PACE: Policy-Aware Application Cloud Embedding

Transcription

1 PACE: Policy-Awae Alication Cloud Embedding Li Ean Li Vahid Liaghat Hongze Zhao MohammadTaghi Hajiaghayi Dan Li Godon Wilfong Y. Richad Yang Chuanxiong Guo Bell Labs Micosoft Reseach Asia Tsinghua Univesity Yale Univesity Univesity of Mayland AT&T Reseach Abstact The emegence of new caabilities such as vitualization and elastic (ivate o ublic) cloud comuting infastuctues has made it ossible to deloy multile alications, on demand, on the same cloud infastuctue. A majo challenge to achieve this ossibility, howeve, is that moden alications ae tyically distibuted, stuctued systems that include not only comutational and stoage entities, but also olicy entities (e.g., load balances, fiewalls, intusion evention boxes). Deloying alications on a cloud infastuctue without the olicy entities may intoduce substantial olicy violations and/o secuity holes. In this ae, we esent PACE: the fist systematic famewok fo Policy-Awae Alication Cloud Embedding. We ecisely define the olicy-awae, cloud alication embedding oblem, study its comlexity and intoduce simle, efficient, online imal-dual algoithms to embed alications in cloud data centes. We conduct evaluations using data fom a eal, lage camus netwok and a ealistic data cente toology to evaluate the feasibility and efomance of PACE. We show that deloyment in a cloud without consideing in-netwok olicies may lead to a lage numbe of olicy violations (e.g., using tee outing as a way to enfoce in-netwok olicies may obseve u to 91% olicy violations). We also show that ou embedding algoithms ae vey efficient by comaing with a good online factional embedding algoithm. I. INTRODUCTION Cloud data centes suoting vitualization and elastic esouces offe many advantages ove taditional aoaches, whee a dedicated infastuctue is constucted fo each alication [6]. Fo examle, in cloud data centes, alications can be aidly deloyed, migated, o scaled, on demand, on the cloud infastuctues, imoving infastuctue efficiency. A majo challenge to the cloud data cente aoach, howeve, is that moden alications ae not simle sets of vitual machines (VM). Rathe, they ae distibuted, stuctued systems that also include olicy entities such as load balances, alication acceleatos, fiewalls, and intusion evention boxes. Hence, designing cloud data centes without a stong suot fo olicy entities may intoduce substantial olicy violations and/o secuity holes. The imotance of intoducing olicy suot has been widely ecognized in the industy. Fo examle, VMWae intoduces the caability of associating (softwae) olicies with a VM. Recently VMWae also intoduced a caability called Vitual Sevice Domain [7], which allows a gou of vitual machines to be otected by a vitual aliance. All taffic enteing o leaving the gou of vitual machines will be sent to that aticula vitual aliance fo olicy veification. Data cente switches (e.g., Voltaie Vantage 6024 switch[23]) have also stated to intoduce featues to suot ot olicy migation when a VM attached to the ot migates. Alimitationoftheafoementionedaoaches,howeve,is that they ae limited to enfoce olicy only at the VM last ho. We call such olicies end-oint olicies. On the othe hand, fo many netwoks, some olicies ae best enfoced o can be enfoced only in the netwok. Fo examle, due to efomance equiements, some olicy middleboxes need hadwae acceleation and thus ae available only at cetain netwok locations with the hadwae; some desiable featues ae available only fom cetain systems that ae available only at cetain netwok locations; some olicy boxes (e.g., intusion evention boxes) efom bette when they can obseve taffic involving multile endoints. We efe to such olicies as alication-wide, in-netwok olicies. In this ae, we conduct the fist systemic study of enfocing alication-wide, in-netwok olicies in cloud data centes. Ou famewok, called PACE, comlements existing caabilities on end-oint olicies to build a comlete solution famewok fo cloud alication deloyment. We make seveal contibutions. Fist, we ecisely chaacteize alication equiements in cloud data centes (Section II). We intoduce concets such as the flow secuity gah to igoously catue the equiements. Second, we study the comlexity of enfocing cloud alication flow secuity gah duing cloud alication deloyment (Section III). We efe to this oblem as the cloud alication embedding oblem. Weshowthatthecomlexity of the embedding oblem deends on the enfocing mechanisms. In aticula, we show that using taditional tee-based outing, the oblem is NP-comlete. This oints out a seious challenge in using the taditional netwok infastuctue fo suoting cloud alication deloyment. Thid, using feasible mechanisms (e.g., souce outing, OenFlow [19], o -switches [15]), we esent fast, effective, imal-dual algoithms fo cloud alication embedding (Section IV). Ou algoithms conside olicy and ealistic constaints such as on bandwidth and eliability. Fouth, we study the olicy entity lacement oblem (Section V). We give a negative esult on the efomance of alication equest agnostic lacement (oblivious lacement). We also give a lacement algoithm based on the knowledge of alication equest distibutions. Fifth, we conduct evaluations on the imotance of olicyawae cloud alication embedding as well as the efomance of ou algoithms (Section VI). Using eal alications fom a lage eal camus netwok and seveal ealistic data cente toologies, we show that olicy-agnostic deloyment may lead to a lage numbe of olicy violations (e.g., using tee outing as a way to enfoce in-netwok

2 olicies may obseve u to 91% olicy violations). We also demonstate the effectiveness of ou algoithms. II. ENCODING CLOUD APPLICATION POLICIES Many moden alications ae designed as stuctued distibuted systems to achieve scalability and secuity, based on concets such as load balanaces and DMZ. We encode the equiements of a given alication i (denoted as A i )withatule(fsg i,config i ).Thefistcomonent is called the flow secuity gah (FSG), which encodes the logical entities and the infomation flow among the entities of the alication. An FSG is much iche than a vitual netwok. Nodescaneesentvitualmachines,middleboxes, vitual outes, etc. An FSG is annotated with demands on comuting esouces, middleboxes, netwok bandwidth, and eliability, etc. The second comonent eesents the configuation state of alication entities. Fo examle, fo a fiewall, the configuation state is the set of fiewall ules; fo a vitual machine, the configuation state consists of the set of allowed sevices, etc. We now give moe details on an FSG. We eesent entities imlementing an alication as nodes in a gah. Fo examle, in a two-tieed alication, each tie o middlebox is eesented as a node in the gah. In addition, Intenet clients as a gou ae eesented as a single node. Edges eesent diect communication between nodes. Nodes and edges ae annotated with labels that encode alication equiements on comuting esouces, netwok bandwidth and eliability. Netwok bandwidth equiements: an alication may equie cetain bandwidth between ais of logical entities (e.g., between tie 1 and tie 2). Bandwidth equiements ae encoded as edge demands on the flow secuity gah. Comuting esouce equiements: vaious logical entities may need comuting esouces. Fo examle, in a two-tieed alication, each tie equies a cetain numbe of vitual machines. This is encoded as node demand. Reliability equiements: an alication may want its logical entities be laced in moe than one fault domain. A fault domain is a unit that has coelated failues of a cetain tye. Amachine,acko od canafaultdomain.acustome may demand that its alications be laced in two fault domains. To encode eliability constaint, we annotate each logical entity with its equied numbe of fault domains. We eesent the vitual machine demand and fault domain demand as a tule. Any two nodes ae connected by at least one ath in FSG. If thee ae multile aths and an alication efes a secific ath, the alication has to annotate the FSG with the chosen ath. As an examle, the flow secuity gah of a two-tie alication is shown in Figue 1. Tie 1 and 2 ae eesented as nodes u 1 and u 2 esectively. Middleboxes ae fiewall F i,load balance LB i,intusioneventionsystemips i, i = 1,2. We do not need to eesent the switches in ou flow secuity gah. The tule (50, 1) means that it needs 50 vitual machines and one fault domain. The Intenet clients ae denoted as u e with zeo demands on vitual machines and fault domains. The alication needs one coy of each middlebox. Each Fig. 1. Flow secuity gah of a two-tie alication. middlebox equies one fault domain. Thee ae no bandwidth demands on links since it is a best effot sevice. III. FEASIBILITY OF ENFORCING POLICIES We fist conduct a feasibility study. We ae given a cloud data cente with seves (hosts seveal VMs) and middleboxes. The middleboxes can be hadwae based o softwae based. Most hadwae-based middleboxes ae vitualized and can suot multile tenants. Thei lacements ae fixed. Then the key feasibility issue fo cloud ovide is that given the olicies of a cloud alication eesented by an FSG, decide the existence of a cloud data cente outing to satisfy the FSG. Ou esults ae that the existence oblem is NP-had fo tee outing. Fo Oenflow [19], a solution may not exist. Howeve, if one exists, we can decide in olynomial time as long as the numbe of middleboxes in each ath segment is a constant. Fo switch [15] o souce outing, a solution always exists. The key intuition hee is that diffeent flows have diffeent olicies. Constaining all of them to use the undelying teebased outing leads to infeasibility. To quantify the hadness of the oblem, we look at a secific class of FSG whee thee is a set of alication teminal nodes, each alication teminal node equies a coesonding middlebox, and all of the middleboxes connect to a shaed oot. We assume geneal link laye netwok toology. A. Policy enfocement mechanisms Diffeent alications do not shae Scoe. Thus,alications must be isolated. Thee is no shaing of fowading and outing table, no communication between VMs of diffeent alications, no shaing of middlbox instances (tyically a hysical middleboxes have many vitual instances). Besides isolation between alications, diffeent comonents of an alication must also be isolated. In ou examle alication, tie 1 and tie 2 ae on seaate VLANs to enfoce isolation. To enfoce FSG embedding, cloud ovides need mechanisms to maniulate outing so that ackets can go though middleboxes secified by the olicy. We conside five tyes of link laye outing suot: (1) Laye 2 outing uses taditional 2

3 R R x 1 x 2 x k x i x j t 1 t 2 t k t i G t j G u s 1 s 2 s k s i s j Fig. 2. NP-hadness constuction. sanning tees; (2) Recent laye 2 shotest ath outing oosed by IEEE SPB o IETF TRILL; (3) Oenflow based laye 2outing;(4)souceouting;and(5)switch-basedouting whee all middleboxes ae laced off the netwok ath. We will study a unified solution fo (1) and (2). The case of Oenflow, switch and souce outing admits simle solutions because of thei ability to contol outing. We focus on a unified case of (1) and (2). B. Feasibility using Tee Routing We want the olicy to be imlemented by the sanning tee otocol. Thus, we want a tee. Ou NP comlete oof looks at a simle oblem. We ae given a gah G =(V,E), a distinguished oot node R, a set of souce nodes S = {s 1,s 2,...,s k } V and a set of middleboxes X = {x 1,x 2,...,x k } V.Theoblemistodetemineiftheeisa ath P i between s i and R such that x i P i fo each i, 1 i k, whee 1 i k P i foms a tee. We call this oblem the k-athstee oblem. ThisoblemencodesasecialcaseofouFSG olicy feasibility oblem. R can eesent the gateway to the Intenet (clients need to go though the gateway to get web sevice fom each alication). Each souce node s i togethe with the middlebox x i,andr foms an embedding of a FSG eesenting a web alication. Theoem 1: The k-aths-tee oblem is NP-comlete. Poof: Note that checking if a set of aths P 1,P 2,...,P k satisfies the given instance of the k-aths-tee oblem can tivially be done in olynomial time. Hence the k-aths-tee oblem is in NP. To show that the k-aths-tee oblem is NP-had, we show aeductionfomthek-node-disjoint-aths oblem to it. An instance of the k-node-disjoint-aths oblem consists of a gah G =(V,E) and k disjoint ais of nodes (s i,t i ),1 i k. The oblem is to decide if thee exist k aiwise disjoint aths P 1,P 2,...,P k whee P i is a ath between s i and t i fo 1 i k suchthat these k aths ae aiwise node disjoint. This oblem is known to be NP-comlete [8]. Conside an instance NDP of the k-node-disjoint-aths oblem given by the gah G =(V,E) and ais (s i,t i ), 1 i k. ThenweconstuctaninstancePT of the k-athstee oblem as follows. Let G =(V,E ) be the gah whee Fig. 3. A node othe than R in both P i and P j imlies a cycle. V = V {x 1,x 2,...,x k,t 1,t 2,...,t k,r} and E = E {t i x i :1 i k} {x i R :1 i k}. SeeFigue2foanillustationof the constuction of G.LetS = {s 1,s 2,...,s k } be the set of souce nodes and {x 1,x 2,...,x k } be the set of middleboxes. Then we wish to detemine if thee ae aths P i between s i and R so that x i P i fo 1 i k and whee 1 i k P i is a tee. We claim that thee is a solution to NDP if and only if thee is a solution to PT.FistsuoseP i,1 i k is a solution fo NDP. ClealyifwedefineT to be the gah consisting of aths P i and edges t i x i and x i R fo 1 i k,then T is a tee satisfying the equiement that the ath fom s i to R contains x i.thatis,theathsint fom the souce nodes to R satisfy PT. Suose T is a solution to PT.Then T is a tee and the ath fom s i to R in T asses though x i fo 1 i k. Itcan easily be checked that any ath fom s i to R containing x i must contain the edges t i x i and x i R.LetP i be the ath in T fom s i to t i,1 i k. Weclaimthattheseathsaeaiwisedisjoint. To show this, conside two such aths P i and P j.suoseby way of contadiction that P i and P j ae not node disjoint. (See Figue 3.) Let u be the node in P i P j such that no othe node in the subath of P i between u and t i is in P j.thentheunion of the edges in P i fom u to R with the edges in P j fom u to R, fomacycleint.butthiscontadictstheassumtionthat T is a tee. One may wonde if we limit the class of netwok toology, the oblem may become easie. Fo examle, one class of toologies consists of lana gahs. Howeve, by the constuction given in the eceding oof and the fact that k-node-disjoint-aths oblem emains NP-comlete in lana gahs, we conclude that the k-aths-tee oblem also emains NP-comlete even when esticted to lana gahs [17]. Anothe class of netwok toologies is that of fat tees. Given the inceasing tend to adot fat tee as a toology fo data centes, we study feasibility in such a netwok. We have the following esults. Theoem 2: Even if gah G =(V,E) is a fat tee, the k- aths-tee oblem is NP-comlete. Poof: See aendix. 3

4 C. Feasibility using Oenflow The only estiction in this case is that the ath segment has to be a simle ath (i.e., itdoesnotcontainacycle).if one exists, we can decide in olynomial time as long as the numbe of middleboxes in each ath segment is a constant. D. Feasibility using switch o souce outing Aswitchcanefomho-by-hooutingandfowadtaffic matching olicy to a middlebox diectly. Thus, a solution always exists. The case fo souce outing is simila as long as middleboxes can be addessed in laye 3. IV. DEPLOYING ENTERPRISE APPLICATIONS IN PUBLIC DATA CENTERS Enteises use a management inteface simila to, but iche than Amazon EC2 to submit thei alication deloyment equests (each eesented as a flow secuity gah). Thee ae thee stes fo the cloud ovide to deloy enteise alications in ublic data centes. Fist, the cloud ovide needs to ealize the flow secuity gah in the undelying data cente netwok. We efe to this ste as flow secuity gah embedding. The second ste fo the cloud ovide is to configue the entities in the flow secuity gah. The thid ste fo the cloud ovide is olicy enfocement. The second ste is staightfowad and alication secific. We have consideed olicy enfocement mechanisms and feasibility of olicy enfocement in Section III. We now only conside FSG embedding. We assume mechanisms such as Oenflow, olicy switch o souce outing ae available to enfoce secific olicies on flows of an alication. To educe outing comlexity, and leveage undelying data cente outing otocol, we assume that neighbos in a flow secuity gah ae connected by the native outing ath in the data cente. A. Flow secuity gah embedding Fo ease of the descition of the algoithm, we conside a few simlifying assumtions; all the esults cay to the geneal case. We assume the flow secuity gah of each alication equest is a simle ath and the fault domain constaint is one, i.e., all esouces of an entity must be laced togethe. We also assume thee is one tye of middlebox. Alication equests must be ocessed as they aive in eal time. Thus, we need an online algoithm. 1) Poblem Fomulation: An instance of the offline FSG embedding oblem is the tule (G,C,n,R) in which The weighted gah G =(V,E,B) eesents the netwok toology whee B : E N shows the bandwidth of the edges; The function C : V N shows the numbe of comute nodes (i.e. VMs) on each vetex; 1 The intege n is the numbe of available middleboxes to be laced on vetices; and R is the sequence of aiving equests which ae to be allocated on the toology. Each equest is associated with a ize π and a ath stuctue q.theizeofaequestshowsthebenefitofallocating 1 In a fat tee, the comute nodes ae only on the leaves. that equest which may encode the ioity, imotance, size, o othe consideations. A ath stuctue descibes the demands of the equest. An extended ath of length k in the gah is an odeed sequence of k vetices with simle aths connecting them. Theefoe an extended ath would be in the fom of =< v 1, 1,v 2,..., k 1,v k > whee i is a ath between vetices v i and v i+1.wenotethat these aths may be emty, i.e., v i s ae not necessay diffeent. We allocate the equests to the extended aths of the toology with enough esouces. Thus we can define the ath stuctue of a equest as a sequence of the fom q =< ( 1,t 1 ),b 1,( 2,t 2 ),b 2,...,b k 1,( k,t k ) > whee k is a small constant [14]; i N is the numbe of esouces needed on the i th vetex; t i is the tye of the esouce needed on the i th vetex; and b i is the bandwidth of the connection needed between vetex i and i + 1. As mentioned befoe, we assume that t i may have only two otions: eithe middlebox o comute node. To allocate a equest on the toology, we have to choose a valid extended ath. An extended ath is valid fo the ath stuctue q if fo 1 i k, thevetexv i has i amounts of eithe middleboxes (if t i = middlebox ) ocomutenodes(ift i = comutenode ) available and fo 1 i k 1alltheedgesintheath i have b i amounts of bandwidth available. By allocating to, these amounts of esouces would be allocated to the equest and thus will not be available anymoe. We may denote the valid extended aths as candidate aths. Given an instance (G,C,n,R), thealgoithmhastwohases. In the fist hase, the algoithm should define a function F : V N which shows the numbe of middleboxes to be laced on each vetex. We note that the total numbe of middleboxes is n, i.e., v V F(v) =n. Inthesecondhase,thealgoithm should choose a subset of the equests and allocate them to the candidate aths. An allocation scheme is the selection of the subset of the equests to be allocated with thei coesonding allocated candidate aths. The ayoff of an allocation scheme is the total ize of the allocated equests. The online FSG embedding oblem is an online vesion of the offline FSG embedding oblem, in the sense that the sequence of equests is evealed to the algoithm in an online manne, howeve we know the numbe of equests in advance (which might be lage). The algoithm should decide about the lacement of the middleboxes (i.e. F(v)) befoeeceivingthe equests. Uon eceiving a equest the algoithm should eithe allocate a candidate ath to the equest o discad it ight away; this decision is not evocable. The goal is to maximize the total ize of the allocated equests. We can fomulate the offline vesion as the following intege ogamming otimization (IP) oblem. Let P be the set of all ossible candidate aths fo equest in the toology. We note that since the size of a equest is constant and neighbos in a FSG ae connected by the native outing ath in G, then the numbe of ossible candidate aths is olynomial. This might still be a lage numbe. Howeve, we tyically want nodes (VMs o middleboxes) in an alication to be 4

5 allocated close togethe, e.g. within a fault domain (if the FSG of an alication has no equiements fo moe than one fault domain). This can dastically educe the numbe of candidate aths to a manageable level. The LP vaiable y indicates the situation whee the candidate ath P is allocated to the equest R. Thevaluesc v, f v, b e ae indeendent of LP vaiables, showing the equied (i) comute nodes on vetex v, (ii) middleboxes on vetex v and (iii) bandwidth on edge e, iftheath was to be allocated to the equest. Maximize. π y (FSG) R : y 1 (FSG.A) v V : y c v C(v) (FSG.B) v V : y f v F(v) (FSG.C) e E : y b e B(e) (FSG.D) v F(v) n y {0,1} F(v) N (FSG.E) In the maximization LP, the set of constaints FSG.A insue that each equest can be assigned at most once; FSG.B insue that the numbe of equied comute nodes on each vetex cannot exceed the numbe of available comute nodes on that vetex; FSG.C insue that the numbe of equied middleboxes on each vetex cannot exceed the numbe of available middleboxes on that vetex; FSG.D insue that the allocated equests cannot exceed the bandwidth limit on each edge. In the FSG embedding oblem we should decide about the lacement of middleboxes befoe eceiving the equests. Fo any lacement thee could be a sequence of equests whee none of the equests can be allocated but the same sequence can be allocated in a diffeent lacement. Thus we have to decide about the lacement of middleboxes by finding the best ossible lacement fo a set of samles fo the equests. In the est of this section we assume that we know the lacement in advance and ty to give an online allocation scheme with a nea otimum cometitive atio. We call this oblem FSG Path Allocation Poblem. 2) FSG Path Allocation Poblem: If we e-wite the FSG linea ogamming using a secific middlebox lacement, then all ou constaints would be in the fom of a acking constaint 2.Fomally,wecanconsidethefollowingelaxed LP fo the offline oblem: Maximize. π y i [ R + V + V + E ] : y q(i,, ) u(i) (FSG.A,B,C,D) y 0 2 A acking constaint denotes a linea combination of vaiables with ositive coefficients which has to be be smalle than a ositive constant. whee all the evious constaints ae e-witten in a geneal fom. Indeed one can simlify the LP even moe. We wite a new LP by elacing y with z π and q(i,, ) with π a(i,, ). Thus we get the following LP and its dual. One can easily veify that thee is a 1-to-1 elation between the feasible solutions of the two LPs which eseves the objective value. Theefoe any α-cometitive algoithm which uses the modified LP is also an α-cometitive algoithm fo ou oblem. Maximize. z i [ R + V + V + E ] : z a(i,, ) u(i) (FSG.A,B,C,D) Minimize. R and P : i z 0 u(i)x i i a(i,, )x i 1 x i 0 In the online vesion of the FSG Path Allocation Poblem, we have the same LP but the vaiables (along with thei set of coefficients) ae evealed to us in an online fashion. As usual, the efomance of an online algoithm on a given inut is defined to be the atio between the maximum (offline) ayoff of any solution (i.e., allocation scheme) and the ayoff of the solution given by the algoithm. The maximum atio, taken ove all inut sequences, is defined to be the cometitive atio of the algoithm. If we accet any eal value fo the vaiables, then we get the geneal online factional coveing oblem. BuchbindeandNao[4]giveanalgoithmthatgets the desied cometitive atio B > 0andoducesasolution that does not violate the ith acking constaint by moe than ( 1+ Na i (max) a i (min) B ) a facto of 2lg whee N is the total numbe of constaints and a i (max) and a i (min) ae the maximum and minimum (non-zeo) coefficients of the constaint. They also gave a tight lowe bounds on any online algoithm fo the oblem, oving that thei scheme is otimal fo any B > 0. Using the algoithm given in [4] with B = 2lg(1 + NT max ) we can give a O (lg( R + V + E )+lg(t max ))-cometitive algoithm which do not violate any constaint; whee N = R + 2 V + E and T max = max{ c max c min, f max f min, b max b min },i.e.,themaximum of equied comute nodes atio, equied middlebox atio and equied bandwidth atio. Since lg(t max ) can be consideed a small constant in the context of this ae, the algoithm gives a O (lg( R + V + E ))-cometitive factional solution fo the online ath allocation oblem. Fo the sake of comleteness we esent the algoithm of [4]. We initialize all the vaiables x i and z to zeo. Uon eceiving the equest, wewilldefine avaiablez fo evey ossible ath (o we can imove the efomance by using a heuistic algoithm to geneate only a set of suitable aths fo the equest). Fo each ath we comute the coefficients of z in the constaints and un Algoithm 1 given in the figue. Theoem 1 in [4] oves that this algoithm gives a B- cometitive factional solution fo the oblem. Howeve, we 5

6 Algoithm 1 Online Factional FSG Path Allocation Poblem 1: z 0. 2: Fo each x(i): a i (max) max (, ) R P a(i,, ). 3: while i a(i,, )x(i) < 1 do 4: Incease z continuously. 5: Incease each vaiable x(i) by the following incement function: x(i) max{x(i), 1 Na i (max) [ ex( B 2u(i) (, ) R P a(i,, )z ) 1 ] } should eithe discad a equest o allocate the whole equest to one ath and thus we need an integal solution. We can show that no online integal algoithm can always guaantee o( R )- cometitiveness. Theefoe we have to ely on the cometitive atio of the factional solution and use a andomized ounding method to obtain the integal solution based on the factional solution. Fist we comute the vecto y coesonding to the cuent solution z,i.e.,foall R and P we set y = z w. Fo the equest, conside 1,..., m as an odeing of the ossible aths. Since i y i is always smalle than o equal to one, we can conside the values of y i fo 1 i m as the distibution of equest ove all the aths. Thus we like to choose the ath i with obability y i and discad with obability 1 i y i.weickaandomnumbex [0,1) and we choose ath k fo, iff k 1 i=1 y i x < k i=1 y i ;o we discad if x m i=1 y i.ifaathwaschosen,weassign it to unless this assignment togethe with evious integal decisions violate some of the constaints, which in that case we discad the equest. Wewillsetthevaiablesaccoding to this decision and continue to the next equest. V. MIDDLEBOX PLACEMENT Most ecent data cente achitectue designs [11], [10], [20] have ignoed middleboxes. One excetion is the ecent Cisco multi-tenant data cente achitectue [5] which advocates lacement at the aggegation laye in a thee-laye toology. Due to cost, middleboxes can not be attached to evey switch. The question is how should they be laced to maximize data cente efomance (ability to host maximal alications equiing in-netwok olicy enfocement)? Insights on lacement can shae the design of futue olicyawae data cente netwok achitectue. Ideally, we would like to addess this question indeendent of secific alication equest sequences. Howeve, we show that thee is no good guaantees fo oblivious middlebox lacement oblem. Theefoe, we ae obliged to conside equest distibutions in ou solution. A. Negative esults on equest oblivious lacement One can show that simila to many othe online oblems 3 no online algoithm can always guaantee a o( R )-cometitive solution to the Online (Integal) FSG Path Allocation Poblem when advesay has full contol ove the inut. Theoem 3: Thee is no o( R )-cometitive algoithm fo the Online (Integal) Path Allocation Poblem. 3 Fo examle the famous secetay oblem Poof. Conside an online algoithm and a simle ath toology with M > R comute nodes at its vetices. The advesay will give a equest which can be satisfied but will use all the esouces (i.e. the fist equest is just the toology itself). If the algoithm does not assign the fist equest, then the advesay will send only imossible equests as the emaining R 1 equests and thus the algoithm will not satisfy any of the equests. Howeve if the algoithm assigns the fist equest, then the advesay will send R 1smallequestswhichthey only need one comute node. Thus the cometitive atio in this scenaio would be R 1. This shows that no online algoithm can be o( R )-cometitive. B. Placement algoithm Assume that we have a toology < G,C,n > and a set of samle sequences of equests R 1,...,R K.Solvingtheelaxation of FSG fo a set of equests R i would give us a factional solution fo middleboxes ositions, i.e. the function F i.the function F i gives us a distibution π i of n middleboxes ove the set of vetices, i.e., π i (v) =F i (v)/n. Howeve,π i is only otimal fo one set of equests, but we need a lacement that could give a maximum aveage solution fo diffeent scenaios. Theefoe we combine all LP-elaxations of diffeent samles, i.e., we dulicate the toology fo any samle sequence, but will use the same F(v) set of vaiables fo all of these toologies. The LP-elaxation is given below. Maximize. y k [K] R k P k k [K] & R k : y 1 P k k [K] & v V k : y c v C(v) R k P k k [K] & v V k : y f v F(v) R k P k k [K] & e E k : y b e B(e) R k P k k [K] : F(v) n v V k y {0,1} F(v) N (OPL) (OPL.A) (OPL.B) (OPL.C) (OPL.D) (OPL.E) By solving the LP-elaxation fo all samles togethe, we can get the distibution Γ ove the vetices which gives the otimum aveage solution fo all the samles. Finally, we assign Γ(v)n middleboxes to evey vetex v and assign the emaining middleboxes one by one to the vetices with highest Γ(v). Aftefindingtheoelacement,weuntheonline algoithm in Section IV-A2 to give a solution fo the online steam of equests. VI. EVALUATION When enteises deloy thei alications in emote ublic data centes, olicies can be enfoced eithe in emote data centes o back in the base enteise netwoks (base netwoks fo shot). We fist evaluate the cost and the feasibility of enfocing olicy constaints in base netwoks. We show that it may not be feasible if the enteise can only use tee-based 6

7 outing to enfoce olicies. It also incus substantial cost in tems of ath length. We then conside enfocing olicies locally in emote data cente. We evaluate ou embedding algoithm, and imacts of diffeent middlebox lacements. A. Methodology An enteise netwok toology and alication olicies: We obtain oute, middlebox and switch configuation files of acamusnetwokwithmoethan50outesandmoethan 1000 switches. We fist extact the oute distibution gah, and layethee toology using a tool in [2]. We inset the link-laye toology into the laye-thee toology due to the fact that switch configuations ae not adequate. We then infe the middlebox tavesal olicy based on the toology oeties and the oute distibution gah. We examine the ossible aths between two endoints (eesented as two subnets o two VLANs). Fom the ath, we detemine the middleboxes tavesed and stoe this sequence as the wayoints fo this aticula ath. Fo scoe, if both endoints ae in the same VLAN, then the scoe is all nodes in the boadcast domain. If they ae not in the same VLAN, we use all eachable nodes (based on oute distibution gah and ACLs) in the secuity zone as the scoe. We comae the tee outing case and the switch case. We ick 7 laye-two netwoks as the alication netwok toologies to migate to a emote data cente. We assume the emote data cente has no middleboxes. We evaluate the two mechanisms: tee outing and switch. We leave the evaluation of Oenflow mechanism to futue wok. Policy-awae data cente netwok toology: We use simulation to study the efomance of ou embedding algoithms. We use thee tyical data cente stuctues Bcube [11], Dcell [13], and fat-tee [1]. We use Bcube 3 which has 2187 leaf nodes and 4 levels of 3-ot mini-switches. Each leaf node has 300 VMs. Each switch has 150 middlebox instances. Each link has a bandwidth of 1Gbs. We use Dcell(32, 1) which has 1056 leaf nodes. Each leaf node has 500 VMs, and each switch has 1000 middlebox instances, each link has bandwidth 1Gbs. We use fat-tee with k = 24. This gives us 3456 leaf nodes. Each link node has 400 VMs. We use the Google cluste dataset [9] fo equest size distibution. This dataset gives a nomalized job size distibution extacted fom Google oduct wokloads. The distibution shows moe than 51% jobs ae the smallest. 20% middle sized jobs use 65% of the total esouces. This distibution is used fo both the VM demand and middlebox demand of alication embedding equests. The aveage numbe of VMs and middleboxes e equest is 50 and 60 esectively. The aveage bandwidth demand e equest is 350Mbs which is geneated fom a Poisson distibution. We use Amazon EC2 icing schemes fo VMs ($0.048/h e VM) and bandwidth (0.01$/GB). Middleboxes ae assumed to be 4 times moe exensive than VMs. B. Results on enfocing olicy in base netwoks Feasibility: We fist study the feasibility of satisfying innetwok olicies. Figue 4 shows the esults of olicy violation Faction of violation Fig Tee outing Index of alications Faction of aths with olicy violations in the case of tee-outing. using tee outing. We see that tee outing may not always find a feasible solution. In 5 out of 7 alications, tee outing fails to find a feasible solution. The numbe of olicy violations (vaies fom 0 to 91%) deends on the set of olicies associated with the L2 netwoks. Using switch we find feasible solutions in all cases. Costs: Inthenextexeiment,weevaluatethecostofenfocing olicies by consideing the aveage ath length fo communication between oints in elocated laye-two netwoks and othe endoints in the netwok. We only look at soucedestination ais whose olicies ae satisfied. The ath length is defined as the numbe of netwok devices a acket must tavese fom souce to destination (i.e., netwokhos). Figue 5 shows the tade-off of the two mechanisms in tems of ath length. In the cases (alications indexed 5 and 6) that tee outing is feasible, both mechanisms have the same aveage ath length and so both cases use simle ath (no cycles). In the cases (alications indexed 2 and 3) that tee outing has the lagest ecentage of violations (91% and 80%), the ath lengths diffe the most. That is, the ath length of the switch case is 7.6 and 6.5 hos longe than that of the tee outing case. This is due to the fact that the algoithm fo the switch case finds non-simle aths to satisfy olicies. This is not ossible in the tee outing case. Fo the intemediate cases (alications indexed 1 and 4) whee olicy violation ecentage is 31% and 21%, the ath length of the switch case is only 2.4 and 1.5 hos longe than that of the tee outing case. This means that most of the olicies can be satisfied by simle aths. C. Results on alication embedding and middlebox lacements Toology Acceted BW VM Middlebox Fist Reve- Requests Usage Usage Usage Reject nue($) FatT I % 38.2% 70.2% FatT II % 37.4% 68.2% FatT III % 38.1% 66.1% Bcube % 58.1% 59.9% DCell % 51.3% 53.1% TABLE I PERFORMANCE OF FRACTIONAL FSG EMBEDDING ALGORITHM UNDER DIFFERENT PLACEMENT STRATEGY 7

8 Fig. 5. Aveage ath length Tee outing switch Index of alications A comaison of the aveage ath length fo tee outing and switch. Toology Acceted BW VM Middlebox Fist Reve- Requests Usage Usage Usage Reject nue($) FatT I % 33.1% 67.2% FatT II % 33.2% 65.9% FatT III % 36.2% 66.4% Bcube % 79.6% 58.6% DCell % 47.2% 50.2% TABLE II PERFORMANCE OF INTEGRAL FSG EMBEDDING ALGORITHM UNDER DIFFERENT PLACEMENT STRATEGIES. We investigate thee middlebox lacement stategies fo fattee: (1) FatT I: all ae attached to aggegation switches, each has 3000 instances; (2) FatT II: half attached to aggegation switches, half attached to access switches, each switch has 1500 middlebox instances; (2) FatT III: all ae attached to access switches, each has 3000 middlebox instances. Fo Bcube and Dcube, we lace middleboxes unifomly, each switch has 150, and 1000 middlebox instances esectively. We comae ou factional solution with ou integal solution. Ou efomance metics ae total acceted numbe of alication equests oveall and total acceted equests befoe the fist ejection, the esouce utilization in tems of VMs, middleboxes, and netwok bandwidth. Utilization is defined as the total usage by all admitted equests divided by the total esouce. Ou esults ae shown in Table I and II. As exected, the factional solution tyically efoms bette in tems of total acceted equests and total evenue. Howeve, the diffeence in tems of total acceted equests ae smalle than 16% in all cases. This shows that ou integal solution is vey close to otimal. In tems of imact of middlebox lacement stategies, we see that lacing at the aggegation switches efoms the best. The eason is that many equests can not be localized to a single ack, if VMs of one ack have to go to anthe ack s access switch fo middlebox sevice, then the ath is much longe than just go to a middlebox in the aggegation switch. VII. RELATED WORK With the excetion of [16], evious studies on olicy enfocement in ublic data centes o enteise netwoks have focused on end-oint olicies [7], [23] and access contol olicies [14], [21], [24], [22], [3], [18], [2]. In [16], we have focused on olicy eseving netwok extension. It does not conside alication equest embedding. Pevious wok on alication embedding in ublic data centes [12] does not conside olicy enfocement. VIII. CONCLUSION AND FUTURE WORK We conduct the fist study on satisfying alication-wide, in-netwok olicies, and othe ealistic equiements such as bandwidth and eliability. we ecisely encode alication equiements using flow secuity gah, middlebox configuation states and olicy secification. We chaacteize feasibility of olicy enfocement based on enfocement mechanisms. We then oose an effective online algoithm to ma enteise alication onto ublic data cente toology. Ou study motivates the need of flexible olicy enfocement mechanisms such as Oenflow and switch, and the design of olicy-awae data cente netwok achitectue. Thee ae many avenues fo futue wok. We would like to conside designing olicy-awae data cente netwok achitectue. We ae also lanning to conduct exeiments in a cloud comuting testbed which connects a cooate data cente with Amazon Vitual Pivate Cloud. IX. ACKNOWLEDGEMENT H. Zhao and D. Li ae atly suoted by 973 Pogam of China unde Gants 2012CB315803, and NSFC ogam unde Gants No and We aeciate the hel of A. Voellmy, M.F. Nowlan, and R. Beebee. REFERENCES [1] Mohammad Al-Faes, Alexande Loukissas, and Amin Vahdat. A scalable, commodity data cente netwok achitectue. In Poceedings of ACM SIGCOMM, ages63 74,NewYok,NY,USA,2008.ACM. [2] Theohilus Benson, Aditya Akella, and David Maltz. Mining olicies fom enteise netwok configuation. In IMC, [3] Theohilus Benson, Aditya Akella, and David Maltz. Unaveling the comlexity of netwok management. In Poceedings of USENIX NSDI, ages , Bekeley, CA, USA, USENIX Association. [4] N. Buchbinde and J. Nao. Online imal-dual algoithms fo coveing and acking. Math. Oe. Res., 34(2): , [5] Cisco. Cisco vitualized multi-tenant data cente, vesion 2.0 comact od design guide. htt:// Enteise/Data Cente/VMDC/2.0/design guide/vmdccpoddesign20. df. [6] Cisco Inc. Data cente inteconnect: Laye 2 extension between emote data centes. [7] Cisco Inc and Vmwae Inc. Vitual netwoking featues of the vmwae vnetwok distibuted switch and cisco nexus 1000v switches. available at htt:// cisco vmwae vitualizing the datacente.df, [8] M. R. Gaey and D. S. Johnson. Comutes and Intactability: A Guide to the Theoy of NP-Comleteness. W.H. Feeman and Co., San Fancisco, CA, [9] Google. Google cluste data. htt://code.google.com// googleclustedata/. [10] Albet Geenbeg, Navendu Jain, Sikanth Kandula, Changhoon Kim, Paanta Lahii, Dave Maltz, Paveen Patel, and Sudita Senguta. Vl2: Ascalableandflexibledatacentenetwok. InPoceedings of ACM SIGCOMM, August2009. [11] Chuanxiong Guo, Guohan Lu, Dan Li, Haitao Wu, Xuan Zhang, Yunfeng Shi, Chen Tian, Yongguang Zhang, and Songwu Lu. Bcube: a high efomance, seve-centic netwok achitectue fo modula data centes. In Poceedings of ACM SIGCOMM, ages63 74,NewYok, NY, USA, ACM. [12] Chuanxiong Guo, Guohan Lu, Helen J. Wang, Shuang Yang, Chao Kong, Peng Sun, Wenfei Wu, and Yongguang Zhang. Secondnet: a data cente netwok vitualization achitectue with bandwidth guaantees. In Poceedings of Co-NEXT, ages15:1 15:12,NewYok,NY,USA, ACM. 8

9 x 1 M T d T R M F d F x k T 1 T F +1 Fig. 6. Constuction fo 3-SAT eduction. F m [13] Chuanxiong Guo, Haitao Wu, Kun Tan, Lei Shi, Yongguang Zhang, and Songwu Lu. Dcell: a scalable and fault-toleant netwok stuctue fo data centes. In Poceedings of ACM SIGCOMM, ages75 86,New Yok, NY, USA, ACM. [14] Mohammad Hajjat, Xin Sun, Yu-Wei Eic Sung, David Maltz, Sanjay Rao, Kunwadee Sianidkulchai, and Mohit Tawamalani. Cloudwad bound: Planning fo beneficial migation of enteise alications to the cloud. In Poceedings of ACM SIGCOMM, [15] D. Joseh, A. Tavakoli, and I. Stoica. A olicy-awae switching laye fo data centes. CCR, [16] Li Ean Li, Michael F. Nowlan, Yang Richad Yang, and Ming Zhang. Mosaic: Policy homomohic netwok extension. In Poceedings of the ACM Lage-Scale Distibuted Systems and Middlewae (LADIS), [17] J. F. Lynch. The equivalence of theoem oving and the inteconnection oblem. ACM SIGDA Newslette, 5(3):31 36, Setembe [18] Anku Kuma Nayak, Alex Reimes, Nick Feamste, and Russ Clak. Resonance: dynamic access contol fo enteise netwoks. In Poceedings of the 1st ACM woksho on Reseach on enteise netwoking (WREN), ages11 18,NewYok,NY,USA,2009.ACM. [19] Oenflow. The oenflow switch secification. htt://oenflowswitch. og. [20] Andeas Pambois, Nathan Faington, Nelson Huang, Padis Mii, Sivasanka Radhakishnan, Vikam Subamanya, and Amin Vahdat. Potland: A scalable fault-toleant laye 2 data cente netwok fabic. In ACM SIGCOMM, August2009. [21] Lucian Poa, Minlan Yu, Steven Y. Ko, Sylvia Ratnasamy, and Ion Stoica. Cloudolice: taking access contol out of the netwok. In Poceedings of the Ninth ACM SIGCOMM Hotnets Woksho, ages 7:1 7:6, New Yok, NY, USA, ACM. [22] Yu-Wei Eic Sung, Sanjay G. Rao, Geoffey G. Xie, and David A. Maltz. Towads systematic design of enteise netwoks. In Poceedings of ACM CoNEXT, ages1 12,NewYok,NY,USA,2008.ACM. [23] Voltaie Inc. Voltaie vantage 6024 switch. available at htt://www. voltaie.com/poducts/ethenet/voltaie vantage 6024, [24] Geoffey G. Xie, Jibin Zhan, David A. Maltz, Hui Zhang, A. Geenbeg, Gisli Hjalmtysson, and Jennife Rexfod. On static eachability analysis of i netwoks. In Poceedings IEEE INFOCOM, volume 3, ages vol. 3, Mach Moe fomally, we define an instance of the k-aths-tee oblem as follows. Let T i = x i,1 x i,2 x i,3 and F i = x i,1 x i,2 x i,3.define V = {R,M T,M F,d T,d F,x 1,x 2,...,x n, T 1,T 2,...,T,F +1,F +2,...,F k }. Let E j = {x j d T,x j d F },1 j n. Finally,fo1 i define E i = {T ix i,1,t i x i,2,t i x i,3 } and fo + 1 i k define E i = {F i x i,1,f i x i,2,f i x i,3 }.Thenlet n E = {RM T,RM F,M T d T,M F d F } E j E i. j=1 i=1 In the k-aths-tee instance let G =(V,E) be the gah. We define the souce nodes s i as s i = T i if 1 i and s i = F i if + 1 i k. Themiddlenodesaedefinedasm i = M T if 1 i and m i = M F if + 1 i k. Suose thee is a solution to the MONOTONE 3-SAT instance. Conside one such solution S. We will constuct a solution P to the k-aths-tee instance. Put the edges M T R and M F R into the set P. FoeveyT i thee is some x i, j that is tue in S and so choose one such x i, j and ut the edges T i x i, j and x i, j M T into the set P. SimilalyfoeveyF i thee is some x i, j that is false in S and so we choose one such x i, j and ut the edges F i x i, j and x i, j M F into the set P. Itcanbeeasily checked that P foms a tee and the ath fom each souce node to R goes though its coesonding middle node. That is, P is a solution to the k-aths-tee instance. Now suose we have a solution P to the k-aths-tee instance. Conside any souces T i and F h.theathfomt i to R in P is called a tue ath and must be of the fom T i x i, j d T M T R and the ath fom F h to R in P is called a false ath and must be of the fom F h x h,s d F M F R and it must be that x i, j x h,s since othewise x i, j d T M T RM F d F x h,s would be acycleinp contadicting the fact that P is a tee. Theefoe it makes sense to set the vaiable x i, j to Tue if thee is a tue ath though it in P and othewise set it to False. Then since P is a solution to the k-aths-tee instance, thee must be a ath fom evey T i and F i to R in P and hence fo evey clause T i thee is a vaiable x i, j that has been set to Tue and fo evey clause F h thee is a vaiable x h,s set to False. That is we have asolutiontothemonotone 3-SAT instance. X. PROOF OF NP-HARDNESS OF FEASIBILITY FOR FAT TREE TOPOLOGY Poof. Fo tee based outing, we show that the decision oblem is had even if the netwok has a fat tee toology. We educe the NP-comlete oblem MONOTONE 3-SAT [8] to ou oblem. Fom an instance of MONOTONE 3-SAT with vaiables x j,1 j n, andclausest i,1 i, withunnegated vaiables and clauses F i, + 1 i k, consistingof negated vaiables we constuct an instance of the k-aths-tee oblem as illustated in Figue 6. 9