Download i3: A Scalable and Flexible Indirection Layer for the Internet and more Study notes Computer Science in PDF only on Docsity!
Boon Thau LooSpring 2007 Lecture 11 (Presentation based on slides from Robert Morris. Sean Rhea and Ion Stoica)
(^) Today’s Internet is built around apoint communication abstraction: unicast point-to- This abstraction allows Internet to be highly^ Send packet “p” from host “A” to host “B” scalable and efficient, but…… not appropriate for applications that require other communications primitives: (^) Multicast AnycastMobility …
$ (^) Point-to-point communicationassumes there is one sender and % implicitly one receiver, and that they are placed atknown locations fixed and well- & (^) E.g., a host identified by the IP address128.32.xxx.xxx is located in Berkeley
(^1) Extend IP to support new communication primitives,e.g., (^22) Mobile IPIP multicast (^1) Disadvantages:^2 IP anycast (^2) Difficult to implement while maintaining Internet’s scalability(e.g., multicast) (^2) Require community wide consensus -- hard to achieve inpractice
(^1) Implement the required functionality at theapplication level, e.g., (^22) Application level multicast (e.g., Narada, Overcast,Scattercast…) (^1) Disadvantages: 2 Application level mobility 2 Efficiency hard to achieveRedundancy: each application implements the samefunctionality over and over again (^2) No synergy: each application implements usually onlyone service; services hard to combine
? (^) Virtually all previous proposals useindirection, e.g., & A (^) Physical indirection pointLogical indirection point @ @ (^) IP multicastmobile IP
“Any problem in computer science canbe solved by adding a layer of indirection”
Use an Incrementally deployable; don’t need to change IP overlay network to implement this layer
Build an efficient indirection layeron top of IP
IP^ TCP/UDP
Indir.^ Application layer
(^) Each packet is associated an identifierTo receive a packet with identifier id , id receiver R maintains aoverlay network trigger ( id , R) into the Sender id R trigger
datadata id id Receiver (R) data R
(^) API A (^) sendPacket( p ); A A (^) insertTrigger(removeTrigger( t ); t ) // optional (^) Best-effort service model (like IP) Triggers periodically refreshed by end-hostsID length: 256 bits
(^) Host just needs to update its trigger as itmoves from one subnet to another
Sender^ Receiver(R1) Receiver(R2)
idid R1R
data id
(^) Receivers insert triggers with same identifier Can dynamically switch between multicast andunicast id R1 Receiver (R1) Receiver (R2)
Sender id R data R data R
data id
Use Prefix p: anycast group identifier longest prefix matching instead of exact matching Suffix si: encode application semantics, e.g., location Sender p|s 1 R1 Receiver (R1) p|s p|s 23 R2R3 Receiver (R2) Receiver (R3)
datadata p|ap|a data^ R
(^) Use well-known trigger for initial rendezvousExchange a pair of (private) triggers well-located (^) Use private triggers to send data traffic [42..3] [4..7]
[8..20] [36..41] [21..35] 37 [2] R R
data 2 [2] S (^3037) S [30] data R 2 30 [30] R Sender (S) Receiver (R)
(^) Implementation Examples (^) Heterogeneous multicast (^) Scalable MulticastLoad balancing Security^ Proximity (^) Applications
^ ^ ^ ^ ^ $ ^ ^ $^ ^ $^ ^ ^ %^ $^ ^ $^ ^ ^
(^) Sender not aware of transformations
id_MPEG/JPEG S_MPEG/JPEG^ Receiver R1(JPEG) id (id_MPEG/JPEG, R1)
send(id, data)
S_MPEG/JPEG Sender(MPEG) send((id_MPEG/JPEG, R1), data)
send(R1, data)
id R2 Receiver R (MPEG)
send(R2, data)
^ ^ ^ ^ $^ ^ ^ ^ ^ ^!^ ^ $^ ^ ^ ^ ^ ^ ^ ^
& (^) i3 doesn’t provide direct support for " (^) Triggers with same identifier are mapped onto the same i3 node scalable multicast & (^) Solution: have end-hosts build an hierarchy of trigger ofbounded degree R 2 R 1 R 3 R 4
gx gR 1 gR 2 R^ x 3 xR 4
(g, data) (x, data)
Unlike IP multicast, i3 1. Implement only small scale replication # allow infrastructure to
- (^) $remain simple, robust, and scalableGives end-hosts control on routing # enable end-hosts to $ Achieve scalability, andOptimize tree construction to match their needs, e.g., delay,bandwidth
% & ' ( ) * + , -. / ' 0 1 ' * ' 2 3 4 2 5 (^66) Servers insert triggers with IDs that have random suffixesClients send packets with IDs that have random suffixes
1010 0101^ S1 S 1010 1101^ 1010 1010 (^) S4^ S
S1 S S S
A
B
send(1010 0110,data)
send(1010 1110,data)
1010 0010
Suffixes of trigger and packet IDs encode theserver and client locations
1000 0010 (^) S1^ 1000 1010^ S2^ 1000 1101^ S
S1 send(1000 0011,data) S2^ S
Implementation
ExamplesSecurity
Applications
S id^ R R id A Attacker (A)
Eavesdropping Attacker
id 1 id 2 id 2 id 3 id 4 id (^1) id 3 id 4
Loop
Attacker id 1 id 2 id id^ id 222 id id id^333 id 3 V Victim(V)
Confluence Attacker id 1 id 2 id 2 id 3
Dead-End
Malicious linking Attacker can sign an end-host R to a high
bandwidth traffic stream sent to id by inserting atrigger (id,R)
Impersonation Same as eavesdropping
Encryption: A send to B
Challenges^ Encrypt private trigger ida^ using public key of B (vice versa)
Nonce-based challenges to prevent unjustified insertion oftriggers by third parties
Send random nonce to end-host. Remove if end-host doesnot respond.
Push-back When there is no more matching trigger for packet ID, i3sends a push-back message to previous node
Time-to-live (TTL)
hl(), hr(): well-known one-way hash functions
Use hl(), hr() to constrain trigger (x, y) ID: prefix prefix 64 must match keykey 128 suffixsuffix 64
x y
x.key = hl(y) x y
x.key = hl(y.key) end-host address
Left constrained^ x^ y
Right constrained y.key = hr(x)
Implementation
ExamplesSecurity
Architecture Optimizations
Applications Routing as a service
Service composition platformSupport of legacy applications over overlays
Goal: allow third-parties and end-hosts toeasily insert new functionality on data path
E.g., firewalls, NATs, caching, transcoding, spamfiltering, intrusion detection, etc..
Why i3? Make middle-boxes part of the architecture
Allow end-hosts/third-parties tothrough middle-boxes explicitly route
% & ' ( ) * +
Use Bro system to provide intrusion detection forend-hosts that desire so
Spam filtering, etc.
M client A (^) i3 server B
Bro (middle-box) (id idM:idABBA A, data) id (^) M M (^) (id(idBAid, data)BA B (idAB, data) M:idAB, data)
ImplementationExamples
SecurityArchitecture Optimizations
Applications Routing as a service
Service composition platformSupport of legacy applications over overlays
(^6) See http://ocala.cs.berkeley.edu
Indirection – key technique to implement basiccommunication abstractions
Multicast, Anycast, Mobility, …http://i3.cs.berkeley.edu
Reminder: Project proposal was due yesterday!
(^) Volunteers for second presentations
