arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 1703.01313cs.NI
收藏

安全的多云虚拟网络嵌入

Secure Multi-Cloud Virtual Network Embedding

Max Alaluna, Luís Ferrolho, José Rui Figueira, Nuno Neves, Fernando M. V. Ramos

摘要:

现代网络虚拟化平台使用户能够为其虚拟网络指定自定义拓扑和任意寻址方案。然而,这些平台一直针对单个提供商的数据中心,这不足以支持需要跨多个信任域部署的(关键)应用程序,同时实施各种安全要求。本文针对这一局限性,提出了一种新的解决方案的中央资源分配问题的网络虚拟化-虚拟网络嵌入,其目的是找到有效的映射虚拟网络的请求到底层网络。我们通过将安全性视为虚拟网络的一等公民来改进最先进的技术,同时利用来自多个云提供商的资源来增强底层基础设施。我们的解决方案支持在三个核心元素中定义灵活的策略:在虚拟链路上,可以探索替代的安全妥协(例如,encryption);在虚拟交换机上,必要时支持不同程度的保护和冗余;在底层基础设施上,将其扩展到多个云,包括公共和私有设施,并与其固有的不同信任级别相关联。我们提出了一个最佳的解决方案,这个问题制定为一个混合线性规划(MILP)。我们的评估结果提供了深入了解与网络虚拟化中包含安全需求相关的权衡。特别是,他们提供的证据表明,增强用户的虚拟网络的安全性并不排除高接受率和有效利用资源,并允许提供商增加他们的收入。

英文摘要:

Modern network virtualization platforms enable users to specify custom topologies and arbitrary addressing schemes for their virtual networks. These platforms have, however, been targeting the data center of a single provider, which is insufficient to support (critical) applications that need to be deployed across multiple trust domains, while enforcing diverse security requirements. This paper addresses this limitation by presenting a novel solution for the central resource allocation problem of network virtualization -- the virtual network embedding, which aims to find efficient mappings of virtual network requests onto the substrate network. We improve over the state-of-the-art by considering security as a first-class citizen of virtual networks, while enhancing the substrate infrastructure with resources from multiple cloud providers. Our solution enables the definition of flexible policies in three core elements: on the virtual links, where alternative security compromises can be explored (e.g., encryption); on the virtual switches, supporting various degrees of protection and redundancy if necessary; and on the substrate infrastructure, extending it across multiple clouds, including public and private facilities, with their inherently diverse trust levels associated. We propose an optimal solution to this problem formulated as a Mixed Integer Linear Program (MILP). The results of our evaluation give insight into the trade-offs associated with the inclusion of security demands into network virtualization. In particular, they provide evidence that enhancing the user's virtual networks with security does not preclude high acceptance rates and an efficient use of resources, and allows providers to increase their revenues.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑