THE GEOMORPHIC VIEW OF NETWORKING: A NETWORK MODEL AND ITS USES



Similar documents
Lecture 17 - Network Security

Internet Protocol: IP packet headers. vendredi 18 octobre 13

12. Firewalls Content

Application Note. Onsight TeamLink And Firewall Detect v6.3

Digi Connect WAN Application Helper NAT, GRE, ESP and TCP/UPD Forwarding and IP Filtering

Why SSL is better than IPsec for Fully Transparent Mobile Network Access

Chapter 9. IP Secure

Firewalls and VPNs. Principles of Information Security, 5th Edition 1

Internet Firewall CSIS Packet Filtering. Internet Firewall. Examples. Spring 2011 CSIS net15 1. Routers can implement packet filtering

Objectives of Lecture. Network Architecture. Protocols. Contents

ELEC3030 (EL336) Computer Networks. How Networks Differ. Differences that can occur at network layer, which makes internetworking difficult:

Application Note. Onsight Connect Network Requirements V6.1

Firewalls. Basic Firewall Concept. Why firewalls? Firewall goals. Two Separable Topics. Firewall Design & Architecture Issues

Application Note. Firewall Requirements for the Onsight Mobile Collaboration System and Hosted Librestream SIP Service v5.0

Understanding TCP/IP. Introduction. What is an Architectural Model? APPENDIX

Extending Networking to Fit the Cloud

Application Note. Onsight Connect Network Requirements v6.3

A Case for Overlays in DCN Virtualization Katherine Barabash, Rami Cohen, David Hadas, Vinit Jain, Renato Recio and Benny Rochwerger IBM

OVERLAYING VIRTUALIZED LAYER 2 NETWORKS OVER LAYER 3 NETWORKS

Chapter 6 Configuring the SSL VPN Tunnel Client and Port Forwarding

Security Technology: Firewalls and VPNs

5.0 Network Architecture. 5.1 Internet vs. Intranet 5.2 NAT 5.3 Mobile Network

Appendix A: Configuring Firewalls for a VPN Server Running Windows Server 2003

SSVVP SIP School VVoIP Professional Certification

SOFTWARE-DEFINED NETWORKING AND OPENFLOW

Data Communication Networks and Converged Networks

Network Address Translation (NAT) Adapted from Tannenbaum s Computer Network Ch.5.6; computer.howstuffworks.com/nat1.htm; Comer s TCP/IP vol.1 Ch.

Network: several computers who can communicate. bus. Main example: Ethernet (1980 today: coaxial cable, twisted pair, 10Mb 1000Gb).

The need for bandwidth management and QoS control when using public or shared networks for disaster relief work

IP address format: Dotted decimal notation:

Virtual private network. Network security protocols VPN VPN. Instead of a dedicated data link Packets securely sent over a shared network Internet VPN

Cisco Which VPN Solution is Right for You?

Certes Networks Layer 4 Encryption. Network Services Impact Test Results

Overview. Securing TCP/IP. Introduction to TCP/IP (cont d) Introduction to TCP/IP

Internet Security Firewalls

ΕΠΛ 674: Εργαστήριο 5 Firewalls

Network System Design Lesson Objectives

Networking 4 Voice and Video over IP (VVoIP)

Network Considerations for IP Video

CSCE 465 Computer & Network Security

Building scalable IPSec infrastructure with MikroTik. IPSec, L2TP/IPSec, OSPF

Chapter 11 Cloud Application Development

GPRS / 3G Services: VPN solutions supported

Network Models OSI vs. TCP/IP

Cloud Networking Disruption with Software Defined Network Virtualization. Ali Khayam

Firewalls P+S Linux Router & Firewall 2013

Software Defined Network (SDN)

Other VPNs TLS/SSL, PPTP, L2TP. Advanced Computer Networks SS2005 Jürgen Häuselhofer

21.4 Network Address Translation (NAT) NAT concept

Towards Software Defined Cellular Networks

Cisco Application Networking for IBM WebSphere

Telematics. 14th Tutorial - Proxies, Firewalls, P2P

ReadyNAS Remote White Paper. NETGEAR May 2010

Компјутерски Мрежи NAT & ICMP

ΕΠΛ 475: Εργαστήριο 9 Firewalls Τοίχοι πυρασφάλειας. University of Cyprus Department of Computer Science

ICS 351: Today's plan. IP addresses Network Address Translation Dynamic Host Configuration Protocol Small Office / Home Office configuration

Industrial Network Security for SCADA, Automation, Process Control and PLC Systems. Contents. 1 An Introduction to Industrial Network Security 1

A P2P SIP Architecture - Two Layer Approach - draft-sipping-shim-p2p-arch-00.txt

Configuring IPSec VPN Tunnel between NetScreen Remote Client and RN300

Proxy Server, Network Address Translator, Firewall. Proxy Server

Firewalls. Chien-Chung Shen

Computer Networking. Definitions. Introduction

Routing Security Server failure detection and recovery Protocol support Redundancy

Network Virtualization Solutions

How To Configure Apple ipad for Cyberoam L2TP

LESSON Networking Fundamentals. Understand TCP/IP

Internet Security. Internet Security Voice over IP. Introduction. ETSF10 Internet Protocols ETSF10 Internet Protocols 2011

Tomás P. de Miguel DIT-UPM. dit UPM

Virtualization, SDN and NFV

Affording the Upgrade to Higher Speed & Density

Software Defined Networking

Software-Defined Networking Architecture Framework for Multi-Tenant Enterprise Cloud Environments

NAT and Firewall Traversal with STUN / TURN / ICE

High-Performance IP Service Node with Layer 4 to 7 Packet Processing Features

Virtual Private Networks

APPLICATION NOTE 211 MPLS BASICS AND TESTING NEEDS. Label Switching vs. Traditional Routing

IP Networking. Overview. Networks Impact Daily Life. IP Networking - Part 1. How Networks Impact Daily Life. How Networks Impact Daily Life

The Internet. Charging for Internet. What does 1000M and 200M mean? Dr. Hayden Kwok-Hay So

Secure Remote Monitoring of the Critical System Infrastructure. An Application Note from the Experts in Business-Critical Continuity

How To Learn Cisco Cisco Ios And Cisco Vlan

Technical Support Information Belkin internal use only

SDN CONTROLLER. Emil Gągała. PLNOG, , Kraków

"Charting the Course...

The TCP/IP Reference Model

IPv6 Tunneling Over IPV4

Introduction to Computer Security

Considerations In Developing Firewall Selection Criteria. Adeptech Systems, Inc.

Network Address Translation (NAT)

IPv4 and IPv6 Integration. Formation IPv6 Workshop Location, Date

20. Switched Local Area Networks

SOFTWARE-DEFINED NETWORKING AND OPENFLOW

Overview - Using ADAMS With a Firewall

Communication Systems Internetworking (Bridges & Co)

Bandwidth Management in MPLS Networks

Transcription:

THE GEOMORPHIC VIEW OF NETWORKING: A NETWORK MODEL AND ITS USES Pamela Zave AT&T Laboratories Research Florham Park, New Jersey, USA Jennifer Rexford Princeton University Princeton, New Jersey, USA

THE CLASSIC INTERNET ARCHITECTURE this architecture has succeeded (beyond most peoples wildest dreams) in fostering innovation and shaping the world we live in however, it is now widely agreed that it does not meet society s present and future requirements security dependability mobility scalability quality of service resource management APPLICATION LAYER TRANSPORT LAYER NETWORK LAYER LINK LAYER PHYSICAL LAYER the trend is toward a more pluralistic architecture...... with multiple, customized protocol stacks

A REAL EXAMPLE headers in a typical AT&T packet (12 instead of 4) Application HTTP TCP IP IPsec IP GTP UDP security HTTP being used as a transport protocol (! ) because it is the only way to traverse NAT boxes and firewalls cellular service (mobility, QoS, billing) IP MPLS MPLS multiple layers of resource management Ethernet

A REAL EXAMPLE: WHAT ARE THE PROBLEMS? COMMUNICATION SERVICES Application HTTP TCP IP IPsec IP GTP UDP IP MPLS MPLS Ethernet we need... a broader range of services security appropriate to each application... so that all applications can be developed easily and efficiently DESIGN PRINCIPLES this is not the most efficient way to satisfy the stakeholders requirements! 15 load-balancing algorithms apply to each packet; each designed and analyzed in isolation we need principles that apply to all levels, produce modular and predictable behavior SOFTWARE DEVELOPMENT we need to develop all this custom software through code re-use and code generation

A NEW LAYER MODEL: MEMBERS, ROUTING, AND member a process, which is merely a locus of state and control with the potential for autonomous action name FORWARDING unique and persistent within the layer LAYER A B C D E link a communication channel forwarding protocol enables members to send messages to one another, using the links routes often there is not a link between every pair of members; routes tell the forwarding protocol how to reach one member from another over the existing links, with forwarding by intermediate members routing algorithm maintains the routes as links change over time

A NEW LAYER MODEL: COMMUNICATION SERVICES channel an instance of a communication service session a communication channel (as are links) session protocol implements an end-to-end communication service, on top of the basic, fundamentally unreliable, message delivery provided by the forwarding protocol session LAYER a b link d e from the perspective of one layer, sessions are more convenient than links they have longer reach; might be more reliable, better-behaved (with FIFO delivery), with guaranteed performance, etc.

A NEW LAYER MODEL: THE USES HIERARCHY OVERLAY (higher layer) A when an overlay uses an underlay, a link in the overlay is implemented by a session in the underlay link E registration relates an overlay member to the underlay member that it is using on the same machine UNDERLAY (lower layer) a b session d e members on the same machine communicate reliably through its operating system to set up this link/session: 1 2 3 4 A sends request to a a looks up registration of E, finds e a sends request to e e sends request to E

A NEW LAYER MODEL: THE MAJOR COMPONENTS PROTOCOLS every member must participate STATE can be centralized or distributed across the members in any way ALGORITHMS can be centralized or distributed across the members in any way session protocol where members are registered in underlays registrations of overlay members in this layer members attachments locations sessions member algorithm attachment algorithm location algorithm forwarding protocol links routes link algorithm routing algorithm

A NEW LAYER MODEL: SCOPE AND LEVEL layers are arranged in a uses hierarchy, which defines levels the scope of a layer is the set or class of processes that could be members application process APPLICATION LAYERS INTERNET CORE (IP, TCP, UDP) 1 IP interface of machine 2 this describes the classic Internet architecture in terms of the new layer model or geomorphic view LANs 1 2 gateway Ethernet interface

CLASSIC LAYERS OR OSI REFERENCE MODEL THE GEOMORPHIC VIEW OF NETWORKING there is a fixed number of levels the scope of each layer is global, so layer = level each layer/level has a specialized function there can be any number of levels some layers have small or local scopes each layer is a microcosm of networking, containing all the basic components (state components and mechanisms)

WE CALL THIS THE GEOMORPHIC VIEW OF NETWORKING...... BECAUSE THE COMPLEX ARRANGEMENT OF LAYERS RESEMBLES THE EARTH S CRUST

HOW CAN THE GEOMORPHIC VIEW HELP? SIMPLICITY NO MORE TUNNELS the only encapsulation is inter-layer encapsulation NO MORE ARGUING ABOUT NAMES vs. IDENTIFIERS vs. LOCATORS vs. ADDRESSES each layer has exactly one name space, designed for the purposes of the layer (whatever you wish to call the names) the goal is to describe architectures with fewer, better-understood mechanisms...... rather than many ad hoc mechanisms whose interactions we do not understand hopefully, there will be no constraints on which architectures can be described

HOW CAN THE GEOMORPHIC VIEW HELP? GENERALIZATION the same basic mechanism is used for different purposes in different layers...... so all layers can benefit from the same general theories and possibly even implementations routing is vestigial APPLICATION LAYER user service purpose of routing is security CLOUD LAYER browser security filter server purpose of routing is reachability INTERNET LAYER host router host router host

HOW CAN THE GEOMORPHIC VIEW HELP? UNDERSTANDING THERE ARE TWO DISTINCT PATTERNS FOR MOBILITY a discovery enabled by the geomorphic view BENEFITING LAYER DYNAMIC ROUTING MOBILITY A B SESSION-LOCATION MOBILITY as the attachments of a member change, its links change, and the routing algorithm must find new routes to it layer state components that change: attachments links routes a a1 a2 LAYER IMPLEMENTING MOBILITY LAYERS WHERE ATTACH- MENT CHANGES b1 b2 b1 b2 as the session endpoint in the overlay changes its location in this layer, the session state changes to match it layer state components that change: locations sessions

HOW CAN THE GEOMORPHIC VIEW HELP? A DESIGN HAS ONLY ONE CORRECT DESCRIPTION AN ORGANIZED SPACE OF POSSIBLE DESIGNS CAN BE GENERATED DESIGN COMPARISON picture shows a scalable design for mobility of routers as well as endpoints (a previously unsolved problem) generated within a mobility design space application work session bus company router b00 b30 layer implements dynamic routing mobility for bus active when bus moves, does nothing with individual devices on bus registration when laptop is on the bus b35 port on bus LAN registration when laptop is elsewhere layer implements session-location mobility for laptop active when laptop moves on and off bus, not when bus moves

HOW CAN THE GEOMORPHIC VIEW HELP? FORMALIZATION WE HAVE A FORMAL MODEL OF LAYERS AND LAYER COMPOSITION (the uses hierarchy) IN ALLOY this model becomes more complete as we use it to investigate more issues FOR EXAMPLE, WE HAVE A COMPLETE MODEL OF DYNAMIC ROUTING AND SESSION-LOCATION MOBILITY this model has been used to prove that dynamic routing and sessionlocation mobility are compositional within a layer: they co-exist and work without interference layer implements dynamic routing mobility for bus layer implements session-location mobility for laptop

SUMMARY WE NEED MULTIPLE, CUSTOMIZED PROTOCOL STACKS WITH... better communication services design principles code generation and re-use THE GEOMORPHIC VIEW OF NETWORKING IS A USEFUL TOOL IT OFFERS... simplicity generalization understanding design comparison formalization Isn t this all too low-level for middleware and service-oriented architecture? NO! For example, mobility is everywhere you look. FINANCIAL APPLICATION LAYER my employer s payroll link used for direct deposit my bank account BANKING LAYER if I change banks, the direct deposit of my paycheck should still work bank A ident bank B ident