MTS: Bringing Multi-Tenancy to Virtual Networking

MTS: Bringing Multi-Tenancy to Virtual Networking

Abstract

Multi-tenant cloud computing provides great benefits in terms of resource sharing, elastic pricing, and scalability, however, it also changes the security landscape and introduces the need for strong isolation between the tenants, also inside the network. This paper is motivated by the observation that while multi-tenancy is widely used in cloud computing, the virtual switch designs currently used for network virtualization lack sufficient support for tenant isolation. Hence, we present, implement, and evaluate a virtual switch architecture, MTS, which brings secure design bestpractice to the context of multi-tenant virtual networking: compartmentalization of virtual switches, least-privilege execution, complete mediation of all network communication, and reducing the trusted computing base shared between tenants. We build MTS from commodity components, providing an incrementally deployable and inexpensive upgrade path to cloud operators. Our extensive experiments, extending to both micro-benchmarks and cloud applications, show that, depending on the way it is deployed, MTS may produce 1.5- 2x the throughput compared to state-of-the-art, with similar or better latency and modest resource overhead (1 extra CPU). MTS is available as open source software.

Grafik Top
Authors
  • Thimmaraju, Kashyap
  • Hermak, Saad
  • Retvari, Gabor
  • Schmid, Stefan
Grafik Top
Supplemental Material
Shortfacts
Category
Paper in Conference Proceedings or in Workshop Proceedings (Paper)
Event Title
USENIX Annual Technical Conference (ATC)
Divisions
Communication Technologies
Subjects
Informatik Allgemeines
Event Location
Renton, Washington, USA
Event Type
Conference
Event Dates
July 10–12, 2019
Date
July 2019
Export
Grafik Top