Virtual vpn in the cloud

1.1.1
 
Problem Statement 
Cloud computing offers a way for enterprises to access computing resources on-
demand. This allows enterprises to save on capital expenses related to periodic hardware 
upgrades, maintenance and energy costs. Furthermore, cloud computing enables enterprises 
to dynamically allocate and/or release resources to match their needs or the demand from 
their customers. Many cloud providers have built data centers in various geographic 
locations and interconnected them through high-speed Internet links. This makes it possible 
for cloud tenants to instantiate services close to the location of the users. Theoretically, a 
customer can rent resources from several cloud providers and merge them together in a 
common pool, as is the case in a federated cloud. 
The resources in the pool are often building blocks for services, typically VMs 
with associated memory, storage and network. These building blocks, denoted as Virtual 
Network Functions (VNFs) or Generic Enablers (GEs), are interconnected into service 
chains that can do advanced data processing. In a federated cloud the interconnected 
elements can span vast geographic distances as well as multiple Internet Autonomous 
Systems (ASs).
Considering a scenario wherein various cloud providers are involved, each 
providing different services such as online shopping, web services and so on. Tenants as a 
part of either of the cloud, do not want their card credentials to be compromised when 
associated with the shopping services. Similarly, tenants with business relations do not want 
their confidential data to be compromised in transit. For similar reasons, Cloud tenants, not 

---

3 
wanting to rely on cloud provider services, can build their own private VPN tunnel for 
secure transfer of information. 
In this situation it is desirable that data traversing these elements remains 
confidential and that third parties cannot alter it without detection. In addition, it is often 
convenient that chain elements instantiated with different providers are located in a common 
IP address space. This can simplify the implementation of service discovery, load balancing, 
high-availability schemes etc.
A VPN is a typical way of interconnecting networks over a public network 
infrastructure. Although several cloud providers offer VPN access to their tenants this can be 
undesirable in certain circumstances (e.g., the tenant does not trust the provider and/or the 
tenant wants to have better controls over the VPN policies and key generation and 
distribution process). The goal of this project is to provide VPN-as-a-Service (VPNaaS) 
using virtualized VPN software, essentially making the VPN yet another building block for a 
service.