权益分类	功能权益	普通用户	{{item.name}}会员
{{category.name}}	{{benefitItem.name}}

Resilience as a Service: Optimisation of Middlebox placement

弹性即服务：中间盒布局的优化

基本信息

批准号：
1802322
负责人：
金额：
--
依托单位：
University of Glasgow
依托单位国家：
英国
项目类别：
Studentship
财政年份：
2016
资助国家：
英国
起止时间：
2016 至无数据
项目状态：
已结题

来源：
https://gtr.ukri.org/projects?ref=studentship-1802322
关键词：
Resilience Service Optimisation Middlebox placement

项目摘要

The aim of this research is to propose an approach for virtualising, deployingand orchestrating multiple security applications in a distributed fashion withina network, to boost overall performance and resilience. Our initial list of objectivescontains the following:Investigate and implement lightweight virtual environments that can runon a variety of network systems, including nodes and switches, and canprovide the required access to network data for security applications. Suchvirtual environments are currently limited by underlying operating systems,such as Docker[11], or present unnecessary complexity for embeddeddevices, e.g. network switches, as is the case with the Java VirtualMachine[15][14].Investigate various deployment strategies that can maximise performance4and resilience through flow analysis, virtual machine migration techniquesand topology coverage analysis. Research has shown that the migrationand optimal placement of guest virtual machines within large data centrenetworks improves overall resource usage[16][4], a technique we want toleverage in order to also offer increased network resilience in the case offaults or attacks.Propose an extension to SDN southbound protocols that would allow managementof these devices in a programmatic manner. Following the samedesign principles as SDN, this allows for increased scalability and flexibilityof a large network; furthermore it provides a global view of the securitystatus of the network, allowing administrators and developers to managesecurity applications with ease. Current attempts of using SDN for thisshow severe limitations[8], the protocols involved not being designed withthis use case in mind.Analyse, implement and deploy proof of concept applications that wouldleverage existing locality for resilience within a network. In order to verifythe correct functionality and prove our claims for middlebox localisation(which provides overall increased performance and allows for scaling ondemand) and enhanced resilience, applications that perform well knownnetwork functions (e.g. Firewalls, Proxies, Intrusion Detection Systems)are required. These applications must leverage the lightweight environmentmentioned above to also demonstrate portability and execution onembedded devices.

本研究的目的是提出一种方法，用于在网络内以分布式方式虚拟化，部署和编排多个安全应用程序，以提高整体性能和弹性。我们最初的目标列表包括以下内容：研究和实现轻量级虚拟环境，可以运行在各种网络系统上，包括节点和交换机，并可以为安全应用程序提供所需的网络数据访问。此类虚拟环境目前受到底层操作系统（如Docker[11]）的限制，或者为嵌入式设备（如网络交换机）带来不必要的复杂性，如Java VirtualMachine[15][14]。研究各种部署策略，通过流分析、虚拟机迁移技术和拓扑覆盖分析来最大限度地提高性能4和弹性。研究表明，客户虚拟机在大型数据中心网络中的迁移和最佳放置可以提高整体资源使用率[16][4]，我们希望采用这种技术，以便在发生故障或攻击的情况下提高网络弹性。遵循与SDN相同的设计原则，这可以提高大型网络的可扩展性和灵活性;此外，它还提供了网络安全状态的全局视图，使管理员和开发人员能够轻松管理安全应用程序。目前使用SDN的尝试显示出严重的局限性[8]，所涉及的协议没有考虑到这种用例进行设计。分析、实施和部署概念验证应用程序，这些应用程序将利用网络内的现有本地性来实现弹性。为了验证正确的功能并证明我们对中间盒本地化（提供整体性能提升并允许按需扩展）和增强弹性的要求，需要执行众所周知的网络功能（例如防火墙，代理，入侵检测系统）的应用程序。这些应用程序必须利用上面提到的轻量级环境来证明可移植性和在嵌入式设备上的执行。