MTS: Bringing Multi-Tenancy to Virtual Networking

Abstract: Multi-tenant cloud computing provides great benefits in terms of resource sharing, elastic pricing, and scalability, however, it also changes the security landscape and introduces the need for strong isolation between the tenants, also inside the network. This paper is motivated by the observation that while multi-tenancy is widely used in cloud computing, the virtual switch designs currently used for network virtualization lack sufficient support for tenant isolation. Hence, we present, implement, and evaluate a virtual switch architecture, MTS, which brings secure design best-practice to the context of multi-tenant virtual networking: compartmentalization of virtual switches, least-privilege execution, complete mediation of all network communication, and reducing the trusted computing base shared between tenants. We build MTS from commodity components, providing an incrementally deployable and inexpensive upgrade path to cloud operators. Our extensive experiments, extending to both micro-benchmarks and cloud applications, show that, depending on the way it is deployed, MTS may produce 1.5-2x the throughput compared to state-of-the-art, with similar or better latency and modest resource overhead (1 extra CPU). MTS is available as open source software.

• The paper introduces MTS, a virtual switch architecture that compartmentalizes tenant operations into dedicated VMs to enhance security and performance.
• The methodology leverages SR-IOV for isolating virtual functions, enabling flexible resource allocation and up to 2x throughput improvements.
• Experimental results validate MTS's cost-effectiveness and latency enhancements, offering a scalable solution for multi-tenant cloud networks.

MTS: Bringing Multi-Tenancy to Virtual Networking

The paper "MTS: Bringing Multi-Tenancy to Virtual Networking" (2403.01862) addresses the challenges associated with multi-tenant virtual switch designs in cloud environments. It introduces a novel architecture, MTS, aimed at enhancing security while maintaining high performance and cost-effectiveness.

Introduction to Multi-Tenancy in Cloud Networking

The growing adoption of multi-tenant architectures in cloud computing necessitates robust isolation of virtual networks to ensure security and performance. The current virtual switch designs often fail to provide adequate isolation between tenants, exposing cloud infrastructure to potential security breaches. This paper identifies these shortcomings and proposes MTS, a secure multi-tenant virtual switch architecture.

MTS Architecture Overview

MTS introduces a compartmentalized virtual switch architecture to improve tenant isolation (Figure 1). The core innovation lies in moving vswitch functionalities to dedicated virtual machines (VMs), thereby compartmentalizing tenant operations. Each compartment allocates separate virtual functions (VFs) using Single Root Input/Output Virtualization (SR-IOV) to maintain high-speed intercommunication.

Figure 1: High-level overview of MTS in security Level-2. The Red and Blue vswitch compartments (VMs) are allocated dedicated virtual functions (VFs) to communicate with external networks using the In/Out VF, their respective tenants using the Gw VF and T VF. Communication between the vswitches, tenants and the Host physical function (PF) are mediated via the SR-IOV NIC switch.

Implementation Details

Compartmentalization

MTS relies on the concept of compartmentalizing vswitch functions into dedicated VMs, allowing for isolated and secure packet processing. This separation aligns with secure system design principles like least privilege and complete mediation.

Communication and Mediation

Communication within the MTS architecture utilizes SR-IOV, a hardware technique that segregates network device resources into isolated VFs to facilitate efficient and secure tenant isolation. This ensures that tenant data traffic does not interfere with or compromise other tenant data (Figure 2).

Figure 2: A step-by-step illustration of how packets enter and leave the Red tenant from Figure 1.

Resource Allocation

MTS supports various resource allocation strategies, ranging from shared to isolated modes to optimize security and performance trade-offs (Figure 3, Figure 4). These strategies allow flexible deployment across diverse cloud environments, ensuring scalable and cost-effective solutions.

Figure 3: The security, throughput, latency and resource tradeoff comparison of MTS. The rows indicate the resource mode. The columns are ordered as throughput, latency and resources. The security levels used are shown in the legend.

Figure 4: Iperf throughput, Apache and Memcached throughput and latency comparison of MTS. The rows indicate the resource mode where the bottom row is for security Level-3 in the isolated resource mode combined with the other security levels.

Evaluation and Results

The authors conducted extensive experiments to evaluate MTS's performance compared to existing solutions. MTS demonstrated significant improvements in throughput and latency with modest resource overhead. The design achieved up to 2x throughput improvements while maintaining or enhancing latency performance.

Security Considerations

MTS addresses multi-tenancy-specific security threats by minimizing the shared components amongst tenants and implementing strict access controls. However, the reliance on SR-IOV introduces potential vulnerabilities within the VF interfaces, necessitating careful management and periodic security assessments.

Conclusions and Future Work

The paper establishes MTS as a promising multi-tenant virtual networking solution that provides enhanced isolation without compromising performance or scalability. Future research could expand on dynamically adapting resource allocations in response to real-time workload characteristics or integrating additional security layers to mitigate novel attack vectors.

In conclusion, MTS represents an incremental yet significant advancement in virtual switch design for cloud multi-tenancy, offering both practical deployment pathways and potential for further innovation.