Making middleboxes someone else's problem

SherryJustine,; HasanShaddi,; ScottColin,; KrishnamurthyArvind,; RatnasamySylvia,; SekarVyas,

doi:10.1145/2377677.2377680

Cited by 299 publications

(26 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Figure 2 presents a typical software-defined cloud environment. To effectively manage the middlebox processing capabilities in SDCs, the concept of outsourcing enterprise middlebox processing to the cloud was proposed in [20] with a system the authors called APLOMB (Appliance for Outsourcing Middleboxes). APLOMB delegates middlebox tasks to the cloud to ensure the ease of management and capital expenditure (CAPEX) functions.…”

Section: Application-awareness Concepts In Cloud Datacentersmentioning

confidence: 99%

v-Mapper: An Application-Aware Resource Consolidation Scheme for Cloud Data Centers

Abbasi

Jin

2018

Future Internet

View full text Add to dashboard Cite

Cloud computing systems are popular in computing industry for their ease of use and wide range of applications. These systems offer services that can be used over the Internet. Due to their wide popularity and usage, cloud computing systems and their services often face issues resource management related challenges. In this paper, we present v-Mapper, a resource consolidation scheme which implements network resource management concepts through software-defined networking (SDN) control features. The paper makes three major contributions: (1) We propose a virtual machine (VM) placement scheme that can effectively mitigate the VM placement issues for data-intensive applications; (2) We propose a validation scheme that will ensure that a cloud service is entertained only if there are sufficient resources available for its execution and (3) We present a scheduling policy that aims to eliminate network load constraints. We tested our scheme with other techniques in terms of average task processing time, service delay and bandwidth usage. Our results demonstrate that v-Mapper outperforms other techniques and delivers significant improvement in system’s performance.

show abstract

Section: Application-awareness Concepts In Cloud Datacentersmentioning

confidence: 99%

v-Mapper: An Application-Aware Resource Consolidation Scheme for Cloud Data Centers

Abbasi

Jin

2018

Future Internet

View full text Add to dashboard Cite

show abstract

“…Current networks rely on rich functionalities, such as improved critical performance (e.g., proxies and load balancers), improved security (e.g., firewalls and the intrusion detection system (IDS)), reduced bandwidth costs (e.g., wide area network (WAN) optimizers), and policy compliance capabilities (e.g., network address translation (NAT) and content filters), which are introduced by a wide spectrum of specialized appliances or middleboxes (Carpenter and Brim, 2002). Sherry et al (2012) showed that the number of middleboxes is on par with the number of routers in a network (e.g., an average very-large network holds 2850 layer-3 routers and 1946 middleboxes). In other words, middleboxes are a critical part of today's networks and it is reasonable to expect that they will remain so in the foreseeable future (Walfish et al, 2004;Joseph and Stoica, 2008).…”

Section: Introductionmentioning

confidence: 99%

A virtual service placement approach based on improved quantum genetic algorithm

Xiong

Tian

et al. 2016

Frontiers Inf Technol Electronic Eng

View full text Add to dashboard Cite

Despite the critical role that middleboxes play in introducing new network functionality, management and innovation of them are still severe challenges for network operators, since traditional middleboxes based on hardware lack service flexibility and scalability. Recently, though new networking technologies, such as network function virtualization (NFV) and softwaredefined networking (SDN), are considered as very promising drivers to design cost-efficient middlebox service architectures, how to guarantee transmission efficiency has drawn little attention under the condition of adding virtual service process for traffic. Therefore, we focus on the service deployment problem to reduce the transport delay in the network with a combination of NFV and SDN. First, a framework is designed for service placement decision, and an integer linear programming model is proposed to resolve the service placement and minimize the network transport delay. Then a heuristic solution is designed based on the improved quantum genetic algorithm. Experimental results show that our proposed method can calculate automatically the optimal placement schemes. Our scheme can achieve lower overall transport delay for a network compared with other schemes and reduce 30% of the average traffic transport delay compared with the random placement scheme.

show abstract

“…We can see that even if a well-specified security policy exists, its implementation by a firewall configuration remains a manual and hence error-prone task. A 2012 survey [20] of 57 enterprise network administrators confirms that a "majority of administrators stated misconfiguration as the most common cause of failure" [20]. A study [22] conducted by Verizon from 2004 to 2009 and the United States Secret Service during 2008 and 2009 reveals that data leaks are often caused by configuration errors [12].…”

Section: Introductionmentioning

confidence: 99%

Directed Security Policies: A Stateful Network Implementation

Diekmann

Hupel

Carle

2014

Electron. Proc. Theor. Comput. Sci.

View full text Add to dashboard Cite

Large systems are commonly internetworked. A security policy describes the communication relationship between the networked entities. The security policy defines rules, for example that A can connect to B, which results in a directed graph. However, this policy is often implemented in the network, for example by firewalls, such that A can establish a connection to B and all packets belonging to established connections are allowed. This stateful implementation is usually required for the network's functionality, but it introduces the backflow from B to A, which might contradict the security policy. We derive compliance criteria for a policy and its stateful implementation. In particular, we provide a criterion to verify the lack of side effects in linear time. Algorithms to automatically construct a stateful implementation of security policy rules are presented, which narrows the gap between formalization and real-world implementation. The solution scales to large networks, which is confirmed by a large real-world case study. Its correctness is guaranteed by the Isabelle/HOL theorem prover.

show abstract

Making middleboxes someone else's problem

Cited by 299 publications

References 19 publications

v-Mapper: An Application-Aware Resource Consolidation Scheme for Cloud Data Centers

v-Mapper: An Application-Aware Resource Consolidation Scheme for Cloud Data Centers

A virtual service placement approach based on improved quantum genetic algorithm

Directed Security Policies: A Stateful Network Implementation

Contact Info

Product

Resources

About