Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Control Plane Extensibility for Shared Control Plane Extensibility for Shared Network InfrastructureNetwork Infrastructure
Bushar YousefPhD CandidateAdvanced Research in Networking Lab (ARN)UTS
Supervisor: Professor Doan B HoangAdvanced Research in Networking Lab (ARN)UTS
Co-Supervisor: Glynn RogersICT CSIRO
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Talk Outline
• Background:– Services – Provisioning methods
• Serviter– Vision– Architecture– Partitioning
• Conclusion
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services
• What is a Network Service?
– Traditionally:• Connectivity• Protocol Translation
– Today:• Connectivity with Quality of Service• Monitoring, Fault Detection, Auto-Recovery• Virtual Private Networks• SSL acceleration• Firewalls• Intrusion Detection Systems• Mobile Services (Connect Me, Find Me, Follow Me) • Etc…
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services
A Network Service -An operation performed inside the “network” that directly benefits end-users.
More specifically,The network intelligence and forwarding logic which work together to perform an operation that directly benefits end-users.
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning
Administrator
Forwarding Plane
Control Plane
Network Management
A network is composed of:• Forwarding plane • Control plane• Network management protocol
Services require support from all three.
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning:Provisioning Methods
Active Networks
Programmable
Networks Current Networks
Safety Performance
FlexibilityService Deployability
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning: Current Network Infrastructure
Forwarding Plane
Control PlaneStatus of:Hardware, Links, and QueuesPacket Capture: Routing Updates, Remote Config.
Boot ConfigurationsRouting Protocols (RIP, OSPF, etc)Network Management ProtocolsBurst or Wavelength switching
Configuration: routing entries, queues, firewall rules, load balancing, SSL keys, etc.Routing Updates
Forwarding logic (IP,MPLS)QoS control,SSL, Intrusion DetectionFirewall,Load Balancing, etc.
Current
Networks
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning: Current Network Infrastructure
Forwarding Plane
Control PlaneIOS/Boot Image: Preprogrammed Extensible only by manufacturer
Proprietary Protocol
Fixed HardwareMay contain a degree of programmability
Black Box
Current
Networks
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning: Current Network Infrastructure
What does it take to deploy a new service?
• Manufacturer support
• Nodes upgrade
• Service configuration
• Multiple SLA
• Cost-Benefit Analysis
ISPBroadband IP/MPLS
SLA SLASLA
Wireless
Voice
CoreEdgeUsers Access
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning:Current Infrastructure drawbacks
• Cost and Rollout time
• External dependency – Manufacturer– Partner Providers
• Non-customisable services– Network providers provision fixed services of which a
user may purchase– Services do not take into account needs of individuals– Due to the great cost of manual customisation
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning:Provisioning Methods
Active Networks
Programmable
Networks Current Networks
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning:Provisioning Methods
Forwarding Plane
Control Plane
Network Management
Generic CPU and NIC
Extensible Software
Active Networks
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning:Provisioning Methods
Generic CPU and NIC
Node OSDomains
TCP Stack
Packet Capture
Execution Environments
PayloadCode / Ref #
Packets
Active Networks Code Library (optional)
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning:Active Networks Drawbacks
• There is a consensus that Active Networks are Not Feasible!– Drastic Scalability and Performance degradation– Security
• Proponents argue:By placing Active nodes in strategic locations of a network these
issues are overweighed by the benefits.
Funding for the DARPA Active Networking project had not been renewed!
The community is moving towards Adaptive Protocol Stacks.
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning:Provisioning Methods
Active Networks
Programmable
Networks Current Networks
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning:Provisioning Methods
Programmable
Networks
Forwarding Plane
Control Plane
Network Management
Programmable Network Processors(or FPGA)
Extensible Software
Signaling and Deployment Protocols
Interface
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning:Provisioning Methods
Programmable
Networks
PNP
Extensible Software
Signalling and Deployment Protocols
Virtual Network Device(software representation)
Code Injection Monitoring
APINetwork Services Intelligence
Service Injection Monitoring
Stan
dard
ised
Inte
rfac
es
Network Generic Services:• Customised Routing• Routing Algorithms • DiffServ Scheduling
API
Value Added Services
Forwarding Microcode
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Services Provisioning:Programmable Networks Drawback
• Difficult to standardise interfaces
• Performance– Generic hardware support can not be optimised
• Restrictive– Can not perform Service specific operations
• Security and Resource Management– Based on testbed experimentation– Configuration is restricted
• Non-customisable services
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Serviter
Goal:To develop a common platform for existing and new commercial modules (networking module, content directors, SSL accelerators, IDS, etc) for safe on-demand deployment and customisation of services.
Vision:• Network providers focus only on providing new links and
modules.• Third party services providers and users purchase hardware
shares.
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Serviter:Vision Explained
BroadbandAccess
IP/MPLSCore
Metro 1
Metro 2
PSTN
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Serviter:Criteria
• Control Plane Extensibility
• Risk Isolation
• Scalability– Services– Partitions
• Differentiated Services
• On-demand Services in on-demand Partitions
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Serviter
Hardware Modules
Traditional Control Plane
Extensible Control Plane
Control Channels
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Current Hardware Modules
Traditional Control Plane
Extensible Control Plane
Serviter:Architecture
Aux Hardware Support (FPGA, Secure Processors)
User Services
System Services (Cp API)
ProviderThird Party Partition #1 P #2 P #3 P #4
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Extensible Control Plane
Other Advantages:
• Intelligent Monitoring, Detection, Recovery– Autonomic Networks
• Dynamic Network Provider management
• Adaptive Optical Network Control Plane
ServiterPartition Services
Alert ServicesMisc. Network Management
Control Plane
Forwarding Plane
Third Party Services
VPN
#1
VPN
#2
VPN
#3
Network Administration
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Serviter:Architecture
BUS/Switching Fabric
NI NI NI NINI
CE CE CE CECE
Control CE
Forwarding Plane:• Layer 2/3 Switching Modules• Content Switching Modules• SSL Accelerators• Firewall Modules, etc..
Traditional Control PlaneA Management Module with fixed IOS
Extensible Control Plane:A number of PC hosting User Services and other management components
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Serviter:Security and Resource Management overview
NI NI NI NINI
CE CE CE CECE
Control CE
Services Compete for Computational ResourcesInterfere with each other
Services May configure operations on traffic of others
BUS/Switching Fabric
Bottlenecks
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Extensible Control Plane Resources: What to Manage?
• Internal Router Resource Allocation:– Computational
• CPU time, Memory Pages, I/O operations, Harddisk space
– Communication• Computation resource consumed outside of VM • Managing bottleneck fairly:
– Bus/Switching fabric bandwidth– Control-CE
• CE Resource Monitoring• Balancing the load across CEs
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Serviter:Computation Elements
CE ManagementUser Services
System Services
Operating System
Hardware
Resource Management Interface
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Serviter:Computation Elements
RE #N
RE Dispatcher
…
User VM#N
CE Dispatcher
Srv Dispatcher
User Services
Management Process
…
System Process
System Services
System Dispatcher
Load Manager
Bus Interface Driver
C-QoS Interface
Resource C
ontrollers
OS
FPGA
/ Secure Processors
Hardware
Bus Interface
CE Management
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Class-based Kernel Resource Managementckrm.sourceforge.net
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Internal Comm. Resource Partitioning:Dispatcher Structure
CE DispatcherFlow Access Restriction
System Dispatcher
Control CE
NI
Service Dispatcher
RE Dispatcher
User ServicesCE
NPU
Bus Channel Allocation DB
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Internal Comm. Resource Partitioning:Dispatcher Structure
W1
W2
W3
W4
Verification (and any
execution)Routing
Destination Service
Weighted Scheduler
GOLD
SILVER
BRONZE
B. E.
Next Dispatcher
BUS
….
UserVM Source 1
. . .
Fair Schedulers
Fix Size queue
UserVM Source 2
UserVM Source N
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Serviter:Forwarding Plane Partitioning
Flow Access Restriction Module
Valid Users
Commands
Ignore
Invalid Users
Valid Commands
Invalid Commands
Command Verifier User Privileges DB
Control-CE
Source Classifier Source Classification DB
Update
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Conclusion
Add Extensible CP
Add Resource Management
Add Risk Isolation
Current NetworksCurrent Networks
Active Networks
Programmable
Networks
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
Lessons Learned
• Interfaces Standardization:– User Services -> System Services– System Services -> NI
• To what extent can NIs be programmable? • How this be specified and Discovered?
• Traditional CP Bottleneck• Move toward a fully distributed extensible control
plane.
Bushar Yousef (ARN Labs UTS) - CSIRO ICT Talk 2005
NI Capabilities:Specification and Discovery
Classification Manipulation Forwarding
Minimum Level
Layer 2
Layer 3
MAC addressesIngress or Egress NIs
Regular Expression on: - IP header data
Layer 4
Regular Expression on: - TCP header data- UDP header data- QoS fields
Layer 7
Regular Expression on:- Protocol Type- HTTP header data- Packet payload data
Internal RedirectionMirror DropSwitch Normally
Substitution of:- MAC addresses
Substitution of:- IP header field
Route using new header
- HTTP header field substitution- SSL
Substitution of:- TCP header fields - UDP header fields- QoS fields
Queue configuration and monitoringNI status monitoringRouting table modification
Load Balancing for:- Manipulation NIs- Web serversFirewalling