Hanxi Zhang

Layer 1 virtual private network management by users

The layer 1 virtual private network (LlVPN) technology supports multiple user networks over a common carrier transport network. Emerging L1VPN services allow: L1VPNs to be built over multiple carrier networks; L1VPNs to lease or trade resources with each other; and users to reconfigure an L1VPN topology, and add or remove bandwidth. The trend is to offer increased flexibility and provide management functions as close to users as possible, while maintaining proper resource access right control. In this article two aspects of the L1VPN service and management architectures are discussed: management of carrier network partitions for L1VPNs, and L1VPN management by users. We present the carrier network partitioning at the network element (NE) and L1VPN levels. As an example, a transaction language one (TL1) proxy is developed to achieve carrier network partitioning at the NE level. The TL1 proxy is implemented without any modifications to the existing NE management system. On top of the TL1 proxy, a Web services (WS)-based L1VPN management tool is implemented. Carriers use the tool to partition resources at the L1VPN level by assigning resources, together with the WS-based management services for the resources, to L1VPNs. L1VPN administrators use the tool to receive resource partitions from multiple carriers and partner L1VPNs. Further resource partitioning or regrouping can be conducted on the received resources, and leasing or trading resources with partner LlVPNs is supported. These services offer a potential business model for a physical network broker. After the L1VPN administrators compose the use scenarios of resources, and make the use scenarios available to the L1VPN end users as WS, the end users reconfigure the L1VPN without intervention from the administrator. The tool accomplishes LlVPN management by users

Service-Oriented Virtual Private Networks for Grid Applications

Emerging grid applications desire not only high bandwidth but also the ability to control the topology and traffic engineering of the underlying networks, through Web service interfaces. To achieve that goal, we present an advanced user controlled lightpath provisioning (UCLP) system, where network resources and grid resources are both modeled as Web services and are seamlessly integrated into workflows.

A grid oriented lightpath provisioning system

Multi-domain resource sharing is the fundamental feature of computing and data grid applications. In this paper, we address the issue of multi-domain optical network resource sharing and present a network management system designed for end-to-end lightpath provisioning across multiple independently managed domains. Our network management system, called user-controlled lightpath provisioning (UCLP) system, is based on the grid services concept and built on the Jini and JavaSpaces technologies. The UCLP system provides a traffic engineering approach to control network infrastructure for computing and data grid applications.

A User-Controlled Lightpath Provisioning System for Grid Optical Networks

Grid applications require a network to transport data between geographically distributed sites. The key characteristics of grid networks include adaptability, scalability, heterogeneity, the ability to span different administrative domains, and the support for various QoS levels. Our design objective is to support continuous large traffic flows between a set of known remote sites. We provision dedicated optical connections directly between end user premises. A solution is provided for end users to compose their virtual private networks by using network resources from different suppliers. Our network control mechanism is based on granting end users access to the management interfaces of network elements. End users can reconfigure the route and bandwidth of connections without carrier interventions. In this paper, we propose layered network management architecture for Grid optical networks. An overview of the design of a user-controlled lightpath provisioning system is presented

A network management tool for resource-partition based layer 1 virtual private networks

A Layer 1 Virtual Private Network (L1-VPN) has two models for service management: the resource-partition based model and the domain-service based model. In this paper, we present a network management tool for resource-partition based L1-VPNs. A Transaction Language One (TL1) proxy is designed to achieve resource partitioning at the network element level. Building on top of a TL1 proxy, we implemented a User-Controlled LightPath (UCLP) system to support physical network brokers to assign and allocate virtually dedicated resources to customers, and to enable customers to directly manage their resources. With such a capability, customers are able to create wide area networks based on their traffic pattern, and to adjust their traffic pattern based on available resources.

Service-Oriented Management Architecture of Optical Virtual Private Networks

A management architecture is presented for optical virtual private networks (OVPN), where network providers manage physical network infrastructures, service providers compose network resources into OVPNs, end users invoke OVPN management services to configure operational OVPNs.

All-optical network demonstrator program centered around a testbed for verifying and validating next generation optical networks

The all-optical network (AON) demonstrator program is centered around a long-term trial testbed for the validation and verification of key network building blocks, scalable architectures, control and management solutions for next generation wavelength division multiplexing networks. The AON testbed has already validated certain system level concepts in both physical (performance characterization) and upper layers (network management). Performance characterization of optical signals was used to develop real-time monitoring techniques of the key network parameters for detection, identification and localization of signal degradations. Upper layer proof of concepts verified network level management approaches and optimizations for large and challenging applications. A prototype of a network management system was developed for customer-managed networks.

Reliability enhancements for a Jini and JavaSpaces based network management system

A network management system software is prototyped using a service-oriented architecture with its core built using Jini and JavaSpaces technologies. The management system allows users to provision connections across multiple management domains. The systems functional modules are distributed to different management domains. Since the new management system is a distributed system, it imposes special requirements on system reliability. System reliability is improved by using lease-based resource and service sharing, transaction-based resource, concurrent access and persistent storage of resource information, and federation clustering. With these system reliability enhancements, the system is able to maintain its integrity even in the event of partial system failures

Security enhancements for a user-controlled lightpath provisioning system

User owned and managed optical networks offer new benefits compared to carrier networks. There are basically two types of user owned and managed optical networks: metro dark fibre networks and long-haul wavelength networks. A user-controlled lightpath provisioning system is designed to address the network management challenges, where only the customer has complete visibility of its own network and no provider can see all the network elements. The prototyped management software has a service-oriented architecture and uses the Jini and JavaSpaces technologies. Within one management system for a federation, there are six key components: a Jini Lookup Service, an instance of JavaSpaces for storage of Light Path Objects (LPOs), a Jini Service Access Point (SAP), an LPO service, an instance of switch communication service for each switch in the transport layer and a Grid SAP. Since the new management system is a distributed system and the new management system may be deployed over a public Internet infrastructure, secure access to the management modules is required. The application of existing system security technologies to the new management system is analyzed. To securely transfer objects across a network, SSL is used to encrypt RMI data streams and thus data streams between Jini services. To securely execute a dynamically downloaded Java class, Jini adopts the Java security model. To securely use a dynamically downloaded proxy to communicate to a remote service, Jini Extensible Remote Invocation is implemented to support security features such as invocation constraints, remote method control, and the trust verification model.