Fair bandwidth sharing among virtual networks: a capacity resizing approach

Chapter 59 - Virtual Private Networks

Aiming at the virtual network embedding problem under dynamic service request, Service Request Aware-based Dynamic Virtual Network Embedding (SRAD) algorithm is proposed. We first present virtual network embedding model, and then define virtual network construction cost according to the dynamic characteristic of service request. Our goal is to find the optimal reconfiguration policies by awaring service request type and changing trends, which can minimize the overall construction cost using substrate resource. Experimental results show that the proposed algorithm satisfies the service request, achieves higher success ratio and gains higher revenue/cost ratio for substrate network comparing with the existing algorithms.

This paper discusses some modes of signal transmission for corporate systems using the technology of virtual private networks VPN. A very important property of tunnels is the ability to differentiate different types of traffic and assign them the necessary service priorities. In this work, research has been carried out and comparative characteristics of signal transmission modes using virtual networks have been obtained to identify the effectiveness of the network in various modes of organizing a virtual network, and to optimize a virtual network in order to identify an effective method for organizing a VPN. Also, the work analyzes the specifics of the work of corporate information systems and networks intended for their maintenance, showed that for building a corporate network it is advisable to use virtual private network (VPN) technology, which makes it possible to ensure the fulfillment of the basic requirements for the security and quality of customer service and applications and the current state and direction of development of VPN technology when creating new generation corporate networks, while highlighting the main tasks that need to be addressed when creating a network. Some features of setting up an IPSec VPN server for corporate networks are considered.

The cost minimization of virtual private networks (VPN) that use the resources of an underlying transport network is the key factor for their successful implementation. The investigation in this paper is focused on 'network based VPNs', where the operation of the VPN is outsourced to an Internet Service Provider (ISP). The interest in such solutions is generated both by customers seeking to reduce support costs and by ISPs seeking new revenue sources. Solving the cost minimization would allow Internet service providers (ISPs) to define and deploy new VPN services. The basic building block of VPN is the tunnel. A tunnel operates as an overlay across the backbone, and the traffic sent through the tunnel is opaque to the underlying backbone. A VPN end point can terminate multiple tunnels or forward packets between different tunnels. Different tunnels can share the same physical link and traffic belonging to the same VPN tunnel can be carried along different physical links. The multiplexing and management of the VPN tunnels is made possible by core routers supporting the VPN of the underlying network. The novelty of the presented work is the network flow model of VPN mapping on the underlying ISP network. We assume that the VPN topology, the topology of the ISP network and the total utilization cost for all underlying links are known parameters. Based on this, we propose a network management system based on a network flow optimization in order to define the minimal cost link allocation for the VPN tunnels. We provide a simulation of the proposed optimal establishment of VPN tunnels and performance evaluation of the simulation results.

Load balancing in the provisioning of virtual private network (VPN) service in the hose model is studied. Single-path routing and tree routing for the hose model tend to aggregate bandwidth reservations on a small number of links, thus leading to congestion problems in service provider networks. If the link capacity is depleted as a result of improper routing, all future non-VPN traffic will be blocked. We propose a novel multi-objective multi-path (MOMP) routing linear program with the maximum fraction of traffic on a path (MFTP) constraint to solve the problem. The MOMP routing algorithm is able to reduce the bandwidth reservation on the most loaded link by as much as 50%, thus effectively alleviating the potential congestion problems in service provider network. The MFTP constraint provides a guarantee of the availability of multiple paths for each VPN endpoint pair. Further reduction of the bandwidth reservation can be achieved depending on the MFTP value. This is highly significant.

Selective treatments are needed for different types of traffic and different user groups, even on the Internet. Virtual networks provide capabilities for custom routings, priorities, and processing that are not available in either integrated services or differentiated services. This paper relates virtual networks to public network concepts of traffic grooming, virtual private networks and virtual paths, and shows how these and broader capabilities may be realized on the Internet. It describes a networking strategy incorporating intelligent routers that can decouple application QoS needs from core network resource allocations. These routers can be programmed to provide virtual networks, which can satisfy a wide range of application requirements.

Network virtualization is seen as a key networking paradigm for building diverse network services and architectures over a shared network infrastructure. Assigning network resources to virtual links and, more generally to virtual network topologies, efficiently and on-demand is one of the most challenging components of any network virtualization solution. This paper addresses the problem of on-line resource allocation of multiple virtual links on a Software Defined Network (SDN) infrastructure. The application context that is targeted is primarily the online provisioning of virtual overlay networks even if it can be broadened to address more general virtual networks. Considering an SDN physical infrastructure allows a complete freedom in choosing the optimal physical paths and the associated resources that support the virtual links with no interference from any other network function (such as routing). However, for the time being, forwarding in an SDN network is resource consuming with a noticeable impact on the size of the flow tables. Hence, forwarding (i.e. switching) resources should be carefully considered by the network resource allocation algorithm. This paper proposes a novel Integer-Linear formulation of the above cited problem by taking into account: (1) point-to-point as well as point-to-multipoint virtual links, each with an associated bandwidth requirement and a maximum transfer delay requirement, (2) two types of network resources, namely network links' bandwidth and nodes' switching resources, and (3) optionally, path splitting which allows a virtual link to be established on multiple physical paths. We report preliminary experimental results on a real network topology in an overloaded scenario (bandwidth requests largely exceed network capacity); they show that our algorithm outperforms shortest path heuristics with a gain on the admission rate (of virtual links requests) that ranges from 5 to 15% (compared to the most efficient heuristic) and with a computation time less than a few seconds.

Virtual Private Networks (VPNs) are a key component of cloud computing systems, since they provide isolated connectivity between geographically separated users. The elasticity in cloud computing and new usage patterns such as cloud bursting require VPNs to be more dynamic than traditional solutions used by network service providers. Managing and optimizing the topology of VPNs requires insight into the underlying wide area network topology and benefits from new network interfaces currently discussed for Software Defined Networks (SDN). This paper presents the use of the Application-Layer Traffic Optimization (ALTO) protocol for VPN optimization. ALTO is a standardized solution for exposure of abstract topology information to a variety of applications, including cloud management systems. We demonstrate the use of ALTO in determining how to scale-out a VPN on demand. We also present a prototype of an ALTO-based dynamic VPN management, which is based on a carrier-grade network management system. Our results show that ALTO is a powerful topology abstraction approach that enables informed VPN scale-out decisions by applications.

The idea of using a low-cost public network such as the Internet to build a private network is intriguing. In this article, we will focus on virtual private networks (VPNs), which leverage the Internet to provide cost-effective, secure communications. We will discuss the challenges of implementing VPNs based on the Internet Engineering Task Force (IETF) Internet protocol security (IPSec) standards. We will cover various aspects including encryption, authentication, Internet key exchange (IKE), and public key infrastructure (PKI) as they relate to IPSec-based VPNs. We will discuss the major issues facing enterprises, service providers, and end-users in implementing intranets, extranets, and remote access VPNs. We will elaborate by discussing how the Lucent VPN firewall handles the various issues and scenarios described here, and how customers in implementing robust VPNs, use it in practice. We also will touch on other VPN solutions and product architectures, and briefly mention other Lucent VPN products. In closing, we will discuss future VPN challenges, including the impact of Internet protocol version 6 (IPv6).3

SocialVPN: Enabling wide-area collaboration with integrated social and overlay networks

A distributed resource management model for Virtual Private Networks: Tit-for-Tat strategies

Virtual Private Network, Its ‘Virtual', Its ‘Private' and it's a ‘Network'. A virtual private network (VPN) provides a secure connection between a sender and a receiver over a public non-secure network such as the Internet. A secure connection is generally associated with private networks. (A private network is a network that is owned, or at least controlled via leased lines, by an organization.). We can define a VPN by the following relationship: VPN = Tunneling + Security + QoS Parameters. This Chapter deals with Advantages of VPNs, Types of VPNs, VPN Architectures, VPN Models, VPN Devices, Technologies and Protocols Used to Enable Remote Access VPNs.

IPsec can secure the links of a multihop network to protect communication between trusted components, e.g., for a secure virtual network (VN), overlay, or virtual private network (VPN). Virtual links established by IPsec tunnel mode can conflict with routing and forwarding inside VNs because IP routing depends on references to interfaces and next-hop IP addresses. The IPsec tunnel mode specification is ambiguous on this issue, so even compliant implementations cannot be trusted to avoid conflicts. An alternative to tunnel mode uses non-IPsec IPIP encapsulation together with IPsec transport mode, which we call IIPtran. IPIP encapsulation occurs as a separate initial step, as the result of a forwarding lookup of the VN packet. IPsec transport mode processes the resulting (tunneled) IP packet with an SA determined through a security association database (SAD) match on the tunnel header. IIPtran supports dynamic routing inside the VN without changes to the current IPsec architecture. IIPtran demonstrates how to configure any compliant IPsec implementation to avoid the aforementioned conflicts. IIPtran is also compared to several alternative mechanisms for VN routing and their respective impact on IPsec, routing, policy enforcement, and interactions with the Internet Key Exchange (IKE). This memo provides information for the Internet community.

The Locator/ID Separation Protocol (LISP) is being standardized in IETF, which separates the IP address functionality into routing locators (RLOC) and endpoint identifiers (EID). LISP is applicable for instant Virtual Private Network (VPN) services because it has IP tunneling features. However, there are two main issues with application to VPN. One is a Map server/Map resolver (MS/MR) basically allows any third party to know a mapping table even if it is irrelevant to the VPN. The other is an MS/MR should identify the VPN to which the requested site belongs because the requested EIDs can be private addresses and may overlap with other VPN sites. A simple solution is to deploy an independent MS/MR for every VPN. However, this is undesirable from a cost perspective. We present a new LISP-MS/MR that provides a large number of VPN services using a single set. This MS/MR creates a logically separated EID-to-RLOC mapping table for each VPN and selects an appropriate type according to the requesting VPN site. To ensure this, our scheme uses Authentication data included in the Map register for an initial VPN identification of the registering site and associates the identified VPN ID with the registered RLOC. In following Map requests, the appropriate mapping table for the requesting VPN site is selected based on its RLOC. We confirmed the basic network functions of VPN using the prototype system. The results of scalability tests show that our MS/MR completes the transaction for nearly-simultaneous 10,000 Map registers or requests within three seconds.

Hose-model virtual private networks (VPNs) provide customers with more flexibility in specifying bandwidth requirements than pipe-model VPNs. Many hose-model VPN provisioning algorithms have been proposed, and they focus on the bandwidth efficiency in the construction of a single hose-model VPN. In practice, however, VPNs come and go and the dynamics will affect the performance of these VPN provisioning algorithms. If the frequency of adding and deleting VPNs is high, these algorithms will have a scalability problem. We propose in this paper a new network architecture for dynamic VPN construction. In the proposed architecture, adding a new VPN is much simpler and faster, and all that is required is to check if the edge routers have enough bandwidth. There is no need to check the bandwidth left on each internal link because the architecture guarantees that as long as the edge routers have enough capacities to accept the VPN, the internal links will never experience overflow caused by adding the new VPN. We present a linear programming formulation for finding the optimal routing that maximizes the amount of admissible VPN traffic in the network. We then exploit the underlying network flow structure and convert the linear programming problem into a subgradient iterative search problem. The resulting solution is significantly faster than the linear programming approach.