Resource Optimization to Provision a Virtual Private Network Using the Hose Model

Transcription

1 Resource Optimization to Provision a Virtua Private Network Using the Hose Mode Monia Ghobadi, Sudhakar Ganti, Ghoamai C. Shoja University of Victoria, Victoria C, Canada V8W 3P6 e-mai: {monia, sganti, gshoja}@cs.uvic.ca Abstract Virtua Private Networks (VPN) provide a secure and reiabe communication between customer sites over a shared network. With increase in number and size of VPNs, providers need efficient provisioning techniques that adapt to customer demands. The recenty proposed hose mode for VPN aeviates the scaabiity probem of the pipe mode by reserving for its aggregate ingress and egress bandwidth instead of between every pair of VPN endpoints. Existing studies on quaity of service guarantees in the hose mode either dea ony with bandwidth requirements or regard the deay requirement as the main objective ignoring the bandwidth cost. In this work we propose a new approach to enhance the hose mode to guarantee deay requirements between endpoints whie optimizing the provisioning bandwidth cost. We connect VPN endpoints using a tree structure and our agorithm attempts to optimize the tota bandwidth reserved on edges of the VPN tree. Our proposed approach takes into account the user preferences in meeting the deay requirements and provisioning cost to find the optima soution of resource aocation probem. Our experimenta resuts indicate that the VPN trees constructed by our proposed agorithm meet minimum deay requirements whie reducing the bandwidth requirements as compared to previousy proposed agorithms. I. INTRODUCTION A Virtua Private Network (VPN) is a group of computer systems connected as a private network but communicates over a pubic network. The aim is to provide the VPN endpoints with a service comparabe to a dedicated private network estabished with eased ines. Thus, providers of VPN services need to address the QoS and security issues whie depoying a VPN over a shared IP network. In recent years, substantia progress in the IP security technoogies have enabed existing VPN service offerings to provide customers with a eve of privacy comparabe to that offered by a dedicated ine [5]. The emergence of IP technoogies such as MPLS and RSVP-TE [1] have made it possibe to reaize IP-based VPNs that can provide the end customers with QoS guarantees. In the context of QoS guarantee in VPNs, ony deay and aggregate bandwidth guarantee has been considered and we wi consider the same in this work. In this paper, we address the probem of resource aocation in VPN hose mode with QoS guarantees whie optimizing tota provisioning bandwidth cost. Two popuar modes have been proposed for providing QoS in the context of VPNs: the pipe mode [1] and the hose mode [2]. As depicted in Fig. 1, in the pipe mode, a VPN customer buys a set of customer-pipes, i.e., aocations of specific bandwidth on paths between every source-destination pair of the VPN endpoints. However, in the hose mode, as iustrated in Fig. 2, each VPN endpoint connects to the network by a hose, which is specified by its aggregate ingress and egress bandwidth requirements. The hose mode has desirabe characteristics such as ease of specification, fexibiity, and mutipexing gain [2]. A number of provisioning agorithms for VPNs in the hose mode have been proposed [2, 3, 5, 6, 1]. In [2], a hose is reaized with a source-based tree and a factor of two to three in capacity savings over the pipe mode is achieved. The authors suggested that using a Steiner tree connecting VPN endpoints woud optimize the tota bandwidth provisioning cost. Further, in [5], it has been shown that optima bandwidth aocation probem in VPN hose mode is NP-compete. In their work, hoses are impemented with a singe shared tree and the proposed agorithms attempt to optimize the tota bandwidth reserved on the edges of the VPN tree. The bandwidth efficiency of the hose mode is studied in [3] where the over-provisioning factor of the mode is evauated in networks with various sizes and node densities. In [7], a muti-path routing provisioning approach is proposed for the hose mode. A VPN network is modeed as a graph G = (V, E) where V is the set of nodes and E is the set of bidirectiona inks connecting the nodes. Each ink (u, v) is associated with two QoS metrics: maximum bandwidth capacity over the ink and deay between ink endpoints. The deay vaue of a path is defined as the sum of the deay vaues of a the inks aong it. The VPN specification in the hose mode incudes: A subset of endpoints P V corresponding to the VPN endpoints; and for each VPN endpoint i P, the associated ingress and egress bandwidths i in and i out, respectivey [5]. The nature of the Service Leve Agreement (SLA) between a customer and a service provider is driven by the traffic characteristics and QoS requirements of the customer appications that make use of the VPN. For exampe, a voiceover-ip VPN service might require tight bounds on the packet oss rate, deay, and possiby jitter. On the other hand, a dataony VPN service might have reativey ess stringent or no deay requirements. To ensure that appropriate requirements can be met, it is essentia for the provider to know the traffic /7/$ IEEE 512

2 Fig. 1: VPN pipe mode Fig. 2: VPN hose mode characteristics. Athough the hose mode provides customers with simper and more fexibe SLAs, the mode presents the provider with a more chaenging probem of resource management. It is aso difficut to provide QoS guarantee in the hose mode since VPN customers specify QoS requirements per VPN endpoint and not for every pair of endpoints. The main probem of interest in this work is the probem of constructing a shared tree connecting a the VPN endpoints with the objective of satisfying the end-to-end deay requirements and guaranteeing the aggregate bandwidth whie minimizing the provisioning bandwidth cost. Compared to the pipe and source-based tree approaches, the shared tree approach makes the best use of statistica mutipexing to reduce the provisioning cost. Thus, we consider tree structures to connect the VPN endpoints in P since trees are scaabe and simpify routing and restoration. Furthermore, trees aow the bandwidth reserved on a ink to be shared by the traffic between the two sets of VPN endpoints connected by the ink [5]. The rest of the paper is organized as foows. A short review on the previous works that this agorithm is based on is presented in section II. The Optima andwidth Deay Shared Tree (ODST) agorithm that meets the deay requirement whie minimizing the provisioning cost is described in section III. Section IV presents the discussion on time compexity. Simuation resuts comparing the performance of the proposed agorithm are presented in section V. Finay, section VI concudes the paper. II. MOTIVATION AND RELATED WORK The prima-dua agorithm for computing VPN tree was deveoped by Kumar et a. [5]. Their approach finds the near optima bandwidth provisioning tree in which a 1- approximation is obtained by soving the inear program reaxation and rounding the fractiona soution. This approach can find a tree with cost smaer than a Steiner tree suggested in [2]. Foowing the notation of Kumar s paper, for a ink (u, v), et P u (u,v) / P v (u,v) denote the set of VPN endpoints in the connected component of tree T connecting nodes u/v when ink (u,v) is deeted from T. In [5] it has been shown that the bandwidth to be reserved on ink (u,v) of T is C ( u, v) T = min{ ( u, v) Pu, out ( u Pv } + min{, v ) in ( u, v) Pv, out ( u Pu The tota bandwidth reserved for tree T is given by ( u, v ) C T = C. For the purpose of this paper, this aocation T ( u, v ) T of tota bandwidth (C T ) is used as bandwidth cost or provisioning cost. Since we are interested in minimizing the reserved bandwidth for tree T, the probem of computing the optima VPN tree becomes the foowing: Optima andwidth-constrained Shared Tree Probem (OSTP): Given a set of VPN endpoints P and their ingress p in and egress p out bandwidths, compute a shared VPN tree T, connecting these nodes for which C T is minimum. In [5] it is proved that the OSTP is NP-hard. Zhang et a. [8] suggested cassifying appications that use VPN in order to sove the Optima Deay-constrained Shared Tree Probem (ODSTP). Each cass, j, is characterized by its end-to-end deay requirement, maximum_aowabe_deay(j) that must hod between every pair of endpoints. ODSTP addresses the probem of finding a shared tree T connecting VPN endpoints that satisfies the deay requirement. In practice, the deay casses are obtained by measuring characteristics of typica appications over the VPN. The ODSTP Probem has aso been proved to be NP-hard [8]. Zhang et a. [8], find near optima deay constrained shared tree by formuating a Minimum Diameter Steiner Tree (MDStT) probem to make the shared tree support the deay requirements. The diameter of a Steiner tree connecting the VPN endpoints is defined as the maximum deay between any two endpoints. The minimum deay requirement that can be supported by the shared tree can be obtained by finding the minimum diameter Steiner tree. The MDStT supports the owest deay requirement using a tree structure. However to buid a ow provisioning cost tree, Zhang et a. [8] suggested a Least-Cost-Least-Deay (LCLD) approach which tries to reduce the provisioning bandwidth whie maintaining the deay requirement. We found no previous proposed way to construct the shared tree connecting VPN endpoints ensuring that both provisioning cost and deay requirement woud be minimized. LCLD agorithm [8] satisfies the deay requirement, but there is no guarantee that the provisioning cost is optima. In this paper, we use a combination of both MDStT [8] and prima-dua [5] agorithms to find the trees with minimum, v ) in }. (1) 513

3 provisioning cost that aso satisfy the deay requirement. For carity of presentation, in the foowing sections, ony the provisioning of one specific deay cass with its given deay requirement and the associated ingress and egress bandwidths for each VPN endpoint is discussed. Note that the deay requirement is identica for a the VPN endpoints for a given cass. Thus provisioning a VPN network can be viewed as provisioning each of the deay casses separatey [8]. III. OUR CONTRIUTIONS This paper s main objective is to find a near optima shared tree considering the deay requirement whie trying to minimize the tota provisioning bandwidth cost. The probem can be formuated as foows: Optima andwidth and Deay-constrained Shared Tree Probem (ODSTP): Given a set of VPN endpoints P with their associated ingress and egress bandwidths and the maximum_aowabe_deay, compute a shared tree T connecting a the VPN endpoints satisfying the deay requirement in which the tota provisioning bandwidth cost is minimized. In this work, we deveop agorithms to sove the ODSTP ignoring ink capacity constraints. Our proposed approach can be extended to hande ink capacity constraints. Our methodoogy is to find two sets of shared trees: one optimizing the deay requirement and the other optimizing the bandwidth cost. From these sets, we seect the best soution regarding both deay and bandwidth requirements using user specified preference parameters. Our approach consists of four phases. In phase 1, we use a modified version of MDStT agorithm [8] to construct shared tree(s) connecting a VPN endpoints with the objective of satisfying the given maximum aowabe deay. In this step, simiar to LCLD approach [8], we deveop our MDStT agorithm based on absoute center probem [11]. In our approach, if more than one oca 1-center points satisfy the deay requirement, in contrast to LCLD approach [8], a of them woud be set as one of the candidates for center of the graph. For each center candidate, a Steiner tree connecting it to a VPN endpoints using the minimum deay path woud be constructed. The set of constructed trees is caed ODST set. This set of trees consists of a the shared trees which satisfy the deay requirement but might not minimize the provisioning bandwidth. In phase 2, the tota provisioning bandwidth of each tree in ODST set, using (1), is computed. The maximum bandwidth cost for trees in ODST set is chosen as the bandwidth threshod to be used in the next phase. This threshod is the maximum amount of provisioning bandwidth that we are interested in. In phase 3, we use a modified version of primadua agorithm [5], to construct shared tree(s) connecting a the VPN endpoints with the cost ess than the bandwidth threshod. The set of constructed trees in this phase is caed OST set. This means that a the shared trees with tota provisioning bandwidth ess than the bandwidth threshod woud be added to OST set. Our approach to modify prima-dua [5] agorithm is that we save a the trees satisfying the bandwidth threshod requirement whie primadua [5] agorithm ony returns one tree with the smaest cost. In phase 4, a ranking scheme is used to rank the trees in ODST and OST sets. The trees with smaest rank woud be the best candidate for ODSTP. Ranking the trees is done according to user specified bandwidth/deay preference and maximum aowabe deay of the particuar service cass. These parameters depend upon cass-of-service of the appication and user preference in meeting bandwidth/deay requirements. We formuate the foowing scheme for choosing from the above sets of trees the ones that wi be cosest to satisfy user's bandwidth/deay requirements. For each shared tree T, the foowing vaue wi be cacuated: T ODST OST, Rank( T ) = deay _ diametert deay _ preference + maximum _ aowabe _ deay bandwidth _ costt bandwidth _ preference. (2) bandwidth _ threshod In the above formua, the maximum_aowabe_deay is defined as the maximum aowabe end-to-end deay dependent on the cass-of-service. The deay_diameter T is defined as maximum end-to-end deay between VPN endpoints of each tree T. The bandwidth_cost T is defined as sum of provisioning bandwidth over inks of T. As expained earier, the bandwidth_threshod is the maximum bandwidth cost for trees in ODST set. The parameters deay_preference and bandwidth_preference are set by the user. The owest ranked trees are candidates for providing near optima soutions. The justification to use this approach is that it provides needed fexibiity with respect to user's preferences in choosing deay versus bandwidth requirement. For exampe, VoIP appications may use arger deay preference whie a guaranteed data service appication may use arger bandwidth preference. As an exampe consider the graph depicted in Fig. 3. It contains a network with six nodes. Nodes, 1, 2, 3 are VPN endpoints with ingress/egress bandwidth equas to 5/5, 6/6, 7/7, 8/8 Mbps respectivey. The numbers on each edge indicate the ink s deay in miiseconds. Assume that the maximum aowabe deay for a particuar appication is 58 ms. The resut of phase 1 is iustrated in Fig. 4 in which the two shared trees A and beong to the ODST set and satisfy the maximum aowabe deay requirement. Then in phase 2, we compute the bandwidth_cost of each tree and the bandwidth_threshod is set as the maximum bandwidth_cost over the trees in ODST. In this case the maximum bandwidth_cost is the cost of the tree abeed as A which is 74 Mbps. Now, in phase 3, we execute our modified primadua agorithm on the origina network to find a the shared trees with tota bandwidth_cost ess than the bandwidth_threshod computed in phase 2. The modified prima-dua agorithm resuts in a set of trees abeed as C, D 514

4 and E in Fig. 5. Note that for the sake of carity we have not shown the homogeneous trees in Fig. 4 and Fig. 5. In phase 4, the ranking is performed for each tree in ODST and OST sets using (2). Assume that the bandwidth_preference and deay_preference are set equa to 1. The ranking vaue for each tree is as foowing: Rank of tree A = 74/74 + 5/58 = 1.86 Rank of tree = 52/ /58 = 1.7 Rank of tree C = 52/ /58 = 1.7 Rank of tree D = 62/ /58 = 1.85 Rank of tree E = 74/ /58 = 2.53 For this exampe, both trees and C have the same minimum rank. Therefore, one can choose either one of them. However, executing the LCLD agorithm [8] on this network woud resut in seection of tree A which has a arger bandwidth_cost. A 8/8 7/ /5 6/6 Fig. 3: A sampe network with 6 nodes IV. COMPLEXITY ANALYSIS As ong as our agorithm uses both MDStT [8] and primadua [5] agorithms to find the best near optima trees regarding both deay and bandwidth, its time compexity is a function of time compexities of MDStT and prima-dua agorithms. The former has time compexity equa to O(mp+npogp) and the atter has time compexity equa to O(n(mp 2 +mnp+n 2 ogn)) where m is number of edges, n is number of nodes and p is number of VPN endpoints in the network. In our ODST agorithm, during phase 1, a the shared trees constructed by setting each edge as the root might have deays ess than the deay threshod in the worst case. This wi not change the time compexity of finding the goba center in the MDStT agorithm [8] but the compexity of tree construction wi be affected. Thus the worst case time compexity wi be O(m 2 p+nmpogp) for phase 1. However, proper seection of maximum aowabe deay woud eiminate this scenario. In our extensive study regarding the seection of maximum aowabe deay, we found that setting this vaue to be a factor seected in interva [1, 1.5] times the minimum supportabe deay of the network (the vaue of the goba center) woud be the best seection that reduces the time compexity to a constant factor of MDStT agorithm [8] regardess of number of edges. Thus the time compexity of phase 2 is O(c). Execution of prima-dua agorithm [5] is independent of the bandwidth threshod since a the trees wi be constructed in prima-dua approach. The ony difference in our approach is that we keep the trees with bandwidth cost ess than the bandwidth threshod in a inked ist for further ranking. In the worst case, the maximum size of ODST set is the number of edges in the network (m) since each edge can be a candidate center point. The maximum size of OST set is the number of vertices of the network (n), since the agorithm iterates over a nodes in the network. Thus, the time compexity of ranking phase is O(m+n). Max Deay: 5 (W Cost: 74) C W Cost: 52 (Max Deay: 58) D V. SIMULATION STUDY Max Deay: 58 (W Cost: 52) Fig. 4: ODST set, the resut of performing phase 1 W Cost: 62 W Cost: 74 (Max Deay: 59) (Max Deay: 89) Fig. 5: OST set, the resut of performing phase 3 Two sets of topoogies were used in our simuations. The first set is taken from the Rocketfue project [9]. Among a the topoogies, we seected two dominant tier-1 ISP topoogies as isted in Tabe I. The ink deays of these two topoogies were computed based on their geographica distances. The second set was randomy generated using the Waxman Mode [4]. Since we can easiy contro the size of the topoogies, we use them to study the effect of the network size. In this mode, the nodes are paced on a 3 24KM 2 pane, roughy the size of the USA. The probabiity for two nodes to be connected by a ink decreases exponentiay with the Eucidean distance between them according to the (, ) foowing probabiity function: P u v e = α exp( ( u, v) / Lβ ) where L is the maximum distance between any two nodes in the network and (u, v) is the distance between u and v. The parameter β contros the ratio of short inks to ong inks, whie the parameter α contros the average node degree of E 515

5 the network. Large vaue of β increases the number of ong inks, and a arge vaue of α resuts in a arge average node degree. In the simuations, α and β were set at 2.2 and.15 respectivey. These vaues were seected to be the same as used in the MDStT agorithm [8] impementations. Like the Rocketfue topoogies, the ink deay vaues of the random networks were cacuated according to their geographica distances. For both sets of topoogies, the VPN endpoints were randomy seected from the network nodes. The number of VPN endpoints was set to 1% of the tota number of network nodes in the network uness expicity specified. The bandwidth requirement of each VPN endpoint was uniformy chosen between 2 and 1 Mbps. An asymmetry parameter r is associated with each endpoint, representing the ratio between the ingress and egress bandwidth requirements. This ratio varies from 1 to 256 in our simuations. Each simuation resut given beow is the average of 5 rounds of simuation run. The 95% confidence intervas are cacuated as ˆ θ t ˆ( σ ˆ) θ θ ˆ θ + t ˆ( σ ˆ) where θˆ is the average α / 2, f α / 2, f θ vaue of simuations runs, ˆ σ 2 ( ˆ θ ) is the standard deviation and t.25,4 is 2.78 according to Tabe A.5 in [12]. The resuts show that the confidence intervas for provisioning costs are ess than.5 Gbps and confidence intervas for minimum supportabe deay are ess than 5 ms. We define three different scenarios for our ODST agorithm: Scenario 1) bandwidth preference is equa to deay preference; Scenario 2) bandwidth preference is greater than deay preference; and Scenario 3) bandwidth preference is smaer than deay preference. The performance of different scenarios of ODST agorithm and LCLD agorithm [8] are compared in Figures 6 to 11. Fig. 6 compares the diameter of constructed shared trees connecting VPN endpoints. This vaue can be interpreted as the minimum deay requirement supported by each tree. The resuts show that using ODST agorithm with deay preference greater than bandwidth preference woud resut in smaer minimum supported deay than LCLD agorithm [8]. The reason is that in LCLD agorithm ony one center point wi be considered to construct the shared tree whie in our agorithm a the candidate centers are considered. Moreover, the resuts in Fig. 7 show that our agorithm wi aways resut in smaer provisioning bandwidth cost. Note that since the Sprint network is a more inear network than the random networks generated by Waxman mode, there is an increase in the minimum supportabe deay for Sprint network in Fig. 6. Fig. 8 iustrates the effect of increasing number of VPN endpoints on provisioning cost for a 1 network node. As stated earier, the resuts show that our ODST agorithm aways resuts in smaer provisioning cost compared to LCLD agorithm [8]. Fig. 9 shows the effect of increasing the number of VPN endpoints on the execution time of agorithms. Fig. 1 shows the effect of increasing the network size on the execution time. As the resuts shows, running ODST agorithm on a typica tier 1 network, which has around 1 nodes, does not require more than 1 minute. TALE I ROCKETFUEL ISP TOPOLOGIES USED IN THE SIMULATIONS AS Number Name Tier No.of Edges 1239 Sprint(US) ATT(US) Minimum deay requirement supported (ms) Provisioning Cost (Mbps) Provisioning cost (Mbps) ODST agorithm (Scenario 3) MDStTagorithm ODST agorithm (Scenario 1) ODST agorithm (Scenario 2) No.of Nodes rand5 ATT rand1 Sprint rand15 rand2 Topoogies Fig. 6: Minimum deay requirement supported ODST agorithm (Scenario 2) ODST agorithm (Scenario 1) ODST agorithm (Scenario 3) LCLD agorithm rand5 Sprint rand1 ATT rand15 rand2 Topoogies Fig. 7: The provisioning cost comparison 1 Nodes Network ased on Waxman Mode LCLD agorithm ODST agorithm (Scenario 2) Number of VPN nodes Fig. 8: Effect of number of VPN nodes on provisioning cost Since the resource aocation is not ikey to be performed more often than every one minute, this does not pose a probem. In Fig. 11 the effect of changing the bandwidth asymmetry ratio on provisioning cost is studied. The ratio between ingress and egress bandwidth of VPN endpoints has 516

6 Execution time (s) Nodes Network ased on Waxman Mode LCLD agorithm ODST agorithm Number of VPN nodes Zhang et a. Our agorithm modifies and combines primadua agorithm [5] and Least-Cost-Least-Deay agorithm [8] to find the MDStT tree that satisfies the maximum aowabe deay and provides optimum provisioning cost. For future work, the ranking scheme wi be extended to incude ink capacity constraints and any ink capacity enhancement features (e.g. increase the path or ink bandwidth) into our ranking scheme. This can be done by introducing two more parameters such as the enhancement preference and enhancement cost in our ranking scheme. The atter can be interpreted as the preference of network administrator to increase the bandwidth capacity of a particuar ink whie the former is the monetary cost to perform such operation. Provisioning cost (Mbps) Execution time (s) Fig. 9: Effect of number of VPN nodes on execution time LCLD agorithm ODST agorithm Number of nodes Fig. 1: Effect of number of network nodes on execution time 1 Nodes Network ased on Waxman Mode LCLD agorithm ODST agorithm andwidth asymmetry ratio REFERENCES [1]. Davie, Y. Rekhter. MPLS technoogy and appications, San Mateo, CA: Morgan Kaufmann, 2. [2] N. G. Duffied, P. Goya,A. Greenberg, P. Mishra, K. K Ramakrishnan, J. E. van der Merwe, A fexibe mode for resource management in Virtua Private Networks, In Proc. ACM SIGCOMM, vo (4), 1999, pp [3] A. Juttner, I. Szabo, A. Szentesi, On bandwidth efficiency of the Hose resource management mode in Virtua Private Networks, In Proc. INFOCOM, vo. 1, 23, pp [4]. M. Waxman, Routing of mutipoint connections, IEEE Journa on Seected Areas in Communications, vo. 6(9), 1988, pp [5] A. Kumar, R. Rastogi, A. Siberschatz,. Yener, Agorithms for provisioning Virtua Private Networks in the hose mode, IEEE/ACM Transaction on Networking, vo. 1(4), 22, pp [6] G. de Veciana, S. Park, A. Sang, S. Weber. Routing and provisioning VPNs based on hose traffic modes and/or constraints. In Proc. 4th Annua Aerton Conference on Communication Contro and Computing, 22, pp [7] T. Erebach, M. Ruegg, Optima bandwidth reservation in hose mode VPNs with muti-path routing, In Proc. INFOCOM, vo. 4, 24, pp [8] L. Zhang; J. Muppaa, S. Chanson, Provisioning virtua private networks in the hose mode with deay requirements. Hong Kong University, Internationa Conference on Parae Processing, 25, pp [9] Rocketfue project, Computer Science and Engineering, Univ. of Washington. [1] A. Gupta, A. Kumar, Keinberg, R. Rastogi,.Yener, Provisioning a Virtua Private Network: A network design probem for muticommodity fow, In Proc. ACM STOC, 21, pp [11] S. Hakimi. Optima ocations of switching centers and medians of A graph, Operations Research, vo. 12, 1964, pp [12] Jerry anks, John S. Carson, arry L. Neson, David M. Nico, Discrete-Event System Simuation, Fourth Edition, Prentice Ha, 25. Fig. 11: Effect of asymmetry ratio been increased from 1 to 256. The resuts show that our ODST agorithm woud sti perform better than the LCLD agorithm. VI. CONCLUSIONS AND FUTURE WORK In this work, we introduced a new ranking scheme based on user preferences to optimize the provisioning bandwidth cost whie supporting the minimum deay requirement in VPN hose mode. This scheme wi resut in ower bandwidth provisioning costs than the previous work introduced by 517