Justine Sherry

EECS Department, University of California, Berkeley

Technical Report No. UCB/EECS-2012-240

December 13, 2012

http://www2.eecs.berkeley.edu/Pubs/TechRpts/2012/EECS-2012-240.pdf

Middleboxes, such as caches, firewalls, and intrusion detection systems, form a vital part of network infrastructure today. Administrators deploy middleboxes in diverse scenarios from enterprise networks, to datacenters, to access networks. However, middleboxes are universally deployed under what we call the `unilateral model', where middleboxes are deployed and configured by administrators alone, for the benefit of hosts in a single domain alone.

In this thesis, we present two new deployment models for middleboxes which offer new capabilities for middlebox usage as well as new business models for middlebox deployment. Netcalls is an extension to the Internet architecture that allows end host applications to invoke and configure middleboxes in any network their traffic traverses; for example, we present a web server that invokes inter-domain DDoS defense when it detects that it is under attack. APLOMB is a system that allows enterprise networks (as well as individual end hosts) to tunnel their traffic to and from a cloud service that applies middlebox processing to their traffic, avoiding the costly and management-intensive burden of administering middleboxes in a local network. Netcalls and APLOMB allow ISPs and cloud providers (respectively) to monetize their deployment of middleboxes by offering them as a service to third-party clients; all the while presenting new capabilities, in the case of netcalls by enabling application interaction and in the case of APLOMB by providing better scalability and easier management.

We discuss both of these proposals and their benefits in detail; we then discuss challenges and opportunities towards their deployment and adoption.

Advisors: Sylvia Ratnasamy

---

BibTeX citation:

@mastersthesis{Sherry:EECS-2012-240,
    Author= {Sherry, Justine},
    Title= {Future Architectures for Middlebox Processing Services on the Internet and in the Cloud},
    School= {EECS Department, University of California, Berkeley},
    Year= {2012},
    Month= {Dec},
    Url= {http://www2.eecs.berkeley.edu/Pubs/TechRpts/2012/EECS-2012-240.html},
    Number= {UCB/EECS-2012-240},
    Abstract= {   Middleboxes, such as caches, firewalls, and intrusion detection systems, form a vital part of network infrastructure today.
    Administrators deploy middleboxes in diverse scenarios from enterprise networks, to datacenters, to access networks.
    However, middleboxes are universally deployed under what we call the `unilateral model', where middleboxes are deployed and configured by administrators alone, for the benefit of hosts in a single domain alone.

    In this thesis, we present two new deployment models for middleboxes which offer new capabilities for middlebox usage as well as new business models for middlebox deployment.
    Netcalls is an extension to the Internet architecture that allows end host applications to invoke and configure middleboxes in any network their traffic traverses; for example, we present a web server that invokes inter-domain DDoS defense when it detects that it is under attack. 
    APLOMB is a system that allows enterprise networks (as well as individual end hosts) to tunnel their traffic to and from a cloud service that applies middlebox processing to their traffic, avoiding the costly and management-intensive burden of administering middleboxes in a local network.
    Netcalls and APLOMB allow ISPs and cloud providers (respectively) to monetize their deployment of middleboxes by offering them as a service to third-party clients; all the while presenting new capabilities, in the case of netcalls by enabling application interaction and in the case of APLOMB by providing better scalability and easier management.

    We discuss both of these proposals and their benefits in detail; we then discuss challenges and opportunities towards their deployment and adoption.},
}

EndNote citation:

%0 Thesis
%A Sherry, Justine 
%T Future Architectures for Middlebox Processing Services on the Internet and in the Cloud
%I EECS Department, University of California, Berkeley
%D 2012
%8 December 13
%@ UCB/EECS-2012-240
%U http://www2.eecs.berkeley.edu/Pubs/TechRpts/2012/EECS-2012-240.html
%F Sherry:EECS-2012-240