Slide 1

TRANSCLOUD: Design Considerations for a High-Performance Cloud Architecture Across Multiple Administrative Domains Rick McGeer, HP Labs

For the TransCloud Team: HP Labs, UC San Diego, University of Victoria, Northwestern University, University of Amsterdam, TU-Kaiserslautern, Princeton University, PlanetWorks, PlanetLab, GENI, G-Lab, DFN, NLR, GLIFSeptember 10, 2011

Sponsored by the National Science FoundationSponsored by the National Science Foundation#November 3, 20101TransCloud Demonstration

Reduction Job 1Reduction Job 2Merge JobReduction programReduction programReduction ResultReduction ResultFinal ResultSponsored by the National Science Foundation#November 3, 2010TransCloud Distributed Query

Sponsored by the National Science Foundation#November 3, 2010Introduction TransCloudTransCloud: A Cloud Where Services Migrate, Anytime, Anywhere In a World Where Distance Is EliminatedJoint Project Between GENICloud, iGENI, G-LabGENICloud Provides Seamless Interoperation of Cloud Resources Across N-Sites, N-Administrative DomainsiGENI Optimizes Private Networks of Intelligent DevicesG-Lab contributes networking and advanced cloud resourcesSponsored by the National Science Foundation#November 3, 20104Context 1: Seamless Computation Services Available Anytime, AnywhereThe Cloud offers the prospect of ubiquitous information and servicesBUTPerformance of Cloud services Highly Dependent On LocationOf End-User, Applications, Middle Processes, Network TopologyOf Cloud Data, Compute Processes, StorageWhy?Performance of Legacy Protocols Highly Dependent on Latency Therefore:If the Clouds Are Too Far Away, Performance Will Be Very Severely RestrictedErgoClouds Needs To Be Close To Service Sites ORNetworks (And Clouds) Must Be Designed To Eliminate DistanceSponsored by the National Science Foundation#November 3, 2010Context 2: Living With Legacy Protocols Over Commodity Internet vs Creating AlternativesLegacy Is There For a ReasonCompatibilityFairnessCongestion AvoidanceTherefore: Distributed CloudMinimal Latencies Over Legacy Internet To Anywhere/EverywhereTherefore: Private Internal NetworksEliminate Latency Dependence InternallyUse Aggressive Internal Transport/Application ProtocolsTIA-1039, Reliable Blast UDP, Lambda RAMFlow Control EnabledSponsored by the National Science Foundation#November 3, 2010Context 3: No Cloud Lives EverywhereClusters are much easier to build than points-of-presenceMost commercial clouds today have only a few sitesTherefore: cloud service providers want to run services across multiple cloudsNeed a cloud standard that offers identical interfaces over multiple domainsInspiration: the webStandard protocol for sending documentsStandard document formatPermission and access control on a site-by-site, page-by-page basisSponsored by the National Science Foundation#November 3, 2010Context 4: General ConsiderationsMajor Cloud Use Case: Big Data, Distributed Collection, Must Live With Available NetworksSmart CitiesSensor NetsBest Case: Create Private NetworkOwning Optical Fiber Create High Performance Wireless Point-to-Point Links Many Data Intensive Science Projects, Including High Energy Physics (e.g. LHCNet, Science Data Network, I-WIRE)Atmospheric Sensing ApparatusOcean Observing (e.g., Project Neptune)Distributed Radio and Optical TelescopesTelemedicine

Sponsored by the National Science Foundation#November 3, 2010Premise: Compute Where Data Lives!Computation is Ubiquitous and Easy To ObtainPrograms Are Small and Easy to TransmitMost Programs Reduce DataOften Data Is Large and Challenging To TransmitE.g., Jim Gray distributing SDSS by sending computers by FedEx!Solution -- Send Programs to DataRequiresHigh-performance, low-latency networkCommon APIs and operating environmentsLightweight, user-based federationSponsored by the National Science Foundation#November 3, 2010What do we need to make this work?Advanced Networking and CachingFirm guarantees on bandwidth and latency on a per-application basisApplication support at Layer 3 and Layer 2Means: Private Network where possibleAccess to platforms wherever data livesBut data lives everywhere!No organization has Points of Presence (PoP)s everywhereNeed for an individual to be able to make arrangements with an cloud service provider, anywhere, efficiently, minimal overheadCommon form of identity Common identity not requiredCommon AUP not required Sponsored by the National Science Foundation#November 3, 2010What do we need to make this work?Ability to instantiate and run a program anywhereCommon API at each level of the stackIaaS/NaaS (VM/VN Creation)PaaS (guaranteed OS/Progamming environment)QaaS (Standard Query/Data Management API)Easy, Standard Naming SchemeI need to know the name of my VMs, logins, store etc without askingSponsored by the National Science Foundation#November 3, 2010TransCloud Today

Approx 40 nodes at 4 sites, 10 Gb/s connectivitySponsored by the National Science Foundation#November 3, 2010TransCloud Distributed Query Demo

Sponsored by the National Science Foundation#November 3, 2010TransCloud TodaySites atHP Labs, Palo AltoUC San DiegoNorthwesternKaiserslauternComing soonAmsterdamConnectivity provided by:CAVEWave, StarLight, NetherLight, DFN, National Lambda Rail, Global Lambda Integrated FacilitySponsored by the National Science Foundation#November 3, 2010TransCloud EqualsIaaS Based on Slice-Based Federation Architecture (GENI Standard)Current instantiation: MyPLC over EucalyptusWant: ports to OpenStack, etc.Identity: X.509 certificates and ssh keysTransCloud sites agree to accept these as forms of identityWhich to accept up to the siteStandard DNS Infrastructure....trans-cloud.net: experiment interfacee.g.hadoop22.queryTest.hplabs.genicloud.trans-cloud.net..trans-cloud.org: admin interfacehplabs.genicloud.trans-cloud.orgEach authority does its own DNS. Sponsored by the National Science Foundation#November 3, 2010GENICloud Equals..Implementation of SFA on GENI Control FrameworkSecurity by Authorization-Based Access Control (ABAC)Experimental QaaS (Distributed Hadoop/Pig)User-done PaaS (some stock images, but the usual tools for building your own)Sponsored by the National Science Foundation#November 3, 2010Integration with GENIProgrammer and User Interface to Cluster Control is MyPLCCluster version of PlanetLab control interfaceUsed for a number of clusters worldwide, including VICI project in USMechanics of cluster control done by EucalyptusSingle Eucalyptus user MyPLCUsers log in to MyPLC, issue directives, MyPLC effectuates by issuing appropriate Eucalyptus commandsSponsored by the National Science Foundation#November 3, 2010GENICloud ArchitectureMyPLC on EucalyptusSlice Federation Architecture Flow Primitives1039/RBUDPStandard Naming and Access ServicesDistributed PigDistributed HadoopSponsored by the National Science Foundation#November 3, 2010TransCloud Distributed Query

Sponsored by the National Science Foundation#November 3, 2010Getting Hacked!On April 15 (about) we were attacked by the Romanian Black HatsStock VM had a privileged user with a guessable passwordCame with the VMAttack was a worm attack to recruit bots for botnetsWe were alerted when a third-party site saw worm probes coming from usSolution: shut it down, fix it, bring it upThe Fix:Use MyPLC (PlanetLab) as the controllerLogin only by ssh key, X.509 cert (GENI standard)Ssh login only from specified IP addresses (EC-2 standard)Authorized users can add whitelisted IPsCurrently enforced by iptables, but well add support into OpenFlowRunning final pre re-launch tests now

Sponsored by the National Science Foundation#November 3, 2010Goals for 2011Complete integration with MyPLCIntegrate the ProtoGENI Resource Specification (Rspec)Modified to make sense for clustersIntegrate the GENI standard Authorization-Based Access Control (ABAC)Add utility to permit users to manually adjust connectivity rulesIntegration with ProtoGENI RspecExpand and AdaptGoals are very similar to NICT/JGN InterCloudEstablish collaborations and joint projectsSponsored by the National Science Foundation#November 3, 2010Advancing TransCloudIf You Are Interested In Using This Environment, Contact Us

If You Would Like To Contribute Resources, Contact UsIf You Would Like To Collaborate, Contact UsSponsored by the National Science Foundation#November 3, 2010TransCloud At the GEC 12THANKS!

Questions????

Sponsored by the National Science Foundation#November 3, 2010