Open Cloud exchange (OCX)

Open Cloud exchange (OCX) Draft Proposal and Progress GN3plus JRA1 Task 2 - Network Architectures for Cloud Services Yuri Demchenko SNE Group, University of Amsterdam 10 October 2013, GN3plus Symposium, Vienna

Outline GN3+ JRA1: Network Architectures for Horizon 2020 General use cases and scenarios for Cloud services delivery to NRENs and universities Cloud and Intercloud Infrastructure and Services Open Cloud exchange (OCX) Requirements to OCX OCX design principles and suggestions Pilot implementation by SURFnet GreenQloud and OneXS Topics for discussion Additional information Intercloud Architecture Framework (ICAF) and Intercloud Federation Framework (ICFF) GN3Plus Symposium Open Cloud exchange (OCX) Slide_2

JRA1: Network Architectures for Horizon 2020 Task 0: Activity Leadership Task 1: Future Network Architectures Task 2: Network Architectures for Cloud Services Task 3: Network Architecture for Aggregating High- Speed Mobile Networking GN3Plus Symposium Open Cloud exchange (OCX) 3

JRA1 Goals and Tasks Network Access and Delivery Network Infrastructure (NADI) plays important role in delivering cloud services to campuses and research organisations and includes 3 parts/layers The user access network, which connects users to applications. Extreme high-speed networks, which interconnect physical servers and the movement of their virtual machines (VMs). Mega pipe networks, interconnecting storage tiers. JRA1 Task2 and Task 1 will investigate and propose the best architecture for practical NADI implementation To support cloud-based services, including the distribution of very large scientific data Pilot implementation and demonstration of few use cases JRA1 and JRA2 will cooperate on multiple topics Network virtualisation and automation to deliver Performance on Demand by automating the allocation of shared network resources among data centres on behalf of cloud operations JRA1 s focus on the network elements to support cloud-based services interconnection and integration, with focus on the southbound elements of the management and related control plane when interworking with the software-driven network elements JRA2 will research true software-driven networking for cloud-based services, with automated resource orchestration and provisioning that yield reduced network capacity requirements, predictable service performance, and simpler operations GN3Plus Symposium Open Cloud exchange (OCX) 4

Use Cases for delivering Cloud services to campus based users Scientific application and scientific data LHC/HEP, genomics, astronomy, climate, video, etc. (+long tail science) Streaming high-speed high volume experimental data to labs in campus location Direct links through campus network Distributed (Big) Scientific processing with MPP tools on distributed facilities distributed between few locations next to local datacenters CSP and campus L0-L2 (L3) network peering Dark fiber with termination as campus network or as CSP network VoIP SURFnet approach with mobile data access Support mobile access network (LTE) and tunnel access to campus network GN3Plus Symposium Open Cloud exchange (OCX) 5

General use case for infrastructure provisioning: Workflow => Logical (Cloud) Infrastructure Enterprise/Scientific workflow Storage Special Proc 1 Archive Input Filtering Visual Present Instrum. Special Proc 2 Campus A Campus B Group A Resource/ Service VR1 VR2 VR3 VR6 VR4 VR5 Cloud 1 IaaS Cloud 2 PaaS VR7 Enterprise/Project based Intercloud Infrastructure Group B Enterprise/Scientific workflow Is mapped to heterogeneous cloud infrastructure containing IaaS, PaaS components Resource/ Service GN3Plus Symposium Open Cloud exchange (OCX) 6 Cloud IaaS Cloud PaaS

Multi/inter- cloud infrastructure provisioning: => ICADI and OCX functions Enterprise/Scientific workflow Campus A Group A Input Storage Instrum. Filtering Special Proc 1 Special Proc 2 Archive Visual Present Campus B Group B OCX as a part of GEANT infrastructure OCX at NREN Open Cloud exchange (OCX) interconnects CSP and Customer (campus) infrastructures Resource/ Service OCX assumes collocation or collapsed backbone for connecting all OCX members Resource/ Service VR1 VR2 VR3 VR4 GN3Plus Symposium Open Cloud exchange (OCX) 7 VR6 VR5 Cloud 1 IaaS Cloud IaaS Cloud 2 PaaS VR7 Enterprise/Project based Intercloud Infrastructure Cloud PaaS OCX at NREN Intercloud infrastructure: => Federated Access and Delivery Infrastructure

Operations Support System Management Security Infrastructure Multilayer Cloud Services Model (CSM) http://www.ietf.org/id/draft-khasnabish-cloud-reference-framework-05.txt /Client Services * Identity services (IDP) * /Customer Side Functions and Resources Endpoint Functions 1 Federated Access and * Service Gateway Delivery Infrastructure (FADI) * Portal/Desktop Cloud Management Software (Generic Functions) Content/ Services * * Content * Sensor * Device IaaS Cloud Management Platforms OpenNebula PaaS OpenStack PaaS-IaaS Interface IaaS Virtualisation Platform Interface Other CMS Administration and Management Functions (Client) Inter-cloud Functions * Registry and Discovery * Federation Infrastructure Cloud Services (Infrastructure, Platform, Application, Software) VM SaaS PaaS-IaaS IF VM VPN Layer C6 /Customer side Functions Layer C5 Services Access/Delivery Layer C4 Cloud Services (Infrastructure, Platforms, Applications, Software) Layer C3 Virtual Resources Composition and Control (Orchestration) CSM layers (C6) /Customer side Functions (C5) Intercloud Access and Delivery Infrastructure (C4) Cloud Services (Infrastructure, Platform, Applications) (C3) Virtual Resources Composition and Orchestration (C2) Virtualisation Layer (C1) Hardware platform and dedicated network infrastructure Virtualisation Platform KVM XEN VMware Network Virtualis Layer C2 Virtualisation Proxy (adaptors/containers) - Component Services and Resources Storage Resources Compute Resources Hardware/Physical Resources Network Infrastructure Layer C1 Physical Hardware Platform and Network Control/ Mngnt Links Links Contrl&Mngnt Links Links GN3Plus Symposium Open Cloud exchange (OCX) Slide_8

General use case for infrastructure provisioning: Logical Infrastructure => Network Infrastructure (2) Resource and Cloud Domains Campus A Infrastructure VR1 VR3 VR5 VR7 Campus B Infrastructure VR2 VR4 VR6 Campus A Network 1 Cloud Carrier or Network 2 OCX at Cloud Carrier or Network (NREN) level Campus B Group A Resource/ Service VR1 VR2 VR3 VR6 VR4 VR5 Cloud 1 IaaS Cloud 2 PaaS VR7 Enterprise/Project based Intercloud Infrastructure Group B Provisioning network infrastructure may involve multiple providers Introducing OCX (Open Cloud exchange) Resource/ Service GN3Plus Symposium Open Cloud exchange (OCX) 9 Cloud IaaS Cloud PaaS

OCX Definition and Operational Principles Direct service/inter-member peering Re-use and leverage Internet exchange Open collocation services Scalability for growing number of members Controlled network parameters/qos No third party (intermediary/broker) services Transparency for cloud based services No involvement into peering or mutual business relations Trusted Third Party (TTP) To support dynamic service agreements and/or federation establishment Trusted Introducer for dynamic trust establishment May include other special services to support smooth services delivery and integration between CSP and Customer E.g., Local policies, service registry and discovery GN3Plus Symposium Open Cloud exchange (OCX) 10

OCX Topological model and Connectivity OCX OCX L0-L2/L3 topology Any-to-any Distributed or collapsed backbone Hierarchical Topology information exchange L0-L2 + L3? between members SDN control over OCX switching OCX Nodes: s and customers OCX Facilities QoS parameters Bandwidth Speed, latency Jitter, impairment OCX backbone links/connectivity (Lo-L2) OCX GN3Plus Symposium Open Cloud exchange (OCX) 11

OCX Trusted Third Party services TTP OCX Pre-established trust relation with OCX as TTP Trust relations established as a part of dynamic federation between OCX members TTP goals and services Enable dynamic federations establishing Trusted Certificates and CA s Repository Similar to TACAR (TERENA Academic CA Repository) Trusted Introducer Service Trusted Introduction Protocol Service Registry and Discovery Intercloud policy clearinghouse Repository of CSP policies Common policy template SLA repository and clearinghouse GN3Plus Symposium Open Cloud exchange (OCX) 12

OCX location options: GN3, NREN (+University?) CSP GEANT NREN University DFlow IP/L3 VR3 VR4 VR6 VR5 VR7 OCX L2 L1 L0 VR3 VR4 VR6 VR5 VR7 OCX GN3Plus Symposium Open Cloud exchange (OCX) 13

OCX Hierarchical Topology Model CSP GEANT NREN University VR4 VR6 VR7 OCX DFlow VR3 VR5 IP/L3 L2 L1 L0 VR3 VR4 VR6 VR5 VR7 OCX GN3Plus Symposium Open Cloud exchange (OCX) 14

OCX Extended Backplane Topology Model CSP GEANT NREN University VR4 VR6 VR7 OCX DFlow VR3 VR5 IP/L3 L2 L1 L0 VR3 VR4 VR6 VR5 VR7 OCX GN3Plus Symposium Open Cloud exchange (OCX) 15

Pilot OCX Concept Implementation by SURFnet NetherLight as an Open Lightpath Exchanges (OLE) operated by SURFnet To Bandwidth on Demand, Virtual Networking 100G transatlantic trials, and Open Cloud exchange (OCX) pilot/prototype Since 2012, SURFnet and NetherLight have been performing pilots with cloud providers that want to offer their services with lightpath characteristics to SURFnet connected institutions GreenQloud (Iceland) offers service delivery over lightpaths via NetherLight/SURFnet with advantages above the regular IP services Guaranteed bandwidth and latency Protected from the external Internet Possibility of domain extension (VM s appear as if inside campus network) Cost reduction due to offloading of traffic Pilot since 2012 between OneXS and Windesheim University of Applied Sciences to deliver unified services of fixed and mobile telephony Guaranteed bandwidth and latency Protected from the external Internet Protected from DDOS attacks GN3Plus Symposium Open Cloud exchange (OCX) 16

General SURFnet Lightpath interconnection Universities GeenQloud: cloud services OneXS: unified services of fixed and mobile telephony GN3Plus Symposium Open Cloud exchange (OCX) 17

OCX Development Next Steps (for Discussion) First public draft 12 September 2013 GN3plus inter-activities discussion and feedback 17 May 2013 - First draft published June 2013 - First round of comments and update Sept 2013 - Second round of comments and update Sept - Oct 2013 - External comments and community feedback Design and implementation Starting November 2013? SDN based control and management over OCX Standardisation contribution OGF, IETF, ITU-T, IEEE, NIST IEEE Intercloud Testbed Initiative as a dissemination and validation channel - GN3Plus Symposium Open Cloud exchange (OCX) 18

Discussion Network for Clouds or for future Big applications (cloud based)? escience use cases need to be analysed and new requirements identified Trends in university s and research services use SDN vs Software Defined Infrastructure Big data-centric applications will require data structures and processing workflow to be mapped to infrastructure Distributed storage, distributed processing, security, lifecycle/staging, etc. Lower layer infrastructure virtualisation GN3Plus Symposium Open Cloud exchange (OCX) 19

Gartner Technology Hypercycle Big Cloud Computing Source http://www.gartner.com/technology/research/methodologies/hype-cycle.jsp GN3Plus Symposium Open Cloud exchange (OCX) 20

5 yr for Cloud Computing 2 yr for Big adoption GN3Plus Symposium Open Cloud exchange (OCX) 21

Improved: 5+1 V s of Big Variety Structured Unstructured Multi-factor Probabilistic Linked Dynamic Changing data Changing model Linkage Variability Volume Terabytes Records/Arch Tables, Files Distributed 6 Vs of Big Trustworthiness Authenticity Origin, Reputation Availability Accountability Velocity Batch Real/near-time Processes Streams Correlations Statistical Events Hypothetical Value Generic Big Properties Volume Variety Velocity Acquired Properties (after entering system) Value Veracity Variability Commonly accepted 3V s of Big Veracity GN3Plus Symposium Open Cloud exchange (OCX) 22

From Big to All- Paradigm Change Breaking paradigm changing factor storage and processing Security Identification and provenance Traditional model BIG Storage and BIG Computer with FAT pipe Move compute to data vs Move data to compute New Paradigm Continuous data production Continuous data processing Bus as a container and Protocol centric infrastructure and service models Big Move or not to move? Network? Distributed Big Storage Abstraction Bus Infrastructure Abstraction Distributed Compute and Analytics Big Computer Visuali sation Presen tation Action Bus: (1) Container (2) Metadata, State (3) Transfer Protocol GN3Plus Symposium Open Cloud exchange (OCX) 23

Big Ecosystem:, Transformation, Infrastructure Consumer Source Collection& Registration Storage General Purpose Filter/Enrich, Classification Analytics, Modeling, Prediction Big Target/Customer: Actionable/Usable Target users, processes, objects, behavior, etc. Big Source/Origin (sensor, experiment, logdata, behavioral data) Big Analytic/Tools Management Compute General Purpose High Performance Computer Clusters Delivery, Storage Specialised bases Archives (analytics DB, In memory, operstional) categories: categories: metadata, categories: metadata, (un)structured, metadata, (un)structured, (non)identifiable (un)structured, (non)identifiable (non)identifiable Federated Access and Delivery Infrastructure (FADI) management infrastructure and tools Registries, search, ontologies, schemas, namespace Collaborative Environment Heterogeneous multiprovider Inter-cloud infrastructure Federated Access and Delivery Infrastructure (FADI) High performance (programmable) network Security infrastructure Intercloud multi-provider heterogeneous Infrastructure Security Infrastructure Network Infrastructure Internal Infrastructure Management/Monitoring GN3Plus Symposium Open Cloud exchange (OCX) 24

Big Infrastructure and Analytic Tools Big Target/Customer: Actionable/Usable Target users, processes, objects, behavior, etc. Big Source/Origin (sensor, experiment, logdata, behavioral data) Big Analytic/Tools Analytics: Refinery, Linking, Fusion Analytics Applications : Link Analysis Cluster Analysis Entity Resolution Complex Analysis Federated Access and Delivery Infrastructure (FADI) Analytics : Realtime, Interactive, Batch, Streaming Storage General Purpose Compute General Purpose High Performance Computer Clusters Storage Specialised bases Archives Management categories: categories: metadata, categories: metadata, (un)structured, metadata, (un)structured, (non)identifiable (un)structured, (non)identifiable (non)identifiable Intercloud multi-provider heterogeneous Infrastructure Security Infrastructure Network Infrastructure Internal Infrastructure Management/Monitoring GN3Plus Symposium Open Cloud exchange (OCX) 25

http://mattturck.com/2012/10/15/a-chart-of-the-big-data-ecosystem-take-2/ GN3Plus Symposium Open Cloud exchange (OCX) 26

GN3Plus Symposium Open Cloud exchange (OCX) 27

Additional Information GN3Plus Symposium Open Cloud exchange (OCX) 28

Initiatives by the major CSP Amazon Direct Connect Google patent US 2012/0151057 A1 (January 2012) Virtualised Connectivity in a Cloud Service Environment Microsoft Azure campus PoP (Point of Presence) GN3Plus Symposium Open Cloud exchange (OCX) 29

New Service: Amazon Direct Connect AWS Direct Connect links customer internal network to an AWS Direct Connect location over a standard 1 Gbps or 10 Gbps Ethernet fiber-optic cable One end of the cable is connected to customer router, the other to an AWS Direct Connect router Allows creating virtual interfaces directly to the AWS cloud (Amazon EC2, S3) and to Amazon Virtual Private Cloud (Amazon VPC), bypassing Internet service providers in your network path Access is limited to Amazon Web Services in the region 5 Nov 2013, Chasopys, Kiev Cloud and Big 30

InterCloud Architecture Framework (ICAF) Multi-layer Cloud Services Model (CSM) Combines IaaS, PaaS, SaaS into multi-layer model with inter-layer interfaces Including interfaces definition between cloud service layers and virtualisation platform InterCloud Control and Management Plane (ICCMP) Allows signaling, monitoring, dynamic configuration and synchronisation of the distributed heterogeneous clouds Including management interface from applications to network infrastructure and virtualisation platform InterCloud Federation Framework (ICFF) Defines set of protocols and mechanisms to ensure heterogeneous clouds integration at service and business level Addresses Identity Federation, federated network access, etc. InterCloud Operations Framework (ICOF) RORA model: Resource, Ownership, Role, Action RORA model provides basis for business processes definition, SLA and access control Broker and federation operation Intercloud Security Framework (ICSF) Dynamic Security Infrastructure provisioning and protocols GN3Plus Symposium Open Cloud exchange (OCX) 31

Operations Support System Management Security Infrastructure Multilayer Cloud Services Model (CSM) http://www.ietf.org/id/draft-khasnabish-cloud-reference-framework-05.txt /Client Services * Identity services (IDP) * /Customer Side Functions and Resources Endpoint Functions 1 Federated Access and * Service Gateway Delivery Infrastructure (FADI) * Portal/Desktop Cloud Management Software (Generic Functions) Content/ Services * * Content * Sensor * Device IaaS Cloud Management Platforms OpenNebula PaaS OpenStack PaaS-IaaS Interface IaaS Virtualisation Platform Interface Other CMS Administration and Management Functions (Client) Inter-cloud Functions * Registry and Discovery * Federation Infrastructure Cloud Services (Infrastructure, Platform, Application, Software) VM SaaS PaaS-IaaS IF VM VPN Layer C6 /Customer side Functions Layer C5 Services Access/Delivery Layer C4 Cloud Services (Infrastructure, Platforms, Applications, Software) Layer C3 Virtual Resources Composition and Control (Orchestration) CSM layers (C6) /Customer side Functions (C5) Intercloud Access and Delivery Infrastructure (C4) Cloud Services (Infrastructure, Platform, Applications) (C3) Virtual Resources Composition and Orchestration (C2) Virtualisation Layer (C1) Hardware platform and dedicated network infrastructure Virtualisation Platform KVM XEN VMware Network Virtualis Layer C2 Virtualisation Proxy (adaptors/containers) - Component Services and Resources Storage Resources Compute Resources Hardware/Physical Resources Network Infrastructure Layer C1 Physical Hardware Platform and Network Control/ Mngnt Links Links Contrl&Mngnt Links Links GN3Plus Symposium Open Cloud exchange (OCX) Slide_32

General use case for infrastructure provisioning: Workflow => Logical (Cloud) Infrastructure Enterprise/Scientific workflow Storage Special Proc 1 Archive Input Filtering Visual Present Instrum. Special Proc 2 Campus A Campus B Group A Resource/ Service VR1 VR2 VR3 VR6 VR4 VR5 Cloud 1 IaaS Cloud 2 PaaS VR7 Enterprise/Project based Intercloud Infrastructure Group B Enterprise/Scientific workflow Is mapped to heterogeneous cloud infrastructure containing IaaS, PaaS components Resource/ Service GN3Plus Symposium Open Cloud exchange (OCX) 33 Cloud IaaS Cloud PaaS

General use case for infrastructure provisioning: Logical Infrastructure => Network Infrastructure (1) Resource and Cloud Domains Cloud 1 IaaS Cloud 2 PaaS Campus A Infrastructure VR1 VR3 VR5 VR7 Campus B Infrastructure VR2 VR4 VR6 Campus A Cloud Carrier Network Infrastructure Campus B Group A Resource/ Service VR1 VR2 VR3 VR6 VR4 VR5 Cloud 1 IaaS Cloud 2 PaaS VR7 Enterprise/Project based Intercloud Infrastructure Group B Distributed Resource/ heterogeneous cloud Service infrastructure requires separately provisioned network infrastructure that can be outsourced to Cloud Carrier GN3Plus Symposium Open Cloud exchange (OCX) 34 Cloud IaaS Cloud PaaS

General use case for infrastructure provisioning: Logical Infrastructure => Network Infrastructure (2) Resource and Cloud Domains Campus A Infrastructure VR1 VR3 VR5 VR7 Campus B Infrastructure VR2 VR4 VR6 Campus A Network 1 Cloud Carrier or Network 2 OCX at Cloud Carrier or Network (NREN) level Campus B Group A Resource/ Service VR1 VR2 VR3 VR6 VR4 VR5 Cloud 1 IaaS Cloud 2 PaaS VR7 Enterprise/Project based Intercloud Infrastructure Group B Provisioning network infrastructure may involve multiple providers Introducing OCX (Open Cloud exchange) Resource/ Service GN3Plus Symposium Open Cloud exchange (OCX) 35 Cloud IaaS Cloud PaaS

Intercloud Applications Interaction (1) - ICCMP Campus A InterCloud Control and Management Plane (ICCMP) IaaS Domain defined Platform and SW&Apps Layer 3 - IaaS defined Virt&OS Platform Cloud Layers Layer 7 - Applications Layer 6 SaaS/Apps Layer 5 - PaaS Cloud based Platform Layer 4 - IaaS Cloud Infrastructure Layer 3 Composition Layer 2 - Virtualisation Layer 1 - Physical HW Platform/Network PaaS Domain defined SW&Apps Layer 4 - PaaS defined Infrastr. and Virt&OS Platform ICCMP InterCloud Control and management Plane Campus B Group A Resource/ Service VR1 VR2 VR3 VR6 VR4 VR5 Cloud 1 IaaS Cloud 2 PaaS VR7 Enterprise/Project based Intercloud Infrastructure Group B Consistent and tight management of the heterogeneous cloud infrastructure requires Intercloud Control and Management Plane (ICCMP) Resource/ Service AINA2013, 28 March 2013 InterCloud Architecture Framework 36 Cloud IaaS Cloud PaaS

Intercloud Applications Interaction (2) - ICFF IaaS Domain Intercloud Federation Infrastructure PaaS Domain Campus A SW&Apps Layer C3-IaaS Virt&OS Platform GW Attribs Registry Discovery Broker Broker Trust Broker IdP Trust Broker Trust GW SW&Apps LayerC4-PaaS Virt&OS Platform ICFF InterCloud Federation Framework Campus B Group A Resource/ Service VR1 VR2 VR3 VR6 VR4 VR5 Cloud 1 IaaS Cloud 2 PaaS VR7 Enterprise/Project based Intercloud Infrastructure Group B Independently managed cloud domains may use federated model for resources and processes integration and interoperation Resource/ Service AINA2013, 28 March 2013 InterCloud Architecture Framework 37 Cloud IaaS Cloud PaaS

Intercloud Federation Infrastructure and OCX OCX Services Federated Cloud Instance Customer A (University A) Broker Trust Broker Broker Trust Broker Federated Cloud Instance Customer B (University B) Cert Repo (TACAR) TTP Trusted Introducer FedIDP OCX Interconnection and Switching Facility Cloud Service Broker Discovery (RepoSLA) Directory Directory (RepoSLA) Gateway Gateway Gateway Gateway AAA AAA AAA AAA (I/P/S)aaS (I/P/S)aaS (I/P/S)aaS (I/P/S)aaS IDP IDP IDP IDP GN3Plus Symposium Open Cloud exchange (OCX) 38

SW&Apps Layer C3-IaaS Virt&OS Platform SW&Apps LayerC4-PaaS Virt&OS Platform Intercloud Applications Integration (3) - ICOF Input Storage Instrum. Filtering Special Proc 1 Special Proc 2 Archive Visual Present Business Processes Management and Services Operation Support SLA Management Business roles and Actors Business level Service Registry and Broker Mobility? GW Intercloud Federation Infrastructure Attribs IdP Registry Broker Broker Disco-very Trust Broker Trust Broker GW IaaS Domain Cloud Layers PaaS Domain Trust Campus A defined Platform and SW&Apps Layer 3 - IaaS defined Virt&OS Platform Layer 7 - Applications Layer 6 SaaS/Apps Layer 5 - PaaS Cloud based Platform Layer 4 - IaaS Cloud Infrastructure Layer 3 Composition Layer 2 - Virtualisation Layer 1 - Physical HW Platform/Network defined SW&Apps Layer 4 - PaaS defined Infrastr. and Virt&OS Platform Campus B Group A Resource/ Service VR1 VR2 VR3 VR6 VR4 VR5 Cloud 1 IaaS Cloud 2 PaaS VR7 Enterprise/Project based Intercloud Infrastructure Group B Operational and business issues are typically addressed by Operations services and a framework Resource/ Service AINA2013, 28 March 2013 InterCloud Architecture Framework 39 Cloud IaaS Cloud PaaS ICOF InterCloud Operations Framework