Active Networks Towards an Active Network Architecture, D. - - PowerPoint PPT Presentation

▶
active networks towards an active network architecture
SMART_READER_LITE
LIVE PREVIEW

Active Networks Towards an Active Network Architecture, D. - - PowerPoint PPT Presentation

Jan 22, 2024 277 likes •1.09k views

Active Networks Towards an Active Network Architecture, D. Tennenhouse, D. Wetherall, CCR 1996 Winner of ACM SIGCOMM 2007 Test-of-Time Award Internet in 1996: Routers are passive -- just move bits around Bits are either

slide-1
SLIDE 1

Active Networks

slide-2
SLIDE 2

“Towards an Active Network Architecture,”

  • D. Tennenhouse, D. Wetherall,

CCR 1996

slide-3
SLIDE 3

Winner of ACM SIGCOMM 2007 “Test-of-Time Award”

slide-4
SLIDE 4

Internet in 1996: Routers are passive -- just move bits around

slide-5
SLIDE 5

Bits are either dropped

  • r delivered unaltered
slide-6
SLIDE 6

Routers is a close

  • platform. Only vendors

can modify functionality at routers

slide-7
SLIDE 7

Hard to deploy new services

slide-8
SLIDE 8

Example: IPv6 IP Multicast RED

slide-9
SLIDE 9

Internet evolves slowly compared to PC and Web

slide-10
SLIDE 10

Web and PC florishes because anyone can easily deploy new application and services (they’re programmable!)

slide-11
SLIDE 11

Two more examples: Facebook Second Life

slide-12
SLIDE 12

Idea: Let’s make the Internet programmable

slide-13
SLIDE 13

Users can insert code into the network and run computations on packets

slide-14
SLIDE 14
  • 1. Cisco etc.
  • 2. Authorized Vendors
  • 3. End users

""

Users can insert code into the network and run computations on packets

slide-15
SLIDE 15
  • 1. install program onto router
  • 2. packet carries program

""

Users can insert code into the network and run computations on packets

slide-16
SLIDE 16
  • 1. program/function name
  • 2. scripts
  • 3. binaries

""

Users can insert code into the network and run computations on packets

slide-17
SLIDE 17
  • 1. special, “active nodes”
  • 2. any routers

""

Users can insert code into the network and run computations on packets

slide-18
SLIDE 18
  • 1. network (eg: routing)
  • 2. transport (eg: packet filtering)
  • 3. application (eg: compression)

""

Users can insert code into the network and run computations on packets

slide-19
SLIDE 19

Examples of Services in Network

slide-20
SLIDE 20

Authorized application vendors can program firewall to let their packets through

slide-21
SLIDE 21

Users can adapt video to fit their bandwidth/screen-size

slide-22
SLIDE 22

downsize the video for me please

slide-23
SLIDE 23

Shrink as close to the source as possible

slide-24
SLIDE 24

Shrink here

slide-25
SLIDE 25

Web caches can generate dynamic web pages

slide-26
SLIDE 26

Proxy rotate these ads for me please Server

slide-27
SLIDE 27

Wireless base station can retransmit packets

slide-28
SLIDE 28

BS Sender Receiver

3 Dup ACKs

slide-29
SLIDE 29

BS Sender Receiver

Retransmit

slide-30
SLIDE 30

Approaches to Active Network

slide-31
SLIDE 31

Two Approaches to Active Network

  • 1. Discrete
  • 2. Integrated
slide-32
SLIDE 32

Discrete Approach

Packets are send normally, but header identifies additional function to operate on the packet (possible changing it)

slide-33
SLIDE 33

Integrated Approach

Packets carry code with them, code gets executed from node to node

slide-34
SLIDE 34

Capsules = “Packets that carry code (and maybe data)”

slide-35
SLIDE 35

Examples

slide-36
SLIDE 36

ack() { print “ok”} ping(src, dest) { if this is dest eval(src, ack()) else eval(dest, ping(src,dest)) }

slide-37
SLIDE 37

ack(x) { print x} traceroute(src, dest, x) { if this is dest eval(src, ack(x)) else next = getNextHop() eval(next, traceroute(src,dest,x+1)) }

slide-38
SLIDE 38

Execution Environment for Capsules

slide-39
SLIDE 39

Issue: need to restrict the capability of capsules

(e.g. my capsules shouldn’t delete your capsules, or change the routing tables of other capsules)

slide-40
SLIDE 40

Issue: need to limit the resources used by capsules

(e.g. a capsule that goes into infinite loop should not hang the router, or should not replicate itself infinitely)

slide-41
SLIDE 41

Issue: capsules need to be executed on a variety of platforms

slide-42
SLIDE 42

We know how to do this using virtual machines and sandboxes (e.g. java applets)

slide-43
SLIDE 43

Router provides basic API to access routing tables, links information

(e.g. getNextHop())

slide-44
SLIDE 44

Capsules may leave states behind in the executing environment

slide-45
SLIDE 45

Example: in informaion fusion applications

slide-46
SLIDE 46
slide-47
SLIDE 47

Example: roll call -- find

  • ut how many multicast

receivers are there

slide-48
SLIDE 48

var total = 0, count = #children call( ) { if no children eval(parent, reply(1)) for each child c eval(c, call()) } reply(x) { total += x; count -- if (count is 0) eval(parent, reply(total)) }

slide-49
SLIDE 49

Will need to support garbage collection of states and execution environment

slide-50
SLIDE 50

Active Network and E2E Arguments

slide-51
SLIDE 51

” “

E2E Argument

The function in question can completely and correctly be implemented only with the knowledge and help of the application standing at the endpoints of the communication system. Therefore, providing the questioned function as a feature of the communication system itself is not possible. (Sometimes an incomplete version

  • f the function provided by the communication

system may be useful as a performance enhancement)

slide-52
SLIDE 52

Does Active Network violate E2E argument?

slide-53
SLIDE 53

E2E is more about which layer to implement a function, not which node

slide-54
SLIDE 54

Previously,

app/transport layer = end hosts network layer = routers

slide-55
SLIDE 55

Distinction is not as clear with active networks

slide-56
SLIDE 56

How to choose end-point? The end-point is a trustworthy entity.

slide-57
SLIDE 57

In Active Network, we should trust our own code, regardless of where it is executed.

slide-58
SLIDE 58

Implementation and Performance

slide-59
SLIDE 59

ANTS: Active Network Implementation from MIT

slide-60
SLIDE 60

Java based Implementation

slide-61
SLIDE 61

Code are hashed using

  • ne-way function (MD5)
slide-62
SLIDE 62

Capsule include a 128bit hash that identifies which code to run

slide-63
SLIDE 63

Security Implications:

can’t change the code (hash will be inconsistent) can’t guess the hash without knowing the code

slide-64
SLIDE 64

Code needs to be signed and certified by a trusted authority, then posted

  • nline for others to use
slide-65
SLIDE 65

Code can be cached each node. If a code needed by a capsule is not available, ask from the node upstream (where the capsule came from)

slide-66
SLIDE 66

To bootstrap the process, the code is install in the “local” active node (e.g. NUS gateway)

slide-67
SLIDE 67

Code size is limited to 16KB to avoid distributing large amount

  • f code
slide-68
SLIDE 68
slide-69
SLIDE 69
slide-70
SLIDE 70

Can process up to 1.5Mbps (T1 link)

slide-71
SLIDE 71

100Mbps possible with in-kernel, native implementation (but less protection)

slide-72
SLIDE 72

Historical Perspective

slide-73
SLIDE 73

Initiated a flurry of research activities and debates between 96-00

slide-74
SLIDE 74

Main Criticisms “Killer App”? Performance + Security?

slide-75
SLIDE 75

An example of research that involves: OS, PL, Networking, Security, DS

slide-76
SLIDE 76

Still relevant today: network no longer just forward packets

(somewhat?)

^

slide-77
SLIDE 77

NAT WAN accelerator SIP gateway

slide-78
SLIDE 78

NAT WAN accelerator SIP gateway

slide-79
SLIDE 79

Also relevant in wireless sensor networks for deploying new services

  • nto sensor fields
slide-80
SLIDE 80