SYNC: Synergistic Network Policy Management for Cloud Data Centres

所有计算机网络，包括云数据中心网络，都受源于全网要求的高级政策管理，例如“文件服务器只能由内部IP（互联网协议）地址访问”。在部署时，单个策略被实现为网络数据包处理规则的组合（或链），这些规则将被放置在网络中指定的网络功能盒序列中。传统上，实现网络策略是一个容易出错的手动配置过程。软件定义网络（SDN）和网络功能虚拟化（NFV）等新兴技术通过软件自动化在很大程度上消除了手动配置的需要。然而，SDN和NFV的使用导致了大量独立的网络节点，这些节点分别动态地生成和执行策略规则，使得正确执行策略成为一个难题。更糟糕的是，这个问题被云数据中心中的动态虚拟机（VM）整合放大了，因为迁移VM意味着“指定的序列”也必须在整个网络中更新。不完善的政策执行将导致政策违规，导致78%的数据中心停机，每分钟损失5600美元（3758英镑）。这证明了网络策略规则和应用程序虚拟机协同放置的必要性，正如SYNC项目假设中所捕获的那样：云数据中心的基础设施配置和利用以及应用程序性能在很大程度上取决于网络策略规则和应用程序虚拟机的放置。这与现有的方法相反，现有的方法要么只考虑静态规则放置，要么在不考虑应用程序vm的情况下执行动态放置。在这个项目中，我们建议开发SYNC，这是一个协同网络策略管理框架，它将利用a)策略规则，b)应用程序和c)底层时态网络状态之间的协同作用，以实现网络范围的性能优化。为了实现SYNC，将进行以下研究和开发任务：i)。高级网络策略表达式将被分解为最小的全网范围一致的规则链集，这些规则链依次在不同网络位置的网络功能盒中实现，例如中间盒、网络交换机和终端主机。(二)。底层网络状态将被用来（重新）安排应用程序虚拟机和规则，以便将成对流量模式的网络范围影响降到最低。这种创新的关键挑战将是底层基础设施的规模，它可以拥有多达一百万个虚拟机和数百万条规则。我们将构建合适的模型和高效的算法，结合SDN和NFV克服这一挑战。我们打算在知名期刊和会议上发表研究成果，提供研究数据的开放访问，并将我们的知识产权商业化。

All computer networks, including cloud data centre networks, are governed by high-level policies derived from network-wide requirements, such as "file servers should only be accessible by internal IP (Internet Protocol) addresses". Upon deployment, an individual policy is realised as a composition (or chain) of network packets processing rules that will be placed in a specified sequence of network function boxes within the network.Traditionally, implementing network policy is an error-prone manual configuration process. Emerging technologies such as Software-Defined Networking (SDN) and Network Function Virtualisation (NFV) have largely eliminated the need of manual configuration through software automation. Nevertheless, the use of SDN and NFV have resulted in greater number of independent network nodes that dynamically generate and implement policy rules respectively, making correct policy implementation a hard problem to solve. Worse still, this problem is amplified by the dynamic virtual machine (VM) consolidation in cloud data centre since migrating VMs means that the "specified sequence" must also be updated across the network. Imperfect policy implementation will lead to policy violation that attributes to 78% of data centre downtime, which costs $5,600(£3,758) per minute. This demonstrates the necessity of synergistic placement of network policy rules and application VMs, as captured in the SYNC project hypothesis: Infrastructural configuration and utilisation as well as application performance of cloud data centres is largely dictated by the placement of network policy rules and application virtual machines. This is in contrast to the existing approaches which either only consider static rules placement, or perform dynamic placement without taking into account the application VMs.In this project, we propose the development of SYNC, a synergistic network policy management framework that will lever synergy amongst a) policy rules, b) applications and c) underlying temporal network state for achieving network-wide performance optimisation. In order to realise SYNC, the following research and development tasks will take place: i). The high-level network policy expressions will be decomposed into minimum set of network-wide consistent chains of rules, which are in turn implemented in network function boxes at different network locations, e.g. middleboxes, network switches, and end hosts. ii). The underlying network state will be exploited to (re)arrange application virtual machines and rules so that the network-wide impact of pairwise traffic patterns is minimised. The key challenge in this innovation will be the scale of the underlying infrastructure, which can have up to a million VMs and millions of rules. We will construct appropriate models and efficient algorithms, combined with SDN and NFV overcome this challenge. We intend to publish research outcome in prestigious journals and conferences, provide open-access to the research data, and commercialise our intellectual property.