Firewall placement in cloud data centers
Seungjoon Lee, Manish K. Purohit, Barna Saha · 2013
As cloud data services proliferate, filtering the communication between different virtual machines in a data center becomes a necessity. Such filtering can be accomplished by placing firewalls at strategic nodes within the data center network and rerouting the communication flows to pass through a firewall. This abstraction introduces several basic location problems which arise in these contexts. Suppose a VM s wishes to send data to a VM t along path P. If there is no available firewall on path P, we need to reroute the data first from s to a firewall f and then from f to the destination t. Clearly, having too few firewalls would cause a large number of communication flows to be routed to a particular firewall leading to increased congestion in the links leading to the firewall. As latency in data centers is dominated by link congestion rather than distance, we focus on finding good firewall placements subject to a bandwidth constraint on links.