# SALMA: A Novel Middlebox Infrastructure System Based on Integrated Subnets
## 3 Problem Statement  
In the investigated enterprises, each group of middleboxes was installed in the face of certain traffic of particular users. Thus, these middleboxes are configured to perform certain network/security policies on the passing traffic. In an individual enterprise there are \(M\) middleboxes (number of them). Every group of middleboxes is gathered in a single set, \(S_{1},S_{2},S_{3},\ldots S_{n}\), and the total number of sets is \(N\). A single set contains different types of middleboxes and is placed in one of the entry points (known as the point of presence (PoP)) of the enterprise network. These sets are implanted in the network path of a certain group of users to execute specific QoS and security policies on their traffic. For instance, the VPN users entail different QoS and security measures than the visitors for the enterprise website. The network designers typically select the place of every set with little consideration for their optimization. Indeed, the sets' places are critical, and they suffer the same fate: the failure or delay in one of the set members impacts the performance of the whole set. One way to mitigate this challenge is by replicating the set members, which in return increases the total capacity \(C_{m}\) and reduces the utilization, and increases the expenses. Assume the utilization of a set is \(\mathcal{U}_{i}\), where its value is proportionally related to the traffic load of its users \(\lambda_{E}^{i}\). Therefore, \(\mathcal{U}_{i}=\frac{\lambda_{E}^{i}}{C_{m}^{i}}\). In order to elevate the utilization, we need either to add new load (e.g., more users) or decrease the available capacity. The administrator does not control the users' behavior or places. In addition, the administrator has limited control over the middleboxes' processing capacity2. This is not only for one set, since the enterprises and ISPs have hundreds of sets to serve internal and external PoPs, which means a huge number of unused resources. In this work we aim at providing the network administrator enough governance on these two factors. The main obstacle to optimizing the performance of the middleboxes is the network's structure. To overcome this issue, the sets of middleboxes are decoupled from their places and regathered in new sets. The decoupling technique introduces multiple challenges. First, how does the solution engage the users with their corresponding set of middleboxes? Second, how does the solution forward the \(E^{i}\) traffic to the set \(S_{i}\) over the enterprise network? Third, how does the solution make sure the new set have enough capacity to handle the aggregated traffic load? Finally, the solution needs to optimize the assignment process between the traffic load and the sets of the middleboxes. We elaborate more on these concerns in Section 4. Instead of randomly reassigning the group of users to the middleboxes' sets, we need to search for the optimal set that satisfies certain constraints, such as capacity and the security/network policy. The target optimal function is:  
The first constraint, the capacity of the new sets, is enough to serve the total traffic load from all sets. \[\sum_{i=1}^{N}\lambda_{E}^{i}\leq\mathcal{C}_{L} \tag{1}\]  
We can rewrite this constraint to be as follows:  
\[\mathbf{E}_{\tau}\leq\mathcal{C}_{\mathbb{Q}oS}^{L} \tag{2}\]  
Assume the matrix \(\mathbf{E}_{\tau}\) has all the traffic workload on previous sets before the new arrangement, and the \(\mathcal{C}_{\mathbb{Q}oS}^{L}\) matrix has the capacity of all individual middleboxes in every new set. Since the traffic load is different during a working day, \(\mathbf{E}\) is a fat matrix which has the time with a resolution of \(\tau\) unit of time as the column index. For instance, column \((index=1)\) has the traffic workload on every set during the \(\tau_{1}\) unit of time\({}^{3}\). The second constraint is the processing delay: \(\boldsymbol{\mathcal{D}}_{S}\) should not exceed a certain QoS delay, \(\boldsymbol{\mathcal{D}}_{QoS}\).