Multi-Tenant Deployment with Anomaly Isolation in Public Clouds

Cloud vendors provide network services to tenants through shared service nodes, which may cause the abnormal traffic of one tenant to affect others. Deploying auxiliary systems such as firewalls will reduce the frequency of abnormal traffic occurrences but cannot eliminate them entirely. In practice, proper tenant deployment is a promising method to pursue anomaly isolation. Previous works have explored solutions along this line, such as controlling the impact scope of abnormal traffic to mitigate the influence of anomalies among tenants. However, these solutions cannot ensure full anomaly isolation among all tenants. That is, an anomaly in one tenant may cause complete service disruption for another tenant. To bridge the gap, we study the problem of multi-tenant Deployment with Anomaly Isolation (DAI), which is NP-hard. To address this problem, this paper introduces R-DAI, a rounding-based algorithm that can provide a tenant deployment solution in polynomial time, ensuring anomaly isolation among all tenants and load balancing. We implement our proposed algorithm on a large-scale simulation, and the results demonstrate its superior performance. For example, our algorithm eliminates tenant service disruptions caused by abnormal traffic and reduces the impact scope of a service node failure by 53% compared with other alternatives.