A data center is an infrastructure that supports Internet service. Cloud comput the face of the Internet service infrastructure, enabling even small organizations to quickly ng is rapidly changing build Web and mobile...A data center is an infrastructure that supports Internet service. Cloud comput the face of the Internet service infrastructure, enabling even small organizations to quickly ng is rapidly changing build Web and mobile applications for millions of users by taking advantage of the scale and flexibility of shared physical infrastructures provided by cloud computing. In this scenario, multiple tenants save their data and applications in shared data centers, blurring the network boundaries between each tenant in the cloud. In addition, different tenants have different security requirements, while different security policies are necessary for different tenants. Network virtualization is used to meet a diverse set of tenant-specific requirements with the underlying physical network enabling multi-tenant datacenters to automatically address a large and diverse set of tenants requirements. In this paper, we propose the system implementation of vCNSMS, a collaborative network security prototype system used n a multi-tenant data center. We demonstrate vCNSMS with a centralized collaborative scheme and deep packet nspection with an open source UTM system. A security level based protection policy is proposed for simplifying the security rule management for vCNSMS. Different security levels have different packet inspection schemes and are enforced with different security plugins. A smart packet verdict scheme is also integrated into vCNSMS for ntelligence flow processing to protect from possible network attacks inside a data center network展开更多
The packet classification is a fundamental process in provisioning security and quality of service for many intelligent network-embedded systems running in the Internet of Things(IoT).In recent years,researchers have ...The packet classification is a fundamental process in provisioning security and quality of service for many intelligent network-embedded systems running in the Internet of Things(IoT).In recent years,researchers have tried to develop hardware-based solutions for the classification of Internet packets.Due to higher throughput and shorter delays,these solutions are considered as a major key to improving the quality of services.Most of these efforts have attempted to implement a software algorithm on the FPGA to reduce the processing time and enhance the throughput.The proposed architectures,however,cannot reach a compromise among power consumption,memory usage,and throughput rate.In view of this,the architecture proposed in this paper contains a pipelinebased micro-core that is used in network processors to classify packets.To this end,three architectures have been implemented using the proposed micro-core.The first architecture performs parallel classification based on header fields.The second one classifies packets in a serial manner.The last architecture is the pipeline-based classifier,which can increase performance by nine times.The proposed architectures have been implemented on an FPGA chip.The results are indicative of a reduction in memory usage as well as an increase in speedup and throughput.The architecture has a power consumption of is 1.294w,and its throughput with a frequency of 233 MHz exceeds 147 Gbps.展开更多
基金supported in part by the National Key Basic Research and Development(973)Program of China(Nos.2013CB228206 and 2012CB315801)the National Natural Science Foundation of China(Nos.61233016 and 61140320)+1 种基金supported by the Intel Research Council with the title of "Security Vulnerability Analysis based on Cloud Platform with Intel IA Architecture"Huawei Corp
文摘A data center is an infrastructure that supports Internet service. Cloud comput the face of the Internet service infrastructure, enabling even small organizations to quickly ng is rapidly changing build Web and mobile applications for millions of users by taking advantage of the scale and flexibility of shared physical infrastructures provided by cloud computing. In this scenario, multiple tenants save their data and applications in shared data centers, blurring the network boundaries between each tenant in the cloud. In addition, different tenants have different security requirements, while different security policies are necessary for different tenants. Network virtualization is used to meet a diverse set of tenant-specific requirements with the underlying physical network enabling multi-tenant datacenters to automatically address a large and diverse set of tenants requirements. In this paper, we propose the system implementation of vCNSMS, a collaborative network security prototype system used n a multi-tenant data center. We demonstrate vCNSMS with a centralized collaborative scheme and deep packet nspection with an open source UTM system. A security level based protection policy is proposed for simplifying the security rule management for vCNSMS. Different security levels have different packet inspection schemes and are enforced with different security plugins. A smart packet verdict scheme is also integrated into vCNSMS for ntelligence flow processing to protect from possible network attacks inside a data center network
文摘The packet classification is a fundamental process in provisioning security and quality of service for many intelligent network-embedded systems running in the Internet of Things(IoT).In recent years,researchers have tried to develop hardware-based solutions for the classification of Internet packets.Due to higher throughput and shorter delays,these solutions are considered as a major key to improving the quality of services.Most of these efforts have attempted to implement a software algorithm on the FPGA to reduce the processing time and enhance the throughput.The proposed architectures,however,cannot reach a compromise among power consumption,memory usage,and throughput rate.In view of this,the architecture proposed in this paper contains a pipelinebased micro-core that is used in network processors to classify packets.To this end,three architectures have been implemented using the proposed micro-core.The first architecture performs parallel classification based on header fields.The second one classifies packets in a serial manner.The last architecture is the pipeline-based classifier,which can increase performance by nine times.The proposed architectures have been implemented on an FPGA chip.The results are indicative of a reduction in memory usage as well as an increase in speedup and throughput.The architecture has a power consumption of is 1.294w,and its throughput with a frequency of 233 MHz exceeds 147 Gbps.
