Open Cloud eXchange (OCX)
Draft Proposal
GN3plus JRA1 Task 2 - Network Architectures for Cloud Services

Yuri Demchenko
SNE Group, University of Amsterdam
3-6 June 2013, TNC2013, Maastricht

Outline• GN3+ JRA1: Network Architectures for Horizon 2020
– Standardisation contribution• General use cases and scenarios for Cloud services delivery to NRENs
and universities– Cloud and Intercloud Infrastructure and Services• Open Cloud eXchange (OCX)– Requirements to OCX– OCX design principles and suggestions• Additional information– Intercloud Architecture Framework (ICAF) and Intercloud Federation Framework (ICFF)

JRA1 T2: Cloud NetworkOpen Cloud eXchange (OCX)

Slide_2

Cloud services for Universities• E-mail service, e.g. Gmail• Storage services– Shared storage, e.g. Dropbox, Box, SkyDrive– Backup storage• Scientific data access– Genome data
– LHC experiment data

• Computational power– HPC access (to limited extent)– VM and Cloud IaaS services– Cloud SaaS and CloudApps (e.g. Google Aps)

• Related (?): VoIP, CDN and other QoS critical services• Any other - To be added

JRA1 T2: Cloud Network

Open Cloud eXchange (OCX)

3

Use Cases for delivering Cloud services tocampus based users• Distributed (Big) Scientific Data processing with MPP tools
on distributed facilities– Data distributed between few location next to local datacenters• Streaming high-speed high volume experimental data to labs
in campus location– Direct links through campus network• CSP and campus L0-L2(L3) network peering– Dark fiber with termination as campus network or as CSP network• VoIP – SURFnet approach with mobile data access– Support mobile access network (LTE) and tunnel access to campusnetwork

JRA1 T2: Cloud Network

Open Cloud eXchange (OCX)

4

Intercloud Access and Delivery Infrastructure• Intercloud/Cloud Access and Delivery Infrastructure (ICADI)
is a functional layer between Cloud Services layer andCustomer services– Interconnects CSP location/datacenter and customer or user location• Also for multiple CSPs (inter-cloud) and multiple customer locations– Provides infrastructure for federated services and access control• Including service brokering– May include dedicated network infrastructure• Cloud Carrier service layer– Place for NREN services– “Last mile” for cloud services delivery• Need for Open Cloud eXchange (OCX)– As a core for “collapsed” ICADI layer functions
JRA1 T2: Cloud Network

Open Cloud eXchange (OCX)

5

General use case for infrastructure provisioning:
Workflow => Logical (Cloud) InfrastructureEnterprise/Scientific workflow
Storage
Data

SpecialProc 1
Data
Filtering

Input
Data

VisualPresentSpecial
Proc 2

Instrum.
Data

Campus A

Data
Archive

Visualisation

Visualisation

CE

User
Group A

Campus B

CE

User
User
User

User
User
User
VR6

Cloud 2 PaaS

VR2

VR7
VR4

VR1

VR5

Resource/Service
ProviderEnterprise/Scientificworkflow
Is mapped
to heterogeneous cloudinfrastructure containing
IaaS, PaaS componentsJRA1 T2: Cloud Network

User
Group B

VR3

Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

Resource/ServiceProvider
CN

CNCNCNCN

CN

Cloud PaaS Provider

CNCNCNCN
CN

Cloud IaaS Provider

Open Cloud eXchange (OCX)

6

Multi/inter- cloud infrastructure provisioning:=> ICADI and OCX functions
Enterprise/Scientific workflow
Campus A

Storage
Data

Visualisation

Visualisation

Data
Archive

Data
Filtering

Input
Data

CE
User
Group ASpecialProc 1VisualPresentCE

SpecialProc 2

Instrum.
Data

User
User
User

User
User
User

Campus B

User
Group BOCX as a part of GEANT infrastructure

OCXat NREN

OCXat NREN
VR6

Cloud 2 PaaS

VR2VR7
VR4VR1

Open Cloud eXchange(OCX) interconnects
CSP and Customer(campus) infrastructures

VR5

Resource/
ServiceProvider

VR3

Cloud 1 IaaS

Resource/
ServiceProvider
CNCN

OCX assumes collocationor collapsed backbone forconnecting all OCX members
JRA1 T2: Cloud Network

Enterprise/Project basedIntercloud Infrastructure

CN
CN
CN

CN

Cloud PaaS Provider

CN
CN

CN

CN
CN

Cloud IaaS Provider

Open Cloud eXchange (OCX)

7

General use case for infrastructure provisioning:
Logical Infrastructure => Network Infrastructure (1)Resource and Cloud Provider Domains
Cloud 1 IaaS
VR3

VR1Cloud 2 PaaS

VR5VR7Campus A
Infrastructure

Campus B
Infrastructure

VR2Campus A

VR4VR6Cloud Carrier Network Infrastructure

Visualisation

Visualisation

CEUserGroup A

Campus B

CE

User
User
User

User
User
User
VR6Cloud 2 PaaS

VR2

VR7
VR4VR1

VR5Resource/
ServiceProvider

Distributed
Resource/
heterogeneous cloud
Service
Providerinfrastructure requires
separately provisioned
network infrastructure thatcan be outsourced to Cloud Carrier
JRA1 T2: Cloud Network

User
Group B

VR3

Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

CNCNCNCNCNCN

Cloud PaaS Provider

CNCNCNCNCN

Cloud IaaS Provider

Open Cloud eXchange (OCX)

8

General use case for infrastructure provisioning:
Logical Infrastructure => Network Infrastructure (2)Resource and Cloud Provider Domains
VR3VR1

VR5

VR7Campus A
Infrastructure

Campus B
Infrastructure

VR2

VR4

OCX at Cloud Carrier or Network
Provider (NREN) level

Network Provider 1

Campus A

Visualisation

VR6Visualisation

Cloud Carrier or Network Provider 2

CE

User
Group A

Campus B

CE

User
User
User

User
User
User
VR6

Cloud 2 PaaS

VR2

VR7
VR4VR1

VR5Resource/ServiceProvider

Provisioning network
infrastructure may
involve multiple providersIntroducing OCX(Open Cloud eXchange)
JRA1 T2: Cloud NetworkUser
Group B

VR3

Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

Resource/
ServiceProvider
CN

CN
CN

CN
CN

CN

Cloud PaaS Provider

CN
CN

CN

CN
CN

Cloud IaaS Provider

Open Cloud eXchange (OCX)

9OCX Definition and Operational Principles• Direct service/inter-member peering– Re-use and leverage Internet eXchange– Open collocation services• No third party (intermediary/broker) services– Transparency for cloud based services– No involvement into peering or mutual business relations• Trusted Third Party (TTP)– To support dynamic service agreements and/or federation
establishment– Trusted Introducer for dynamic trust establishment• May include other special services to support smoothservices delivery and integration between CSP andCustomer– E.g., Local policies, service registry and discovery
JRA1 T2: Cloud Network

Open Cloud eXchange (OCX)

10

OCX Topological model and Connectivity

OCX

Nodes: Providers and customers

OCX

OCX Facilities

OCX L0-L2/L3 topology• Any-to-any• Distributed or collapsed backbone• Hierarchical• Topology information exchange
L0-L2 + L3? between members

QoS parameters• Bandwidth• Speed, latency• Jitter, impairment

OCX backbone links/connectivity(Lo-L2)
JRA1 T2: Cloud Network

OCX

Open Cloud eXchange (OCX)

11

OCX Trusted Third Party services
TTP goals and services• Enable dynamic federations
establishing• Trusted Certificates and CA’s
Repository

TTP– Similar to TACAR (TERENA
Academic CA Repository)• Trusted Introducer
OCX• Service Registry and Discovery• Intercloud policy clearinghouse– Repository of CSP policies– Common policy templatePre-established trust relation with OCX as TTP
Trust relations established as a part ofdynamic federation between OCX members
JRA1 T2: Cloud Network• SLA repository andclearinghouse

Open Cloud eXchange (OCX)

12

OCX location options: GN3, NREN (+University?)
GEANT

CSP

NREN

University

Visualisation

VR6CE

VR7DFlow

OCX

VR4
VR5User
User
User

VR3

IP/L3
L2Visualisation

VR6

CE

VR7

L1

OCX

VR4User
User
User

VR5L0

VR3

JRA1 T2: Cloud Network

Open Cloud eXchange (OCX)

13

OCX Hierarchical Topology Model
GEANT

CSP

NREN

University

Visualisation

VR6

CE

VR7OCX

VR4VR5User
User
User

VR3DFlow
IP/L3
L2Visualisation

VR6CE

VR7

L1OCX

VR4User
User
User

VR5L0

VR3

JRA1 T2: Cloud Network

Open Cloud eXchange (OCX)

14

OCX Extended Backplane Topology ModelGEANTCSP

NRENUniversityVisualisation

VR6CE

VR7OCX

VR4VR5User
User
User

VR3DFlow
IP/L3L2Visualisation

VR6CE

VR7

L1OCX

VR4User
User
User

VR5L0

VR3

JRA1 T2: Cloud Network

Open Cloud eXchange (OCX)

15

OCX Development – Next Steps• Initial draft issued – 27 May 2013
• GN3plus inter-activities discussion and feedback– First round of comments and update – end of June 2013
– Second round of comments and update – Sept. 2013
– External comments and community feedback – by Sept
2013

• Design and implementation – TBD• Standardisation contribution – OGF, IETF, ITU-T,IEEE, NIST
JRA1 T2: Cloud Network

Open Cloud eXchange (OCX)

16

Discussion and Questions

JRA1 T2: Cloud Network

Open Cloud eXchange (OCX)

17

Additional Information

JRA1 T2: Cloud Network

Open Cloud eXchange (OCX)

18

InterCloud Architecture Framework (ICAF)• Multi-layer Cloud Services Model (CSM)– Combines IaaS, PaaS, SaaS into multi-layer model with inter-layer interfaces– Including interfaces definition between cloud service layers and virtualisationplatform• InterCloud Control and Management Plane (ICCMP)– Allows signaling, monitoring, dynamic configuration and synchronisation of thedistributed heterogeneous clouds– Including management interface from applications to network infrastructure andvirtualisation platform• InterCloud Federation Framework (ICFF)– Defines set of protocols and mechanisms to ensure heterogeneous clouds
integration at service and business level– Addresses Identity Federation, federated network access, etc.

• InterCloud Operations Framework (ICOF)– RORA model: Resource, Ownership, Role, Action•RORA model provides basis for business processes definition, SLA and access control– Broker and federation operation• Intercloud Security Framework (ICSF)– Dynamic Security Infrastructure provisioning and protocols
JRA1 T2: Cloud Network

Open Cloud eXchange (OCX)

19

Multilayer Cloud Services Model (CSM)

Security InfrastructureManagementOperations Support System

User/Client Services* Identity services (IDP)* Visualisation

User/Customer Side Functions and Resources

Administration andManagement Functions(Client)

Content/Data Services* Data * Content * Sensor * Device

1

Endpoint Functions* Service Gateway* Portal/Desktop

Access and DeliveryInfrastructureInter-cloud Functions* Registry and Discovery* Federation Infrastructure

Cloud Services (Infrastructure, Platform, Application, Software)

IaaS

SaaS

PaaS

PaaS-IaaS IF

Layer C5Services
Access/Delivery

Layer C4Cloud Services(Infrastructure,Platforms,Applications,Software)

PaaS-IaaS Interface
IaaS – Virtualisation Platform Interface

Cloud Management
Software(Generic Functions)

Cloud Management Platforms
OpenNebula

Virtualisation Platform

OpenStack

KVM

VM

VM

VPN

Other
CMS

XEN

VMwareNetwork
Virtualis

Proxy (adaptors/containers) - Component Services and Resources

StorageResources

ComputeResources

Contrl&Mngnt Links
JRA1 T2: Cloud Network

Layer C6
User/Customerside Functions

Hardware/PhysicalResources

NetworkInfrastructure

Layer C3
Virtual Resources
Composition andControl(Orchestration)

CSM layers(C6) User/Customer sideFunctions(C5) Intercloud Access andDelivery Infrastructure(C4) Cloud Services(Infrastructure, Platform,Applications)(C3) Virtual Resources
Composition andOrchestration(C2) Virtualisation Layer(C1) Hardware platform anddedicated network
infrastructure

Layer C2
Virtualisation

Layer C1
PhysicalHardwarePlatform andNetwork

Control/
Mngnt Links

Data Links

Data Links

Open Cloud eXchange (OCX)

Slide_20

General use case for infrastructure provisioning:
Workflow => Logical (Cloud) Infrastructure (1)Enterprise/Scientific workflow
Storage
DataSpecial
Proc 1
Data
Filtering

Input
Data

VisualPresentSpecial
Proc 2Instrum.
Data

Campus A

Data
Archive

Visualisation

Visualisation

CE

User
Group A

Campus B

CE

User
User
User

User
User
User
VR6

Cloud 2 PaaS

VR2

VR7
VR4

VR1

VR5

Resource/
Service
ProviderImplementing
Resource/
Enterprise/ScientificService
Providerworkflow or
supporting a business modelis an ultimate goal of any
infrastructure
JRA1 T2: Cloud Network

User
Group B

VR3

Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

CN

CNCNCNCNCN

Cloud PaaS Provider

CNCNCN

CNCN

Cloud IaaS Provider

Open Cloud eXchange (OCX)

21

General use case for infrastructure provisioning:
Workflow => Logical (Cloud) InfrastructureEnterprise/Scientific workflow
Storage
Data

SpecialProc 1
Data
Filtering

Input
Data

VisualPresentSpecial
Proc 2

Instrum.
Data

Campus A

Data
Archive

Visualisation

Visualisation

CE

User
Group A

Campus B

CE

User
User
User

User
User
User
VR6

Cloud 2 PaaS

VR2

VR7
VR4

VR1

VR5

Resource/
Service
ProviderEnterprise/Scientificworkflow
Is mapped
to heterogeneous cloudinfrastructure containing
IaaS, PaaS components
JRA1 T2: Cloud Network

User
Group B

VR3

Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

Resource/ServiceProvider
CN

CNCN

CN
CN

CN

Cloud PaaS Provider

CNCN

CN

CN
CN

Cloud IaaS Provider

Open Cloud eXchange (OCX)

22

General use case for infrastructure provisioning:
Logical Infrastructure => Network Infrastructure (1)Resource and Cloud Provider Domains
Cloud 1 IaaS
VR3

VR1

Cloud 2 PaaS

VR5

VR7

Campus A
Infrastructure

Campus B
Infrastructure

VR2

Campus A

VR4

VR6

Cloud Carrier Network Infrastructure

Visualisation

Visualisation

CE

User
Group A

Campus B

CE

User
User
User

User
User
User
VR6

Cloud 2 PaaS

VR2VR7VR4VR1

VR5Resource/
ServiceProvider

Distributed
Resource/
heterogeneous cloud
ServiceProvider
infrastructure requires
separately provisioned
network infrastructure thatcan be outsourced to Cloud Carrier
JRA1 T2: Cloud NetworkUser
Group B

VR3

Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

CN

CN
CN

CN
CN

CN

Cloud PaaS Provider

CN
CN

CN

CN
CN

Cloud IaaS Provider

Open Cloud eXchange (OCX)

23

General use case for infrastructure provisioning:
Logical Infrastructure => Network Infrastructure (2)Resource and Cloud Provider Domains
VR3

VR1

VR5

VR7

Campus A
Infrastructure

Campus B
Infrastructure

VR2

VR4OCX at Cloud Carrier or Network
Provider (NREN) level

Network Provider 1

Campus A

Visualisation

VR6Visualisation

Cloud Carrier or Network Provider 2CEUser
Group A

Campus B

CE

User
User
User

User
User
User
VR6

Cloud 2 PaaS

VR2

VR7
VR4

VR1

VR5

Resource/
Service
ProviderProvisioning network
infrastructure may
involve multiple providers
Introducing OCX(Open Cloud eXchange)
JRA1 T2: Cloud Network

User
Group B

VR3

Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

Resource/
ServiceProvider
CN

CN
CN

CN
CN

CN

Cloud PaaS Provider

CNCN

CN

CN
CN

Cloud IaaS Provider

Open Cloud eXchange (OCX)

24Intercloud Federation Framework (ICFF)Intercloud Federation
Infrastructure

IaaS Domain

PaaS Domain
Registry
Discovery

User
SW&Apps

Layer C3-IaaS

BrokerBrokerGW

GW
ProviderVirt&OS
Platform

IdP
TrustBroker

Attribs

Visualisation

ICFF – InterCloud
Federation Framework

LayerC4-PaaS

TrustBroker

ProviderVirt&OS
PlatformCampus A

User
SW&AppsVisualisation

TrustCE

User
Group A

Campus B

CE

User
User
User

User
User
User
VR6

Cloud 2 PaaS

VR2

VR7
VR4

VR1

VR5

Resource/
Service
ProviderIndependently
managed cloud domains Resource/
Service
Providermay use federated
model for resources andprocesses integration andinteroperation
JRA1 T2: Cloud Network

User
Group B

VR3

Enterprise/Project basedIntercloud Infrastructure

Cloud 1 IaaS

CN

CN
CN

CN
CN

CN

Cloud PaaS Provider

CN
CN

CN

CN
CN

Cloud IaaS Provider

Open Cloud eXchange (OCX)

25

Basic Cloud Federation model (1.2) – Federating
HO and CSP domains (IDP-HO1 and IDP-CSP)
User UserUser
HO1.1
HO1.2
HO1.3

HO1
Admin/Mngnt
SystemCustomer Home
Organisation(Infrastructure services)••

IDP-HO1•Management(Ops&Sec)

Federation relations

IDP-XaCloudCustomer A1(Running Service Xa)––•

User UserUser
A1.2 A1.1A1.3
CSP
IDP/Broker

CloudProvider A•

JRA1 T2: Cloud Network

IDP-Xa can be implemented
as instantiated service of the CSP IDP
Open Cloud eXchange (OCX)

CSP – Customer – User
IDP/Broker

Cloud accounts A1.1-3 areprovisioned for each user 1-3 fromHO with 2 options––•User side Federation

Simple/basic scenario 1: Federating
Home Organisation (HO) and Cloud
Service Provider (CSP) domains
Cloud based services created forusers from HO1 and managed by
HO1 Admin/Management system
Involved major actors and roles

Individual accounts with new ID::pswdMapped/federated accounts that allows
SSO/login with user HO ID::pswd

Federated accounts may use Cloud
IDP/Broker (e.g. KeyStone) or thosecreated for Service Xa
TODO: Extend with AuthN/AutnZ
service in Virtual Service
Environment
26

Basic Cloud Federation model (1.3) – Using 3rdparty IDP for external users
External Users(Open Internet)
User
User2

User
User3
User
User1

Customer 1
Admin/Mngnt
System•

Ext/3rdParty
IDP-HO1

Direct or Dynamic link

Federation relations

Management(Ops&Sec)•––User User
UserX
Xa.1
Xa.2
a.3
IDP-XaCloud
Customer A1(Running Service Xa)••CSP
IDP/Broker•

JRA1 T2: Cloud Network

CSP – Customer – UserIDP/Broker

Cloud accounts A1.1-3 areprovisioned for each user 1-3 fromHO with 2 options––Cloud
Provider A

User side Federation

Simple/basic scenario 2: Federating
Home Organisation (HO) and Cloud
Service Provider (CSP) domains
Cloud based services created forexternal users (e.g. website) andmanaged by Customer 1
Involved major actors and roles

Individual accounts with new ID::pswd
Mapped/federated accounts that allows
SSO/login with user HO ID::pswd

Federated accounts may use Cloud
IDP/Broker (e.g. KeyStone) or those
IDP-Xa created for Service Xa

IDP-Xa can be implemented
as instantiated service of the CSP IDP
Open Cloud eXchange (OCX)

27

Basic Cloud Federation model (2.1) – Federating
CSP’s/multi-provider cloud resources
HO1
Admin/Mngnt•

User UserUser
HO1.1
HO1.2
HO1.3

IDP-HO1•

User side Infrastructure services

User UserUser
A1.2 A1.1A1.3
Cloud
Service Xa

Cloud
Provider A
Rsr
Ak2

IDP-XaCSP
IDP-A–Federation&Trust relations
Rsr
Ak1

•

Rsr
An1

Rsr
Am1Rsr
K2

Rsr
N1

Rsr
M1
Rsr
IDP-K
M2

Cloud
Provider K

Cloud
JRA1 T2: Cloud NetworkProvider M

IDP-M

Rsr
N2

•
IDP-N

Cloud
Provider N

Open Cloud eXchange (OCX)

May be bilateral or via 3rdparty/broker service

Includes translation or
brokering––––Inter-provider federation for resources sharing
Rsr
Kn1

Cloud provider sidefederation for resources
sharing
Federation and Trust
relations are establishedbetween CSP’s via
Identity management
services, e.g. Identity
Providers (IDP)

Trust relations
Namespaces
Attributes semantics
Policies

Inter-provider federationis transparent tocustomers/users

Provider side Federation28

Intercloud Federation Infrastructure and OCX
TrustBroker

TrustBroker

BrokerTrustedIntroducer

Open Cloud eXchange(OCX) Services

Discovery

OCX Interconnectionand Switching Facility

FedIDP

JRA1 T2: Cloud NetworkBroker

Directory

Directory(RepoSLA)(RepoSLA)

Gateway

Gateway

Gateway

Gateway

AAA

AAA

AAA

AAA

(I/P/S)aaS
Provider(I/P/S)aaS
Provider(I/P/S)aaS
Provider

IDP

IDP

IDP

Open Cloud eXchange (OCX)…

(I/P/S)aaS
ProviderIDP29