CNS Core: Small: Network-wide Policy Enforcement in Programmable Networks using Logical Queues

数据中心网络和互联网交换点(IXP)是当今支持谷歌、Facebook和Netflix等重要云服务的计算基础设施的关键部分。在这些网络中，相互竞争的公司(租户)运行许多跨网络通信的不同分布式应用程序。遗憾的是，现有网络无法确保这些相互竞争的应用程序是独立的。例如，如果恶意租户比其他租户打开更多连接并向网络注入更多数据，它可能会消耗超过其公平份额的网络容量，并对其他租户的应用程序的性能产生不利影响。这项工作引入了一个新系统，它可以执行网络范围的隔离策略，并确保竞争租户无法玩弄系统，并通过打开更多连接或注入更多数据来获得更高的性能。现有的提供网络内性能隔离的方法使用虚拟队列来隔离流量。遗憾的是，这些方法在可伸缩性、性能、更新延迟和TCP友好性方面存在关键限制。为了克服这些限制，本提案旨在重新考虑交换机如何跟踪和响应动态变化的流量模式以及如何向终端主机通知拥塞信息的设计。具体地说，它将引入逻辑队列，它使用计数器来近似地充当具有大量虚拟队列的交换机，而不需要相关的硬件成本。关键的见解是，由于今天的交换机已经将交换机资源(SRAM)专用于用于监控的计数器，这些相同的计数器可以被重新利用来实现低开销的逻辑队列。这项工作将对应用程序开发人员、网络硬件供应商、云提供商和云基础设施的用户产生重大影响。新的抽象有可能在网络应用程序的开发和教学中变得司空见惯，它有可能显著提高当今网络的性能和安全隔离。这一提议还有可能扩大当今可编程开关的吸引力，并开辟一个新的细分市场。作为这项工作的一部分而创建的软件将通过GitHub(https://github.com/uic-data-center-systems/).以灵活的开源许可证广泛提供给公众重用调查人员在向更广泛的研究社区发布他们的研究原型的源代码方面有着很好的记录。这一奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Data center networks and Internet eXchange Points (IXPs) are a critical part of today's computing infrastructure that support important cloud services like Google, Facebook, and Netflix. In these networks, competing companies (tenants) run many different distributed applications that communicate across the network. Unfortunately, existing networks are not able to ensure that these competing applications are isolated. For example, if a malicious tenant were to open more connections and inject more data into the network than other tenants, it could consume more than its fair share of network capacity and adversely affect the performance of other tenants' applications. This work introduces a new system that can enforce network-wide isolation policies and ensure that competing tenants cannot game the system and get more performance by opening more connections or by injecting more data.Existing approaches to providing in-network performance isolation use virtual queues to isolate traffic. Unfortunately, these approaches suffer from key limitations with respect to scalability, performance, update latency, and TCP-friendliness. To overcome these limitations, this proposal aims to rethink the design of how switches track and respond to dynamically changing traffic patterns and how end-hosts are notified of congestion information. Specifically, it will introduce logical queues, which use counters to approximately behave as a switch with a large number of virtual queues without the associated hardware costs. The key insight is that since today's switches are already dedicating switch resources (SRAM) to counters that are used for monitoring, these same counters can be repurposed to implement logical queues with low overheads.This work will have significant implications for application developers, network hardware vendors, cloud providers, and users of cloud infrastructure. The new abstractions have the potential to become commonplace in both the development and teaching of network applications, and it has the potential to significantly improve performance and security isolation in today's networks. This proposal has the potential to also broaden the appeal of today’s programmable switches and open up a new segment of the market. The software created as part of this work will be made broadly available for public reuse under flexible open-source licenses through github (https://github.com/uic-data-center-systems/). The investigators have a strong record of releasing the source codes of their research prototypes to the broader research community.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.