completion of the service sessions independently of their durations.

The remainder of this paper is organized as follows. In section II, we review some research works on admission control for Internet servers. Section III presents the mechanism that we advocate to control the offered session-based network traffic to an Internet server. Section IV is devoted to the performance evaluation of our proposal. Simulation results show that our approach provides the operator with better profitability and contributes to the completion of the offered sessions independently of their duration. Finally, section V concludes the work and outlines interesting future directions.

II. BACKGROUND AND RELATED WORKS

Admission-control mechanisms for Internet servers have almost the same objectives as admission-control mechanisms for the core network. The latter typically involve a gateway that estimates the offered network load by measuring the queue length of its backlogged packets. The admission-control policy uses this value to regulate the acceptance of the incoming packets. The Drop Tail algorithm describes the simplest form of packet discarding. It suggests dropping incoming packets when the router's buffer space becomes full. This idea is obviously applicable to the admission control of requests made to Internet servers. However, its major drawback is that it rejects aggressively and arbitrarily the incoming traffic while approving similarly different classes of traffic. Both the Early Random Drop (ERD) and the Random Early Detection (RED) approaches [START_REF] Floyd | Random Early Detection for congestion avoidance[END_REF][START_REF] Hashem | Analysis of random drop for gateway congestion control[END_REF] addressed Drop Tail's deficiencies. They suggested to prevent the router's congestion rather than simply reacting to it. In essence, the idea is to prevent the backlog saturation by anticipating the rejection of the incoming packets as soon as the backlog queue's length goes beyond a predefined threshold. A packet will be dropped with a probability computed according to the router's backlog queue length. Randomization tends to ensure that all classes of traffic will suffer the same loss rate. Chen and Mohapatra [START_REF] Chen | Providing differentiated services from an Internet server[END_REF] applied the ERD approach to regulate the acceptance of web server requests. They applied a double-threshold-based admission control on the application server's listen queue. Requests of lower priority are rejected with a higher probability as soon as the server's utilisation exceeds the first threshold. All requests are rejected when the second threshold is reached. This approach was shown to be effective for controlling differentiated services, mainly in terms of queuing delays between lower and higher traffic-priority classes. However, it has one major drawback: the application server's queue length does not necessarily represent a good indicator of the server's experienced load. Abdelzaher et al. [START_REF] Abdelzaher | Performance guarantee for Web server end-systems: a control theoretical approach[END_REF] assumed a linear regression method which estimates the impact of the handled requests on the system's utilization. They used a linear feedback control-theory which admits an appropriate number of requests while keeping the system utilization bounded. However, they didn't consider any further constraint on the handled traffic. Lee et al. [START_REF] Lee | Admission control and dynamic adaptation for a proportional delay diffserv-enabled web server[END_REF] focused on the web server and assumed the knowledge of the request arrival rate as well as the maximum waiting time for each incoming traffic class. They suggested two admission-control approaches. The first approach maximizes the potential profit of the service provider, while the second one admits as many clients as possible into the controlled web server. Carlstrom and Rom [START_REF] Cherkasova | A mechanism for peak load management of commercial web sites[END_REF] presented an architecture and some algorithms for optimizing the performance of web services. They advocated an analytical admission-control model, to maximize the service provider's objective. Their key idea was to break down a given web session into stages each having specific requirements and transition probabilities. The server must be aware of this structure so as to provide QoS-aware processing.

III. PROPOSAL OF SESSION-AWARE ADMISSION-CONTROL STRATEGIES FOR INTERNET SERVERS

A. Problem statement and motivations

Fundamental to our proposal is the characterization of the operator's reward as the mean monetary equivalent due to the blocking, the completion and the interruption of the offered sessions over a long time scale. On the basis of economical arguments, we define the operator's reward as the mean pay-off that encompasses the following three performance criteria.

Firstly, in an ideal situation when the Internet server does not suffer overload, an accepted session terminates normally. The consequence of that good functioning is user satisfaction, which translates into a positive image of the operator regarding competition. On the contrary, when the server experiences overload, any newly offered session will be blocked, resulting in bad user perception of the QoS provided by the system. Finally, when the server runs close to its capacity and is overloaded, the already active sessions are most likely to be interrupted.

Based on the operator's point of view, we assume that interrupting existing sessions is even worse than blocking new sessions, since interrupted calls are not charged to customers, while resulting in an increasing number of angry clients and causing the operator's processing resources to be wasted.

Let us associate to the successful completion, rejection, and interruption of a session an equivalent monetary value that describes a per-session gain contribution to the total operator's reward, denoted by c R , b C , and i C , respectively. If c N , b N , and i N stand for the mean number of completed, rejected, and interrupted (respectively) sessions per unit of time, then the operator will try to maximize the following objective function,

i i b b c c N C N C N R R - - = : , (1)
The decision variables that the operator would play on to maximize this objective R are the acceptance probabilities of the newly offered sessions, denoted below by ( ) p .

B. Proposed session-aware admission control

From the above analysis, it turns out that the optimal network traffic acceptance policy would accept an offered session to the server if and only if the reward resulting from accepting the session is more important than the penalty resulting from rejecting it. This policy is expected to maximize the operator's profitability by maximizing the number of completed sessions under heavy load.

The rest of this section is devoted to describing the structural properties of the acceptance strategies that we advocate to optimize the operator's global reward R. We believe that in a more realistic and precise model, the admission control decision should depend on the load of the system [START_REF] Ayari | A Session Aware Admission Control Scheme for next Generation IP Services[END_REF][START_REF] Ayari | SARA: A Session Aware Infrastructure for High Performance Next Generation Cluster-based Servers[END_REF], which could, for instance, be measured in terms of number of packets pending in the server's network buffers.

Firstly, when the load experienced by the server is under a first threshold denoted by 1 T , the incoming traffic is accepted and forwarded to the next processing entity. Once the server's load exceeds the first threshold 1 T , any incoming traffic holding a request for the establishment of a new session is dropped with a probability p computed as a function of the server's instantaneous load. In the remaining of this paper, we refer to p as the probability of rejection of a new session. When the server's load exceeds the second threshold denoted by 2 T , only the traffic pertaining to the already established sessions is admitted. This rule is introduced mainly to avoid the interruption or the QoS degradation of the already established sessions. Particularly, we will show that this rule is necessary to reduce discrimination against long term sessions. Indeed, short lived conversations typically have a higher chance to be completed normally. When the server runs very close to its maximal capacity denoted by C, the offered traffic is dropped, until some processing resources are released. For improved responsiveness, an offered datagram is dropped with a probability p derived as a function of the instantaneously measured server's load denoted by ( ) s l , as follows,

In the following subsection, we describe the advanced simulations conducted to evaluate the advocated admissioncontrol strategies.

IV. PERFORMANCE EVALUATION

To evaluate the proposed admission-control strategies, we have implemented a generic simulator which consists of a processing server with a limited buffer-sized listen queue, a set of generators of clients, sessions, requests and feedbacks, as well as a set of estimators useful to maintain real-time information about the server's load as well as the rates it achieved at session-and request-level. We aim at showing that responsive session-aware admission control improves the operator's benefit as well as the QoS provided to subscribers by improving its session-level rate. Session-level rate will be defined below as the number of successfully completed sessions per unit of time.

A. Simulation model overview

We use a discrete event-based simulation model to describe the interaction between the requests' arrivals to the system and their departures from it. In our model, we define a session as a sequence of individual requests that are generated for the duration of the session. A new session is produced by a session generator according to specified input parameters such as the client's identifier, the time at which the session was initiated, its original and current durations, its source throughput, and more. A session is completed normally when the total number of the related requests are completed successfully. For a given simulation run, the client generator generates N sources of traffic each corresponding to one client. Every client is able to generate sessions at a source rate δ . The request generator issues session's requests according to specific session's parameters such as the inter-request think-time and the number of retries in case of a request loss.

The processing server is characterised by its capacity and service-processing time. The service-processing time is assumed to be proportional to a request's size.

C. Performance Metrics

We aim to study the impact of different admission-control policies, session-aware and session-oblivious, on the operator's achieved profitability. Profitability has been typically estimated by measuring the servers' throughput. Actually, a server's throughput is defined as the number of requests or packets that are processed per unit of time. Usually, a server running close to its edge capacity is considered satisfactory.

In this paper, we define the useful throughput or the success rate as the number of successfully completed sessions per unit of time. We believe that this metric provides a truthful estimation of the operator's benefit, since a server that sustains a high request-level rate may actually be wasting its resources on failed or on interrupted sessions.

In our simulations, we considered a realistic traffic, with similar traffic patterns as voice CBR-like traffic. Simulation results presented below average the output of ten simulation runs, made up of new arrivals of client sessions.

D. Simulation Scenarios and Methodology

In this subsection, we detail our study of the effect on the achieved useful throughput of the different advocated measurement-based admission-control strategies. We simulate the behaviour of an admission-control-enabled processing server over a simulation duration of 100 seconds. A client initiates a conversation with an average talking time that obeys an exponential distribution. Session duration is varied over the simulation run and we have considered medium-and long-term sessions with exponentially distributed durations. The traffic rate is set to 50 packets per unit of time.

Firstly, we consider a server deploying Request-Aware admission Control (RAC), where dropping requests pertaining to the same session occurs at any time during the session's lifespan. The request-aware strategy that we consider responsively drops the offered packets on the basis of a probabilistic model, as follows,

( ) ( )        - - ≤ = ≤ < . , 1 , , 0 1 1 1 1 otherwise T if T capacity T load T load if p C load , (3) ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( ) ( )        > ≤ < ≤ < ≤ = C l if C l T and NewSession if T l T and NewSession if l f T l if p s s s s s , 1 , 1 , , 0 2 2 1 1 , (2)
Secondly, we consider a server deploying Session-Aware admission Control (SAC). When the server runs under a heavy load, the offered packets pertaining to the already established sessions are given a higher priority compared to those holding requests for establishing new sessions.

In the first variant of this model, which is depicted as the ON/OFF Session-Aware admission Control (ON/OFF SAC), the dropping probability p of the offered new sessions is derived as follows, In the following subsection, we will be studying the effect of session awareness on the achieved average useful throughput for different session durations. Next, we will turn our attention to studying the effectiveness of the model described by equation ( 2) in fairly competing sessions independently of their duration. For this purpose, we will consider two simulation scenarios:

( ) ( ) ( ) ( )    > ≤ =
1) Generating homogeneous sessions over the same simulation run, having a duration that ranges from medium-to long-term. 2) Generating mixed sessions over the same simulation run. In order to focus on the fairness property, we have chosen that medium-and long-term conversations be equitably generated over the simulation time.

E. Simulation Results and Discussion

Figure 1 illustrates the effect of session unawareness on the achieved average throughput compared to the achieved average useful throughput for the simulation run [Fig. 1]. The generated sessions are medium-term. Session-unaware admission control is deployed either by involving no admission control (No AC) or by deploying request-aware admission control (RAC).

As we could have expected, when the server is oblivious to admission control or when it deploys request-aware admission control, the achieved average useful throughput has lower values compared to the achieved average throughput. Particularly, when the server is oblivious to admission control (No AC), while it seems to fully satisfy the clients' demands, only nearly 14 % of the offered sessions are successfully completed compared to the completion of nearly 17 % of the offered sessions on average, when responsive request-aware admission control (RAC) is deployed on the server. Indeed, dropping the offered packets to the server at any time during the session's lifespan does not efficiently prevent session interruptions. This observation confirms our economicallyjustified point of view, advocating that request-aware admission control does not deterministically contribute to improving the operator's profitability and the QoS perceived by clients. In contrast, figure 2 illustrates the average achieved useful throughput, when session-aware admission-control strategies are deployed on the server, compared to when responsive request-aware admission control is used by the server [Fig. 2]. Firstly, we can see that when responsive session-aware admission control is used, nearly 76 % of the offered sessions are completed successfully, for a threshold value of 75 % of the server's capacity. The choice of the threshold value is justified by further simulation results where we observed that, under the above assumptions, the best useful throughput is provided when using a threshold of 75% of the server's capacity. Figure 3 below describes the observed average useful throughput versus the threshold, assuming medium-term sessions and a responsive session-aware admission control [Fig. 3].

On the other hand, we can see that responsive session-aware admission control outperforms the basic session-aware admission-control model (ON/OFF SAC) by completing, on average, 8.83 % more offered calls.

It is also worth pointing out that the gain achieved when using responsive session-aware admission control (RESP SAC), compared to when using responsive request-aware admission control (RAC), is the completion of nearly 69 % more offered sessions, on average, under the same previously considered assumptions. As we can see, when the offered sessions are medium-term, double-threshold-based admission control performs slightly better than single-threshold-based admission control. Indeed, only 0.52 % of performance gain is obtained, on average. However, when the offered sessions are long-term, doublethreshold-based session-aware admission control offers a performance gain of nearly 44 % more completed sessions, compared to when single-threshold-based policy is used. This result confirms with intuition, since this model is actually designed to suit long-term sessions.

Let us now examine the average useful throughput when single-and double-threshold-based session-aware admissioncontrol strategies are performed on mixed traffic. Mediumterm and long-term sessions are equitably generated over the simulation runs. Figure 5 plots the percentage histogram of the achieved average of completed calls in that case [Fig. 5]. The first threshold is set to 75 % of the server's capacity for both strategies. The second threshold value is set to 90 % of the server's capacity for the Double SAC strategy. We can globally see that double-threshold-based sessionaware admission control (Double SAC) contributes to improving the average success rate by completing nearly 25 % more offered calls, compared to when single-threshold-based admission control (Single SAC) is used.

Figure 6 highlights the contribution of long-term sessions' success rate in this achieved total average useful throughput. It plots the percentage histogram of the average completed calls as a function of session duration for both single-and doublethreshold-based session-aware admission control [Fig. 6]. As we can see, double-threshold-based session-aware admission control privileges the fair completion of the offered sessions independently of their duration. Indeed, the second threshold aims at a kind of protection of long-term sessions under overload. We observe that more than 13.69 % more long-term calls, established through the server, have satisfactory quality. In contrast, this percentage drops to 2 % completed calls, when responsive request-aware admission control is used. As well, since the double-threshold-based admission control is giving a higher priority to long-term calls, it completes less medium-term calls. In realistic use-cases, calls range from short to long term. If we define QoS as the guarantee of more sessions independently of their duration, hence, based on the above simulation results, we can say that the session-aware admission control that we have advocated in section III contributes to having better QoS provided to subscribers.

V. DISCUSSION

In the previous section, we investigated session-aware admission control as the means to efficiently prevent the overload of Internet servers while maximizing the operator's profitability. We compared the average achieved useful throughput for the different considered scenarios involving the generation of either mixed or homogeneous sessions in terms of durations. As we have shown, session-aware admission control significantly surpasses standard strategies. For a satisfactory operator's revenue, session-aware admission control improves the success rate by more than 69 % compared to standard request-aware admission control when the server deals with medium-term offered sessions. On the other hand, we have shown that using responsive doublethreshold-based admission control is beneficial to increase the performance of servers processing long-term sessions. A performance gain of nearly 44 % more successfully completed long term calls is noticed when double-threshold-based session-aware admission control is used, compared to when using single-threshold-based session-aware admission control. Finally, we showed that in more realistic scenarios, where the calls' durations range from short to long term, doublethreshold-based session-aware admission control contributes to the completion of more sessions independently of their duration.

VI. CONCLUSION AND FUTURE WORKS

Service-aware network management is a key issue for the current and future NGN service-oriented networks. Particularly, providing session-aware QoS at the access, the core and the edge of the current Internet are hot topics for service operators and network providers. In this paper, we focused on the contribution of Internet servers to improving the QoS user experience. Based on an economically-justified service model, we derived and evaluated a novel session-aware admission-control model for Internet servers subjected to session-oriented services. Simulations have considered realistic voice CBR-like traffic. We showed that responsive session-aware admission control improves the providers' benefit as well as the perceived QoS by subscribers. Particularly, we showed that responsive double-threshold-based session-aware admission control adapts to more realistic use-cases by guaranteeing the completion of sessions independently of their duration.

Significant perspectives to this work include extending the advocated session-aware model to handle more QoS metrics, such as the client's category and other composite QoS metrics, as well as addressing the QoS of highly variable Internet traffic, for example, by using advanced forecasting techniques to improve the stability pattern of admission-control decisions under overload.

  second variant of this strategy advocates a responsive Session-Aware admission-Control model (RESP SAC), where new sessions are dropped with a probability p computed as a function of the server's current load as follows,

Fig. 1 .

 1 Fig. 1. Effect of Session-Unaware Admission Control on the Average Useful Throughput -Medium-Term Sessions & Single-Threshold-based RAC (75 % of the Server's Capacity).

Fig. 2 .

 2 Fig. 2. Effect of Session-Aware Admission Control on the Average Useful throughput -Medium-Term Sessions & Single-Threshold-based Admission Control (75 % of the Server's Capacity).

Fig. 3 .

 3 Fig. 3. Average Useful Throughput versus Threshold -Medium-Term Sessions & Responsive Session-Aware Admission Control.Next, we focus on comparing the effectiveness of singleand double-threshold-based session-aware admission-control strategies. Figure4focuses on revealing the gain achieved by a session-aware admission-control-enabled server [Fig.4]. It compares the achieved average useful throughput when the server uses either single-threshold-based responsive sessionaware admission control (Single SAC) or double-thresholdbased session-aware admission control (double SAC). The durations of the generated traffic are homogeneous over simulation runs, meaning that all generated sessions are either medium-or long-term over a given simulation run. The threshold value of the used Single SAC policy is set to 75 % of the server's capacity. The used double SAC involves a first threshold value set to 75 % of the server's capacity and a second threshold value set to 90 % of the server's capacity.

Fig. 4 .

 4 Fig. 4. Percentage Histogram of Completed Calls for Different-Admission Control Strategies -Homogeneous Generated Traffic.

Fig. 5 .

 5 Fig. 5. Percentage Histogram of Completed Calls for Different Admission-Control Strategies -Mixed Traffic.

Fig. 6 .

 6 Fig. 6. Percentage Histogram of Completed Calls for Different Admission-Control Strategies -Mixed Generated Traffic.

Table 1

 1 below summarizes the parameters of the model used to generate the offered sessions [see Table1].

TABLE 1 -

 1 TRAFFIC PROFILE MODEL FOR VOICE CBR CONVERSATIONS.

	Model	Distribution
	Packet Inter Arrival Times	Constant
	Session Inter Arrival Times	Exponential
	Session Duration	Exponential
	Packet Size	Constant


P Neira

R M Gasca

L Lefèvre

Demystifying cluster-based fault-tolerant Firewalls

Firewalls are perimeter security solutions that are useful to address the unwanted traffic problem. However, firewalls cover network security aspects at the cost of introducing more problems in terms of network performance, availability and complexity that also need to be appropriately addressed. This work surveys existing cluster-based fault-tolerant firewall architectures and it discusses their trade-offs in performance, availability and complexity. We present preliminary evaluation of these architectures and we also discuss the need for statereplication in stateful firewall clusters.

I. INTRODUCTION

In the early days of the Internet, the term firewall was used to refer to stateless packet filters. These packet filters control packet traversal across different network segments according to a given filtering policy. The filtering policy is expressed in an Access Control List (ACL), which is composed of rules. Each rule uses a vendor-specific low level language that contains packet selectors; like source and destination address, port source and destination, protocol type, and other fields available in the network packet header.

At some point, stateless packet filters proved to be uneffective against certain attacks like some port probing techniques, e.g. IP ID Idle and TCP-flag scans [START_REF] Lyon | Nmap network scanning[END_REF]; and other sorts of intentional or unintentional out-of-specification protocol misbehaviours. The main problem of stateless firewalls is that the filtering decision is based on individual packets, thus, the global evolution of the communication flow is ignored. Moreover, stateless packet filters have problems to filter multisession application protocols like FTP or SIP. These protocols use different flows for control and data sessions, and packet filters cannot relate the flows since they operate from the network and transport layers.

In order to overcome these limitations, packet filter capabilities were extended to become stateful. Stateful firewalls [START_REF] Gouda | A model of stateful firewalls and its properties[END_REF] perform conformance checkings upon the filtered network traffic. Basically, they enforce that the communications between two peers evolve according to the protocol specification. Stateful firewalls keep track of the filtering by storing the current state of a flow, and they allow a set of possible transitions from a given state. Thus, the firewall administrator can modify the ACL to perform some action on the packets that trigger invalid state transitions, like logging and dropping them. Another interesting aspect is that stateful firewalls also usually support application layer inspection to successfully filter multi-session application protocols 1 .

Although, in general, firewalls cover valuable security concerns, they also introduce more problems in terms of network complexity, performance and availability. In this work, we survey existing fault-tolerant firewall solutions, we discuss their trade-offs in performance, availability and complexity; we discuss the need for state-replication, and we present preliminary evaluation.

This article is organized as follows: in section II, we discuss challenges associated to firewalls in terms of network performance, availability and complexity. Then, section III presents common cluster-based firewall architectures, while section IV focuses on specific aspects of the need for statereplication in cluster-based stateful firewalls. The experimental evaluation is exposed in section V. Section VI lists related works and existing solutions; and section VII concludes this paper and presents some future works.

II. FIREWALL CHALLENGES: NETWORK PERFORMANCE, AVAILABILITY AND COMPLEXITY

Firewalls introduce a single point through which all traffic flows have to pass. This is a problem for network designers in terms of performance, since firewalls may increase latency and reduce bandwidth throughput; availability, since a failure may isolate the protected network and reduce the mean up time; and complexity, since firewalls are new network nodes that have to be appropriately configured and administered.

Performance is a major issue since firewalls may become a bottleneck in the network schema. As each packet that goes across has to match an ACL rule to go through, the matching approach must scale according to the number of rules. An interesting amount of research work addressing the packet matching problem and ACL design have been done since the late '90s [START_REF] Taylor | Survey and taxonomy of packet classification techniques[END_REF]. Although scalable packet matching 1 Some product refers to this ability as deep packet inspection. With regards to availability, firewalls are single points of failures. Thus, a failure in the firewall leads to the isolation of the different connected network segments. Traditionally, redundancy has been used to overcome this potential limitation in packet filters. There are several different redundancy-based architectural designs for firewalls that we detail in this article. Although not covered in this work, link-level redundancy must also be considered to achieve fault-tolerant networks since network switches are also single points of failures. This problem can be addressed with link aggregation (IEEE 802.1AX-2008, formerly IEEE 802.3ad). Redundant ISP links are also important to achieve fault-tolerance. However, this is not in the scope of this article either.

Complexity is another issue that network designers have to face. Architecting highly available and performance firewall solutions incurs in some extra complexity in the network design. Firewalls are also inherently complex solutions that must be appropriately configured to provide an acceptable improvement in terms of security. Moreover, considering that attacks may also come from insiders, and depending on the network structure, a distributed firewall's architecture may be required to provide a good level of security, thus, more than one firewall may be required.

Therefore, according to these three parameters: performance, availability and complexity, the network designer's target must be to select the appropriate architecture to obtain good performance and availability, while trying to keep reduced complexity, at the same time, to simplify maintainance. However, as we expose in this work, network designers have to adopt a compromise solution since improving availability increases complexity and it may reduce performance.

III. FAULT-TOLERANT CLUSTER-BASED FIREWALLS

There are different fault-tolerant and performance firewall architectures with different complexity degrees. In this section, we detail the most used. As we will expose, the common denominator of the following cluster architectures is that stateless firewalls are not problematic, from the availability perspective, whereas stateful firewalls are, for different reasons. In general, stateful firewalls require some state-replication solutions to fully support fault-tolerant firewall architectures. The need for state-replication also deserves special attention, as we do in this work, since it also has impact in the architecture in terms of performance and availability.

A. The Primary-Backup approach

The Primary-Backup firewall approach consists of having two or more firewalls that compose a cluster in which one acts as primary, and others act as backup (See Fig. 1). In this setup, a redundancy protocol like IETF's Virtual Router Redundancy Protocol (VRRP), OpenBSD's Common Address Redundancy Protocol (CARP) or Cisco's Hot Standby Router Protocol (HSRP) is used to ensure that at least one firewall is acting as primary at all times. These redundancy protocols are basically based on heartbeats to detect failures. Heartbeats are token messages that firewalls send periodically to each other if they are working. If the primary stops sending heartbeats, the redundancy protocol assumes that the primary is not available. Thus, it selects a new firewall among the backups to become the new primary. The primary owns the so-called virtual IPs (VIPs), which are the IP addresses used by peers as a default gateway. These VIPs are assigned to the primary firewall. This approach works fine in practise for stateless firewalls. However, if stateful firewalls are used, it leads to the breakage of established communications during the recovery. This problem is due to the absence of the state information in the backup firewalls. Some vendors provide a pickup facility to allow recovering flows from the middle, however, this mechanism reduces the security that stateful firewalls provide as it relaxes the conformance-checking done during the recovery.

From the resource use perspective, the Primary-Backup approach, although useful in terms of availability, is wasteful since the backup firewalls are idle, waiting for the primary firewall to fail. Therefore, this architecture does not provide any advantage in terms of performance, and every extra firewall node belonging to the cluster increases network complexity.

B. Multi-primary multi-path firewall cluster

A common practise to improve the resource use of the Primary-Backup approach has been multi-path routing. For simplicity, assume a cluster node composed of two firewalls, C = {f w 1 , f w 2 }, where the firewall f w 1 owns the V IP 1 , which is the VIP that peers in the protected network use as default gateway, and the other firewall f w 2 owns V IP 2 , which is the VIP that peers in the Internet use to route traffic to the peers that are in the protected network. Thus, f w 1 filters traffic leaving the protected network and f w 2 filters the traffic going to the protected network so that packets follows different paths according to their direction. With regards to availability, as exposed in the Primary-Backup approach, a redundancy protocol can be used to detect firewall failures. Thus, if the firewall f w 2 fails, the firewall f w 1 can recover the V IP 1 and filter both outgoing and incoming traffic until f w 2 is repaired.

This architecture improves availability and performance but it is only suitable for stateless firewalls. Note that, if stateful firewalls are used, some sort of state-replication solution would be required to propagate state-changes between the firewalls. However, the propagation of state-changes would need to be synchronous, otherwise packets may race with the state propagation. Synchronous state-replication means that each packet would have to wait until one state-change is successfully propagated to the backup firewalls. As a result, this approach would dramatically reduce performance. Therefore, this renders state-replication unfeasible in this architecture.

C. Multi-primary firewall cluster sandwich

Another popular architecture is the firewall sandwich. In this architecture, the firewall cluster is placed between two loadbalancers, one on each side. Thus, the load-balancers distribute the flows between the firewalls. This architecture moves the single point of failure problem from the firewalls to the loadbalancers. Thus, we require redundant load-balancers and the use of a redundancy protocol to detect failures. Moreover, we also require some state-replication solution to ensure that the flow-based distribution remains the same across failures.

The main drawback of this architecture is the extra complexity added by the use of load-balancers (up to four, two on each side, assuming redundancy). Moreover, the load-balancers may become a bottleneck if the flow distribution does not scale accordingly to the number of firewall nodes that are used in the firewall cluster.

D. Multi-primary hash-based stateful firewall-clusters

The main feature of this architecture is that firewalls share the workload without the need of load-balancers. Thus, it reduces the complexity of the previous architecture. In this approach, we assume that all the firewalls in the cluster are clones: they all use the same IPs, and they all receive the same traffic at the same time. Then, a hash-based approach selects only one firewall to filter a given flow. Thus, the flows are distributed between the stateful firewalls (See Fig. 2). In this architecture, each firewall has a unique id-number id(f w x ) whose value can be {0, ..., n -1} where n is the number of firewalls in the cluster. The id-number is manually set by the administrator. We assume that every flow F j is represented by means of one flow-tuple T j = {Address SRC , Address DST , P ort SRC , P ort DST , P rotocol}. If the packet P i that is part of the flow F j arrives to the firewall f w x , then a flow-tuple T j is associated to the packet. Then, if hash(Address SRC (T j )) modulo n equals id(f w x ), then this packet P i must be filtered by the firewall f w x . Thus, the flow distribution is achieved. Note that the real packet source is not used in the hashing, instead, the source address of the flow-tuple T j is used. Therefore, the same value is used to calculate the hash for packets going in both directions to avoid multi-path filtering that breaks stateful filtering.

To make all firewalls receive the same packets, you can use a network-hub or configure your network-switch to act as a network-hub using some port mirroring feature. However, not all network-switches allow this configuration. In that case, a multicast MAC address (01:00:5e) is commonly used by all the firewalls. Thus, if the network-switch associates switchports and MAC addresses, the network-switch floods the same packets to the switch-ports which have the same multicast MAC address. Although this technique is commonly used in existing firewall products, it is a violation of the standard RFC 1812 since a network node must not use a multicast MAC address in an ARP reply message. A possible solution for this would be that network-switch vendors start supporting VRRP reserved MAC address space as multicast MAC addresses. However, that seems not to have happened so far.

Looking at this approach from the fault-tolerance perspective, if a firewall fails, a subset of flows would not be appropriately filtered. This problem can be avoided if each firewall has a mask of id-numbers that the firewall is responsible for. Thus, firewalls may filter flows for more than one idnumber temporarily until the real owner of the id-number becomes active again. However, if stateful firewalls are used, the recovery of the established flows is not possible as exposed in the Primary-Backup approach. Therefore, state-replication would be required.

In conclusion, this architecture reduces the complexity with regards to the firewall sandwich solution as it does not need load-balancers. With regards to performance, some results are provided in the evaluation section of this work.

IV. CLUSTER-BASED FAULT-TOLERANT STATEFUL FIREWALLS: THE NEED FOR STATE-REPLICATION

In cluster-based stateful firewalls, state-replication becomes the key idea to solve possible breakages of established communications. Since the current flow-states are crucial to keep deploying the stateful filtering appropriately, the primary firewall has to propagate state-changes to the backup firewalls. Thus, if the primary firewall fails, the backup firewall selected to become the new primary can successfully recover the filtering.

In some situations, the breakage of established flows may be particularly disturbing, for example:

1) Multimedia applications breakage, eg. popular youtubelike Internet video and radio streaming disruptions. 2) Remote control utility breakage, eg. SSH connection closures.

3) The interruption of a big data transfer between two peers, eg. bulk downloads that cannot be resumed and would need to be re-started. 4) Extra monetary cost for an organization, eg. if the VoIP communications are disrupted, the users would have to be re-called with the resulting possible extra cost. 5) Violation of a Service-Level Agreement, that may decrease the customer's confidence on a given service provider. Although state-replication is useful to avoid any of these disturbing events, it does not come costless. Since the firewalls have to invest computational resources in the state-replication, network performance may be reduced.

At this point, the network designer has to select if it enables state-replication or not. This decision depends on how important availability and performance are in the network design of the cluster-based stateful firewall. However, it also depends on how well state-replication can improve availability. In the following section, we evaluate the need for statereplication in the different scenarios that we have surveyed in this work.

V. EVALUATION

We have evaluated the exposed cluster-based firewall architectures in our testbed network. Our environment consists of four HP Proliant 145g2 with one AMD dual core 2.2GHz using 1 GEthernet network links. Two of the systems have been used as firewalls and the other two act as HTTP client and server respectively. We have also tuned the interrupt handling affinity of each CPU core. Thus, the network card's interrupts in the firewalls are always handled by the same CPU core. For the cluster sandwich architecture, we have also used one Dell PowerEdge R410 with two Intel Xeon quad core 2.6GHz as load-balancer. This system is significantly superior to ensure that the load-balancer saturates the two firewalls that compose the cluster.

We have selected Linux as operating system, since it is widely used in the firewall industry2 , and the iptables [START_REF]iptables: The free software firewalling tool for linux[END_REF] firewalling tool, that is one of the most popular free software firewalling tools. To evaluate state-replication we have used the conntrack-tools [START_REF] Neira | conntrack-tools: The netfilter's connection tracking userspace tools[END_REF]. This software package contains a userspace daemon that can be configured to propagate statechanges asynchronously between firewalls. We have summarized the results of the experimentations and the survey in table I.

The experiments that we have performed to evaluate the fault-tolerant firewall architectures depend on two performance metrics:

1) Session rate, that determines the number of flows per second that the cluster-based firewall architecture can filter. In order to obtain the maximum session rate that the solution can filter, we have to generate flows with no data transfers. Thus, the flows are set up and tear down almost inmediately. This is the worst case for state-replication since it generates the maximum number of state-changes per second. 2) Data rate, that talks about the amount of data per second that the solution can filter. This metric is expressed in bytes per second. To obtain the maximum data rate we have to generate flows that perform large data transfers. The maximum data rate provides the best case for statereplication since it generates the minimum number of state-changes per second. To evaluate availability, we have used the average number of recovered flows and their statistic deviation. The failures have been triggered by unplugging the dedicated link, that is used to replicate state-changes, and one of the main links, that connects the firewalls with the HTTP client and server. We have selected the keepalived [START_REF] Cassen | Keepalived: Health checking for LVS & high availability[END_REF] high-availability manager.

We have used the inject32 [START_REF] Tarreau | inject32: HTTP injection tool[END_REF] and the httpterm [START_REF]httpterm: HTTP server benchmarking tool[END_REF] tools to generate HTTP traffic between the client and the server. Basically, the clients start TCP sessions with the server and they retrieve one object of variable size per flow. The firewalls perform stateful filtering and Network Address Translation (NAT).

A. Primary-Backup firewall cluster

In Fig. 3, we have represented in the top part the relation between sessions/s (left y-axis) and throughput (right y-axis), which is an inverse relationship. To obtain the maximum throughput, we have used big objects (x-axis), whereas to obtain the maximum session/s we have used very small objects. We consider that small objects are those that are below the average web object size [START_REF] King | Website Optimization: Speed, Search Engine & Conversion Rate Secrets[END_REF]. Note that the number of sessions/s is around 10-15% less with state-replication enabled for objects smaller than 5KB. However, as it is shown in the bottom part of the figure, the recovery results are slightly worse with state-replication than without it. So, contrary to what one would expect, statereplication does not always improve the recovery. This problem is due to the asynchronous nature of the state-replication.

Basically, the state-change propagation has a maximum latency of around 200ms according to LatencyTOP [START_REF] Van De Ven | LatencyTOP: measuring and fixing Linux latency[END_REF] which is more than the time to set up and tear down short flows between the client and the server in our testbed scenario, that is 1.7ms for empty objects and 3.8ms for 10KB objects. Thus, the backup holds old states that confuse the stateful firewall during the recovery. Note that state-replication starts being useful for 20KB objects whose transfer takes 6.8ms. For 50KB objects, the time to retrieve the object is 16.9ms, 100KB objects need 34.4ms and 1MB objects take 344ms. Therefore, to enable state-replication in a scenario in which flow-states have a very short lifetime is not a good idea. In the particular case of HTTP servers that are protected by firewalls, an evaluation of the average object size of your web server [START_REF] King | Website Optimization: Speed, Search Engine & Conversion Rate Secrets[END_REF] would help to select if state-replication needs to be enabled.

B. Multi-primary multi-path firewall cluster

We have performed a very simple performance evaluation of this setup since stateful firewalling cannot be supported without problems due to the asynchronous nature of the statereplication approach. Basically, this architecture allows us to saturate the maximum sessions/s that the HTTP server can handle, which is 36000 session/s, and it reaches the maximum link throughput of 1GB. In this case, the HTTP server becomes the bottleneck. Therefore, some web server cluster solution would be required to reach the maximum session/s that both firewalls can handle.

As we have exposed in this work, multi-primary multipath firewall clusters can be only considered for stateless firewalls. Some network administrators initially consider that state-replication is the solution to support stateful firewalling in their asymmetric-path firewall cluster. This conception is wrong due to the asyncronous nature of the state-replication. Moreover, in the particular case of Linux, stateless firewalls do not support NAT in this solution since this feature depends on the stateful filtering capabilities.

C. Multi-primary firewall sandwich cluster

The results of the experimental evaluation of the firewall sandwich cluster are shown in Fig. 4.

With regards to the sessions/s, we reach the limit of 36000 sessions/s that the HTTP server can handle. The performance drop in terms of session/s is around 15% with state-replication. With regards to flow recovery, similar conclusions to the Primary-Backup scenario can be extracted from the results. This architecture provides around 65% more performance than the Primary-Backup setup but this improvement is limited due to the HTTP server.

D. Multi-primary hash-based stateful firewall-clusters

Fig. 5 shows that the session/s that this solution can reach is around 40% more than the Primary-Backup setup. The scalability of this solution is limited due to the interrupt handling. Basically, the packet fetching from the NIC needs to be done to calculate the hash on the packet. Thus, each firewall has to invest resources to fetch a packet that may be ignored There are several proprietary commercial solutions such as CheckPoint Firewall-1, StoneGate and Cisco PIX that offer highly available stateful firewall products that support the multi-primary hash-based cluster. However, as far as we know, there is only documentation on how to install and configure the firewall cluster. Unfortunately, we did not find any relevant information on their internal design and implementation. In the open-source community, the OpenBSD project provides a fault-tolerant solution for their stateful firewall, the socalled pfsync [START_REF] Mcbride | Pfsync: Firewall Failover with pfsync and CARP[END_REF], which is a kernelspace state-replication that uses an unreliable protocol to propagate state-changes. There are several documents disecting some implementation details but its source code remains the main reference. The implementation of the state-replication in kernelspace can help to reduce the latency in the state-change propagation. However, bugs in the state-replication code may lead to availability problems 3 .

There are also several open-source projects like Linux-HA [START_REF] Robertson | Linux HA project[END_REF], CARP [START_REF] Mcbride | Pfsync: Firewall Failover with pfsync and CARP[END_REF] and Keepalived [START_REF] Cassen | Keepalived: Health checking for LVS & high availability[END_REF] that implements heartbeat-based redundancy protocols.

With regards to firewall architectures, Kopparapu's book [START_REF] Kopparapu | Load-Balancing servers, firewalls and caches[END_REF] provides a good background on cluster-based firewall architectures. However, this book barely covers stateful firewalls and state-replication aspects, probably due to the fact that stateful firewalls started to proliferate at the same time that the book was released.

VII. FUTURE WORKS: TOWARDS PROACTIVE FAULT-TOLERANCE FOR CLUSTER-BASED STATEFUL FIREWALLS?

Commercial off-the-shelf platforms provide, more and more, integrated hardware error-detection facilities. These mechanisms allow correction of hardware errors in runtime. These include RAM memory and PCI bus transfer error detection and correction [START_REF]Linux EDAC (Error Detection and Correction) Project[END_REF]. Intuitively, if a system has correctable errors, it will experience performance degradation. Moreover, correctable errors may become uncorrectable at

Fig. 1 .

 1 Fig. 1. An example of the Primary-Backup firewall architecture

Fig. 2 .

 2 Fig. 2. An example of the hash-based multi-primary with two flows

Fig. 3 .

 3 Fig. 3. Primary-Backup firewall cluster

Fig. 4 .

 4 Fig. 4. Firewall sandwich cluster

Fig. 5 .

 5 Fig. 5. Multi-primary hash-based firewall cluster

  This article has been published in IEEE Internet Computing, 13(6):31-38, November-December 2009. This is a preprint. algorithms and appropriate ACL design are important to improve performance, they are not covered by this work since we mainly focus on improving performance by means of clustering techniques.

TABLE I SUMMARY

 I OF FAULT-TOLERANT CLUSTER-BASED FIREWALL ARCHITECTURES

Several vendors use Linux as base system for their firewall products, this is the case of StoneGate, Checkpoint's Firewall-1, Fortinet, Astaro, Vyatta and some of the Nokia IPSO versions, although most of them seem to use their own firewall software, not iptables.

Although this may seem a weak argument, in a recent re-design of pfsync, a bug in the state-replication that can generate data corruptions was discovered: http:undeadly.org/cgi?action=article&sid=20090301211402. some point, and the chances of experiencing a failure increases. Following this basis, it would be safe to proactively migrate states to a sane operational firewall before the major failure. Thus, this approach will avoid costly preventive statereplication. Although there are some research works in this direction nowadays, we will have to wait until a feasible pure proactive fault-tolerant solution for cluster-based enterpriselevel firewalls becomes reality.