Secure and manageable virtual private networks for end-users

Kourai, Kenichi; Hirotsu, Toshio; Sato, Kazumichi; Akashi, Osamu; Fukuda, Ken‐ichi; Sugawara, Toshiharu; Chiba, Shigeru

doi:10.1109/lcn.2003.1243164

Cited by 10 publications

(9 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For maximum efficiency, we run one VM on each CPU of a physical node [8]. Virtual Routing [12], [15] allows for creating virtual nodes [9] by partitioning the operating system running inside the virtual machine. All virtual nodes running in the same VM share a common operating system.…”

Section: System Architecturementioning

confidence: 99%

NETbalance: Reducing the Runtime of Network Emulation Using Live Migration

Grau

Herrmann

Rothermel

2011

2011 Proceedings of 20th International Conference on Computer Communications and Networks (ICCCN)

View full text Add to dashboard Cite

Network emulation is an efficient method for evaluating distributed applications and communication protocols by combining the benefits of real world experiments and network simulation. The process of network emulation involves the execution of connected instances of the software under test (called virtual nodes) in a controlled environment. In previous work, we introduced an approach to minimize the runtime of network emulation experiments based on prior known average resource requirements of virtual nodes.In this paper, we introduce NETbalance, a novel approach to runtime reduction for experiments with unknown or varying resource requirements. NETbalance migrates virtual nodes during an experiment to distribute the load evenly across the physical nodes, avoiding overloaded nodes and exploiting the idle resources on underloaded nodes for speeding up the experiment execution. We make the following contributions: First, we present an emulation architecture for efficiently supporting live migration of virtual nodes. Second, we propose a cost model for determining the runtime reduction achieved through the migration. Third, we introduce an algorithm for calculating placements that minimize the experiment runtime. Our evaluations of the NETbalance prototype show, that it is able to reduce the experiment runtime by up to 70%.

show abstract

Section: System Architecturementioning

confidence: 99%

NETbalance: Reducing the Runtime of Network Emulation Using Live Migration

Grau

Herrmann

Rothermel

2011

2011 Proceedings of 20th International Conference on Computer Communications and Networks (ICCCN)

View full text Add to dashboard Cite

show abstract

“…Based on these components, we are able to run the SUT in a controlled environment. Since our network emulation To increase the number of virtual nodes (hosts, routers, switches) in the emulated network we use a node virtualization system that is based on Virtual Routing (VR) [15]. As opposed to Virtual Machines (VM) [2], [3], [7], Virtual Routing provides more lightweight virtualization.…”

Section: System Architecturementioning

confidence: 99%

Efficient and Scalable Network Emulation Using Adaptive Virtual Time

Grau

Herrmann

Rothermel

2009

2009 Proceedings of 18th International Conference on Computer Communications and Networks

View full text Add to dashboard Cite

Performance analysis and functionality testing are major parts of developing distributed software systems. Since the number of communicating software instances heavily influences the behavior of distributed applications and communication protocols, evaluation scenarios have to consider a large number of nodes. Network emulation provides an infrastructure for running these experiments using real prototype implementations in a controllable and realistic environment. Large-scale experiments, however, have a high resource consumption which often exceeds available physical testbed resources. Time dilation allows for reducing the resource demands of a scenario at the expense of the experiment's runtime. However, current approaches only consider a constant time dilation factor, which wastes a lot of resources in case of scenarios with varying load.We propose a framework for adaptive time virtualization that significantly reduces the runtime of experiments by improving resource utilization in network emulation testbeds. In this framework, resource demands are monitored and the time dilation factor is dynamically adapted to the required level. Our evaluation shows that adaptive virtual time in combination with our lightweight node virtualization architecture allows us to increase the possible scenario sizes by more than an order of magnitude and, at the same time, ensure unbiased emulation results. This represents an important contribution to making network emulation systems highly scalable.

show abstract

“…The IDS VMs were implemented by extending the portspace [15]. The portspace is not a heavy-weight VM that emulates hardware; rather, it provides only an independent namespace for a file system, a network system, and processes.…”

Section: Ids Vmmentioning

confidence: 99%

“…Here, we give an overview of the extended portspace. Further details of the implementation of the original portspace are described in [15].…”

Section: Ids Vmmentioning

confidence: 99%

“…It enables untrusted programs to be executed securely and provides independent virtual machines and a virtual network for Grid users, but does not provide any monitoring mechanisms. The personal network we previously reported uses virtual machines and virtual networks to enable the user to securely use multiple networks in the user's host [15]. Unlike Hyper-Spector, the personal network does not provide monitoring mechanisms, and it allows the user to extend the personal network freely.…”

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

HyperSpector

Kourai

Chiba

2005

Proceedings of the 1st ACM/USENIX International Conference on Virtual Execution Environments

View full text Add to dashboard Cite

In this paper, a virtual distributed monitoring environment called HyperSpector is described that achieves secure intrusion detection in distributed computer systems. While multiple intrusion detection systems (IDSes) can protect a distributed system from attackers, they can increase the number of insecure points in the protected system. HyperSpector overcomes this problem without any additional hardware by using virtualization to isolate each IDS from the servers it monitors. The IDSes are located in a virtual machine called an IDS VM and the servers are located in a server VM. The IDS VMs among different hosts are connected using a virtual network. To enable legacy IDSes running in the IDS VM to monitor the server VM, HyperSpector provides three inter-VM monitoring mechanisms: software port mirroring, inter-VM disk mounting, and inter-VM process mapping. Consequently, active attacks, which directly attack the IDSes, are prevented. The impact of passive attacks, which wait until data including malicious code is read by an IDS and the IDS becomes compromised, is confined to within an affected HyperSpector environment.

show abstract

Secure and manageable virtual private networks for end-users

Cited by 10 publications

References 12 publications

NETbalance: Reducing the Runtime of Network Emulation Using Live Migration

NETbalance: Reducing the Runtime of Network Emulation Using Live Migration

Efficient and Scalable Network Emulation Using Adaptive Virtual Time

HyperSpector

Contact Info

Product

Resources

About