Architectural approaches to enhancing the performance and security of cloud networks

Abstract

While cloud computing has gained significant popularity and become an integral part of many businesses these days, lots of security challenges are still located in the infrastructure of cloud systems. In particular, the architectural problems of cloud components have persistently posed serious threats and performance degradations to not only cloud services but also the cloud infrastructure itself. Hence, this dissertation focuses on three major architectural problems among various types of security problems in cloud components: (1) the limited composability of security functionalities in SDN controllers, (2) the limited network isolation and security enforcement of containerized cloud services, and (3) the limited security capabilities due to the performance uncertainty of NFV-based service chains. Then, this dissertation proposes Barista, an operator-defined reconfigurable NOS for software-defined networks, Bastion, a security enforcement network stack for containers, and Probius, an automated performance profiling framework for NFV-based service chains, to address each problem. Even though the proposed solutions are not enough to address all kinds of security problems in the cloud infrastructure, we believe that they will take an important step toward enhancing the performance and security of the cloud infrastructure.