Cloud computing technology enables uniform access to shared pools of configurable system resources and higher-level services, rapidly provisioned with minimal management effort. Cloud computing relies on sharing the resources to achieve coherence and economies of scale, through virtualizion. Cloud network, in particular, is virtualized through multiple logical constructs and SW layers, making cloud connectivity complex to configure, debug, and visualize. In this work, we show how to detect cloud network operational issues through monitoring and analytics, using and enhancing open source network analyzer, Skydive [2]. In particular, we focus on Noisy Neighbor Effect, a situation in which a common resource is monopolized by a noisy tenant, resulting in performance degradation experienced by other tenants. Skydive is an open-source network topology and protocol analyzer, capable of discovering and visualizing cloud network topology across its multiple layers, as well as capturing network traffic at programmable granularity, injecting network traffic, and more. Typical Skydive setup consists of multiple Skydive agents installed on various network components and one or more Skydive analyzers deployed on any compute resource in the cloud. Skydive agents discover and report the information to a Skydive analyzer, that stores it over time so it can be consumed via Web UI, command line tools, and REST API, for visualization, exploration, and analytics. In our work we used Skydive to investigate and detect the Noisy Neighbor Effect in Kubernetes (k8s) network. Our setup consisted of a commercial cloud platform, IBM Cloud Private (ICP) [1], running an HTTP server and two HTTP clients constantly sending requests to the server, all 3 are containerized Python applications as shown in Figure 1. We have installed Skydive agents on all the k8s worker nodes. To achieve our goal of detecting anomalous client behavior and creating a visual indication of such anomaly in Skydive UI, we have enhanced Skydive capabilities and contributed our enhancements back to the project by extending the Python REST client library to support traffic injections, and fixing existing bugs in the Skydive system. We used those enhancements to measure Round Trip Time (RTT) between nodes in the cloud network, detect anomalies in RTT measurements and indicate them in Skydive UI, such as the green indication in Figure 1. In this work, we have made the first step towards automatic detection of Noisy Neighbor with Skydive, using simple threshold based approach, in an experimental setup. This work can be extended in a multiple ways - support more generic and realistic multi-tenant setup; employ deeper analyses, e.g. ML and DL, also on historical data; explore additional anomalous cases, beyond the Noisy Neighbor Effect.

With the growing reliance on the ubiquitous availability of IT systems and services, these systems become more global, scaled, and complex to operate. To maintain business viability, IT service providers must put in place reliable and cost efficient operations support. Artificial Intelligence for IT Operations (AIOps) is a promising technology for alleviating operational complexity of IT systems and services. AIOps platforms utilize big data, machine learning and other advanced analytics technologies to enhance IT operations with proactive actionable dynamic insight. In this paper we share our experience applying the AIOps approach to a production cloud object storage service to get actionable insights into system's behavior and health. We describe a real-life production cloud scale service and its operational data, present the AIOps platform we have created, and show how it has helped us resolving operational pain points.

Network slicing has emerged as a major new networking paradigm for meeting the diverse requirements of various vertical businesses in virtualised and softwarised 5G networks. SliceNet is a project of the EU 5G Infrastructure Public Private Partnership (5G PPP) and focuses on network slicing as a cornerstone technology in 5G networks, and addresses the associated challenges in managing, controlling and orchestrating the new services for users especially vertical sectors, thereby maximising the potential of 5G infrastructures and their services by leveraging advanced software networking and cognitive network management. This paper presents the vision of the SliceNet project, highlighting the gaps in existing work and challenges, the proposed overall architecture, proposed technical approaches, and use cases.

Federated cloud networks are formed by federating virtual network segments from different cloud platforms into a single federated network. This allows virtual machines from one virtual network segment to communicate with virtual machines running on the other virtual network segments of the federated network. Federated cloud networks can be very useful for creating application specific isolated networks between clouds. In this paper we describe current work in the BEACON project to secure the federated network with a global security policy. Virtual network functions and service function chaining are used to implement the security policy. The federated cloud network security policy is described in a service manifest. This enables automated deployment and configuration of network security functions across the different cloud federation networks. The approach is illustrated with a simple case study where communications between trusted and untrusted clouds are encrypted.

The Software Defined Networking (SDN) paradigm, according to the most popular definition, proposes the ambitious vision of making network infrastructure (e.g., routers and switches) fully programmable. This approach introduces suitable levels of abstraction, in order to adaptnetwork infrastructure functions at runtime through powerful and expressive APIs. In this context, the concept of network virtualisation is of particular importance, namely the idea to create virtual partitions of the physical network infrastructure. When virtualization is applied in this domain, it allows several controller instances and their applications to populate and manage the assigned partitions. Even more useful are the aforementioned concepts when dealing with wide-area networks of cloud-hosting datacenters, especially when trying to provide, e.g., cloud-agnostic and transparent QoS, i.e., cloud-bursting. Scientific research is tackling these new trends following two approaches: multi-cloud and federated cloud. In this work we will pursue the latter, because it leaves the end-users (application owners or companies) free to focus their efforts on application-related activities. Load balancing is among the best practices to distribute user workloads fairly and dynamically among all the nodes in a scaling group, either in a data-center or across clouds. This strategy becomes even more relevant in a scenario featuring federated cloud networks. This is the context where this work finds its place, namely the design of a Load Balancing as a Service (LBaaS) approach for SDN in a OpenStack-based brokered cloud federation.

With a growing number of infrastructure cloud services, there are many benefits to interconnecting several clouds. However, seamless cloud interoperability is highly desired but not yet easily attainable in the current cloud solutions market. In this paper we address the problem of network monitoring and analysis in a complex federated network environment. Federated cloud networks deal not only with heterogeneous cloud platforms (i.e. OpenStack, AWS, Azure), but also with different virtualization technologies. Moreover, federation of the networks adds complexity, because in addition to the physical infrastructure and virtual networks dimensions, there is a dimension of the federated overlay network spread across clouds.

With a growing number of infrastructure cloud services becoming available there are many benefits to interconnecting several cloud services. However, seamless cloud interoperability is the complex issue, especially when different cloud platforms are interconnected. One of the major aspects of federating clouds resources is network federation. Federated networks must deal not only with heterogeneous cloud platforms, but also with different virtualization technologies and the added complexity of multi-layer virtualization. In order to allow monitoring and analysis of the complex heterogeneous environment, there is a need to present a user with the full aggregated view of the federated network including cloud interconnect and with the match between different layers and platforms. In this paper we present a framework that uses Skydive tool for network monitoring and analysis in BEACON federated network environment.

The BEACON framework enables the provision of federated cloud infrastructures, with special emphasis on intercloud networking and security issues, to support the automated deployment of applications and services across different clouds and datacenters. BEACON is distributed as an open source software, and some of its innovative features have contributed to the OpenNebula and OpenStack cloud management platforms.

Smart IoT applications require connecting multiple IoT devices and networks with multiple services running in fog and cloud computing platforms. One approach to connecting IoT devices with cloud and fog services is to create a federated virtual network. The main benefit of this approach is that IoT devices can then interact with multiple remote services using an application specific federated network where no traffic from other applications passes. This federated network spans multiple cloud platforms and IoT networks but it can be managed as a single entity. From the point of view of security, federated virtual networks can be managed centrally and be secured with a coherent global network security policy. This does not mean that the same security policy applies everywhere, but that the different security policies are specified in a single coherent security policy. In this paper we propose to extend a federated cloud networking security architecture so that it can secure IoT devices and networks. The federated network is extended to the edge of IoT networks by integrating a federation agent in an IoT gateway or network controller (Can bus, 6LowPan, Lora,...). This allows communication between the federated cloud network and the IoT network. The security architecture is based on the concepts of network function virtualisation (NFV) and service function chaining (SFC) for composing security services. The IoT network and devices can then be protected by security virtual network functions (VNF) running at the edge of the IoT network.

Smart Internet of Things (IoT) applications will rely on advanced IoT platforms that not only provide access to IoT sensors and actuators, but also provide access to cloud services and data analytics. Future IoT platforms should thus provide connectivity and intelligence. One approach to connecting IoT devices, IoT networks to cloud networks and services is to use network federation mechanisms over the internet to create network slices across heterogeneous platforms. Network slices also need to be protected from potential external and internal threats. In this paper we describe an approach for enforcing global security policies in the federated cloud and IoT networks. Our approach allows a global security to be defined in the form of a single service manifest and enforced across all federation network segments. It relies on network function virtualisation (NFV) and service function chaining (SFC) to enforce the security policy. The approach is illustrated with two case studies: one for a user that wishes to securely access IoT devices and another in which an IoT infrastructure administrator wishes to securely access some remote cloud and data analytics services.

Cloud federation refers to a mesh of Cloud providers that are interconnected by using agreements and protocols necessary to provide a decentralized computing environment. Federation is raising many challenges in different research fields but is also creating new business opportunities. Nowadays, the combination between Cloud federation, Software Defined Networking (SDN), and Network Function Virtualization (NFV) technologies offers new business opportunities to Cloud providers that are able to offer new innovative federated Cloud networking services to customers. In this paper, we focus on federated Cloud networking services considering multiple OpenStack Clouds. In particular, we present a preliminary outcome of an innovative design of a Federation Management system acting as an external service provider dealing with federated networking services among multiple federated OpenStack Clouds. More specifically, we describe how virtual resources, virtual networking, and security management can be accomplished.

We study the virtual machine live migration ( LM) and disaster recovery (DR) from a networking perspective, considering long-distance networks, for example, between data centers. These networks are usually constrained by limited available bandwidth, increased latency and congestion, or high cost of use when dedicated network resources are used, while their exact characteristics cannot be controlled. LM and DR present several challenges due to the large amounts of data that need to be transferred over long-distance networks, which increase with the number of migrated or protected resources. In this context, our work presents the way LM and DR are currently being performed and their operation in long-distance networking environments, discussing related issues and bottlenecks and surveying other works. We also present the way networks are evolving today and the new technologies and protocols (e.g., software-defined networking, or SDN, and flexible optical networks) that can be used to boost the efficiency of LM and DR over long distances. Traffic redirection in a long-distance environment is also an important part of the whole equation, since it directly affects the transparency of LM and DR. Related works and solutions both from academia and the industry are presented.

Capacity, availability or resilience of clouds can be increased by interconnecting two or more cloud computing environments to form a cloud federation and share resources. Shared resources include compute and storage resources but also networking resources. By integrating software defined networks/virtual networks (SDN), network function virtualization (NFV) and network function chaining (SFC) technologies into cloud management platforms it is possible to create more advanced and flexible cloud federation mechanisms. In this paper we show how to secure federated cloud networks and how to customise the security of each individual federated cloud network running in a cloud federation. We propose an architecture for securing federated cloud networks by enforcing a global security policy to all network segments of a federation, and local security policies on each network of the federation. Cloud stakeholders can specify the required security virtual network functions (VNF), how to configure them, and how to chain them in a service manifest. The proposed architecture is illustrated with a deep packet inspection case study. Future work on implementing the proposed architecture in an OpenStack federation is briefly discussed.

Federated cloud networks are formed by federating virtual network segments from different clouds, e.g. in a hybrid cloud, into a single federated network. Such networks should be protected with a global federated cloud network security policy. The availability of network function virtualisation and service function chaining in cloud platforms offers an opportunity for implementing and enforcing global federated cloud network security policies. In this paper we describe an approach for enforcing global security policies in federated cloud networks. The approach relies on a service manifest that specifies the global network security policy. From this manifest configurations of the security functions for the different clouds of the federation are generated. This enables automated deployment and configuration of network security functions across the different clouds. The approach is illustrated with a case study where communications between trusted and untrusted clouds, e.g. public clouds, are encrypted. The paper discusses future work on implementing this architecture for the OpenStack cloud platform with the service function chaining API.

This paper presents the BEACON Framework, which will enable the provision and management of cross-site virtual networks for federated cloud infrastructures in order to support the automated deployment of applications and services across different clouds and datacenters. The proposed framework will support different federation architectures, going from tightly coupled (datacenter federation) to loosely coupled (cloud federation and multi-cloud orchestration) architectures, and will enable the creation of Layer 2 and Layer 3 overlay networks to interconnect remote resources located at different cloud sites. A high level description of the main components of the BEACON framework is also introduced.

Cloud federation enables cloud providers to collaborate in order to create a large pool of virtual resources at multiple network locations. Different types of federated cloud architectures have been proposed and implemented up to now. In this context, an effective, agile and secure federation of cloud networking resources is a key aspect for the deployment of federated applications. This paper presents the preliminary security requirements analyzed in the H2020 BEACON Project that aims at researching techniques to federate cloud network resources and defining an integrated cloud management layer that enables an efficient and secure deployment of federated cloud applications. The paper analyses both how to protect the cloud networking infrastructure, and how cloud users can customize the network security for their distributed applications.

Cloud federation enables cloud providers to collaborate and share their resources to create a large virtual pool of resources at multiple network locations. The BEACON H2020 project focuses on one aspect of achieving cloud federation, namely, enabling federated cloud networking. We define a cloud network architecture that enables interconnection of different clouds powered by different cloud platforms and virtualization technologies and enables effective network function virtualization across clouds. The long term vision of the project is a fully virtualized data center for federated clouds with fully integrated virtualized compute, storage and network resources across clouds.

Overlay network virtualization quickly gains traction in today's multi-tenant data centers due to its ability to provide independent virtual networks, at scale, along with complete isolation from the underlying physical network. Despite the benefits, performance degradation due to the imposed perpacket encapsulation overhead is a serious impediment. Mitigation approaches are mostly hardware based and thus depend on costly networking gear upgrades and suffer from lesser flexibility and longer times to market, compared to software solutions. Software optimizations proposed so far are limited in scope, applicability, and interoperability. In this paper we present NoEncap , a software-only opt mization, capable of eliminating almost completely the overheads, while fully preserving the benefits of an overlay-based network virtualization.

Seamless cloud interoperability is highly desired but not yet easily attainable in the current cloud solutions market. This work tackles one aspect of achieving cloud interoperability, namely, inter-cloud networking. We list the requirements and propose an inter-cloud networking architecture for a case of independent clouds owned by different entities and powered by different cloud management and network virtualization technologies. Then we validate the proposed architecture by describing an example of working implementation for Open Stack cloud powered by Open Daylight Open DOVE SDN solution. Finally, we compare our architecture to the existing solutions.