Network Tokens A DPI-alternative to deploy network services ONF - - PowerPoint PPT Presentation

▶
network tokens
SMART_READER_LITE
LIVE PREVIEW

Network Tokens A DPI-alternative to deploy network services ONF - - PowerPoint PPT Presentation

Feb 19, 2023 201 likes •507 views

Network Tokens A DPI-alternative to deploy network services ONF Spotlight: 5G Transformation with Open Source Yiannis Yiakoumis, Co-Founder & CEO, Selfie Networks Work with Nick McKeown (Stanford), Frode Sorensen (NKOM)

slide-1
SLIDE 1

Network Tokens

A DPI-alternative to deploy network services

ONF Spotlight: 5G Transformation with Open Source Yiannis Yiakoumis, Co-Founder & CEO, Selfie Networks

Work with Nick McKeown (Stanford), Frode Sorensen (NKOM)

https://networktokens.org | yiannis@selfienetworks.com

slide-2
SLIDE 2

Overview

  • 1. Network traffic differentiation is at a tipping point
  • 2. Why we need a DPI alternative
  • 3. Network Tokens

2

slide-3
SLIDE 3

Network Services are at a tipping point

$0

2010 2020 bandwidth zero-rating 5G slicing

no demand market validation technology sucks market growth technology…?

IoT, entertainment, enterprise 2025

[*] GSMA Network Slicing Usecase Requirements

slide-4
SLIDE 4

Network Services are at a tipping point

$0 $2B

2010 2020 bandwidth zero-rating 5G slicing

no demand market validation technology sucks market growth technology…?

IoT, entertainment, enterprise 2025

slide-5
SLIDE 5

Network Services are at a tipping point

$0 $2B

2010 2020 bandwidth zero-rating 5G slicing

no demand market validation technology sucks market growth technology…? $300B*

IoT, entertainment, enterprise 2025

[*] GSMA Network Slicing Usecase Requirements

slide-6
SLIDE 6

DPI/traffic classification can’t support expected growth Low Level Mechanism 5QI, DiffServ, QCI, bearers High-level Policy / Enforcement Traffic Classification / DPI (application signatures) Onboarding is hard Poor adoption Expensive High overhead In conflict with encryption, privacy, net neutrality

slide-7
SLIDE 7

DPI/traffic classification can’t support expected growth

Each datapath service can be a $100M+ opportunity. Exposing them through DPI means:

  • Poor user and partner adoption
  • High cost and time-to-market to deploy and operate
  • Regulatory risk to be banned/restricted
  • Obsolete with new encryption schemes (ESNI, DOH)

15%

success rate

  • n integration

9+ months

  • nboarding

time

100+

integrations

slide-8
SLIDE 8

Can we do any better?

How can we expose and access traffic differentiation services in a way that ... 1. is easy for operators to deploy and operate 2. is easy for end-users and app providers to access 3. Works with privacy and net neutrality 4. works with encryption and modern infrastructure (ESNI, multi-cloud, 3rd-party APIs)

8

slide-9
SLIDE 9

“

Traffic Classification / DPI → Access Management

slide-10
SLIDE 10

Network Tokens

» Explicit and secure coordination between end-users/apps and the network » They replace heuristics and application signatures/DPI with deterministic mechanism » Heavily influenced by Json Web Tokens (JWT), access tokens, and OAUTH2 workflows

10

slide-11
SLIDE 11

Network Tokens

  • Tokens carry simple claims (e.g., “I need low latency”, “I am Skype”)
  • Encrypted and/or signed based on trust relationships and requirements
  • Provisions against replay and spoofing attacks (expiration, binding, revocation)
  • Represented as JWT, CWT, Custom Formats
  • Inserted as extensions/attributes in existing protocols (e.g. IPv6, TLS, STUN)

11

slide-12
SLIDE 12

Network Tokens Tokens are policy agnostic. Policy dictated by token distribution, crypto functions, E2E workflows

  • User-centric, application agnostic token (e.g. for QoS service)
  • App-specific token (e.g., firewall whitelist, zero-rating)

12

slide-13
SLIDE 13

Sample workflow: user-centric, application-agnostic tokens

13

slide-14
SLIDE 14

Sample workflow: user-centric, application-agnostic tokens

14

Application asks user-permission to access premium network quality service

1

slide-15
SLIDE 15

Sample workflow: user-centric, application-agnostic tokens

15

Application asks user-permission to access premium network quality service

1

Client agent fetches premium quality token with user’s credentials

2

slide-16
SLIDE 16

Sample workflow: user-centric, application-agnostic tokens

16

Application asks user-permission to access premium network quality service

1

Client agent fetches premium quality token with user’s credentials

2

Application attaches token to flows of interest

3

slide-17
SLIDE 17

Sample workflow: user-centric, application-agnostic tokens

17

Application asks user-permission to access premium network quality service

1

Client agent fetches premium quality token with user’s credentials

2

Application attaches token to flows of interest

3

Network detects tokens and provides service

4

slide-18
SLIDE 18

DEMO

Premium network quality for video calls

slide-19
SLIDE 19

DEMO

slide-20
SLIDE 20

1000+ apps Manual, expensive, error-prone privacy-invasive, no user control Proprietary app signatures Current Status with DPI

slide-21
SLIDE 21

Simple, fast, stable dataplane Automated and self-serve control logic User-centric, application driven, application-agnostic, multi-network How it works with Network Tokens

slide-22
SLIDE 22

Network Tokens: Standardization and Open-Source

  • https://github.com/network-tokens

○ Apache 2 License ○ Integrated or stand-alone ○ Integrated with ONFs OMEC

  • IETF: Network tokens as interface between network and apps/end-users
  • 3GPP : How do network tokens fit in 3GPP architecture?

○ Integrate through existing 4G/5G TDF interfaces (Gy, Gw, Sd, …)

22

slide-23
SLIDE 23

Access Management Ecosystem

ID access mgmt Low-level mechanism JWT, ID & access tokens Workflows SSO, OAUTH2, scopes/permissions Solutions Okta, Auth0, IBM, Microsoft, ...

Open-Source Standards Open-Source Proprietary

slide-24
SLIDE 24

Access Management Ecosystem

ID access mgmt Network access mgmt Low-level mechanism JWT, ID & access tokens Network Tokens Workflows SSO, OAUTH2, scopes/permissions User Centric, App Centric, Custom, Multi-network Solutions Okta, Auth0, IBM, Microsoft, ... , ...

Open-Source Standards Open-Source Proprietary

slide-25
SLIDE 25

Get Involved!

» https://networktokens.org | network-tokens@ietf.org » https://github.com/network-tokens » Try it with ONF’s infrastructure Thank you! yiannis@selfienetworks.com

25

slide-26
SLIDE 26

Get involved!

https://networktokens.org

yiannis@selfienetworks.com

slide-27
SLIDE 27

Appendix

slide-28
SLIDE 28

priority + low latency Application + Driver + OS VoLTE Control Plane priority + low latency ⇅ LTE Bearer Network Core QoS 5G slicing Premium Network Quality tailored for voice and video

slide-29
SLIDE 29

Net Neutrality Controversy and consensus

Traffic differentiation is controversial, but there is common ground and consensus on specific use cases. QoS: User-centric, application-agnostic, privacy-aware Zero-Rating: Category-based, inclusive, money-free agreements Enterprise/Firewall Whitelist: do what you want

29