Virtual private networks (VPNs) feature notable characteristics in structure and traffic patterns that can be exploited by the service provider to achieve significant capacity savings. Efficient provisioning of point-to-point connections using statistical admission control is well understood. However, provisioning a VPN involves provisioning a set of point-to-multipoint connections and features an additional dimension in the form of a traffic matrix. Consequently we have multiple network mechanisms that are important for efficient operation: a) admission control, b) signaling-based per-link reservations, c) traffic matrix estimation. In this paper we examine the relative importance of mechanisms that positively affect the operational efficiency in the context of VPN provisioning. Using insights from our extensive measurement based study on the structural properties usually observed in VPNs, we build a simulation framework to quantify the trade-offs in opting for one mechanism over the other. We arrive at our conclusions with the help of simulations featuring a variety of VPN structures and network topologies. We find that the structural characteristics of VPNs cause traffic matrix estimation to be a dominant factor in determining the utilization gains. Consequently, we find that deploying statistical techniques might not be worth the effort if the traffic matrix is not incorporated. While signaling-based reservation mechanisms lead to higher utilization, edge-based techniques prove to be lot more scalable and simpler to realize. We explore the means to reduce the performance penalty associated with such simpler techniques.

Virtual Private Networks provide secure and reliable communication between customer sites. With increase in number and size of VPNs, providers need efficient provisioning techniques that adapt to customer demand by leveraging a good understanding of VPN properties.In this paper we analyze two important properties of VPNs that impact provisioning - (a) structure of customer endpoint (CE) interactions and (b) temporal characteristics of CE-CE traffic. We deduce these properties by computing traffic matrices from SNMP measurements. We find that existing traffic matrix estimation techniques are not readily applicable to the VPN scenario due to the scale of the problem and limited measurement information. We begin by formulating a scalable technique that makes the most out of existing measurement information and provides good estimates for common VPN structures.We then use this technique to analyze SNMP measurement from a large IP VPN service provider. We find that even with limited measurement information we can realize adaptive provisioning for a significant fraction of VPNs, namely, those constituting the Hub-and-Spoke category. In addition, the ability to infer the structure of VPNs holds special significance for provisioning tasks arising from topology changes, link failures and maintenance. We are able to provide a classification of VPNs by structure and identify CEs that act as hubs of communication and hence require prioritized treatment during restoration and provisioning.

Virtual Private Networks (VPNs) feature notable characteristics in structure and traffic patterns that allow for efficient resource allocation. A strategy that exploits the underlying characteristics of a VPN can result in significant capacity savings to the service provider. There are a number of admission control and bandwidth provisioning strategies to choose from. We examine tradeoffs in design choices in the context of distinctive characteristics of VPNs. We examine the value of signaling-based mechanisms, traffic matrix information and structural characteristics of VPNs in the way they impact resource utilization and service quality. We arrive at important conclusions which could have an impact on the way VPNs are architected. We show that the structure of VPNs profoundly influences achievable resource utilization gains with various admission control and provisioning schemes.

In this paper we propose an edge-based quality of service (QoS) architecture aimed at site-to-site private networks over the Internet. We extend the traditional point-to-point service model to a point-to-set service model, assuming a finite, bounded set of destination sites. A point-to-set service allows a user to have a pool of premium tokens, which could be flexibly assigned to traffic going towards any destination within the set. The proposed point-to-set service provides statistical assurances and flexibility to users while allowing providers to obtain multiplexing gains. To realize the point-to-set service model, we introduce edge-based dynamic bandwidth tracking and provisioning schemes. The tracking algorithm predicts demand towards a given destination edge. This information is used to efficiently allocate bandwidth towards the destinations in the set. Simulation results are presented to demonstrate the merits of the proposed architecture in terms of cost savings to the customer and efficient resource utilization to the provider.