The adoption of virtualization and cloud computing technologies have revolutionized how services and applications can be developed, deployed, and operated to achieve better elasticity, flexibility, and scalability. Multiple stakeholders can be involved for providing online services; each of them plays one or more roles (i.e., service operator, application vendor, and infrastructure provider) to create a customized operating model based on the business requirements. The operating model changes from one business to another, and it may even change at different stages of the same business. A trusted relationship among stakeholders for secure information exchange is the key to enable such flexibility. However, traditional usage compliance methods (e.g., in-person audit, dynamic licensing, and subscription) lack explicit trust among involved parties and the flexibility and scalability to support dynamic sizing of services and applications with low overhead. In this work, we argue the need for a new trust framework to manage application usage rights and propose Metered Boot to provide trusted, capacity/usage-based usage rights management for services and applications deployed in virtualized environments. Metered Boot decouples application workload instantiation for service operators, usage rights governance for application vendors, and resource provisioning for infrastructure providers. We leverage cryptoprocessors (e.g., Trusted Platform Module (TPM)) on commodity servers to generate trusted proofs which are managed by efficient cryptographic construction, Merkle hash tree, for usage rights compliance. We integrated our framework with OpenStack and demonstrate that Metered Boot is able to achieve high scalability and low overhead for instantiating virtual network functions (VNFs).

Intent-Based Networking (IBN) has been increasingly deployed in production enterprise networks. Automated network configuration in IBN lets operators focus on intents- i.e., the end to end business objectives-rather than spelling out details of the configurations that implement these objectives. Automation brings its own concerns as the administrators cannot rely on traditional network troubleshooting tools. This situation is further exacerbated in the case of stateful Network Functions (NFs) whose packet processing behavior depends on previously observed traffic patterns. To ensure that the network configuration and state derived from network automation matches the administrator’s specified intent, we propose, Epinoia, a network intent checker for stateful networks. Epinoia relies on a unified model for NFs by leveraging the causal precedence relationships that exist between NF packet I/Os and states. Scalability of Epinoia is achieved by decomposing intents into sub-checking tasks and maintaining a causality graph between checked invariants. Epinoia checks for network-wide intent violations incrementally to reduce overhead in the event of network changes. Our evaluation results using real-world network topologies show that Epinoia can perform comprehensive checking within a few seconds per network with intent updates.

The Softwarization of networks is enabled by the SDN (Software-Defined Networking), NV (Network Virtualization), and NFV (Network Function Virtualization) paradigms, and offers many advantages for network operators, service providers and data-center providers. Given the strong interest in both industry and academia in the softwarization of telecommunication networks and cloud computing infrastructures, a series of special issues was established in IEEE Transactions on Network and Service Management, which aims at the timely publication of recent innovative research results on the management of softwarized networks.

Existing network policy abstractions handle basic group based reachability and access control list based security policies. However, QoS policies as well as dynamic policies are also important and not representing them in the high level policy abstraction poses serious limitations. At the same time, efficiently configuring and composing group based QoS and dynamic policies present significant technical challenges, such as (a) maintaining group granularity during configuration, (b) dealing with network-bandwidth contention among policies from distinct writers and (c) dealing with multiple path changes corresponding to dynamically changing policies, group membership and end-point mobility. In this paper we propose Janus, a system which makes two major contributions. First, we extend the prior policy graph abstraction model to represent complex QoS and dynamic tateful/temporal policies. Second, we convert the policy configuration problem into an optimization problem with the goal of maximizing the number of satisfied and configured policies, and minimizing the number of path changes under dynamic environments. To solve this, Janus presents several novel heuristic algorithms. We evaluate our system using a diverse set of bandwidth policies and network topologies. Our experiments demonstrate that Janus can achieve near-optimal solutions in a reasonable amount of time.

Today's cloud infrastructure is often overwhelmed by inputs from multiple users and administrators for enforcing the policies on which to run cloud services, and infrastructure administrators need to configure policies on different resource types such as compute, network, etc. Such complex policy enforcement decisions from multiple users could result in errors and conflicts. To mitigate such complexities in managing cloud infrastructure, there is a strong push towards decoupling high level intents (“what” should be done) from the underlying infrastructure implementations (“how” to do it). Unlike existing solutions which resolve conflicts at low level during run-time, intent-based systems aim to resolve potential conflicts at the intent specification level. To efficiently handle large scale cloud environments, we propose a Label Management Service (LMS) which provides meaningful abstractions and their relationships by analyzing target cloud infrastructure. It helps the cloud administrators to model their policy requirements efficiently by decoupling the intents from underlying specifics. LMS scales to large dynamic cloud environments and manages the life cycle of label-based intent and enforcement.

Network verification has been recently proposed to detect network misconfigurations. Existing work focuses on the reachability. This paper proposes a framework that verifies the Service Level Agreement (SLA) compliance of the network using static verification. This work proposes a quantitative model and a set of algorithms for verifying performance properties of a network with switches and middleboxes, i.e., service chains. We develop SLA-Verifier and evaluate its efficiency using simulation on real-world data and testbed experiments. To improve the SLA violation detection accuracy, our system uses verification results to optimize online monitoring.

We present Policy Graph Abstraction (PGA) that graphically expresses network policies and service chain requirements, just as simple as drawing whiteboard diagrams. Different users independently draw policy graphs that can constrain each other. PGA graph clearly captures user intents and invariants and thus facilitates automatic composition of overlapping policies into a coherent policy.

Software Defined Networking (SDN) and cloud automation enable a large number of diverse parties (network operators, application admins, tenants/end-users) and control programs (SDN Apps, network services) to generate network policies independently and dynamically. Yet existing policy abstractions and frameworks do not support natural expression and automatic composition of high-level policies from diverse sources. We tackle the open problem of automatic, correct and fast composition of multiple independently specified network policies. We first develop a high-level Policy Graph Abstraction (PGA) that allows network policies to be expressed simply and independently, and leverage the graph structure to detect and resolve policy conflicts efficiently. Besides supporting ACL policies, PGA also models and composes service chaining policies, i.e., the sequence of middleboxes to be traversed, by merging multiple service chain requirements into conflict-free composed chains. Our system validation using a large enterprise network policy dataset demonstrates practical composition times even for very large inputs, with only sub-millisecond runtime latencies.

This paper presents a novel architecture to manage identity and access (IAM) in a Multi-tier cloud infrastructure, in which most services are supported by massive-scale data centres over the Internet. Multi-tier cloud infrastructure uses tier-based model from Software Engineering to provide resources in different tires. In this paper we focus on design and implementation of a centralized identity and access management system for the multi-tier cloud infrastructure. First, we discuss identity and access management requirements in such an environment and propose our solution to address these requirements. Next, we discuss approaches to improve performance of the IAM system and make it scalable to billions of users. Finally, we present experimental results based on the current deployment in the SAVI Testbed. We show that our IAM system outperforms the previously proposed IAM systems for cloud infrastructure by factor 9 in throughput when the number of users is small, it handle about 50 times more requests in peak usage. Because our architecture is a combination of Green-thread and load balanced process, it uses less systems resources, and easily scales up to address high number of requests.

In this paper we discuss how to enable Software-Defined Networking (SDN) applications on Software-Defined Infrastructure (SDI) which is an approach for integrated control and management of converged computing and networking resources. Current separated resource management for computing or networking resources is not sufficient for addressing applications and multimedia services that require guaranteed service and quality levels. In addition, current resource management is not capable of managing heterogeneous resources that include computing and networking resources in combination with other resources such as programmable hardware, GPUs and network processors. We present an SDI that provides pluggable resource management modules for scheduling, networking control, fault management, and so on. This paper focuses on the design and implementation of a networking control module that enables SDN applications using information available from other modules. Currently, we have deployed the network control module in the practical multi-tier cloud infrastructure, SAVI Testbed. We present real measurements that show the functional evaluation results of our network control module.

Providing bandwidth guarantees to specific applications is becoming increasingly important as applications compete for shared cloud network resources. We present CloudMirror, a solution that provides bandwidth guarantees to cloud applications based on a new network abstraction and workload placement algorithm. An effective network abstraction should enable applications to easily and accurately specify their requirements, while simultaneously enabling the infrastructure to provision resources efficiently for deployed applications. Prior research has approached the bandwidth guarantee specification by using abstractions that resemble physical network topologies. We present a contrasting approach of deriving a network abstraction based on application communication structure, called Tenant Application Graph or TAG. CloudMirror also incorporates a new workload placement algorithm that efficiently meets bandwidth requirements specified by TAGs while factoring in high availability considerations. Extensive simulations using real application traces and datacenter topologies show that CloudMirror can handle 40% more bandwidth demand than the state of the art (e.g., the Oktopus system), while improving high availability from 20% to 70%.

Large and various amounts of context data related to a user's environment are available from different domains including mobile devices, smarthomes, wearable sensors, and social networking services. These context domains are interconnected and the context data from them can be shared thanks to mobile, pervasive, convergent, and ubiquitous technologies. We can provide user-centric context-aware services by aggregating and associating the diverse types of context data distributed over multiple domains around a user. However, state-of-the-art research efforts have been devoted to managing context only in a single domain. In this paper, for user-centric context management, we propose 1) a flexible and extensible technology-neutral information model that can represent generic concepts of context; 2) a hierarchical context management architecture that can understand and manage complex interactions among multiple contextual entities.

This paper presents an efficient fault management approach based on cognitive control loops in order to support autonomic network management for the Future Internet. The cognitive control loops determines urgency of network alarms, processes urgent alarms more quickly, and then infers root causes of the problems based on learning and reasoning. We show that we reduce a number of alarms by correlation and detect alarm priorities using an ontology model based on the policy.

Recently, mobile traffic has increased tremendously due to the deployment of smart devices such as smartphones and smart tablets. These devices use various types of access networks such as 3G, WiFi, and mobile WiMAX. Network service providers also provide these access networks with various types of plans. There is a growing need to manage these smart devices and mobile networks. However, research on mobile network management has focused on the performance of the network itself. Few research has focused on applying the usage patterns of smartphone users to mobile network management. In this paper, we present an analysis of smartphone usage patterns. We define the five possible states of a smartphone based on such a phone's basic operations. We collected real usage log data from real smartphone users over a two month period. We show that all users have their own usage pattern. We present a case study in order to show how to apply usage pattern information to power management of smartphones. We also discuss how to apply such information to mobile device management and network management.

Since the IEEE 802.16 first standard was proposed in 2004 to provide broadband wireless service, the standard has not only been widely studied, but also broadly commercialized. The current IEEE 802.16-2009 standard document specifies five Quality of Service classes. As is typical with most standards, IEEE 802.16 does not require the use of a specific scheduler. In this paper, we first evaluate the performance of four popular schedulers. By analyzing the results, we highlight that no single scheduler type performs the best in all traffic situations; however, we shown that there exist the most favorable scheduler type in each situation. Based on this rationale, our idea is to propose an adaptive scheduling schema where the scheduler is dynamically chosen based on the current traffic context, such as the number of flows of each Quality of Service class. We investigate this approach and evaluate its performance against existing static schemas. The results show that our approach presents some interesting performances in terms of throughput, delay, and packet loss ratio regarding state of art approaches.

IPTV is emerging as a new service that can be very lucrative for telecommunication service providers. In addition, work is progressing to make IPTV an entertainment platform that can replace traditional TV for customers. Guaranteeing service quality is one of the most important factors to make IPTV services successful. For this, an IPTV service provider and a customer make a contract that uses specific quality indicators in a Service Level Agreement (SLA). To efficiently manage and guarantee SLAs, a method is required that can manage all hierarchical performance indicators from raw device level performance indicators to key quality indicators. In this paper, we analyze various IPTV performance indicators from various standard organizations and suggest an IPTV performance indicator hierarchy by extending the DEN-ng information model. Then, we propose an architecture that uses an ontology and Semantic Web Rule Language to manage SLAs, and more specifically, to detect SLA violations. The proposed architecture is implemented and tested using a simple scenario. The test results showed a possibility that the architecture can be used for detecting SLA violations.