The SAVI testbed is a multi-tier SDN-enabled heterogeneous cloud created as an application enablement platform for academic research. It was developed to investigate the hypothesis that the entire infrastructure can be virtualized and abstracted as a service. Key to this investigation was the creation of a resource management system based on the concept of Software-Defined Infrastructure (SDI), which enables integrated control and management over heterogeneous resources and exposes a programmable interface for users. In this paper, we present our experiences in designing and deploying the Canadian national SAVI testbed, and discuss the various lessons learned along the way. In addition, we describe our ongoing work to enhance the testbed management system to meet the demands and challenges of the IoT era.

Intent-Driven Networking is recently gaining interest, with all major SDN control platforms now providing an intent Northbound Interface (NBI) as a high-level abstraction for network management. With these frameworks network operators can conveniently define “what needs to be done”, rather than “how it should be done”. Current IDN frameworks pose two main limitations that affect deployment in production grade and multi-domain networks. They are mainly concerned with a single network domain, and thus enabling end-to-end network intents over a multi-domain and large-scale setup is still a challenge. Furthermore, these frameworks do not consider any differentiation between user intents and provider intents, and a limited set of intent classes are available for both. In this paper we present MD-IDN, which provides an intent framework for the users of multi-domain cloud infrastructures. We first propose a graph-based abstraction model for user-defined intents and a generic intent compilation process. Then, we propose compilation algorithms to achieve scalability in multi-domain networks: First, user-defined intents get processed over an abstracted multi-graph of network domains and their interconnections, and a set of local intents will be generated for each of the involved domains. Afterwards, the local intents will be compiled and installed in local regions in parallel. MD-IDN is deployed as a public service in the SAVI Testbed over more than ten data centers spanning across Canada. In multi-domain environments, our experiments show that MD-IDN outperforms current practices that compile intents over a flat network topology.

With the growing pervasiveness of virtualization technologies, carrier networks are shifting from simple packet delivery platforms to multi-tenant integrated clouds offering fine-grained resource management. The need for interoperability among these autonomous cloud-based service providers has created demand for versatile and extensible exchange points to interconnect the future Internet. A novel SDX (Software Defined Exchange) can address this challenge and help redefine the Internet exchange by leveraging SDN. Current implementations of SDXs have focused on traffic exchange between conventional IP networks and have not been specifically intended for exchange between multi-tenant environments and virtual networks; and they have mostly relied on OpenFlow for network forwarding and functionality. While OpenFlow is the de-facto solution for fine-grained forwarding, it nevertheless provides limited network functionality. In this paper we present HyperExchange, a protocol-agnostic exchange fabric for peering of virtual networks. HyperExchange is designed to provide exchange services between autonomous Infrastructure Providers and their hosted Virtual Networks. As a result, it specifically offers solutions for inter-domain tenant authentication and authorization for network control. By leveraging SDI as the core building architecture, HyperExchange uses SDN to forward and steer traffic in a fine-grained manner and yet relies on NFV to push all network functionalities to standard servers as software-based functions. This solution meets both scalability and extensibility requirements for long-term use. We have deployed a prototype of the HyperExchange between SAVI and GENI testbeds to serve real world exchange experiments.

We demonstrate the peering of virtual networks between the SAVI and GENI testbeds using HyperExchange1, a software-defined exchange fabric. The exchange is deployed between the physical networks of the two testbeds. Specifically, a layer-two WAN including nodes in SAVI testbed is peered with a VLAN in GENI testbed without using encapsulation and overlays. Each of these testbeds has a different logic to create and manage layer-two networks, so this demonstration shows how the HyperExchange is protocol-agnostic and allows tenants to create networks across dissimilar networks.

With the advent of SDN, efforts on network virtualization have accelerated. Many concepts have been developed to enable the coexistence of multiple logical network domains on a shared networking infrastructure while also ensuring isolation between them. In this context, we envision a multi-tenant cloud environment that grants users the ability to dynamically alter the behaviour of the underlying network, thus achieving a truer sense of Infrastructure as a service. In this paper, we propose a method for providing users in multi-tenant cloud environments open APIs for installing custom flows into the network at layer 2 (L2). Our proposed system ensures tenant isolation while detecting possible flow-level conflicts that can lead to tenancy violations and to problems in end-to-end reachability. We prototyped our system on a nationwide testbed environment, which showed that our proposed method reduces flow-level conflict detection time over existing proposals from ms to μs scale.

Auto-scaling is a key challenge and benefit in cloud computing infrastructures where applications are deployed on one or more virtual machines (VMs) to balance efficiency in use against delivered performance. In different scenarios, there may be a need for either horizontal or vertical scaling. Therefore, scaling is an important operation of cloud management systems. One way to enable scaling as an automated service is to use a model to predict the VM's future state as a function of time. However, this method is not completely feasible, because the performance of a VM is so dynamic and depends on many parameters. A simpler approach to enable auto-scaling is to use real-time utilization data of VM's and a set of fixed thresholds to execute scaling when thresholds are crossed. However, this method is prone to false positive decisions. Uses this paper, we propose an adaptive method that uses threshold-based mechanisms to control the auto-scaling process and leverages the accuracy and precision given by threshold-based methods to reduce the number of false positives. We present performance results, comparing the fixed threshold methods with our proposed method. We show that our method frequently correctly triggers scaling process in situations where fixed threshold based measurement methods fail.

Cloudification, softwarization and edge processing are been heavily adopted to design, implement and deploy IoT applications at scale. Building upon our previous initiatives and incorporating the above-mentioned paradigm, we propose and demonstrate a hierarchical, programmable and autonomic IoT platform that deploys highly distributed, manageable and efficient IoT applications in a softwaredefined manner. The platform leverages both cloud microservices and macroservices to support big data, local/edge data processing, high level of programmability and runtime autonomic management.

In this demonstration we use a prototype of a Wireless Sensor Node along with a Software Defined Infrastructure to monitor the quality of the air in different classrooms at a University. Specifically, a number of wireless nodes are deployed in different classrooms. Each node has a number of sensors to monitor the air quality in the room. A number of relay nodes forward the data to a vCPE, which delivers the data to a Smart Edge. In the vCPE and the Smart Edge, a monitoring and analytic system, called MonArch, is used for collection, storage and analytic purposes of the monitoring data.

Performing system diagnosis is a critical task in modern datacenters. Investigating individual resource behavior may not be efficient in detecting abnormal behavior in large and complex datacenters. In this paper, we propose a scalable graph based diagnosis framework to detect system anomalies in Software-Defined Infrastructure running in SAVI testbed. We have leveraged Graph Mining and Machine Learning techniques in our approach in order to detect different kinds of anomalies. We have experimentally tested our framework on several use cases: Webserver-Database workload pattern, bandwidth throttling between a pair of VMs, denial-of-service (DoS) attack on a webserver and Spark Job failure. Our framework was able to detect the aforementioned anomalies accurately.

Real-time content delivery (RTCD) systems have become a prominent aspect of telecommunications as evidence by popularity of news-casting, real-time event subscription / publication and live media streaming. Unlike conventional content delivery systems, RTCDs need to deliver processed information to users in real time. This may require the network to handle some of the processing closer to the users to efficiently use the bandwidth consumed by the applications. The combination of Network Function Virtualization (NFV) and service chaining is a promising solution to address this challenge. Our work applies a service chaining algorithm to place NFV modules of an RTCD application in a Software Defined Infrastructure (SDI), where virtualized Customer Premise Edges (vCPEs), possessing scarce resources, are employed. We suggest containers to efficiently pack VNFs into vCPEs. Our objective is to maximize the total number of chains that can be serviced in the RTCD application. To optimally chain the NFV modules, a heuristic algorithm is proposed and evaluated. Using simulations, we show that our algorithm with the help of vCPEs can support higher number of users while providing high-level service quality.

Cloud data centers today use visualization technologies to facilitate allocation of physical resources to multiple applications. As cloud data centers continue to grow in scale and complexity, effectively monitoring and identifying system anomalies is becoming a critical problem. Furthermore, due to complex dependencies between system components in a virtualized data center, a single cause of anomaly can typically trigger multiple alarms. Therefore there is also a need to efficiently analyze and identify the causes of the anomalies in a scalable and effective manner, in order to reduce the overhead of diagnosis and troubleshooting performed by the cloud operator. Motivated by these observations, we present a mechanism for automatic anomaly detection and root cause analysis in virtualized cloud data centers. We first use unsupervised learning techniques to identify abnormal system behaviors, and then propose a technique for root cause analysis with consideration to anomaly propagation among system components. Using a real virtualized cloud testbed, we show that our mechanism efficiently identifies system anomalies and accurately determines their causes.

Network function visualization (NFV) has emerged as a promising paradigm in networking, where the hardware-based middleboxes are replaced with software-based virtualized entities typically running on the cloud to provide specific functionalities. By deploying NFV, network services become more adaptive and cost-effective. Many multicast services such as real-time multimedia streaming and intrusion detection require appropriate services chaining; however, NFVs placement in the network as well as traffic routing strategy to guarantee that the multicast flows traverse through the services chain before reaching the end user is still an open problem. In this paper, we present an algorithm to solve this problem.

We present a novel method of using cloud-based virtualized reconfigurable hardware to enhance the functionality of OpenFlow Software-Defined Networks. OpenFlow is a capable and popular SDN implementation, but when users require new or unsupported packet-processing, software processing in the OpenFlow controller cannot provide multi-gigabit rates. Our method sees packet flows redirected through virtualized hardware with custom-designed packet-processing engines that can add new capabilities to an OpenFlow network, while retaining line-rate processing. A case study shows this can be achieved with virtually no loss in throughput and minimal latency overheads.

Many multicast services such as live multimedia distribution and real-time event monitoring require constructing a multicast mechanism that involves network functions (e.g. firewall, video transcoding). Network Function Virtualization (NFV) is a concept that proposes using virtualization to implement network functions on infrastructure building block (such as high volume servers, virtual machines), where software provides the functionality of existing purpose-built network equipment. We present an approach for building the multicast mechanism whereby multicast flows are processed by NFV before reaching their end users. We propose a routing algorithm and a method for building an appropriate multicast topology.

Virtual machine (VM) migration occurs very frequently in cloud computing. VM Migration enables a running OS, including memory and storage to move from one physical host to another physical host. A particular case of interest is live migration where the process of migrating the full state from one OS to the other should happen continuously and without any connection disruption. In order to have a seamless VM migration process the system has to be able to resume network connectivity very quickly. Fast resumption has proved to be a challenging problem. In this paper, we present a scheme to efficiently to migrate VMs networking resources using SDN techniques to achieve fast network flow resumption on SDN. We formulate the problem by an integer programming problem, we prove its NP-completeness and we propose a heuristic algorithm to solve the problem. Software simulation and real testbed implementation are done to demonstrate the performance of the flow migration scheme.

We propose ViNO (Virtual Network Overlay), an orchestration service that can be used to create arbitrary network topologies with OVS (Open vSwitch) switches and VMs. ViNO connects switches and VMs through an overlay network using VXLAN encapsulation. ViNO provisions VMs by making API calls to the underlying platform. Users specify the desired topology using an expressive Domain Specific Language that allows users to easily express commonly used network topologies while hiding the underlying complexity. An important use case for ViNO is enabling the seamless migration of Linux services across VMs in different regions with very little downtime.

Programmability in wireless access networks can provide unprecedented flexibility in meeting the communications needs of a diverse set of wireless devices under changing demand and network conditions. Programmability also holds the promise of enabling multiple simultaneous virtual operators providing a variety of access networks that offer different services using different business models. In this paper we present our work on enabling wireless access network programmability in the SAVI testbed. We introduce an architecture for Software-Defined Infrastructure that offers virtualized heterogeneous resources in support of services and applications. Central to this architecture is the Janus SDI resource manager that can coordinate the actions of a set of controllers, e.g. OpenStack, OpenFlow, and other controllers such as a wireless access controller. We describe a design where Janus is used to integrate the wireless access network into a Smart Edge node. We introduce use cases that exploit the flexibility offered by this design, and we present experimental results from our implementation.

Software-Defined Infrastructure (SDI) presents an approach for integrated management of virtualized heterogeneous resources. Monitoring and measurement is an essential component for effective control and management. This paper presents an architecture of a system, named MonArch, based on SDI that provides integrated monitoring and measurement functionalities. Unlike existing cloud and network monitoring systems, MonArch supports execution of user-generated monitoring tasks, offers monitoring as a service to tenants, administrators as well as management modules, and provides a framework for monitoring data analytics. We have implemented and deployed MonArch in the SAVI Testbed, and our experience shows the system is able to support a wide variety of monitoring tasks while achieving high performance and scalability.

In this paper we introduce an architecture for wireless access on two-tiered heterogeneous clouds. We first discuss the concept of Software Defined Infrastructure (SDI), and role of Software Defined Radio in SDI, and review relevant literature. Next we present the architecture design for a Software Defined Wireless Access module in detail and provide measurements for the implemented solution. While the architecture introduced is capable of handling protocols such as LTE and WiFi, GSM is used for in our implementation.

In this paper we present an approach to implement security as a Virtualized Network Function (VNF) that is implemented within a Software-Defined Infrastructure (SDI). We present a scalable, flexible, and seamless design for a Deep Packet Inspection (DPI) system for network intrusion detection and prevention. We discuss how our design introduces significant reductions in both capital and operational expenses (CAPEX and OPEX). As proof of concept, we describe an implementation for a modular security solution that uses the SAVI SDI testbed to first detect and then block an attack or to re-direct it to a honey-pot for further analysis. We discuss our testing methodology and provide measurement results for the test cases where an application faces various security attacks.

Real-time content delivery services such as live media streaming, news casting and real-time event subscription/publication systems have become popular in recent years. Unlike traditional content delivery applications, real-time content delivery requires live content to be processed and delivered to end users in a timely and efficient manner. Furthermore, as both content producers and consumers may change over-time, it is a challenge to provision resources for these applications to achieve high service quality while minimizing total operational costs. Fortunately, the recent development of Cloud computing and Software Defined Networking (SDN) enables efficient implementation of real-time content delivery systems. Recently, the concept of Software Defined Infrastructure aims at combining Cloud computing and SDN to provide an unified framework for application deployment and management. In this paper, we present Kaleidoscope, an architecture for real-time content delivery in Software Defined Infrastructures. Kaleidoscope leverages network virtualization, SDN-based broadcasting and dynamic cloud resource provisioning to achieve high resource efficiency and service performance. Specifically, we present a resource management scheme that controls Cloud resource allocation and network configuration at run-time in accordance with service demand. Experiments show that Kaleidoscope is able to achieve lower resource cost while providing high service quality.

Many multicast services such as live multimedia distribution and real-time event monitoring require multicast mechanisms that involve network functions (e.g., firewall and video transcoding). Network function virtualization (NFV) is a concept that proposes using virtualization to implement network functions on infrastructure building block (such as high volume servers and virtual machines), where software provides the functionality of existing purpose-built network equipment. We present an approach for building the multicast mechanism whereby multicast flows are processed by NFV before reaching their end users. We propose a routing algorithm and a method for building an appropriate multicast topology.

We present a new approach for integrating virtualized FPGA-based hardware accelerators into commercial-scale cloud computing systems, with minimal virtualization overhead. Partially reconfigurable regions across multiple FPGAs are offered as generic cloud resources through OpenStack (opensource cloud software), thereby allowing users to “boot” custom designed or predefined network-connected hardware accelerators with the same commands they would use to boot a regular Virtual Machine. We propose a hardware and software framework to enable this virtualization. This is a first attempt at closely fitting FPGAs into existing cloud computing models, where resources are virtualized, flexible, and have the illusion of infinite scalability. Our system can set up and tear down virtual accelerators in approximately 2.6 seconds on average, much faster than regular virtual machines. The static virtualization hardware on the physical FPGAs causes only a three cycle latency increase and a one cycle pipeline stall per packet in accelerators when compared to a non-virtualized system. We present a case study analyzing the design and performance of an application-level load balancer using a fully implemented prototype of our system. Our study shows that FPGA cloud compute resources can easily outperform virtual machines, while the system's virtualization and abstraction significantly reduces design iteration time and design complexity.

This paper presents a novel architecture to manage identity and access (IAM) in a Multi-tier cloud infrastructure, in which most services are supported by massive-scale data centres over the Internet. Multi-tier cloud infrastructure uses tier-based model from Software Engineering to provide resources in different tires. In this paper we focus on design and implementation of a centralized identity and access management system for the multi-tier cloud infrastructure. First, we discuss identity and access management requirements in such an environment and propose our solution to address these requirements. Next, we discuss approaches to improve performance of the IAM system and make it scalable to billions of users. Finally, we present experimental results based on the current deployment in the SAVI Testbed. We show that our IAM system outperforms the previously proposed IAM systems for cloud infrastructure by factor 9 in throughput when the number of users is small, it handle about 50 times more requests in peak usage. Because our architecture is a combination of Green-thread and load balanced process, it uses less systems resources, and easily scales up to address high number of requests.

In this paper we discuss how to enable Software-Defined Networking (SDN) applications on Software-Defined Infrastructure (SDI) which is an approach for integrated control and management of converged computing and networking resources. Current separated resource management for computing or networking resources is not sufficient for addressing applications and multimedia services that require guaranteed service and quality levels. In addition, current resource management is not capable of managing heterogeneous resources that include computing and networking resources in combination with other resources such as programmable hardware, GPUs and network processors. We present an SDI that provides pluggable resource management modules for scheduling, networking control, fault management, and so on. This paper focuses on the design and implementation of a networking control module that enables SDN applications using information available from other modules. Currently, we have deployed the network control module in the practical multi-tier cloud infrastructure, SAVI Testbed. We present real measurements that show the functional evaluation results of our network control module.

We present a Distributed Ethernet Traffic Shaping (DETS) system for regulating the flow of data when multiple virtual machines run on one host and share a single Ethernet link to send and receive traffic in a cluster or a data center. In such settings, virtual machines can undermine each other's ability to receive traffic on the shared link. In DETS, sending machines monitor and regulate their transmission rates to conform to target rates. The DETS system is implemented in the host system, and there is no need to change or modify any processing or networking hardware. We describe an implementation on a Linux-based cluster, and through experimental performance evaluations, we show that DETS can guarantee the access rate of virtual machines. We also describe modifications to the Ethernet control plane so that DETS can be natively supported in Ethernet networks.

Application creation through service composition is a cornerstone for several architectures including Service-Oriented Architecture. As the number and diversity of applications created based on this paradigm increase, the need for guaranteeing quality of service becomes more important. In this paper, we present a distributed algorithm for guaranteeing a specified level of application completion probability. The algorithm is designed to control service commitments in both queue-less and queue-enabled service-oriented systems. The algorithm does not assume a specific distribution type for service execution times and application request inter-arrival times, and hence is suitable for systems with stationary or non-stationary request arrivals. We show that the proposed distributed algorithm achieves its performance objectives for both queue-less and queue-enabled service oriented systems.

In a service oriented environment an application is created through the composition of different service components. In this paper, we investigate the problem of application admission control in a service oriented environment. We propose an admission control system that makes admission decisions using an online optimization approach. The core part of the proposed system is an online optimization algorithm that solves a binary integer programming problem which we formulate in this paper. An online optimizer maximizes the system revenue given the system's available resources as well as the system's previous commitments. Another part of the proposed system carries out a feasibility evaluation that is intended to guarantee an agreed level of probability of success for each admitted application instance. We use simulations and performance comparisons to show that the proposed application admission control system can improve the system revenue while guaranteeing the required level of quality of service.

In this paper, we extend our previous work on committing service instances to the applications in a service-oriented environment, and we propose a distributed heuristic algorithm which is able to estimate the number of future service instances needed by each application instance in a future time. Also, this algorithm does not assume any specific type of distribution function for services execution time and applications interarrival time. In this paper, after presenting the mathematical basis for the proposed distributed algorithm, we explain how this algorithm can be implemented in a distributed environment, and through the simulations and performance comparisons, we show that the proposed algorithm improves the performance of the system significantly, compared to a No commitment policy system and a full commitment policy system.