Anna Levin

EnforSDN: Network policies enforcement with SDN

Network services, such as security, load-balancing, and monitoring, are an indisputable part of modern networking infrastructure and are traditionally realized as specialized appliances or middleboxes. Middleboxes complicate the management, the deployment, and the operations of the entire network. Moreover, they induce network performance issues and scalability limitations by requiring huge amounts of traffic to be, often sub-optimally redirected, and sometimes redundantly processed. Recent trends of server virtualization and Network Function Virtualization (NFV) exacerbate these scalability and performance issues. In this paper, we present EnforSDN - a new management approach that exploits SDN principles to decouple the policy resolution layer from the policy enforcement layer in network service appliances. Our approach improves the enforcement management, network utilization and communication latency, without compromising the policy and the functionality of the network. Using emulated SDN-based data center environment, we demonstrate higher throughput and lower latency achieved with EnforSDN, as compared to a baseline SDN network. In addition, we show that EnforSDN reduces the overall network appliances load, as well as the forwarding tables size.

Networking Architecture for Seamless Cloud Interoperability

Seamless cloud interoperability is highly desired but not yet easily attainable in the current cloud solutions market. This work tackles one aspect of achieving cloud interoperability, namely, inter-cloud networking. We list the requirements and propose an inter-cloud networking architecture for a case of independent clouds owned by different entities and powered by different cloud management and network virtualization technologies. Then we validate the proposed architecture by describing an example of working implementation for Open Stack cloud powered by Open Daylight Open DOVE SDN solution. Finally, we compare our architecture to the existing solutions.

BEACON: A Cloud Network Federation Framework

This paper presents the BEACON Framework, which will enable the provision and management of cross-site virtual networks for federated cloud infrastructures in order to support the automated deployment of applications and services across different clouds and datacenters. The proposed framework will support different federation architectures, going from tightly coupled (datacenter federation) to loosely coupled (cloud federation and multi-cloud orchestration) architectures, and will enable the creation of Layer 2 and Layer 3 overlay networks to interconnect remote resources located at different cloud sites. A high level description of the main components of the BEACON framework is also introduced.

NoEncap: overlay network virtualization with no encapsulation overheads

Overlay network virtualization quickly gains traction in todays multi-tenant data centers due to its ability to provide independent virtual networks, at scale, along with complete isolation from the underlying physical network. Despite the benefits, performance degradation due to the imposed perpacket encapsulation overhead is a serious impediment. Mitigation approaches are mostly hardware based and thus depend on costly networking gear upgrades and suffer from lesser flexibility and longer times to market, compared to software solutions. Software optimizations proposed so far are limited in scope, applicability, and interoperability. In this paper we present NoEncap, a software-only opt mization, capable of eliminating almost completely the overheads, while fully preserving the benefits of an overlay-based network virtualization.

Survey: Live Migration and Disaster Recovery over Long-Distance Networks

We study the virtual machine live migration (LM) and disaster recovery (DR) from a networking perspective, considering long-distance networks, for example, between data centers. These networks are usually constrained by limited available bandwidth, increased latency and congestion, or high cost of use when dedicated network resources are used, while their exact characteristics cannot be controlled. LM and DR present several challenges due to the large amounts of data that need to be transferred over long-distance networks, which increase with the number of migrated or protected resources. In this context, our work presents the way LM and DR are currently being performed and their operation in long-distance networking environments, discussing related issues and bottlenecks and surveying other works. We also present the way networks are evolving today and the new technologies and protocols (e.g., software-defined networking, or SDN, and flexible optical networks) that can be used to boost the efficiency of LM and DR over long distances. Traffic redirection in a long-distance environment is also an important part of the whole equation, since it directly affects the transparency of LM and DR. Related works and solutions both from academia and the industry are presented.

Enabling federated cloud networking

Cloud federation enables cloud providers to collaborate and share their resources to create a large virtual pool of resources at multiple network locations. The BEACON H2020 project focuses on one aspect of achieving cloud federation, namely, enabling federated cloud networking. We define a cloud network architecture that enables interconnection of different clouds powered by different cloud platforms and virtualization technologies and enables effective network function virtualization across clouds. The long term vision of the project is a fully virtualized data center for federated clouds with fully integrated virtualized compute, storage and network resources across clouds.

Federated Networking Services in Multiple OpenStack Clouds

Cloud federation refers to a mesh of Cloud providers that are interconnected by using agreements and protocols necessary to provide a decentralized computing environment. Federation is raising many challenges in different research fields but is also creating new business opportunities. Nowadays, the combination between Cloud federation, Software Defined Networking (SDN), and Network Function Virtualization (NFV) technologies offers new business opportunities to Cloud providers that are able to offer new innovative federated Cloud networking services to customers. In this paper, we focus on federated Cloud networking services considering multiple OpenStack Clouds. In particular, we present a preliminary outcome of an innovative design of a Federation Management system acting as an external service provider dealing with federated networking services among multiple federated OpenStack Clouds. More specifically, we describe how virtual resources, virtual networking, and security management can be accomplished.

Enforcement of global security policies in federated cloud networks with virtual network functions

Federated cloud networks are formed by federating virtual network segments from different clouds, e.g. in a hybrid cloud, into a single federated network. Such networks should be protected with a global federated cloud network security policy. The availability of network function virtualisation and service function chaining in cloud platforms offers an opportunity for implementing and enforcing global federated cloud network security policies. In this paper we describe an approach for enforcing global security policies in federated cloud networks. The approach relies on a service manifest that specifies the global network security policy. From this manifest configurations of the security functions for the different clouds of the federation are generated. This enables automated deployment and configuration of network security functions across the different clouds. The approach is illustrated with a case study where communications between trusted and untrusted clouds, e.g. public clouds, are encrypted. The paper discusses future work on implementing this architecture for the OpenStack cloud platform with the service function chaining API.

Security Requirements in a Federated Cloud Networking Architecture

Cloud federation enables cloud providers to collaborate in order to create a large pool of virtual resources at multiple network locations. Different types of federated cloud architectures have been proposed and implemented up to now. In this context, an effective, agile and secure federation of cloud networking resources is a key aspect for the deployment of federated applications. This paper presents the preliminary security requirements analyzed in the H2020 BEACON Project that aims at researching techniques to federate cloud network resources and defining an integrated cloud management layer that enables an efficient and secure deployment of federated cloud applications. The paper analyses both how to protect the cloud networking infrastructure, and how cloud users can customize the network security for their distributed applications.

To drop or not to drop: On the impact of handovers on TCP performance

This paper presents a comparison between two handover schemes: drop and forward. In the drop scheme, packets received by the base station after the host has disconnected are dropped, whereas in the forward scheme these packets are forwarded to the new base station. We analyze various TCP flavors and compare our findings to simulation results. Our results can be used to determine which handover scheme and which TCP flavor should be employed to minimize the negative effect of handovers on TCP performance.