Cloud Computing

Acknowledgments xi

1 Introduction 1

References 6

2 The Business of Cloud Computing 7

2.1 IT Industry Transformation through Virtualization and Cloud 7

2.2 The Business Model Around Cloud 13

2.2.1 Cloud Providers 14

2.2.2 Software and Service Vendors 15

2.3 Taking Cloud to the Network Operators 15

References 18

3 CPU Virtualization 19

3.1 Motivation and History 20

3.2 A Computer Architecture Primer 21

3.2.1 CPU, Memory, and I/O 21

3.2.2 How the CPU Works 23

3.2.3 In-program Control Transfer: Jumps and Procedure Calls 25

3.2.4 Interrupts and Exceptions-the CPU Loop Refined 28

3.2.5 Multi-processing and its Requirements-The Need for an Operating System 34

3.2.6 Virtual Memory-Segmentation and Paging 38

3.2.7 Options in Handling Privileged Instructions and the Final Approximation of the CPU Loop 42

3.2.8 More on Operating Systems 44

3.3 Virtualization and Hypervisors 48

3.3.1 Model, Requirements, and Issues 49

3.3.2 The x86 Processor and Virtualization 52

3.3.3 Dealing with a Non-virtualizable CPU 55

3.3.4 I/O Virtualization 57

3.3.5 Hypervisor Examples 60

3.3.6 Security 65

References 69

4 Data Networks-The Nervous System of the Cloud 71

4.1 The OSI Reference Model 74

4.1.1 Host-to-Host Communications 74

4.1.2 Interlayer Communications 76

4.1.3 Functional Description of Layers 79

4.2 The Internet Protocol Suite 85

4.2.1 IP-The Glue of the Internet 87

4.2.2 The Internet Hourglass 98

4.3 Quality of Service in IP Networks 102

4.3.1 Packet Scheduling Disciplines and Traffic Specification Models 103

4.3.2 Integrated Services 105

4.3.3 Differentiated Services 109

4.3.4 Multiprotocol Label Switching (MPLS) 112

4.4 WAN Virtualization Technologies 117

4.5 Software-Defined Network 120

4.6 Security of IP 125

References 129

5 Networking Appliances 131

5.1 Domain Name System 131

5.1.1 Architecture and Protocol 134

5.1.2 DNS Operation 140

5.1.3 Top-Level Domain Labels 142

5.1.4 DNS Security 145

5.2 Firewalls 149

5.2.1 Network Perimeter Control 153

5.2.2 Stateless Firewalls 155

5.2.3 Stateful Firewalls 158

5.2.4 Application-Layer Firewalls 161

5.3 NAT Boxes 163

5.3.1 Allocation of Private IP Addresses 165

5.3.2 Architecture and Operation of the NAT Boxes 168

5.3.3 Living with NAT 172

5.3.4 Carrier-Grade NAT 180

5.4 Load Balancers 184

5.4.1 Load Balancing in a Server Farm 185

5.4.2 A Practical Example: A Load-Balanced Web Service 187

5.4.3 Using DNS for Load Balancing 188

References 191

6 Cloud Storage and the Structure of a Modern Data Center 193

6.1 Data Center Basics 195

6.1.1 Compute 196

6.1.2 Storage 196

6.1.3 Networking 198

6.2 Storage-Related Matters 198

6.2.1 Direct-Attached Storage 200

6.2.2 Network-Attached Storage 208

6.2.3 Storage Area Network 215

6.2.4 Convergence of SAN and Ethernet 221

6.2.5 Object Storage 230

6.2.6 Storage Virtualization 233

6.2.7 Solid-State Storage 236

References 242

7 Operations, Management, and Orchestration in the Cloud 245

7.1 Orchestration in the Enterprise 247

7.1.1 The Service-Oriented Architecture 253

7.1.2 Workflows 255

7.2 Network and Operations Management 259

7.2.1 The OSI Network Management Framework and Model 261

7.2.2 Policy-Based Management 264

7.3 Orchestration and Management in the Cloud 267

7.3.1 The Life Cycle of a Service 268

7.3.2 Orchestration and Management in OpenStack 274

7.4 Identity and Access Management 287

7.4.1 Implications of Cloud Computing 289

7.4.2 Authentication 291

7.4.3 Access Control 295

7.4.4 Dynamic Delegation 299

7.4.5 Identity Federation 302

7.4.6 OpenStack Keystone (A Case Study) 303

References 309

Appendix: Selected Topics 313

A.1 The IETF Operations and Management Standards 313

A.1.1 SNMP 313

A.1.2 COPS 316

A.1.3 Network Configuration (NETCONF) Model and Protocol 319

A.2 Orchestration with TOSCA 324

A.3 The REST Architectural Style 329

A.3.1 The Origins and Development of Hypermedia 329

A.3.2 Highlights of the World Wide Web Architecture 332

A.3.3 The Principles of REST 334

A.4 Identity and Access Management Mechanisms 336

A.4.1 Password Management 336

A.4.2 Kerberos 338

A.4.3 Access Control Lists 341

A.4.4 Capability Lists 342

A.4.5 The Bell-LaPadula Model 343

A.4.6 Security Assertion Markup Language 345

A.4.7 OAuth 2.0 347

A.4.8 OpenID Connect 349

A.4.9 Access Control Markup Language 351

References 353

Index 355