Virtual Private Networks Management Research Articles

Layer 1 virtual private network management by users

The layer 1 virtual private network (LlVPN) technology supports multiple user networks over a common carrier transport network. Emerging L1VPN services allow: L1VPNs to be built over multiple carrier networks; L1VPNs to lease or trade resources with each other; and users to reconfigure an L1VPN topology, and add or remove bandwidth. The trend is to offer increased flexibility and provide management functions as close to users as possible, while maintaining proper resource access right control. In this article two aspects of the L1VPN service and management architectures are discussed: management of carrier network partitions for L1VPNs, and L1VPN management by users. We present the carrier network partitioning at the network element (NE) and L1VPN levels. As an example, a transaction language one (TL1) proxy is developed to achieve carrier network partitioning at the NE level. The TL1 proxy is implemented without any modifications to the existing NE management system. On top of the TL1 proxy, a Web services (WS)-based L1VPN management tool is implemented. Carriers use the tool to partition resources at the L1VPN level by assigning resources, together with the WS-based management services for the resources, to L1VPNs. L1VPN administrators use the tool to receive resource partitions from multiple carriers and partner L1VPNs. Further resource partitioning or regrouping can be conducted on the received resources, and leasing or trading resources with partner LlVPNs is supported. These services offer a potential business model for a physical network broker. After the L1VPN administrators compose the use scenarios of resources, and make the use scenarios available to the L1VPN end users as WS, the end users reconfigure the L1VPN without intervention from the administrator. The tool accomplishes LlVPN management by users

Auto-Configuration Method of Provisioning System for Internet VPNs

Internet Virtual Private Networks (VPNs) across geographically distributed users' networks are ideal for ad-hoc group activities, such as online gaming, over the Internet. However, users find it difficult to determine and set the configurations of the VPN routers and hosts rapidly enough for ad-hoc usage, due to the need for consistency of such configurations over the users' networks. Moreover, the number of operators is insufficient to help all users. Hence, the automatic determination and setting of such configurations from the management server is desirable. Existing auto-configuration methods are insufficient for ad-hoc usage because they cannot rapidly determine and set the hosts' configurations to be consistent with the VPN and user's network they are joining. To enable ad-hoc creation of and joining to a VPN by the users themselves, we propose a new method that utilizes the Dynamic Host Configuration Protocol (DHCP), which can automatically set the configurations of many existing hosts. The DHCP server's and relay agents' configurations are automatically determined and set by the VPN management server, based on the user request, so that the hosts can be auto-configured to be consistent with the VPN and the user's network they are joining, from the DHCP server via the autoconfigured DHCP relay agents. To evaluate the time overhead of our proposed method, we implemented a test bed, including 10 VPN routers, a VPN management server, and a DHCP server. In this evaluation, the DHCP server is auto-configured for each new VPN in less than 1 second, and the DHCP relay agents on the VPN routers are auto-configured in less than 5 percent of the total time for configuring the VPN routers, regardless of the total number of the VPN routers in a VPN. These results show that the proposed method can auto-configure the VPN routers and hosts simultaneously with the DHCP, while ensuring sufficient rapidity of the entire auto-configuration operation for ad-hoc usage.

Alternative Schemes for Dynamic Secure VPN Deployment in UMTS

Three alternative schemes for secure Virtual Private Network (VPN) deployment over the Universal Mobile Telecommunication System (UMTS) are proposed and analyzed. The proposed schemes enable a mobile node to voluntarily establish an IPsec-based secure channel to a private network. The alternative schemes differ in the location where the IPsec functionality is placed within the UMTS network architecture (mobile node, access network, and UMTS network border), depending on the employed security model, and whether data in transit are ever in clear-text, or available to be tapped by outsiders. The provided levels of privacy in the deployed VPN schemes, as well as the employed authentication models are examined. An analysis in terms of cost, complexity, and performance overhead that each method imposes to the underlying network architecture, as well as to the mobile devices is presented. The level of system reliability and scalability in granting security services is presented. The VPN management, usability, and trusted relations, as well as their behavior when a mobile user moves are analyzed. The use of special applications that require access to encapsulated data traffic is explored. Finally, an overall comparison of the proposed schemes from the security and operation point of view summarizes their relative performance.

A Web-based monitor and management system architecture for enterprise virtual private network

Virtual private network (VPN) not only possesses the low cost, inexpensive fees, and excellent support advantages of the Internet, it also has the benefit of the security as the leased line. How to properly manage the VPN is an issue in which the enterprise IT engineers have to take seriously. This research is based on the new network management technologies such as policy-based network management, mobile agent, etc., to design a VPN monitor and management system architecture that contains high level management with low network traffic load. This system architecture integrates both VPN devices and general network devices, such the feature can integrate the monitor and manage the VPN and Intranet at the same time. The result of this research provides enterprises with a VPN architecture for monitoring and managing the enterprises, as well as to establish a prototype for the enterprise VPN monitor and management system. Such system architecture can effectively assist the semiconductor companies to monitor and manage their enterprise VPN in order to utilize the Internet resources, and to reduce the possible operation off time. The prototype system could proof the feasibility of the systematic architecture, it can automatically detect and activate the backup mechanism according to the preset management policy, and to achieve the effective and fast solution for the enterprise network problems.

Resource Management in Layer 1 Virtual Private Networks

This paper proposes resource management in Layer 1 Virtual Private Networks (VPNs). We have been proposing Layer 1 VPNs that provide layer 1 services to multiple customers over the single optical network with per VPN control and management capabilities. We have proposed two resource management models for Layer 1 VPNs, which constitute different class of services. One is the shared model, where resources are shared among VPNs. The other is the dedicated model, where resources are explicitly pre-assigned to each VPN. In this paper, after introducing an overview of Layer 1 VPNs, we evaluate several path computation algorithms for these two models focusing on the multi layer network scenario. In the shared model, there are several existing studies for non-VPN cases, but considerations for VPN cases are not investigated. This paper evaluates algorithms originally proposed for non-VPN cases for use in VPN cases. Simulation results show that the path computation algorithm that works as saving layer 1 resources achieves better resource sharing effect. In the dedicated model, the problem is identical to non-VPN cases. There is one conventional algorithm, but amount of available resources is not well considered. We propose a novel path computation algorithm. Simulation results show effectiveness of our proposed algorithm against the conventional algorithm. Furthermore, resource usage efficiency of two resource management models is compared. We analyze and propose applicability of resource management models.

Global Open Ethernet (GOE) System and its Performance Evaluation

This paper presents an overview of global open Ethernet (GOE) architecture as a cost-effective Ethernet-based virtual private network (VPN) solution, and discusses a hardware and software implementation of a prototype system. Three main approaches have been proposed for a VPN solution on metro-area network: resilient packet ring, Ethernet over multiprotocol label switching (EoMPLS), virtual bridged local area network-tag stacking (Q-in-Q). None of these schemes can satisfy the following requirements at the same time: network topology flexibility, affordable network functionalities, low equipment cost, and low operational cost. The proposed GOE system is designed to solve VPN management problems of these approaches with MPLS VPN functionality at a low cost of Ethernet-based solution. The key components of GOE are: 1) a novel GOE tag for high-speed switching and 2) a novel routing and protection module via per-destination multiple rapid spanning tree protocol (PD-MRSTP). Via the analytical performance evaluation of EoMPLS, Q-in-Q, and GOE, we show that the memory cost and the network utilization of GOE is two-three times smaller and 22% higher than the other approaches, respectively. We also have developed a GOE prototype system and obtained the following remarkable hardware and software performance results. The GOE core switch delivered 100% of theoretical maximum throughput (10 G) with zero packet loss even with the field programmable gate array platform, and its 10-G port density is 1.5 times denser than the best currently available products. The GOE switch using PD-MRSTP also delivered a significantly fast protection switching time (1.975 ms), which was significantly faster than legacy Ethernet switches. These performance evaluation results prove that the proposed GOE system can be used as a cost-effective high-performance Ethernet-based VPN solution.

Web-Based Customer Management of VPNs

The use of Virtual Private Networks (VPNs) is one of the major trends in the integrated broadband communications environment. Currently, the control and management of VPN resources is mainly supported by the provider of the bearer telecommunication services, and VPN customers have no control over these resources. The increasing importance of the broadband communication infrastructure in corporate operations and transactions is stressing the requirement for a customizable configuration, operation and management of VPN services. First, this paper discusses the evolution of VPN environments towards customized VPN configurations and goal-driven management of these VPNs. VPN service characteristics and management requirements are analyzed. Then, the paper introduces the proposed customer management architecture satisfying these requirements. The architecture is based on the multi-level virtualization of network resources through the partitioning of resources in the provider's shared communication infrastructure and the dynamic allocation of these resources to customers. A Web-based distributed approach is used for implementing the proposed customer management of VPNs.

Cooperative management in open distributed systems

We describe the need for the collaboration of managers in cooperative applications where the federative application context must be harmonized with the hierarchical component environment. A cooperative management concept is introduced which augments existing hierarchical management policies and procedures. The concept includes proposals for federations, ‘manager’ domains and collaboration procedures. It relates a group of managers to a group of managed objects, and proposes rules for collaboration between the managers before executing operations on the objects. Some possible application areas, including inter-domain information management, customer network management, the management of virtual private networks (VPN) and trading in open distributed processing (ODP), are discussed. A related approach is described for comparison. Remarks on the importance of adequate access control mechanisms and on the need for the dynamic creation and modification of manager groups are added.

Management of virtual private networks for integrated broadband communication

Management of Virtual Private Networks (VPNs) is becoming an increasingly important issue in the context of integrated broadband communication (IBC). In the near future corporate customers may want to subscribe to broadband VPN services offered by globally operating service providers to replace most of their leased line services that are used today to build their corporate networks. The concepts historically known as characterizing VPNs, such as the concept of closed user groups, will still be valid, but the importance of VPN service features and, in particular, the set of VPN management services offered to VPN customers will become dominant. In this paper we present a detailed technical approach to the management of broadband VPNs based on current technology and common standards. In particular, we discuss architectural solutions, management interfaces and management services provided at these interfaces, as well as managed objects.