Cloud-Based Middlebox Management System

• US 20140068602A1
• Filed: 09/04/2012
• Published: 03/06/2014
• Est. Priority Date: 09/04/2012
• Status: Active Grant

• Current Assignee: Wisconsin Alumni Research Foundation (University of Wisconsin System)
• Original Assignee: Wisconsin Alumni Research Foundation (University of Wisconsin System)
• Inventors: Anand, Ashok, Akella, Srinivasa Aditya, Gember, Aaron Robert, Grandl, Robert Daniel, Benson, Theophilus Aderemi
• Granted Patent: US 9,104,492 B2
• Time in Patent Office: Days
• US Class Current: 718/1
• CPC Class Codes: G06F 2009/45595 Network integration; Enabling network access in virtual machine instances
• CPC Class Codes: G06F 9/45558 Hypervisor-specific management and integration aspects
• CPC Class Codes: G06F 9/5072 Grid computing
• CPC Class Codes: H04L 12/4633 Interconnection of networks using encapsulation techniques, e.g. tunneling

Abstract

A virtual network virtual machine may be implemented on a cloud computing facility to control communication among virtual machines executing applications and virtual machines executing middlebox functions. This virtual network virtual machine may provide for automatic scaling of middleboxes according to a heuristic algorithm that monitors the effectiveness of each middlebox on the network performance as application virtual machines are scaled. The virtual machine virtual network may also locate virtual machines in actual hardware to further optimize performance.

Claims

1. A computing system comprising a plurality of network connected computers implementing virtual machines and controlled by a cloud application that dynamically allocates virtual machines to different enterprises and monitors costs of the virtual machines against an account for each enterprise;

the virtual machines for at least one enterprise including;

(1) application virtual machines executing software to implement an application for the enterprise;

(2) middlebox virtual machines executing software enforcing rules related to transport of data between application virtual machines; and

(3) at least one VNVM executing software to dynamically control a virtual network interconnecting the application virtual machines and middlebox virtual machines;

wherein at least one VNVM;

(i) intercommunicates with the application virtual machines and middlebox virtual machines to control a flow of data therebetween.

2. The computing system of claim 1 wherein the VNVM controls the flow between application virtual machines and middlebox virtual machines by inter-communicating with the application virtual machines and middlebox virtual machines to establish tunnels on the network therebetween.

3. The computing system of claim 2 wherein the tunnels are between application virtual machines and middlebox virtual machines.

4. The computing system of claim 2 wherein the tunnels are between the VNVM and one of the application virtual machines and middlebox virtual machines.

5. The computing system of claim 1 wherein the VNVM further

(ii) monitors a performance metric of the enterprise to request additional middlebox virtual machines from the cloud application according to that monitoring.

6. The computing system of claim 5 wherein the performance metric is requests per second handled by at least one application virtual machine.

7. The computing system of claim 5 wherein the VNVM further monitors a performance metric of at least one application virtual machine while changing a number of a middlebox virtual machines operating in parallel on a path of data flowing to at least one application virtual machine to determine where to increase a number of middlebox virtual machines on the path to at least one application virtual machine and adding middleboxes according to this determination.

8. The computing system of claim 7 wherein the VNVM intercommunicates with the application virtual machines and middlebox virtual machines to provide a splitting of data directed to multiple middlebox applications operating in parallel on a path of data flowing to at least one application virtual machine, the splitting of data preferentially assigning new data flows to a new middlebox until flows to the parallel middleboxes are substantially equal.

9. The computing system of claim 1 wherein the plurality of network connected computers are connected in a hierarchy of sub-networks and wherein the VNVM further

(iii) communicates with the cloud application to control placement of the middlebox virtual machines in particular sub-networks according to at least one of:

(a) intended connections of middlebox virtual machines to associated application virtual machines on the virtual network so that middlebox virtual machines are close to associated application virtual machines on a physical network;

(b) predicted scaling required by middlebox virtual machines so that middlebox virtual machines requiring substantial future scaling are separated from other middlebox virtual machines requiring substantial future scaling; and

(c) a ratio of input to output traffic for middlebox virtual machines so that middlebox virtual machines with a high ratio are close to virtual machines providing input to the middlebox virtual machine with a high ratio.

10. The computing system of claim 9 wherein the VNVM controls placement of the middlebox virtual machines within the sub-networks by at least one of:

(a) encouraging placement of virtual machines in the same sub-network by making the virtual machines the same size; and

(b) encouraging placement of virtual machines in the same sub-network by instantiating them at the same time.

11. A method of managing a plurality of network connected computers implementing virtual machines and controlled by a cloud application that dynamically allocates virtual machines to different enterprises and monitors costs of the virtual machines against an account for each enterprise;

the virtual machines for at least one enterprise including;

(1) application virtual machines executing software to implement an application for the enterprise; and

(2) middlebox virtual machines executing software enforcing rules related to transport of data between application virtual machines;

comprising the steps of;

(1) instantiating at least one VNVM executing software to dynamically control a virtual network interconnecting the application virtual machines and middlebox virtual machines; and

(2) operating the one VNVM to intercommunicate with the application virtual machines and middlebox virtual machines to control the flow of data therebetween.

12. The method of claim 11 wherein the VNVM controls the flow between application virtual machines and middlebox virtual machines by inter-communicating with the application virtual machines and middlebox virtual machines to establish tunnels on the network therebetween.

13. The method of claim 12 wherein the tunnels are between application virtual machines and middlebox virtual machines.

14. The method of claim 12 wherein the tunnels are between the VNVM and one of the application virtual machines and metal box virtual machines.

15. The method of claim 11 further including the step of:

(3) using the VNVM to monitor a performance metric of the enterprise to request additional middlebox virtual machines from the cloud application according to that monitoring.

16. The method of claim 15 wherein the performance metric is requests per second handled by at least one application virtual machine.

17. The method of claim 15 further including the steps of using the VNVM to monitor a performance metric of at least one application virtual machine while changing a number of a middlebox virtual machines operating in parallel on a path of data flowing to at least one application virtual machine to determine where to increase a number of middlebox virtual machines on the path to at least one application virtual machine and adding middleboxes according to this determination.

18. The method of claim 17 further including the step of using the VNVM to intercommunicate with the application virtual machines and middlebox virtual machines to provide a splitting of data directed to multiple middlebox applications operating in parallel on a path of data flowing to at least one application virtual machine, the splitting of data preferentially assigning new data flows to a new middlebox until flows to the parallel middleboxes are substantially equal.

19. The method of claim 18 wherein the network connected computers may be held in different racks and wherein the splitting of data preferentially assigns data flows to reduce dataflows passing between different racks

20. The method of claim 11 wherein the plurality of network connected computers are connected in a hierarchy of sub-networks and further including the step of:

(4) using the VNVM to communicate with the cloud application to control placement of the middlebox virtual machines in particular sub-networks according to at least one of;

(a) intended connections of middlebox virtual machines to associated application virtual machines on the virtual network so that middlebox virtual machines are close to associated application virtual machines on the physical network;

(b) predicted scaling required by middlebox virtual machines so that middlebox virtual machines requiring substantial future scaling are separated from other middlebox virtual machines requiring substantial future scaling; and

(c) a ratio of input to output traffic for middlebox virtual machines so that middlebox virtual machines with a high ratio are close to virtual machines providing input to the middlebox virtual machine with a high ratio.

21. The method of claim 20 wherein the VNVM controls placement of the middlebox virtual machines within the sub-networks by at least one of:

(a) encouraging placement of virtual machines in the same sub-network by making the virtual machines the same size; and

(b) encouraging placement of virtual machines in the same sub-network by instantiating them at the same time.