NTTドコモ様 導入事例 OpenStack Summit 2016 Barcelona 講演「Expanding and Deepening NTT DOCOMO's Private Cloud」 - OpenStack最新情報セミナー(2016年12月)

Editor's Notes

1. By the way, Provider network can provide layer 2 connectivity to external devices too. But, our model can not deploy on large FLAT L2 network that required by provider network. So, We chooses L2 Gateway.
2. Short packet workload with using commodity server based solution requires large number node for fulfilling the target performance.
3. http://blog.ipspace.net/2015/09/vxlan-hardware-gateway-overview.html 性能値を載せるか検討
4. https://github.com/openstack/networking-l2gw https://bugs.launchpad.net/networking-l2gw https://review.openstack.org/#/q/project:openstack/networking-l2gw SSL support https://review.openstack.org/#/c/334744/ Mcast_Macs_Remote table https://review.openstack.org/#/c/202495/
5. 後で大幅に直す
6. 大幅に直す
7. Test on production size environment　稼動前テスト探す！pilot?
8. 謝っている雲秀 Network trouble occurred without missing a week in customer's long run test phase. The l2gw agent does not work correctly after few days when customers long run a test. That test create and delete neutron port many times.
9. Keep to a delivery date
10. By using the L2GW, the existing network configuration was kept that our user requested.
11. 16分： execute
12. Our cloud expanded as we presented. Next, We would like to present how to plant various tree to free space, which means how to migrate various in-house APP to our cloud. When we aimed to migrate users, we had big problem. Our company have over one hundred guidelines for security governance, and a lot of efforts are required to meet the policies when users reconstruct APP on our cloud. For example, this picture is part of all security policies, and various point of view, Redundancy log, certificate and so on. In order to reduce users task, we wonder predefined models are provided
13. We propose predefined models, called Referenence model. This is system architecture based on many on security rules, and then deployed server are included sets of Open Source software stacks that heavily tested on our project. Now, doing quick demo.(確認appleのdemo movieで言ってること)
14. This picture display system architecture of Reference model. This is covered with several security policies, such as dividing network segment, enforcing SG. And, Each server meets needed security guidelines. For example, we will explain about WEB/LB server and step server.
15. We explain about WEB/Load balancer server. Our reference model uses apache for web and LVS that is software loadbalancer by default. And, some of security policies are set by default, such as dummy certificates for HTTPS and WAF basic rules. By the way, we didn’t use LBaaS_v1. this is because LBaaS_v1, which we use juno, doesn’t satisfy use cases of our users. It means that Users required to set SG to LBaaS, or use sorry page and so on , and then it was difficult to satisfy these requirement by LBaaS_v1. That’s why we decided to use LVS
16. We explain about VPN server. In order to secure remote access, (this server is prepaied,) and installed OpenVPN for SSL-VPN by default. And, default setting can be done, and we prepaied tools for operation of SSL-VPN. Same as LBaaS, we didn’t use VPNaaS_v1. this is because VPNaaS_v1, which we use juno, use only sha1, and then sha1 is under encryption compromise . That’s why we decided to use openvpn. we hear VPNaaS in neuton have sha256. Sha1
17. Finally, about security policies, Reference model can covered 60% of security policies In this picture, covered area is changed pink color. For the future, we will update this model by adding the lack parts about security policies, aim to 100%.
18. From now we will explain about security update. As our cloud expands, more security threats. Current manual operation is a lot of time, and can cause human error such as forget to check vulnerabilities Nice if we have automatic operation to vulnerabilities
19. This shows current operations about vulnerability. Almost all of process is manual, it can make us a lot of time and human error. Especially, in this first step, we checked vendor site, and in second step, we assessed the risk of vulnerability one by one. Even if we have the scripts checking package-version, it won’t be enough. That’s why we hoped this operation can be automatic.
20. now doing quick demo（検証中をデモで見せます）. First, detection of vulnerabilities. Until now, we have found vulnerabilities by checking vendor site. （それに対して。の英語）this process can be based on CVE & CVSS. CVE means attached ID to vulnerabilities, and CVSS means score to vulnerability. As this score is high, the risk is high That’s why it is important to check CVE, and then we used API CVE-search for detection. This is demo. By this API once by day(1日に１回), the latest vulnerabilities can be found and shown in screen.
21. Second, risk assessment. Even is CVSS is high, the risk of the vulnerability in our cloud me be low/none. For example, if the version is not related, risk will be none, Or, if the host in internal NW is targeted, The risk will be low. On the contrary, in case of vulnerability that guest OS can invade host OS, it is important to check heavyiliy. That’s why it is needed to re-evaluate the CVSS score for each host regarding its environment. Now Demo. We re-evaluate CVSS from the point of view about this important part, and shows S/A/B which are used in our security governance.
22. Third, Management TODO list. Of cource, do not forget vulnerabillities until patch are applied. Moreover, it is important to check CVSS of same vulnerabilities. This is because it will be high score as analysis proceeds. Demo shows. In this screen, we manage TODO list as “status”. For example, updatable means this vulnerability will be applied. （逆もあるで） We updated CVE&CVSS by updating API, and then if CVSS become change, the vulnerabilities will be re-evaluated and shows screen. Now ultra short demo short quick
23. Fourth, Update Our cloud. In this process, we must care about the influence on users’ instance. Then,, it is necessary to have manual interventions only for check points. It means that there are three processes in update process大まかに言って such as live migration, security update, return back. And, we had check points between three processed. For example, we try to confirm the normality users’ app after live migration, the nomarity of openstack function after update. Thus, we decided semi-automatic procedure currently. For the future, we try to automatic update hosts which don’t exist user Moreover, extend our security tools for users’ self-check, Thank you for your listening. Any question. 手のひらを向けて、please