The Software-Defined Networking (SDN) architecture facilitates the flexible deployment of network functions by detaching them from network devices to a logically centralized point, the so-called SDN controller, and maintaining a common communication interface between them. While promoting innovation for each side, this architecture also induces a higher chance of conflicts between concurrent control applications compared to existing traditional networks. We have discovered a new type of anomalies that we call hidden conflicts. They appear to occur only due to side-effects of control application’s behaviour and to be independent of and distinct from the class of conflicts between rules present in the network devices. We analyse the SDN interaction primitives susceptible to such disruptions and present experiments supporting our analysis, the result of which indicates the necessity of the knowledge on the control mechanics in detecting hidden conflicts. We present a hidden conflict prediction approach that employs speculative provocation to determine the deployed applications’ behaviour. The observed behaviour can be leveraged to predict undesired network state. Evaluation of our prediction prototype suggests that prediction functions should be integrated into control applications.

The global proliferation of cloud computing, smart homes, the internet of things and machine learning requires a novel view on the flow of confidential information and its classification. The security of an organisation is affected by the privacy enjoyed by its members. Sufficient data on those members can be leveraged in a so-called abduction attack aiming to extract confidential information from the organisation. To illustrate it we develop a model of actors and data flows and discuss three scenarios in which the confidentiality achievable by an organisation is limited by the privacy of its members. We support the model and the attack scenarios by reviews of the most prolific sources of personal data, its handling and its perceived value to the individuals it pertains to.

—We find that existing multicast protocols require either the participation of hosts in group management or partial address lists of the group members to be sent to end-points (hosts), thus creating a privacy issue. Many services suitable for multicast are transmitted via massive unicast for technical or management reasons outside the sphere of influence of the sender. The large amount of identical payload transmitted constitutes a significant waste of network resources. We address these issues by presenting MEADcast , a multicast protocol intended to support a smooth transition from massive unicast to sender-centric multicast over the Internet. Senders perform all group management while receivers do not require explicit support for the protocol. The protocol copes with varying degrees of support by routers in the network and avoids the disclosure of end-point addresses to other end-points. Performance evaluation shows a decrease of the total traffic volume in the network of up to 1:5 as compared to unicast, suggesting suitability for applications, such as Internet Protocol Television (IP-TV), video conferences, online auctions and others.

Software-defined networks (SDN) replacing the network appliances of traditional networks with logically centrally deployed applications, which are able to introduce the network function they implement into any element in the network. This flexibility renders SDN prone to conflict. We demonstrate conflict between applications in a laboratory setting to emphasize the importance of conflict detection in production networks. The evaluation of an analytical approach shows substantial obstacles in the general case. Our experimental approach produces conflict classes and detection patterns by means of studying network behaviour in the presence of multiple applications and traffic profiles being applied to different topologies. Based on such experiments, we illustrate the extraction of conflict patterns and their application to conflict detection in new situations.

The architecture of software-defined networks (SDN) allows flexible, centralised control of network behaviour but also increases the likelihood of conflicts between the behaviour specified by concurrent control applications. We have discovered a new type of anomalies that we call hidden conflicts. They appear to occur only due to side-effects of application behaviour and to be independent of the conflict class formed by the rules present in the SDN devices. We analyse the interaction primitives of SDN with respect to their susceptibility to such disruptions and present experiments, which support our analysis and indicate that the detection of hidden conflicts requires insight into the control mechanics present in the network. We sketch our prototype for conflict prediction that employs speculative provocation to gain insight into the deployed applications' behaviour.

Software-defined networks (SDN) allow the centralization of the network control plane into a platform for applications implementing network functions. Thus, SDN applications can replace the network appliances common in traditional networks with centrally deployed software packages. In addition, they are able to introduce the network function they implement into any element in the network topology. The greatly increased flexibility of SDN renders them more prone to conflict, i.e. interference between network functions. A demonstration of conflicts between SDN applications occurring even in a small laboratory setup indicates that conflict handling is indispensable in large-scale networks. We regard conflict detection as an obvious prerequisite for any further conflict handling, such as conflict classification and conflict resolution. With the aid of a program execution model for SDN we argue that a purely analytic approach to general conflict detection is infeasible and propose an experimental approach. We present an experimental methodology and develop a parameter space for the exhaustive, automated search for conflict situations in a large number of network scenarios. We show the parameter space for n-node networks to be of size of 10^n single experiment points and discuss alternatives to reduce its complexity to a manageable level.

Die Nutzung vieler Instanzen einer virtueller Infrastruktur für Laborversuche und Lehrveranstaltungen kann eine große Anzahl virtueller Netze und somit entsprechend hohen Managementaufwand erfordern. Diese Arbeit zeigt einen Ansatz zur Kapselung der virtuellen Komponenten und Netze einer Instanz mittels der Schichtung virtueller Maschinen. Die darin implizite Gruppierung der virtuellen Komponenten und Netze zerlegt die Gesamtmenge virtueller Entitäten in kleinere, leichter handzuhabende und dem Zweck der Instanz entsprechende Managementdomänen geringerer Komplexität. Anwendungen in der Lehre sowie in der Praxis illustrieren den Ansatz.

Managing virtual components requires specialised tools, that differ in their user interfaces, underlying information models and in their dependencies of specific platforms and auxiliary services. This paper proposes the use of the familiar file-system structure as a means of representation for the IT infrastructure, its organisational structure and its physical and virtual components. Thus, by using common file-managing tools, an administrator or user can view and manage the infrastructure as a whole. We study how operations on such a file-system can be employed to trigger management operations on the infrastructure and how the changes to the file-system reflect changes in the infrastructure. A proof-of-concept prototype illustrates this incipient approach.

The projection of the structure and operations of virtualized infrastructure onto a file-system structure yields a familiar interface for management and the opportunity to perform management operations with non-specialised tools for file and directory manipulation. The file-system paradigm offers a well-known information model onto which the infrastructure data model is mapped. We describe the mapping of the static and dynamic structure and discuss its potential and limitations. The concepts are illustrated to the reader by means of the Virtualized Infrastructure File-System prototype, that is discussed in terms of architecture and operation.

Today's applications do not react to the ad-hoc, dynamic changes in locality, performance and environment that are characteristic of virtualized infrastructure. We illustrate exemplary effects experienced by distributed programs in reaction to change in the infrastructure and explore call interception, library replacement and aspect-oriented programming as alternatives for remedy. We demonstrate the remedial effect of adaptive code introduced without change to the original application code, or its bindings. We sketch a software architecture to make available management knowledge as a base for adaptation.

Anwendungen auf mobilen Geräten beschränken sich längst nicht mehr auf Adressbücher und lokale Kalender, sondern haben die Schwelle hin zu hohen Leistungsanforderungen an Rechen- und Übertragungskapazität überschritten. Viele Anwendungen erfordern den Zugriff auf große Datenbestände (etwa Kartenmaterial, Verzeichnisse) und benötigen Rechenkapazität jenseits der des mobilen Gerätes. Moderne mobile Applikationen, sogenannte Smart Mobile Apps, müssen auf skalierbare und dynamisch zuteilbare, in Rechenzentren bereitgestellte Ressourcen zurückgreifen, um entsprechende fortgeschrittene Dienstfunktionen erfüllen zu können. Cloud Computing bietet sich als Modell für die Realisierung eines solchen Betriebs an.

The advent of host virtualization has increased the number of management attribute classes and instances. At the same time an additional degree of heterogeneity has been introduced, due to different hypervisor products coupled with multiple guest operating systems. These changes obviate provisionary methods of harmonising management information. We analyse the problem dimensions of attribute harmonisation according to a common management scenario and show why heterogeneity at hypervisor and VM level is difficult to deal with at present. In response, we present a classification of bottom-up attribute matching patterns and propose a methodology for the systematic processing of management attributes. As a proof-of-concept, we describe our implementation of an attribute normalising framework extending the libvirt library.

—Services sensitive to network quality convergeonto general-purpose data networks which, in contrast tospecial-purpose (e.g., public telephony) networks, lack built-in quality control functions needed by many applications,like Internet telephony or video conferencing. High-volume,high-performance applications such as those in Grid andCloud computing may be too important for customers torely on mere promises of network quality, while at thesame time requiring connections traversing multiple networkoperators' domains. Thus, in addition to end-to-end QoSassurances, customers of these applications demand man-agement functionality for those connections made availableto them. Traditional routing procedures are insufcient toselect paths according to these requirements, as they relyon evaluation of only one parameter (e.g., hop count), whileQoS parameters alone will account for multiple independentmetrics.We present a solution that addresses these issues bycombining a routing procedure, a common set of QoSoperations, and an information model for the representationof connection properties within and across administrativedomains.Keywords -end-to-end; quality of service (QoS); inter-domain routing; network management

Many services provided over the Internet, like voice over IP and video on demand, increase the demand for assurances concerning the quality of the underlying network. A score of techniques for assurance of quality of service (QoS) have been devised for use within administrative domains. However, when paths cross the border of autonomous systems, assurance of end-to-end QoS remains an unsolved issue. Thereby the key challenge is the establishment of connection-oriented communication flows. We introduce a technique to establish ISO/OSI Layer 3 multi-domain communication paths. The proposed solution does not stress border-routers and is independent of domain-internal policies, while relying on the common forwarding mechanisms.

We propose a simple system architecture for a wireless unidirectional high-rate digital data system architecture. The majority of the current systems, in similar use cases, suggest complex system architectures, which leads to complex implementations, system constraints, as well as high operation cost. In the architecture proposed here, a specific scenario will be shown for short-range transmission in order to evaluate system complexity and feasibility. The work encompasses a short discussion about the state of the art in wireless high-rate digital data transmission for short-range applications and the system simulation at baseband in a static environment.

The quick adoption of virtualization technology in general and the advent of the Cloud business model entail new requirements on the structure and the configuration of back-end I/O systems. Several approaches to virtualization of I/O links are being introduced, which aim at implementing a more flexible I/O channel configuration without compromising performance. While previously the management of I/O devices could be limited to basic technical requirments (e.g. the establishment and termination of fixed-point links), the additional flexibility carries in its wake additional management requirements on the representation and control of I/O sub-systems. This paper focuses on the modelling of dynamic and static aspects of the management of virtual I/O devices. Based on management scenarios and common operations on virtual machines we propose management function prototoypes and discuss the corresponding necessary information items.

Multi-layered provisioning architectures such as those in emergent virtualized (e.g. cloud) infrastructures exacerbate the cost of faults to a degree where automation effectively constitutes a prerequisite for operations. The acquisition of management information and the execution of routine tasks have been automated to some degree; however the decision processes behind fault management in large-scale environments have not. This paper addresses automation of such decision processes by proposing a planning-based fault recovery algorithm based on hierarchical task networks and data models for the knowledge necessary to the recovery process. We embed these concepts in a generic architecture and evaluate its prototypical implementation with respect to function and scalability.

In this paper we analyse the suitability of computing clouds, i.e. large-scale virtualized infrastructures for high-performance applications that are normally executed on specialised clusters or supercomputers. We classify such applications according to their requirements on different system components and present measurements of virtualization software overhead for these components. Based on the results, we discuss cloud-tolerant problems and address surprising performance effects observed in different hypervisors.