Edge-Disjoint Tree Allocation for Multi-Tenant Cloud Security in Datacenter Topologies

Resource sharing with its implied mutual interference has been considered a major concern for running applications of multiple tenants in shared cloud datacenters. Besides its security benefits, the isolation of traffic might ensure a quality of service (QoS) performance guarantee avoiding interference among tenants. Traffic isolation can be achieved by dedicating the usage of link resources in the network to a single tenant preventing its sharing among others. Accordingly, tenants should be connected through an edge-disjoint tree to enable isolated communication among its hosts. In this paper, we study the problem of establishing edge-disjoint trees in common datacenter topologies. We show that the availability of such trees is highly affected by the mapping of the tenants to hosts of the topology. Specifically, with the flexibility to map tenants in the datacenter topology, we describe a mapping algorithm and an optimal tree establishment for the optimization problem. Given the mapping of the tenants, we prove the problem turns out to be NP-Hard and provide comprehensive heuristics for the problem. Finally, we conduct experiments using real workloads to examine tree availability under various scenarios.