Acila: attaching identities of workloads for efficient packet classification in a cloud data center network

Abstract

IP addresses and port numbers (network based identifiers) are major identifiers for network devices to identify systems and roles of hosts exchanging packets for access control lists, priority control, etc. However, in modern system design on cloud, such as microservice architecture, network based identifiers are inefficient to identify systems and roles of hosts because VMs and containers (workloads), which elastically change due to autoscaling and deployment of new codes, have only network based identifiers based on servers where workloads are running. We propose a new system, Acila, to classify packets based on the identity of a workload at network devices, by marking packets with necessary information extracted from the identity that is usually stored in cloud controllers. We implement Acila and show that packet filtering and priority control work with Acila, and entries for them with Acila is more efficient than network based identifiers approach, with little overhead on performance.