ONE Cloud Services Secure Cloud Applications for E-Health

ONE Cloud Services Secure Cloud Applications for E-Health http://cloudbestpractices.net Cloud Solutions Roadmap The Cloud Best Practices Network (CBPN) specializes in pioneering and documenting best practice configurations that make Cloud Computing more easily adoptable. This document outlines a proposed Prototype Project scenario for a number of new capabilities that Cloud Computing could enable in E-Healthcare. This is part of an overall Cloud Solutions Roadmap program that is building a portfolio of these business use case scenarios. The output is a best practices paper. Customer Requirements EHealth Ontario To ensure these scenarios reflect real-world requirements the CBPN engages end-user [X] In this case E-Health Ontario (www.ehealthontario.on.ca/) ehealth Ontario has the unique challenge of revolutionizing Ontatio s Public Health Informatics system with the overarching goal to improve patient care, safety and access in support of the government s health strategy. As part of this goal, ehealth Ontario has a suite of services that need to be served in a scaleable and automated manner across all the hospitals and health care providers in the province of Ontario. These needs of ehealth Ontario will be best served through a Private Cloud tasked with delivering the services in the manner described above. Here are some examples of services that this private cloud may provide: EMR systems EMR as a server Encrypted Email Service (ONE Mail) Secure Mail as a Service PACS Storage as a Service (Encrypted) Disaster Recovery (DR) as a service ONE Cloud Services - EHealth Ontario provides a set of IT services under the portfolio brand of 'ONE' services. This is based on the province-wide WAN that connects all healthcare organizations via their own dedicated private network, 'ONE Network', and hence the proposed private Cloud services are described as 'ONE Cloud Services'. In the rest of this document we propose a set of technologies that will be used and looked at to build the cloud that fits the need of ehealth Ontario the best. http://cloudbestpractices.net ONE Cloud Services Page 1

Using OpenNebula to build the ehealth Ontario Cloud It is proposed to use OpenNebula as the Cloud platform for this scenario. OpenNebula is FOSS (Free and Open Source Software) for operating Cloud Computing. OpenNebula orchestrates storage, network, virtualization, monitoring, and security technologies to enable the dynamic placement of multi-tier services (groups of interconnected virtual machines) on distributed infrastructures, combining both data center resources and remote cloud resources, according to allocation policies. This means it is ideally suited for 'Cloud Bursting' - Using it for an internal Private Cloud, which then dynamically calls upon infrastructure services from remote providers like Amazon, as and when it experiences spikes in traffic demand. OpenNebula is also developing compliance with a number of key open standards, a critical point for organizations wanting to ensure they avoid vendor lock-in by Cloud Providers. Standards like OVF, CDMI and OCCI all make it much easier to move applications and data in between and across multiple Clouds. This means this Cloudbursting type scenario is inherently more flexible, both commercially as well as technically, and achieves the optimum balance of cost efficient use of Cloud plus internal resources. Read more in this article Open, Interoperable Cloud. http://cloudbestpractices.net ONE Cloud Services Page 2

Value Proposition Why OpenNebula? There are multiple reasons for using OpenNebula to build the ehealth Ontario cloud: 1. Prevention of Cloud lock in. ehealth Ontario will not be locked into the format of a single provider for its cloud services. This will also allow for cloud bursting to other cloud providers as and when needed. (requirement of the cloud providers is the support for OVF) 2. Open source model of OpenNebula allows for the cloud management layer to be customized to the exact requirements of ehealth Ontario instead of being tied into the way any proprietary cloud management layer is designed. 3. Choice of Hypervisors: with its recent announcements, OpenNebula now supports all the major hypervisors: VMware, KVM, Xen and Hyper-V. This will allow the developers of the ehealth Ontario cloud to test out the different hypervisors and their corresponding capabilities and decide which hypervisor to use as the platform. Key High level requirements of the ehealth Ontario cloud OpenNebula offers a number of key features that are core to the value of the ONE Cloud Services: 1. Zones: The ability of 'Zones' cater to the geographic factors of Cloud data hosting. For example if personal patient information can't leave a certain area, a separate zone for that area may be appropriate. 2. Cloud Brokering / Bursting Using Open Nebula as a Private Cloud gateway to buy and use burst capacity IaaS from providers like Amazon. However, the security and data/hosting implication of this need to be evaluated under ehealth Ontario s context. 3. High availability architecture The best approaches for engineering highly distributed, very resilient Clouds. a. Clustering capabilities b. Disaster recovery capabilities 4. Apps Store This involves creating an inventory of existing applications and providing appropriate cloud transformations for them using IaaS, PaaS or SaaS based implementations. Additionally, the OpenNebula cloud will need to enable cataloguing of the transformed applications. 5. Billing/Metering system To track the resource consumption of each ehealth Ontario department to allow for appropriate resource pool allocation as well as provide an accurate chargeback model to that department. 6. Cloud on-ramp capabilities The ehealth Ontario cloud needs to provide a smooth on-ramp to transition the various departments from existing systems to the cloud. This includes: a. P2V capabilities from existing hardware b. Federation features that allow a department to continue using existing installations while transitioning to the cloud. This could include technologies like: a. Hybrid clouds that connect legacy private clouds of departments to the ehealth Ontario cloud http://cloudbestpractices.net ONE Cloud Services Page 3

b. Transferring data to cloud-ready formats and transferring them to the cloud c. Test capabilities with the option to promote it to host primary workloads 7. Current State of the art This involves cataloguing existing applications and retiring them for newer SaaS based applications or packaging them into VMs and moving them to the IaaS ehealth Ontario cloud. Prototype deployment In order to kickstart the OpenNebula ehealth Ontario Cloud, a prototype deployment will be done, which will include a small subset of early adopter departments in ehealth Ontario. The findings from the prototype deployment will be used to deploy the OpenNebula cloud for all of ehealth Ontario. Goals The goal of the prototype deployment is two-fold: - Provide a canonical deployment that will be used as a model to grow the ehealth Ontario cloud and add the remaining departments under the ehealth Ontario s umbrella - Understand at a canonical level the performance and scale requirements that the ehealth Ontario will need to provide to meet the requirements of the various departments - Test the waters with different technology choices before finalizing on the ones that provide the best functionality, performance as well as TCO. One example of such a technological choice is: which hypervisor to use: VMware, Xen, or Hyper-V? - Create a Technology Adoption Program (TAP) for a larger Government Cloud so that early adopters like ehealth Ontraio could give deployment feedback and allow for iterative development of the larger cloud. Additionally, the TAP program will allow hardware and software partners to participate in the innovation. Technology Choices Configuring the pilot project Here are some of the technology choices that need to be made during the course of the prototype deployment: Choice of Hypervisor 1. Xen 2. KVM 3. Vmware 4. Hyper-V Choice of OS Each of the hypervisor choices is tied to the relevant OSes, except for Xen and KVM, there is a choice as to which Linux distro to use: Redhat, Suse or CentOS http://cloudbestpractices.net ONE Cloud Services Page 4

Here is an initial set of metrics that will help in deciding which Hypervisor to use: 1. Performance: a. Storage b. CPU c. Networking d. Memory 2. Manageability metrics a. Ease of deployment b. Ease of P2V of an existing VM c. Ease of configuring resource pools d. Capabilities to provide metering e. Business continuity features and ease of moving a VM across various levels of business continuity that will be required by the target customers 3. Metering metrics: a. Storage: capacity b. Memory: Average memory consumed c. CPU: average CPU consumed in MHz d. Networking: Network bytes sent/received external to the cloud 4. Cost of ownership Choice of Storage Here are the storage choices that need to be made: 1. File Server 2. FC SAN 3. iscsi SAN 4. DAS Here are the set of metrics that will help in deciding the storage type to use: 1. Cost of ownership 2. How easy it is to scale out 3. Performance 4. Integration with Resource Pooling capability of the Hypervisor layer 5. High Availability 6. Size of images supported 7. Dedupe and thin provisioning capabilities 8. Provisioning capabilities Choice of networking Choice of network infrastructure will focus on the choice of the NIC and the switching fabric. Support for the following capabilities will guide the networking hardware that will be deployed: - Integration with QoS capabilities to support multitenancy - RDMA http://cloudbestpractices.net ONE Cloud Services Page 5

- SR-IOV (for high scale workloads, if they are needed for the Canada GovCloud) - Support for High Availability: LBFO NIC teaming - Manageability - Support for scale out deployments o Bandwidth consolidation o Load Balancing o High Availability Manageability: to allow network admins to manage the network traffic all the way from the switch hardware to the Virtual Machine. NB: As of now, the Cisco Nexus 1000v is the prominent product that supports this key feature. Choice of server Choice of server will be predicated on cost vs. support for integrating with the storage and networking fabrics that have been listed above. The final choice of hardware will also depend on conversations with ehealth Ontario with regard to the workloads that are run and their respective scaleability needs. Configuration choices With respect to managing the various services running in the virtual machines, there are a plethora of configuration choices that will define the behaviour of the ehealth Ontario Cloud fabric, through: API to be used: a. Sunstone b. OCCI c. EC2 Authentication mechanism Monitoring a. LDAP b. X509 a. Ssh native b. Ganglia Quota management Authorization Management of resource quotas in CPU, memory, storage and networking and tying them to a custom billing system Definition of groups and roles http://cloudbestpractices.net ONE Cloud Services Page 6

Virtual switch management at the fabric layer Storage management Zone management Pilot Project Partners Here are some of the partner companies we are looking to collaborate with as part of this project Hypervisor Partners - Microsoft (Hyper-V) - VMware (ESXi) - Citrix (XenServer) - RedHat (KVM) Software Partners These partners will provide technology, expertise or both with regards to application delivery using SaaS, infrastructure management or resource management software - Existing Cloud providers o Joyent - ISVs o Mitel - C12G Labs (OpenNebula) Hardware partners - Server o HP o IBM o Dell - Storage o NetApp o EMC - Network o Cisco Infrastructure Partners The infrastructure partners will be key in providing the datacentre space as well as the associated services to keep the cloud up and running - Telcos o Telus o Bell o Rogers http://cloudbestpractices.net ONE Cloud Services Page 7

Translation to ehealth Ontario Services Taking a look at the example set of services of ehealth Ontario and a high level view of how they will be implemented in the cloud: Private MPLS Network to connect every hospital in Ontario: will be managed by the OpenNebula Cloud console and will include all relevant administrative tasks, like setting up VLANS EMR systems EMR as a server: will be maintained as virtual machines which will be deployed to ensure high availability, again using the relevant hypervisor platform in tandem with clustered servers managed by OpenNebula. The deployment model will also be self-service by the administrators Encrypted Email Service (ONE Mail) Secure Mail as a Service: will be managed the same way as EMR systems PACS Storage as a Service (Encrypted): Open Nebula will expose the right APIs to allow clients to subscribe to storage as a service. The backend virtual systems will be sufficiently abstracted away. Disaster Recovery (DR) as a service: a subset of the workloads could be configured to be protected through DR as a service such that if a failure were to happen in one sight, an alternate ehealth Ontario site (or a collocated site) can take over the operations. The orchestration of the same will be taken care of by the underlying hypervisor layer and OpenNebula. http://cloudbestpractices.net ONE Cloud Services Page 8

Statement of Work Subject to the proposal being approved, the following activities will take place: 1. Interviews with the stakeholders in ehealth Ontario to get further details of each of the services 2. Create subset of high impact services that will made part of the POC deployment 3. The size of the PoC deployment in terms of number of servers will be enough to allow the observer to accurately extrapolate how the full scale deployment will look like 4. Initial emphasis will be on manageability instead of scale. So, as a result, the networking layer will stick to the traditional vswitch while the storage backend will likely be NFS based. Additionally, monitoring will use SSL. 5. During the POC, vendor offerings from each of the vendors will be compared on the basis of the metrics that matter the most to ehealth Ontario. 6. Final result: a working POC with concrete recommendations on technologies and partner technologies to grow the ehealth Ontario cloud to fruition. Project Costings Item Deliverables Cost Project Services Resources [1] http://canadacloud.files.wordpress.com/2011/11/ciscocloudecosystem.pdf [2] http://www.govcloud.info/opennebula For enquiries on this project please contact us : contact@cloudbestpractices.org http://cloudbestpractices.net ONE Cloud Services Page 9

About the Project Team Neil McEvoy Neil McEvoy is the Founder and President of the Cloud Best Practices Network. Soumya Das Bhaumik Soumya is the project leader for this ONE Health Cloud project. http://cloudbestpractices.net ONE Cloud Services Page 10