Xue-Kai Du et al.: LTSS: Load-Adaptive Traffic Steering and Forwarding 1267
are not included. We also propose a new lightweight
traffic flow forwarding scheme for cloud data centers.
We notice that Hari et al.
[8]
did interesting work in
this area. In [8], Hari et al. pre sented an algorithm fo r
encoding path informatio n into packets and proved that
their solution is optimal. Later on Hari et al. described
the path switch in [9], which is an SDN-friendly packet
forwarding mechanism developed based on their path
information encoding algorithm. Their scheme encodes
path information into the data link layer (L2/Ether net)
header and integrates middlebox services into Open-
vSwitch. Compa red with their work, our scheme is
more lig htweight and easier to implement, and our path
scheduling is dynamic.
Shin et al. analyzed the problem in another way
and prese nted a new concept of NSV (network secu-
rity virtualization) in [10-12]. NSV categorizes secu-
rity functions into two modes, the in- line mode and
the pa ssive mode, according to different processing re-
quirements of security devices. They also designed and
implemented NETSECVISOR, a system that can se-
lect traffic paths based on tenants’ and administrators’
policies and handle security incidents. However, their
scheme does not take into account the loads of data
plane de vices and some complex network topologies.
Our work reported in this paper addresses the issue by
proposing a load-adaptive traffic steering algorithm and
a new tenant traffic forwarding scheme.
This paper is based on our previous work on
policy-driven SDN controller improvement scheme —
PDSDN
[13]
. In order to define the process of managing
network resources , we proposed a policy-driven batch
processing SDN controller scheme in [13]. This scheme
allows the cloud datacenter administrators to send net-
work policies to the SDN controller, which then pro-
cesses the received policies according to tenant permis-
sion and operation priority. Through this scheme, net-
work resourc es and computing resources management
can be integrated in a clo ud datacenter environment.
In this paper, LTSS utilizes PDSDN’s policy de finition
mechanism. While the LTSS system defines the ten-
ants’ policies, it will send these policies to the SDN
controller, and then the SDN controller will process
the tenant’s network security service deployment ope -
rations in batches based on these polic ies.
3 LTSS Traffic Steering Scheme
In this section, we first introduce the basic defini-
tion of LTSS configuration and policy and then present
the load-adaptive traffic steering algorithm.
3.1 Basic Configuration Definition
As shown in Table 1, there are three types of admini-
strator configurations: network security device configu-
ration, switch configur ation, and link configuration.
Network security device configur ation de fines the
parameters of a network security dev ice. In this con-
figuration, the mode gives one of the two modes that
the device can be in: passive mode and in-line mode.
A device in the in-line mode is on a traffic path and
will be traversed by the original traffic (for example, a
firewall is in the in-line mode). A device in the pas-
sive mode may either process the o riginal traffic or just
receive a duplicate of the original traffic flow (for ex-
ample an IDS can be in the passive mode). The ca-
pacity represents the maximum number of packets that
a device can handle in a time unit, which is set by the
administrator . If more than o ne device provides a sa me
security service in the network, we choose the se curity
devices with minimal capacity rate for tenants. The
value specifies a threshold of capacity that a device can
Table 1. Definition of Administrator Configurations
Configuration Parameter Meaning
Network Security Device ID Uniquely identifying a network security device
Type Service supported by a device
Location Identifying the switch on which a device is hosted
Mode Passive or in-line
Description Descriptive information of device
Capacity Maximum number of packets that a device can handle in a time unit
Switch ID Uniquely identifying a switch
Capacity Maximum number of packets that a switch can handle in a time unit
Value Threshold of capacity set by the administrator
Link ID Uniquely identifying a link
Capacity Maximum number of packets that a link can handle in a time unit
Value Threshold of capacity set by the administrator
R-Port-a One switch p ort that the link is connected with
R-Port-b The other switch port that the link is connected with