[Paper Review] NetSecCC: A Scalable and Fault-tolerant Architecture without Outsourcing Cloud Network Security

Jin He, Mianxiong Dong+3 more|arXiv (Cornell University)|May 4, 2014

Cloud Data Security Solutions11 references3 citations

TL;DR

NetSecCC proposes a scalable, fault-tolerant cloud network security architecture that eliminates reliance on outsourced security services by integrating security inspection chains (SICs) with dynamic load balancing and active/standby redundancy. It achieves minimal performance overhead—under 14% latency increase and 11% throughput loss—while providing comprehensive protection against both external and internal network threats in virtualized cloud environments.

ABSTRACT

Modern cloud computing platforms based on virtual machine monitors carry a variety of complex business that present many network security vulnerabilities. At present, the traditional architecture employs a number of security devices at front-end of cloud computing to protect its network security. Under the new environment, however, this approach can not meet the needs of cloud security. New cloud security vendors and academia also made great efforts to solve network security of cloud computing, unfortunately, they also cannot provide a perfect and effective method to solve this problem. We introduce a novel network security architecture for cloud computing (NetSecCC) that addresses this problem. NetSecCC not only provides an effective solution for network security issues of cloud computing, but also greatly improves in scalability, fault-tolerant, resource utilization, etc. We have implemented a proof-of-concept prototype about NetSecCC and proved by experiments that NetSecCC is an effective architecture with minimal performance overhead that can be applied to the extensive practical promotion in cloud computing.

Motivation & Objective

• Address the limitations of traditional cloud security architectures that lack internal VM-to-VM protection and suffer from poor scalability and fault tolerance.
• Overcome the shortcomings of cloud provider solutions (e.g., AWS, VMware) and SecaaS offerings, which lack integrated, scalable, and fault-tolerant mechanisms.
• Develop a self-managed, in-cloud security architecture that ensures end-to-end protection without relying on external security vendors.
• Achieve high resource utilization and low performance overhead while maintaining strong security guarantees in dynamic cloud workloads.

Proposed method

• Design a security inspection chain (SIC) architecture where traffic flows through a sequence of security services (e.g., firewall, WAF, anti-virus, SSL/VPN) in a configurable order.
• Implement dynamic load balancing across active middlebox nodes to distribute traffic and prevent overload, with automatic failover to standby nodes when needed.
• Use a hybrid fault-tolerance mechanism: switch to hot-standby (HS) mode for immediate failover (1.2s response) if no active node is overloaded, or create a new active node (3s response) if load imbalance occurs.
• Integrate security groups to enforce fine-grained access control policies across virtual machines and services.
• Leverage virtualization and software-defined networking (SDN) principles to enable flexible, programmable security policy deployment and traffic steering.
• Use IXIA as a performance testing tool to evaluate throughput and latency under real-world workloads (web and email access) with and without NetSecCC.

Experimental results

Research questions

• RQ1 How can a cloud network security architecture achieve high scalability and fault tolerance without outsourcing security functions?
• RQ2 What is the performance overhead of an in-cloud security architecture that enforces comprehensive inspection chains across multiple security services?
• RQ3 How does dynamic load balancing and failover strategy impact response time and system availability during middlebox failures?
• RQ4 Can a self-contained, in-cloud security architecture effectively defend against both external and internal network threats in virtualized environments?
• RQ5 To what extent does the integration of security inspection chains affect end-to-end latency and throughput in cloud workloads?

Key findings

• NetSecCC reduces performance overhead to within acceptable limits, with an average latency increase of 9.3% for web access and 11.1% for encrypted email access compared to unprotected configurations.
• Throughput degradation is minimal, averaging only 0.4% for web access and 5% for email access, indicating strong efficiency under inspection workloads.
• The hybrid fault-tolerance mechanism ensures low failover latency (1.2s via hot standby) and avoids performance degradation during failover by intelligently choosing between failover and node creation.
• The architecture successfully prevents both external and internal attacks by enforcing security inspection chains across VMs, addressing a key gap in traditional and cloud-provider solutions.
• Experimental results confirm that NetSecCC maintains high system availability and performance even under traffic bursts, demonstrating its scalability and robustness.
• The solution achieves a balance between strong security, low overhead, and high fault tolerance, making it suitable for large-scale cloud deployment without external security outsourcing.