Dynamic VPN Optimization by ALTO Guidance

Chapter 59 - Virtual Private Networks

Hose-model virtual private networks (VPNs) provide customers with more flexibility in specifying bandwidth requirements than pipe-model VPNs. Many hose-model VPN provisioning algorithms have been proposed, and they focus on the bandwidth efficiency in the construction of a single hose-model VPN. In practice, however, VPNs come and go and the dynamics will affect the performance of these VPN provisioning algorithms. If the frequency of adding and deleting VPNs is high, these algorithms will have a scalability problem. We propose in this paper a new network architecture for dynamic VPN construction. In the proposed architecture, adding a new VPN is much simpler and faster, and all that is required is to check if the edge routers have enough bandwidth. There is no need to check the bandwidth left on each internal link because the architecture guarantees that as long as the edge routers have enough capacities to accept the VPN, the internal links will never experience overflow caused by adding the new VPN. We present a linear programming formulation for finding the optimal routing that maximizes the amount of admissible VPN traffic in the network. We then exploit the underlying network flow structure and convert the linear programming problem into a subgradient iterative search problem. The resulting solution is significantly faster than the linear programming approach.

The cost minimization of virtual private networks (VPN) that use the resources of an underlying transport network is the key factor for their successful implementation. The investigation in this paper is focused on 'network based VPNs', where the operation of the VPN is outsourced to an Internet Service Provider (ISP). The interest in such solutions is generated both by customers seeking to reduce support costs and by ISPs seeking new revenue sources. Solving the cost minimization would allow Internet service providers (ISPs) to define and deploy new VPN services. The basic building block of VPN is the tunnel. A tunnel operates as an overlay across the backbone, and the traffic sent through the tunnel is opaque to the underlying backbone. A VPN end point can terminate multiple tunnels or forward packets between different tunnels. Different tunnels can share the same physical link and traffic belonging to the same VPN tunnel can be carried along different physical links. The multiplexing and management of the VPN tunnels is made possible by core routers supporting the VPN of the underlying network. The novelty of the presented work is the network flow model of VPN mapping on the underlying ISP network. We assume that the VPN topology, the topology of the ISP network and the total utilization cost for all underlying links are known parameters. Based on this, we propose a network management system based on a network flow optimization in order to define the minimal cost link allocation for the VPN tunnels. We provide a simulation of the proposed optimal establishment of VPN tunnels and performance evaluation of the simulation results.

Multi Protocol Label Switching (MPLS) Virtual Private Networks (VPNs) have seen an unparalleled increasing adoption in the last decade. Although their flexibility as transport technology and their effectiveness for traffic engineering are well recognized, VPNs are difficult to set up and manage, due to the complexity of configurations, to the number of involved protocols, and to the limited control and predictability of network behaviors. On the other hand, Software-Defined Networking (SDN) is a consolidated, yet still emerging paradigm by which the control plane logic of a network device is implemented by an arbitrarily programmed software that runs outside the device itself. We conjugate the effectiveness of traditional VPNs with the programmability of SDN, proposing a novel and improved realization of MPLS VPNs based on SDN. With our approach, provisioning and setup of VPNs are accomplished by using a simple and flexible configuration language. Management and troubleshooting are facilitated because only a minimal set of technologies (notably, just MPLS) is retained. Control and predictability of network behaviors are enhanced by the centralized coordination enforced by the SDN controller. Besides illustrating our proposed approach and specifying the configuration language, we describe a prototype implementation of a controller and the outcome of tests we conducted in several configuration scenarios.

The Locator/ID Separation Protocol (LISP) is being standardized in IETF, which separates the IP address functionality into routing locators (RLOC) and endpoint identifiers (EID). LISP is applicable for instant Virtual Private Network (VPN) services because it has IP tunneling features. However, there are two main issues with application to VPN. One is a Map server/Map resolver (MS/MR) basically allows any third party to know a mapping table even if it is irrelevant to the VPN. The other is an MS/MR should identify the VPN to which the requested site belongs because the requested EIDs can be private addresses and may overlap with other VPN sites. A simple solution is to deploy an independent MS/MR for every VPN. However, this is undesirable from a cost perspective. We present a new LISP-MS/MR that provides a large number of VPN services using a single set. This MS/MR creates a logically separated EID-to-RLOC mapping table for each VPN and selects an appropriate type according to the requesting VPN site. To ensure this, our scheme uses Authentication data included in the Map register for an initial VPN identification of the registering site and associates the identified VPN ID with the registered RLOC. In following Map requests, the appropriate mapping table for the requesting VPN site is selected based on its RLOC. We confirmed the basic network functions of VPN using the prototype system. The results of scalability tests show that our MS/MR completes the transaction for nearly-simultaneous 10,000 Map registers or requests within three seconds.

Virtual private networks (VPN) and link sharing are cost-effective ways of realizing corporate intranets. Corporate intranets will increasingly have to provide integrated services for voice and multimedia traffic. Although packet scheduling algorithms can be used to implement integrated services in link sharing and virtual private networks, their statistical multiplexing gains are limited. We propose a new scheme called stochastic fair sharing (SFS) to carry out fair link sharing and fair sharing among virtual leased links (VLL). In the link sharing environment, capacities allocated to different classes are adjusted dynamically as sessions arrive (or depart). The SFS admission control algorithm decides which sessions to accept and which to reject depending upon the current utilizations and provisioned capacities of the classes. SFS gives protection to classes with low session arrival rate against classes with high session arrival rates by ensuring them a low blocking probability. In the case of multi-hop VLL, capacity resizing requests are sent in the service providers's network which are admission-controlled using SFS. Our simulations indicate that using SFS, the equivalent capacity of virtual links converge to their max-min fair capacity, with a fairness index of 0.97 in extreme situations. The average signaling load of the protocol was found to be reasonable. The scheme is simple to implement, efficient, and robust. The potential applications of SFS are fair and efficient resource sharing in telecommunication networks, ATM networks, virtual private networks (VPN) and integrated services or differentiated services-based IP networks.

A virtual private network (VPN) is an overlay network that uses the public network to carry data traffic between corporate sites and users, maintaining privacy through the use of tunnelling protocols and security procedures. In the network-based model, VPN-aware network elements are placed within the network to set up concatenated tunnels between the user/site and enterprise resources to offer intranet VPN and remote access VPN. This paper identifies the important differences between a traditional VPN and the mobile VPN and proposes a hierarchical network architecture to efficiently realize network-based mobile VPNs. We address the problem of optimally provisioning VPN-aware devices, called IP service gateways (IPSGs), in the hierarchical network architecture for mobile VPNs, while taking into account of (1) the cost of links over which VPN tunnels are established, (2) the cost of provisioning a VPN customer on an IPSG, and (3) redundancy in IPSG provisioning for fault tolerance. We develop generic yet powerful problem formulations for different scenarios described above while considering practical requirements of the network elements and business requirements of the VPN service provider. The formulation becomes a set of integer programming problems. We solve several instances of the problem for a few practical cases and discuss their applications in the overall network design.

With the rapid development of Virtual Private Network (VPN), many companies and organizations use VPN to implement their private communication. Traditionally, VPN uses security protocols to protect the confidentiality of data, the message integrity and the endpoint authentication. One core technique of VPN is tunneling, by which clients can access the internal servers traversing VPN. However, the tunneling technique also introduces a concealed security hole. It is possible that if one vicious user can establish tunneling by the VPN server, he can compromise the internal servers behind the VPN server. So this paper presents a novel Application-layer based Centralized Information Access Control (ACIAC) for VPN to solve this problem. To implement an efficient, flexible and multi-decision access control model, we present two key techniques to ACIAC—the centralized management mechanism and the stream-based access control. Firstly, we implement the information center and the constraints/events center for ACIAC. By the two centers, we can provide an abstract access control mechanism, and the material access control can be decided dynamically by the ACIAC's constraint/event mechanism. Then we logically classify the VPN communication traffic into the access stream and the data stream so that we can tightly couple the features of VPN communication with the access control model. We also provide the design of our ACIAC prototype in this paper.

We propose an all-optical virtual private network (VPN) system in an orthogonal frequency division multiplexing (OFDM) based long reach PON (LR-PON). In the optical access network field, technologies based on fundamental upstream (U/S) and downstream (D/S) have been actively researched to accommodate explosion of data capacity. However, data transmission among the end users which is arisen from cloud computing, file-sharing and interactive game takes a large weight inside of internet traffic. Moreover, this traffic is predicted to increase more if Internet of Things (IoT) services are activated. In a conventional PON, VPN data is transmitted through ONU-OLT-ONU via U/S and D/S carriers. It leads to waste of bandwidth and energy due to O-E-O conversion in the OLT and round-trip propagation between OLT and remote node (RN). Also, it causes inevitable load to the OLT for electrical buffer, scheduling and routing. The network inefficiency becomes more critical in a LR-PON which has been researched as an effort to reduce CAPEX and OPEX through metro-access consolidation. In the proposed system, the VPN data is separated from conventional U/S and re-modulated on the D/S carrier by using RSOA in the ONUs to avoid bandwidth consumption of U/S and D/S unlike in previously reported system. Moreover, the transmitted VPN data is re-directed to the ONUs by wavelength selective reflector device in the RN without passing through the OLT. Experimental demonstration for the VPN communication system in an OFDM based LR-PON has been verified.

The idea of using a low-cost public network such as the Internet to build a private network is intriguing. In this article, we will focus on virtual private networks (VPNs), which leverage the Internet to provide cost-effective, secure communications. We will discuss the challenges of implementing VPNs based on the Internet Engineering Task Force (IETF) Internet protocol security (IPSec) standards. We will cover various aspects including encryption, authentication, Internet key exchange (IKE), and public key infrastructure (PKI) as they relate to IPSec-based VPNs. We will discuss the major issues facing enterprises, service providers, and end-users in implementing intranets, extranets, and remote access VPNs. We will elaborate by discussing how the Lucent VPN firewall handles the various issues and scenarios described here, and how customers in implementing robust VPNs, use it in practice. We also will touch on other VPN solutions and product architectures, and briefly mention other Lucent VPN products. In closing, we will discuss future VPN challenges, including the impact of Internet protocol version 6 (IPv6).3

With the worldwide acceptance of the Internet as a de-facto public network, there is great interest in the deployment of Virtual Private Networks (VPNs) across IP networks. VPNs provide an economic alternative to the expensive private leased lines. The main purpose of a VPN is to provide a company secure communication among multiple sites through the shared Internet. The allocation of bandwidth for VPNs to meet the requirements specified by customers is an important traffic engineering research issue. This paper addresses the problem of provisioning VPN services based on pipe and hose workload models over shared network infrastructure with bandwidth guarantees, an issue studied only by different resource allocation methods [1] and not studied before by general optimization methods. The general problem of computing a constrained VPN tree with optimum bandwidth allocation is a hard combinatorial optimization problem [2]. Our proposed optimization method for provisioning VPNs is based on the Simulated Evolution (SE) meta-heuristic originally introduced in [3]. The proposed Evolutionary Algorithm (EA) connects VPN nodes using a tree structure while seeking to optimize the total bandwidth reserved on the edges of the VPN tree. Experimental results with Waxman network graphs [4] show that tree bandwidth costs obtained with hose workloads are higher by a factor of a maximum 2.5 compared to those obtained with pipe workloads.

Virtual private networks (VPNs) enable companies to connect geographically dispersed offices and remote workers via secure links to the private company network, using the public Internet as a backbone. Specially, VPN service in the broadband data communication network is very important and necessary to take in users who want to specify group communication. VPN mechanisms are needed which work over existing deployed backbones, and which can also be migrated to new backbones like MPLS (Multi-Protocol Label Switching). MPLS is the latest step in the evolution of multi-layer switching in the Internet. In this paper, we clarify how MPLS can be applied to creating VPNs. For this, we researched an architectural model for building VPNs in an MPLS domain. The proposed model takes advantage of both network layer peering and packet switching, and link-layer circuit and per-stream switching. It comes with a design scheme and an implementation procedure for VPN services in MPLS systems. Then we describe MPLS-based VPN service procedures and we describe MPLS VPN schemes that must be accommodated with existing network backbones and must also provide for a full range of QoS characteristics.

Virtual Private Network (VPN) is a private network that uses public network to tunnel the connection from the users’ end to the VPN server. VPN allows users to create a secure connection to another network over the public Internet. VPNs can be used to shield users’ browsing activity and encrypts data transmitted over the network to prevent sniffing attack. Nowadays, users can either pay a premium price for a good VPN service or risk their privacy using free browser-based VPN. Thus, SafeSearch is developed to address these issues in mind. With SafeSearch, users will not need to fork out a lot of money for premium VPN subscription services or expose themselves to targeted advertising when utilising free browser-based VPN. In this study, open VPN protocol was used to create the VPN server on a microcomputer called Raspberry Pi. The software used was mostly open-source except for the VPN client. Obfuscation technique was used to hide VPN traffic by disguising it as just another normal Internet traffic against Deep Packet Inspection when passing through firewall. After the VPN server was established, tests were carried out to evaluate the functionality and reliability of the VPN server in “real-world” environment. The tests conducted were network restriction penetration assessment, network performance and user acceptance test. Penetration assessment result showed that SafeSearch is capable of bypassing web filtering and deep packet inspection. Network performance during SafeSearch connection has slight latency and bandwidth decline, although it is not overly affected. The outcome of the user acceptance test was positive as the majority of participants of the study were confident that SafeSearch can secure their connection and protect their privacy when browsing the web. To conclude, both objectives of this project were fully achieved and the scope of study was followed thoroughly.

A distributed resource management model for Virtual Private Networks: Tit-for-Tat strategies

Virtual Private Network, Its ‘Virtual', Its ‘Private' and it's a ‘Network'. A virtual private network (VPN) provides a secure connection between a sender and a receiver over a public non-secure network such as the Internet. A secure connection is generally associated with private networks. (A private network is a network that is owned, or at least controlled via leased lines, by an organization.). We can define a VPN by the following relationship: VPN = Tunneling + Security + QoS Parameters. This Chapter deals with Advantages of VPNs, Types of VPNs, VPN Architectures, VPN Models, VPN Devices, Technologies and Protocols Used to Enable Remote Access VPNs.