[Paper Review] MTS: Bringing Multi-Tenancy to Virtual Networking

Kashyap Thimmaraju, Saad Hermak+2 more|arXiv (Cornell University)|Mar 4, 2024

Software-Defined Networks and 5G32 references4 citations

TL;DR

MTS proposes a secure, multi-tenant virtual switch architecture that isolates tenant networks by moving the vswitch out of the host and into dedicated, compartmentalized VMs using SR-IOV and least-privilege principles. It achieves 1.5–2× higher throughput than baseline vswitches with only one additional CPU core, while significantly improving security and performance isolation in cloud environments.

ABSTRACT

Multi-tenant cloud computing provides great benefits in terms of resource sharing, elastic pricing, and scalability, however, it also changes the security landscape and introduces the need for strong isolation between the tenants, also inside the network. This paper is motivated by the observation that while multi-tenancy is widely used in cloud computing, the virtual switch designs currently used for network virtualization lack sufficient support for tenant isolation. Hence, we present, implement, and evaluate a virtual switch architecture, MTS, which brings secure design best-practice to the context of multi-tenant virtual networking: compartmentalization of virtual switches, least-privilege execution, complete mediation of all network communication, and reducing the trusted computing base shared between tenants. We build MTS from commodity components, providing an incrementally deployable and inexpensive upgrade path to cloud operators. Our extensive experiments, extending to both micro-benchmarks and cloud applications, show that, depending on the way it is deployed, MTS may produce 1.5-2x the throughput compared to state-of-the-art, with similar or better latency and modest resource overhead (1 extra CPU). MTS is available as open source software.

Motivation & Objective

• To address the critical lack of strong network isolation in existing multi-tenant virtual switch designs, which violate core security principles.
• To improve tenant isolation in cloud virtual networks without sacrificing performance or requiring major infrastructure overhauls.
• To provide a practical, incrementally deployable upgrade path for cloud operators using commodity hardware and existing vswitches like Open vSwitch.
• To reduce the trusted computing base shared between tenants by compartmentalizing vswitch components and mediating all network communication.
• To demonstrate that secure virtual networking can be achieved with modest performance and resource overhead, enabling broader adoption.

Proposed method

• MTS deploys multiple isolated vswitch compartments as VMs, each dedicated to a single tenant, using SR-IOV for direct hardware access and complete mediation of network I/O.
• It enforces least-privilege execution by running each vswitch in a separate VM with minimal privileges, reducing the attack surface.
• The architecture uses interrupt-based communication between tenant VMs and their dedicated vswitch VMs, avoiding shared memory and improving isolation.
• It leverages existing production-grade vswitches like Open vSwitch, enabling seamless integration without modifying QEMU or requiring application reprogramming.
• MTS employs a lightweight, user-space packet processing model that supports high-performance forwarding while maintaining strong isolation guarantees.
• The system is designed for incremental deployment, allowing cloud operators to migrate existing deployments with minimal configuration changes.

Figure 1 : A high-level view of the tradeoffs between security, performance and resources for the state-of-the-art and MTS

Experimental results

Research questions

• RQ1 Can a virtual switch architecture be designed to provide strong network isolation between tenants while maintaining high performance?
• RQ2 How can tenant isolation be improved in cloud virtual networking without requiring changes to existing virtualization stacks or vswitch software?
• RQ3 What performance and resource overhead is incurred by moving vswitches out of the host and into isolated VMs?
• RQ4 Can a secure, compartmentalized vswitch design achieve better throughput and latency than traditional host-based vswitches?
• RQ5 Is it feasible to deploy such a system incrementally in real-world cloud environments using commodity hardware?

Key findings

• MTS achieves 1.5–2× higher forwarding throughput (in packets per second) compared to the baseline state-of-the-art vswitch when deployed in shared mode with one additional CPU core.
• Tenant workloads, including web servers and key-value stores, experience a 1.5–2× improvement in both throughput and response time when using MTS.
• The system maintains strong network isolation even if a vswitch VM is compromised, due to compartmentalization and complete mediation of network I/O.
• MTS introduces only a modest resource overhead of one additional CPU core, making it a practical upgrade path for cloud operators.
• The architecture enables secure, high-performance virtual networking without requiring changes to QEMU or reprogramming existing vswitches, supporting backward compatibility.
• The solution is incrementally deployable and can be easily scripted into existing cloud systems, enabling broad adoption with minimal engineering effort.

Figure 2 : High-level overview of MTS in security Level-2. The Red and Blue vswitch compartments (VMs) are allocated dedicated virtual functions (VFs) to communicate with external networks using the In/Out VF , their respective tenants using the Gw VF and T VF . Communication between the vswitches,