Resilience as a Service: Optimisation of Middlebox placement

本研究的目的是提出一种在网络内以分布式方式虚拟化、部署和编排多个安全应用程序的方法，以提高整体性能和弹性。我们最初的目标列表包含以下内容：调查和实现可以在各种网络系统上运行的轻量级虚拟环境，包括节点和交换机，并且可以为安全应用程序提供对网络数据的所需访问。这种虚拟环境目前受到底层操作系统的限制，比如Docker[11]，或者为嵌入式设备带来不必要的复杂性，比如网络交换机，就像Java VirtualMachine[15][14]的情况一样。研究各种部署策略，通过流分析、虚拟机迁移技术和拓扑覆盖分析来最大化性能4和弹性。研究表明，在大型数据中心网络中迁移和优化客户虚拟机的位置可以改善整体资源使用情况，我们希望利用这一技术，以便在发生故障或攻击时提供更高的网络弹性。建议扩展SDN南向协议，允许以编程方式管理这些设备。遵循与SDN相同的设计原则，这允许增加大型网络的可扩展性和灵活性；此外，它还提供了网络安全状态的全局视图，允许管理员和开发人员轻松地管理安全应用程序。目前使用SDN的尝试显示出严重的局限性b[8]，所涉及的协议没有在设计时考虑到这个用例。分析、实现和部署概念验证应用程序，这些应用程序将利用现有的局部性来实现网络中的弹性。为了验证正确的功能，并证明我们对中间件本地化（它提供了整体性能的提高，并允许按需扩展）和增强弹性的主张，需要执行众所周知的网络功能（例如防火墙，代理，入侵检测系统）的应用程序。这些应用程序必须利用上面提到的轻量级环境来展示可移植性和在嵌入式设备上的执行。

The aim of this research is to propose an approach for virtualising, deployingand orchestrating multiple security applications in a distributed fashion withina network, to boost overall performance and resilience. Our initial list of objectivescontains the following:Investigate and implement lightweight virtual environments that can runon a variety of network systems, including nodes and switches, and canprovide the required access to network data for security applications. Suchvirtual environments are currently limited by underlying operating systems,such as Docker[11], or present unnecessary complexity for embeddeddevices, e.g. network switches, as is the case with the Java VirtualMachine[15][14].Investigate various deployment strategies that can maximise performance4and resilience through flow analysis, virtual machine migration techniquesand topology coverage analysis. Research has shown that the migrationand optimal placement of guest virtual machines within large data centrenetworks improves overall resource usage[16][4], a technique we want toleverage in order to also offer increased network resilience in the case offaults or attacks.Propose an extension to SDN southbound protocols that would allow managementof these devices in a programmatic manner. Following the samedesign principles as SDN, this allows for increased scalability and flexibilityof a large network; furthermore it provides a global view of the securitystatus of the network, allowing administrators and developers to managesecurity applications with ease. Current attempts of using SDN for thisshow severe limitations[8], the protocols involved not being designed withthis use case in mind.Analyse, implement and deploy proof of concept applications that wouldleverage existing locality for resilience within a network. In order to verifythe correct functionality and prove our claims for middlebox localisation(which provides overall increased performance and allows for scaling ondemand) and enhanced resilience, applications that perform well knownnetwork functions (e.g. Firewalls, Proxies, Intrusion Detection Systems)are required. These applications must leverage the lightweight environmentmentioned above to also demonstrate portability and execution onembedded devices.