VIOLIN: A Network Virtualization Middleware for Virtual Networked Computing Dongyan Xu Lab FRIENDS (For Research In Emerging Network and Distributed Services) Department of Computer Sciences Center for Education and Research in Information Assurance and Security (CERIAS) Purdue University

The Team  Lab FRIENDS  Xuxian Jiang (Ph.D. student)  Paul Ruth (Ph.D. student)  Dongyan Xu (faculty)  Supported in part by NSF Middleware Initiative (NMI)

Outline  Motivations and goals  Architecture of VIOLIN  Applications of VIOLIN  Network system emulation  Scientific computing  Honeyfarm (network attack aggregation)  On-going work

Motivations  Formation of wide-area shared cyber-infrastructure  Multiple domains  Heterogeneous platforms  Large number of users  Need for mutually isolated distributed environments  Customized system administration and configuration  Consistent and binary-compatible runtime support  Un-trusted or malfunctioning applications  Known vulnerabilities in KaZaa, and Condor  Un-trusted network traffic control

Potential Applications  Multi-institutional collaboratories  Large-scale distributed emulations  Cyber-systems  Real-world systems  Parallel/distributed scientific applications  Philanthropic (volunteer) computing services  Content distribution networks

VM (Virtual Machine): a Solution?  Achieves single node isolation (SODA*)  Administration  Resource  Runtime services/libraries  Fault/attack impact  However, does not achieve network isolation  VMs addressable from/to any Internet hosts  Cannot control traffic volume between VMs  Cannot have overlapping address spaces * X. Jiang, D. Xu, “SODA: Service-on-Demand Architecture for Service Hosting Utility Platforms”, IEEE HPDC-12, 2003.

VIOLIN: Proposed Solution  VIOLIN: A VN (Virtual Network) for VMs *  Independent IP address space  Invisible from Internet and vice versa  Un-tamperable topology and traffic control  Value-added network services (e.g., IP multicast)  Binary and IP compatible runtime environment * X. Jiang, D. Xu, “VIOLIN: Virtual Internetworking on OverLay INfrastructure”, Springer LNCS Vol (ISPA 2004). * D. Xu, X. Jiang, “Towards an Integrated Multimedia Service Hosting Overlay”, ACM Multimedia 2004.

VIOLIN: the Big Picture Internet NMINMI NMINMI NMINMI NMINMI NMINMI NMINMI NMINMI Physical infrastructure NMI-based Grid infrastructure Two mutually Isolated VIOLINs VM

Key Ideas in VIOLIN  One level of indirection between VIOLIN and real Internet  “All problems in Computer Science can be solved by another level of indirection ” – Butler Lampson  A middleware-level underlay network serving as “intelligent carrier” of a VIOLIN  Traffic tunneling  Topology control  Traffic volume control  Traffic encryption  Network service virtualization

VIOLIN Architecture Host OS Guest OS App 1 Guest OS App 2 VIOLIN daemon … Existing NMI Middleware VMs Physical host

VIOLIN Architecture Host OS Guest OS App 1 VIOLIN daemon Virtual NIC Host OS Guest OS App 1 VIOLIN daemon Virtual NIC Message (e.g.,MPI) TCP, UDP, … IP Ethernet frame via UDP tunneling Between two VIOLIN nodes (VMs) planetlab6.csail.mit.eduplanetlab6.millennium.berkeley.edu

VIOLIN Network Performance TCP throughput measurement on PlanetLab planetlab6.csail.mit.edu → planetlab6.millennium.berkeley.edu

VIOLIN Network Performance ICMP latency measurement on PlanetLab planetlab6.csail.mit.edu → planetlab6.millennium.berkeley.edu

Application I: Network System Emulation  vBET: an education toolkit for network emulation *  “Create your own IP network ” on a shared platform  IP address space and network topology  Routers, switches, firewalls, end-hosts, links  Real-world network software (OSPF, BGP…)  Strict confinement (network security experiments)  Flexible configuration  Not constrained by device/port availability  No manual cable re-wiring or hardware setup * X. Jiang, D. Xu, “vBET: a VM-Based Emulation Testbed”, ACM SIGCOMM Workshop on Models, Methods, and Tools for Reproducible Network Research (ACM MoMeTools), 2003

vBET GUI

Sample Emulation: OSPF Routing

Emulation of OSPF Routing Demo video clip:

Sample Emulation: Critical Server Protection

Screenshot: Distributed Firewall

Sample Emulation: Chord P2P Network

Screenshot

Sample Emulation: Internet Worms * X. Jiang, D. Xu, H. J. Wang, E. H. Spafford, “Virtual Playgrounds for Worm Behavior Investigation”, 8 th International Symposium on Recent Advances in Intrusion Detection (RAID’05), A shared infrastructure (e.g. PlanetLab) A worm playground Virtual Physical

Application II: Scientific Computing *  Virtual clusters leveraging idle CPU cycles  Long running parallel/distributed jobs  Complicated communication patterns between nodes (different from Condor)  Runtime adaptation  Resource re-allocation  Migration/re-location  Scale adjustment * P. Ruth, X. Jiang, D. Xu, S. Goasguen, “Towards Virtual Distributed Environments in a Shared Infrastructure”, IEEE Computer, May 2005.

Experiment Setup Physical Cluster (ITaP) Two mutually isolated virtual clusters VM Physical Switch VS

VIOLIN vs. Physical Hosts (running HPL benchmark)  Physical host: dual processor 1.2 GHz Athlon, 1GB memory  VM: running one per host, ≤512MB memory

Multiple VIOLINs Sharing Physical Hosts (running HPL benchmark)  Aggregate performance remains stable (up to 16 VIOLINs)  In this example, 16 VIOLINs exhaust memory

VM Communication Pattern 7MB/s 6MB/s MB/s 6MB/s 5MB/s 7MB/s 5MB/s 3MB/s

Application III: Honeyfarm  Collapsar: a network attack aggregation center *  Achieving two (seemingly) conflicting goals  Distributed honeypot presence  Centralized honeypot operation  Key ideas  Leveraging unused IP addresses in each network  Diverting corresponding traffic to a “detention” center (transparently), by VIOLIN  Creating VM-based honeypots in the center * X. Jiang, D. Xu, “Collapsar: a VM-Based Architecture for Network Attack Detention Center”, 13 th USENIX Security Symposium (Security’04), 2004.

Collapsar Architecture VM-based Honeypot Collapsar Architecture Redirector Correlation Engine Management Station Production Network Collapsar Center Attacker Front-End

Real-Time Worm Alert * X. Jiang, D. Xu, R. Eigenmann, “Protection Mechanisms for Application Service Hosting Platforms”, IEEE/ACM CCGrid’04, 2004.

Log Correlation: Stepping Stone iii.jjj.kkk.11 compromised a honeypot & installed a rootkit, which contained an ssh backdoor xx.yyy.zzz.3 connected to the ssh backdoor using the same passwd

Log Correlation: Network Scanning

On-going Work  VIOLIN-based virtual distributed environments on shared cyber-infrastructure  Self-management (making them smart entities)  Missing role of VIOLIN administrator  Automatic customization and bootstrapping  Enforcement of application-specific policies  Self-provisioning (application-driven)  Resource scaling  Scale adaptation  Topology evolution

Thank you. For more information: URL: Google: “Purdue SODA Friends”