SYNC: Synergistic Network Policy Management for Cloud Data Centres

所有计算机网络，包括云数据中心网络，都受到源自全网要求的高级策略的管理，例如“文件服务器应只能通过内部IP(互联网协议)地址访问”。在部署时，单个策略被实现为网络分组处理规则的组合(或链)，这些规则将被放置在网络内的特定网络功能框中。传统上，实现网络策略是一个容易出错的手动配置过程。软件定义联网(SDN)和网络功能虚拟化(NFV)等新兴技术通过软件自动化在很大程度上消除了手动配置的需要。然而，SDN和NFV的使用导致了更多独立的网络节点，它们分别动态地生成和执行策略规则，使得正确的策略实施成为一个难以解决的问题。更糟糕的是，云数据中心中的动态虚拟机(VM)整合放大了这个问题，因为迁移VM意味着还必须在整个网络上更新“指定的顺序”。不完善的策略实施将导致违反策略，这归因于78%的数据中心停机时间，每分钟的成本为5,600美元(3,758 GB)。这证明了协同放置网络策略规则和应用程序虚拟机的必要性，如同步项目假设中所述：云数据中心的基础设施配置和利用率以及应用程序性能在很大程度上取决于网络策略规则和应用程序虚拟机的放置。在这个项目中，我们提出了一种协作式网络策略管理框架SYNC的开发，它将平衡a)策略规则、b)应用和c)底层时态网络状态之间的协同，以实现网络范围内的性能优化。为了实现同步，将进行以下研究和开发工作：i)。高级网络策略表达式将被分解成网络范围内一致的规则链的最小集合，这些规则链又在不同网络位置的网络功能盒中实现，例如中间盒、网络交换机和终端主机。Ii)。将利用底层网络状态来(重新)安排应用程序虚拟机和规则，以便将成对流量模式对整个网络的影响降至最低。这一创新中的关键挑战将是底层基础设施的规模，该基础设施可以拥有多达一百万台虚拟机和数百万条规则。我们将构建合适的模型和高效的算法，结合SDN和NFV来克服这一挑战。我们打算在著名的期刊和会议上发表研究成果，开放访问研究数据，并将我们的知识产权商业化。

All computer networks, including cloud data centre networks, are governed by high-level policies derived from network-wide requirements, such as "file servers should only be accessible by internal IP (Internet Protocol) addresses". Upon deployment, an individual policy is realised as a composition (or chain) of network packets processing rules that will be placed in a specified sequence of network function boxes within the network.Traditionally, implementing network policy is an error-prone manual configuration process. Emerging technologies such as Software-Defined Networking (SDN) and Network Function Virtualisation (NFV) have largely eliminated the need of manual configuration through software automation. Nevertheless, the use of SDN and NFV have resulted in greater number of independent network nodes that dynamically generate and implement policy rules respectively, making correct policy implementation a hard problem to solve. Worse still, this problem is amplified by the dynamic virtual machine (VM) consolidation in cloud data centre since migrating VMs means that the "specified sequence" must also be updated across the network. Imperfect policy implementation will lead to policy violation that attributes to 78% of data centre downtime, which costs $5,600(£3,758) per minute. This demonstrates the necessity of synergistic placement of network policy rules and application VMs, as captured in the SYNC project hypothesis: Infrastructural configuration and utilisation as well as application performance of cloud data centres is largely dictated by the placement of network policy rules and application virtual machines. This is in contrast to the existing approaches which either only consider static rules placement, or perform dynamic placement without taking into account the application VMs.In this project, we propose the development of SYNC, a synergistic network policy management framework that will lever synergy amongst a) policy rules, b) applications and c) underlying temporal network state for achieving network-wide performance optimisation. In order to realise SYNC, the following research and development tasks will take place: i). The high-level network policy expressions will be decomposed into minimum set of network-wide consistent chains of rules, which are in turn implemented in network function boxes at different network locations, e.g. middleboxes, network switches, and end hosts. ii). The underlying network state will be exploited to (re)arrange application virtual machines and rules so that the network-wide impact of pairwise traffic patterns is minimised. The key challenge in this innovation will be the scale of the underlying infrastructure, which can have up to a million VMs and millions of rules. We will construct appropriate models and efficient algorithms, combined with SDN and NFV overcome this challenge. We intend to publish research outcome in prestigious journals and conferences, provide open-access to the research data, and commercialise our intellectual property.