Multi-tenancy architecture （MTA） is often used in Software-as-a-Service （SaaS） and the central idea is that multiple tenant applications can be developed using components stored in the SaaS infrastructure. Recentl...Multi-tenancy architecture （MTA） is often used in Software-as-a-Service （SaaS） and the central idea is that multiple tenant applications can be developed using components stored in the SaaS infrastructure. Recently, MTA has been extended to allow a tenant application to have its own sub-tenants, where the tenant application acts like a SaaS infrastructure. In other words, MTA is extended to STA （Sub-Tenancy Architecture）. In STA, each tenant application needs not only to develop its own functionalities, but also to prepare an infrastructure to allow its sub-tenants to develop customized applications. This paper applies Crowdsourcing as the core to STA component in the development life cycle. In addition, to discovering adequate fit tenant developers or components to help build and compose new components, dynamic and static ranking models are proposed. Furthermore, rank computation architecture is presented to deal with the case when the number of tenants and components becomes huge. Finally, experiments are performed to demonstrate that the ranking models and the rank computation architecture work as design.展开更多
The Tenant of Wildfell Hall,firstly published in 1848,was the second and final novel of Anne Brontë,the youngest of the Brontësisters,telling a story of the mysterious young widow Helen Huntingdon,who flees ...The Tenant of Wildfell Hall,firstly published in 1848,was the second and final novel of Anne Brontë,the youngest of the Brontësisters,telling a story of the mysterious young widow Helen Huntingdon,who flees her abusive husband and hides with her son at Wildfell Hall.Just as most contemporary critic defines it as one of the first feminist novels,the overall characterization of Helen sends a strong message of the empowerment of women.What confuses modern readers,however,is the subtle confrontation between the empowerment and its subversion.Thus,this paper conducts an in-depth analysis of the text concerning Anne's empow⁃erment of Helen and the corresponding subversion of the established empowerment before unveiling the fundamental cause of such arrangement with a view of shedding light on the comprehension of Anne Brontë's belief in universal social issues.展开更多
A data center is an infrastructure that supports Internet service. Cloud comput the face of the Internet service infrastructure, enabling even small organizations to quickly ng is rapidly changing build Web and mobile...A data center is an infrastructure that supports Internet service. Cloud comput the face of the Internet service infrastructure, enabling even small organizations to quickly ng is rapidly changing build Web and mobile applications for millions of users by taking advantage of the scale and flexibility of shared physical infrastructures provided by cloud computing. In this scenario, multiple tenants save their data and applications in shared data centers, blurring the network boundaries between each tenant in the cloud. In addition, different tenants have different security requirements, while different security policies are necessary for different tenants. Network virtualization is used to meet a diverse set of tenant-specific requirements with the underlying physical network enabling multi-tenant datacenters to automatically address a large and diverse set of tenants requirements. In this paper, we propose the system implementation of vCNSMS, a collaborative network security prototype system used n a multi-tenant data center. We demonstrate vCNSMS with a centralized collaborative scheme and deep packet nspection with an open source UTM system. A security level based protection policy is proposed for simplifying the security rule management for vCNSMS. Different security levels have different packet inspection schemes and are enforced with different security plugins. A smart packet verdict scheme is also integrated into vCNSMS for ntelligence flow processing to protect from possible network attacks inside a data center network展开更多
Virtual Machine（VM） allocation for multiple tenants is an important and challenging problem to provide efficient infrastructure services in cloud data centers. Tenants run applications on their allocated VMs, and th...Virtual Machine（VM） allocation for multiple tenants is an important and challenging problem to provide efficient infrastructure services in cloud data centers. Tenants run applications on their allocated VMs, and the network distance between a tenant＇s VMs may considerably impact the tenant＇s Quality of Service（Qo S）. In this study, we define and formulate the multi-tenant VM allocation problem in cloud data centers, considering the VM requirements of different tenants, and introducing the allocation goal of minimizing the sum of the VMs＇ network diameters of all tenants. Then, we propose a Layered Progressive resource allocation algorithm for multi-tenant cloud data centers based on the Multiple Knapsack Problem（LP-MKP）. The LP-MKP algorithm uses a multi-stage layered progressive method for multi-tenant VM allocation and efficiently handles unprocessed tenants at each stage. This reduces resource fragmentation in cloud data centers, decreases the differences in the Qo S among tenants, and improves tenants＇ overall Qo S in cloud data centers. We perform experiments to evaluate the LP-MKP algorithm and demonstrate that it can provide significant gains over other allocation algorithms.展开更多
Software-as-a-Service （SaaS） introduces multi- tenancy architecture （MTA）. Sub-tenancy architecture （STA）, is an extension of MTA, allows tenants to offer services for subtenant developers to customize their app...Software-as-a-Service （SaaS） introduces multi- tenancy architecture （MTA）. Sub-tenancy architecture （STA）, is an extension of MTA, allows tenants to offer services for subtenant developers to customize their applications in the SaaS infrastructure. In a STA system, tenants can create sub- tenants, and grant their resources （including private services and data） to their subtenants. The isolation and sharing re- lations between parent-child tenants, sibling tenants or two non-related tenants are more complicated than those between tenants in MTA. It is important to keep service components or data private, and at the same time, allow them to be shared, and support application customizations for tenants. To ad- dress this problem, this paper provides a formal definition of a new tenant-based access control model based on administra- tive role-based access control （ARBAC） for MTA and STA in service-oriented SaaS （called TMS-ARBAC）. Autonomous areas （AA） and AA-tree are proposed to describe the auton- omy of tenants, including their isolation and sharing relation- ships. Authorization operations on AA and different resource sharing strategies are defined to create and deploy the access control scheme in STA models. TMS-ARBAC model is ap- plied to design a geographic e-Science platform.展开更多
介绍云平台安全整体架构设计,针对多租户虚拟网络环境下租户与租户之间、租户内部和租户对外访问等多种安全访问需求,围绕云网络安全设计具体说明虚拟扩展局域网(Virtual Extensible Local Area Network,VXLAN)、安全组、虚拟防火墙等...介绍云平台安全整体架构设计,针对多租户虚拟网络环境下租户与租户之间、租户内部和租户对外访问等多种安全访问需求,围绕云网络安全设计具体说明虚拟扩展局域网(Virtual Extensible Local Area Network,VXLAN)、安全组、虚拟防火墙等方面的安全防护技术,重点探讨分布式虚拟防火墙和安全虚拟组件两种安全防护系统的特点与优势,为云平台安全防护提供新的思路和解决方案。展开更多
文摘Multi-tenancy architecture （MTA） is often used in Software-as-a-Service （SaaS） and the central idea is that multiple tenant applications can be developed using components stored in the SaaS infrastructure. Recently, MTA has been extended to allow a tenant application to have its own sub-tenants, where the tenant application acts like a SaaS infrastructure. In other words, MTA is extended to STA （Sub-Tenancy Architecture）. In STA, each tenant application needs not only to develop its own functionalities, but also to prepare an infrastructure to allow its sub-tenants to develop customized applications. This paper applies Crowdsourcing as the core to STA component in the development life cycle. In addition, to discovering adequate fit tenant developers or components to help build and compose new components, dynamic and static ranking models are proposed. Furthermore, rank computation architecture is presented to deal with the case when the number of tenants and components becomes huge. Finally, experiments are performed to demonstrate that the ranking models and the rank computation architecture work as design.
文摘The Tenant of Wildfell Hall,firstly published in 1848,was the second and final novel of Anne Brontë,the youngest of the Brontësisters,telling a story of the mysterious young widow Helen Huntingdon,who flees her abusive husband and hides with her son at Wildfell Hall.Just as most contemporary critic defines it as one of the first feminist novels,the overall characterization of Helen sends a strong message of the empowerment of women.What confuses modern readers,however,is the subtle confrontation between the empowerment and its subversion.Thus,this paper conducts an in-depth analysis of the text concerning Anne's empow⁃erment of Helen and the corresponding subversion of the established empowerment before unveiling the fundamental cause of such arrangement with a view of shedding light on the comprehension of Anne Brontë's belief in universal social issues.
基金supported in part by the National Key Basic Research and Development(973)Program of China(Nos.2013CB228206 and 2012CB315801)the National Natural Science Foundation of China(Nos.61233016 and 61140320)+1 种基金supported by the Intel Research Council with the title of "Security Vulnerability Analysis based on Cloud Platform with Intel IA Architecture"Huawei Corp
文摘A data center is an infrastructure that supports Internet service. Cloud comput the face of the Internet service infrastructure, enabling even small organizations to quickly ng is rapidly changing build Web and mobile applications for millions of users by taking advantage of the scale and flexibility of shared physical infrastructures provided by cloud computing. In this scenario, multiple tenants save their data and applications in shared data centers, blurring the network boundaries between each tenant in the cloud. In addition, different tenants have different security requirements, while different security policies are necessary for different tenants. Network virtualization is used to meet a diverse set of tenant-specific requirements with the underlying physical network enabling multi-tenant datacenters to automatically address a large and diverse set of tenants requirements. In this paper, we propose the system implementation of vCNSMS, a collaborative network security prototype system used n a multi-tenant data center. We demonstrate vCNSMS with a centralized collaborative scheme and deep packet nspection with an open source UTM system. A security level based protection policy is proposed for simplifying the security rule management for vCNSMS. Different security levels have different packet inspection schemes and are enforced with different security plugins. A smart packet verdict scheme is also integrated into vCNSMS for ntelligence flow processing to protect from possible network attacks inside a data center network
基金supported in part by the National Key Basic Research and Development (973) Program of China (No. 2011CB302600)the National Natural Science Foundation of China (No. 61222205)+1 种基金the Program for New Century Excellent Talents in Universitythe Fok Ying-Tong Education Foundation (No. 141066)
文摘Virtual Machine（VM） allocation for multiple tenants is an important and challenging problem to provide efficient infrastructure services in cloud data centers. Tenants run applications on their allocated VMs, and the network distance between a tenant＇s VMs may considerably impact the tenant＇s Quality of Service（Qo S）. In this study, we define and formulate the multi-tenant VM allocation problem in cloud data centers, considering the VM requirements of different tenants, and introducing the allocation goal of minimizing the sum of the VMs＇ network diameters of all tenants. Then, we propose a Layered Progressive resource allocation algorithm for multi-tenant cloud data centers based on the Multiple Knapsack Problem（LP-MKP）. The LP-MKP algorithm uses a multi-stage layered progressive method for multi-tenant VM allocation and efficiently handles unprocessed tenants at each stage. This reduces resource fragmentation in cloud data centers, decreases the differences in the Qo S among tenants, and improves tenants＇ overall Qo S in cloud data centers. We perform experiments to evaluate the LP-MKP algorithm and demonstrate that it can provide significant gains over other allocation algorithms.
文摘Software-as-a-Service （SaaS） introduces multi- tenancy architecture （MTA）. Sub-tenancy architecture （STA）, is an extension of MTA, allows tenants to offer services for subtenant developers to customize their applications in the SaaS infrastructure. In a STA system, tenants can create sub- tenants, and grant their resources （including private services and data） to their subtenants. The isolation and sharing re- lations between parent-child tenants, sibling tenants or two non-related tenants are more complicated than those between tenants in MTA. It is important to keep service components or data private, and at the same time, allow them to be shared, and support application customizations for tenants. To ad- dress this problem, this paper provides a formal definition of a new tenant-based access control model based on administra- tive role-based access control （ARBAC） for MTA and STA in service-oriented SaaS （called TMS-ARBAC）. Autonomous areas （AA） and AA-tree are proposed to describe the auton- omy of tenants, including their isolation and sharing relation- ships. Authorization operations on AA and different resource sharing strategies are defined to create and deploy the access control scheme in STA models. TMS-ARBAC model is ap- plied to design a geographic e-Science platform.
文摘介绍云平台安全整体架构设计,针对多租户虚拟网络环境下租户与租户之间、租户内部和租户对外访问等多种安全访问需求,围绕云网络安全设计具体说明虚拟扩展局域网(Virtual Extensible Local Area Network,VXLAN)、安全组、虚拟防火墙等方面的安全防护技术,重点探讨分布式虚拟防火墙和安全虚拟组件两种安全防护系统的特点与优势,为云平台安全防护提供新的思路和解决方案。
