Recently, to match the emerging demands for multi-site edge clouds, the cloud-based information and communication technology (ICT) infrastructure is rapidly expanding. To protect distributed edge-based cloud assets from networking-based threats by recognizing suspicious traffic, cloud operators should monitor the overall underlying topology to categorize and identify diversified networking packet traffic, flowing through various paths among virtualized and containerized cloud nodes. Perimeter-based networking security, which employs security appliances in fixed locations, cannot address this visibility challenge. As a result, in this paper, we propose the SmartX Multi-tier Security (Multi-Sec) framework, which aims to provide intuitive and systematic visibility for multi-site edge-cloud security. SmartX Multi-Sec abstracts the underlying networking topology among multi-site edge clusters as multiple onion-ring-based tiers of physical, virtualized, and containerized cloud nodes. It also provides collective DevSecOps automation features for monitoring, visualizing, and filtering targeted networking traffic from the respective tiers of the abstracted networking topology. The resulting flow-centric visibility using SmartX Multi-Sec can be featured with extended Berkeley Packet Filter and eXpress Data Path (eBPF/XDP)-leveraged lightweight flow capture and filtering, three-dimensional onion-ring visualization, and automated deployment of DevSecOps functions. By integrating these features, the Proof-of-Concept (PoC)-version of the SmartX Multi-Sec framework is realized to verify the flexible and scalable flow-centric security for multi-site cloud-native edge clouds.

With the expansion of cloud-leveraged Information and Communications Technology (ICT) convergence trend, cloud-native computing is starting to be the de-facto paradigm together with MSA(Microservices Architecture)-based service composition for agility and efficiency. Moreover, by bridging the Internet of Things (IoT) and cloud together, a variety of cloud applications are explosively emerging. As an example, the so-called IoT-Cloud services, which are cloud-leveraged inter-connected services with distributed IoT devices, dynamically utilize geographically-distributed multiple clouds since mobile IoT devices can selectively connect to the near-by cloud resources for low-latency and high-throughput connectivity. In comparison, most public cloud providers may cause vendor lock-in problems that limit the inter-operable service compositions. Thus, in this paper, we propose a new overlay approach to address the above limitations, denoted as Dynamic OverCloud, which is a specially-arranged razor-thin overlay layer that provides users with an inter-operable and visibility-supported environment for MSA-based IoT-Cloud service composition over the existing multiple clouds. Then, we design a software framework that dynamically builds the proposed concept. We also describe a detailed implementation of the software framework with workflows. Finally, we verify its feasibility by realizing a smart energy IoT-Cloud service with the suggested operation lifecycle.

In this paper, we present our proposals and efforts for building an affordable playground (i.e., miniaturized testbed) for Software-Defined Networking (SDN)-Cloud experiments by using hyper-converged SmartX Boxes that are distributed across multiple sites. Each SmartX Box consists of several virtualized functions that are categorized into SDN and cloud functions. Multiple SmartX Boxes are deployed and inter-connected through SDN to build multi-site distributed cloud playground resources. The resulting deployment integrates both cloud multi-tenancy and SDN-based slicing, which allow developers to run experiments and operators to monitor resources in a distributed SDN-cloud playground. It also describes how the hyper-converged SmartX Box can increase the affordability of the playground deployment. Thus, the analysis result shows the efficiency of SmartX Box for building a distributed playground by providing semi-automated DevOps-style resource provisioning.