In the last few years, the appealing features of cloud computing have been fueling the integration of cloud environments in the industry, which has been consequently motivating the research on related technologies by both the industry and the academia. The possibility of paying-as-you-go mixed with an on-demand elastic operation is changing the enterprise computing model, shifting on-premises infrastructures to off-premises data centers, accessed over the Internet and managed by cloud hosting providers. Regardless of its advantages, the transition to this computing paradigm raises security concerns, which are the subject of several studies. Besides of the issues derived from Web technologies and the Internet, clouds introduce new issues that should be cleared out first in order to further allow the number of cloud deployments to increase. This paper surveys the works on cloud security issues, making a comprehensive review of the literature on the subject. It addresses several key topics, namely vulnerabilities, threats, and attacks, proposing a taxonomy for their classification. It also contains a thorough review of the main concepts concerning the security state of cloud environments and discusses several open research topics.

/pdf/security-issues-in-cloud-environments-a-survey-1t9z0if3y4.pdf

Security issues in cloud environments: a survey

Cloud security issues and challenges

A method and/or network system is able to perform an in-service software upgrade (“ISSU”) using virtualization technology while ongoing network service is maintained. After receipt of an upgrade signal such as a command of software upgrade, a new or second virtual machine (“VM”) is created in response to the upgrade signal. After downloading the new version of program to the second VM while maintaining the first version of program running on the first VM, the process for providing network management begins to migrate from the first version of program to the new version of program. The process simultaneously facilitates ISSU for a data-path module such as a line card to convert from the previous version of software to the new version of the software.

Methods and Apparatus for Performing In-Service Software Upgrade for a Network Device Using System Virtulization

A hybrid cloud solution for securely extending a private cloud or network to a public cloud can be enhanced with tools for evaluating the resources offered by multiple public cloud providers. In an example embodiment, a public cloud evaluation system can be used to create a virtual machine (VM) in a public cloud to serve the function of a public cloud evaluation agent. The public cloud evaluation agent can instantiate one or more VMs and other resources in the public cloud, and configure the VMs and resources to execute performance evaluation software. The results of the performance evaluation software can be transmitted to a private enterprise network, and analyzed to determine whether the public cloud is an optimal public cloud for hosting an enterprise application.

Performance-based public cloud selection for a hybrid cloud environment

A method for bridging communication between a plurality of Virtual eXtensible Local Area Network (VXLAN) networks, wherein the method comprises joining the VXLAN networks, obtaining a forwarding entry table that associates a plurality of endpoints with a plurality of VXLAN tunnel endpoints (VTEPs) within the VXLAN networks, receiving a VXLAN encapsulated data packet from one of the VXLAN networks, and transmitting the VXLAN encapsulated data packet using the forwarding entry table to a different VXLAN network.

Communication between endpoints in different VXLAN networks

Conditional address translation is performed in a multi-tenant cloud infrastructure to effectively support tenant-assigned addresses. For each tenant, the multi-tenant cloud infrastructure deploys both a private network used to communicate between the tenant and the cloud and a tenant-facing gateway to manage the private network. The multi-tenant cloud infrastructure also includes an externally-facing gateway used to communicate between the multi-tenant cloud and a public network. The tenant-facing gateways are configured to bypass address translation—providing consistent addressing across each private network irrespective of the physical location of resources linked by the private network. By contrast, the public-facing gateway is configured to translate source addresses in outgoing packets to addresses that are unique within the public network. Advantageously, discriminately mapping addresses enables multiple tenants to interact in a uniform fashion with both on-premises resources and cloud-hosted resources without incurring undesirable address collisions between tenants.

Cross-cloud namespace management for multi-tenant environments

Virtualization of computer workloads onto powerful x86 multicore platforms is leading to a massive transformation in the way services are produced by next generation data centers. Simultaneously, cloud computing principles are compelling a rethink in the way enterprises are beginning to consume such services. In this paper, we present the need for network and security (netsec) functions, which are currently realized in hardware appliances, to significantly evolve to keep pace with these new trends, and to provide "disruptively simplified" security that was not earlier possibleWith server consolidation and desktop virtualization, significantly more traffic remains within the data center racks, leading to blind spots for "in network" security appliances. Current netsec devices which are architected based on "scale up" principles cannot keep pace with increased bandwidth driven to the servers, and the ever increasing volume of threats at all layers of the network stack. Also, highly mobile workloads and increasing intelligence in the virtual/hypervisor layer, makes it increasingly hard for static network devices to interlock with dynamic policy changes and onthe- fly re-purposing of resources to serve different workloads, applications, or usersThis paper highlights a new trend in the industry to virtualize netsec functions inside security virtual appliances (SVAs), which can then be placed on hosts, and offer distributed security functions for network flows across the cluster. We analyze this trend in detail using the VMware vShield product line as an example. The approach replaces single choke-point based physical security devices like firewalls, IP address Management (IPAM), flow monitoring, and data leakage prevention (DLP) with distributed virtual counterparts running on slices of x86 co-located with compute workloads with ability to tap into traffic going in and out of virtual machines (VMs)vShield's distributed scale-out architecture means performance can scale up or down linearly as new SVAs are added, while simplifying the lifecycle management of these SVAs including installs, upgrades, ability to debug, and reliability by leveraging underlying virtualization primitives of VM cloning, deploy from template, and VM high availability and fault tolerance. Interactions with features like live migration (vmotion) of guest VMs and distributed power management of host servers introduce new aspects of appliance management that was not possible in the physical world. The paper analyzes these aspects of SVA management in depth. Our measurements of the security inspection throughput for given vCPUs and memory indicate it is comparable to those of physical counterparts with the additional flexibility of a scale-out deployment. Further, we demonstrate that with this approach a virtual datacenter (VDC) in the cloud can be deployed in minutes compared to days/weeks with physical datacenters. Finally, we present the additional security inspections that can be performed in the virtual world that were not possible in the physical world. The ability of SVAs to introspect traffic into and out of VMs implies they can perform checks for MAC spoofing, IP spoofing [6], ARP filtering at the source. Furthermore, based on security analysis if a VM is deemed suspect it can be quickly quarantinedConcepts such as flow introspection, automated insertion of SVAs into flows at VM ingress/egress, distributed scale out architecture across a cluster of hosts, encapsulation of secure VDCs, and programmability of security policies via RESTful interfaces, represent a significant architectural change, with wide applicability in enterprise data centers, and private/public cloud environments.

/pdf/virtualizing-networking-and-security-in-the-cloud-3aqwuwzy87.pdf

Virtualizing networking and security in the cloud

Some embodiments provide a novel method for load balancing data messages that are sent by a source compute node (SCN) to one or more different groups of destination compute nodes (DCNs). In some embodiments, the method deploys a load balancer in the source compute node's egress datapath. This load balancer receives each data message sent from the source compute node, and determines whether the data message is addressed to one of the DCN groups for which the load balancer spreads the data traffic to balance the load across (e.g., data traffic directed to) the DCNs in the group. When the received data message is not addressed to one of the load balanced DCN groups, the load balancer forwards the received data message to its addressed destination. On the other hand, when the received data message is addressed to one of load balancer's DCN groups, the load balancer identifies a DCN in the addressed DCN group that should receive the data message, and directs the data message to the identified DCN. To direct the data message to the identified DCN, the load balancer in some embodiments changes the destination address (e.g., the destination IP address, destination port, destination MAC address, etc.) in the data message from the address of the identified DCN group to the address (e.g., the destination IP address) of the identified DCN.

Dynamically adjusting load balancing

The disclosure herein describes a system, which provides uniform access to a gateway in an extended virtualized layer-2 network. During operation, the system identifies a media access control (MAC) address, which is associated with a respective gateway in the extended virtualized layer-2 network, in a layer-2 header of a data frame. This MAC address is specific to the extended virtualized layer-2 network (e.g., for a different extended virtualized layer-2 network, a different MAC address is associated with a respective gateway). The system modifies the layer-2 header by swapping the MAC address with another MAC address, which uniquely identifies a gateway in the extended virtualized layer-2 network, in the layer-2 header and forwards the frame with the modified header to the gateway.

Method and system for uniform gateway access in a virtualized layer-2 network domain

Some embodiments provide a central firewall management system that can be used to manage different firewall devices from a single management interface. This management interface provides a uniform interface for defining different firewall rule sets and deploying these rules sets on different firewall devices (e.g., port-linked firewall engines, firewall service VMs, network-perimeter firewall devices, etc.). Also, this interface allows the location and/or behavior of the firewall rule sets to be dynamically modified. The management interface in some embodiments also provides controls for filtering and debugging firewall rules.

Serge Maskalik

Papers

Cross-cloud namespace management for multi-tenant environments

Virtualizing networking and security in the cloud

Dynamically adjusting load balancing

Method and system for uniform gateway access in a virtualized layer-2 network domain

Firewall Rule Management