The X-Bone & Its Virtual Internet Architecture
Total Page:16
File Type:pdf, Size:1020Kb
The X-Bone & its Virtual Internet Architecture 10 Years Later Joe Touch, Greg Finn, Lars Eggert, Amy Hughes and Yu-Shun Wang Workshop on Overlay and Network Virtualization 16th GI/ITG Conference on Kommunikation in Verteilten Systemen Kassel, Germany March 6, 2009 March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 1 History X-Bone was a series of research projects at USC/ISI 1997-2005+ initial funding from DARPA, follow-on funding from the NSF http://www.isi.edu/xbone/ key results an architecture (the “Virtual Internet” architecture) a deployment/management system (the “X-Bone”) follow-on work using virtual nets March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 2 X-Bone Overlay System Web GUI Multiple views IP Base Star Overlay B A C D ring-ovl star-ovl B B A A Ring Overlay C D C D xd GUI Overlay Manager Resource Base IPv4 Resource Daemon Daemon Network Resource Daemon link host router X-Bone system Automated monitoring March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 3 X-Bone Timeline 1997 – first whitepaper 2001-2003 – NetFS (NSF) 1998-2001 – X-Bone (DARPA) File system configuration of IP overlays with revisitation, network properties recursion (LISP) 2002-2005 – X-Tend (NSF) 2000 – running code (FreeBSD, X-Bone for testbed uses Linux) 2003-2005 – DataRouter (int.) 2000 – application deployment Support for overlay P2P 2001 – TetherNet “NAT-buster” forwarding to support demos 2005-2006 – Agile Tunnels (NSA) 2001-2004 – DynaBone Partial overlays for DDOS safety (DARPA) 2006-2009 – RNA (NSF) 800-way spread-spectrum Extending X-Bone Choices model parallel overlays to general protocol stack 15-level deep overlays architecture March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 4 Creating a Ring Request sin eql Ring Ovl. udel cos div sec isipc2 bbn Internet March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 5 Virtual Internet – Why “network equivalent of virtual memory” protection separate topology, optionally secured test + deploy new protocol/service sharing increase utility of infrastructure abstraction adapt topology to application March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 6 Virtual Internet – What network = hosts + routers + links virtual network = virtual host → packet src/sink + virtual router → packet gateway + virtual link → tunnel X over Y virtual Internet – ”network of networks” use Internet as physical media virtual virtual Internet IP link IP network IP payload create virtual link & network layers header header header strong L2 vs. weak L3 host model a virtual Internet should look exactly like the real thing “if an app can know it runs in a VI, we did it wrong March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 7 Feature – Recursion virtual Internets on top of virtual Internets our litmus test: system should be able to do recursive VI-in-VI without hacks recursion has real uses cases e.g., allows transparent reconfiguration change outer VI w/o affecting inner fault tolerance, basis for DynaBone also allows VI “embedding” “router is a network inside” March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 8 Feature – Concurrency one node participates in multiple virtual Internets at the same time basis for isolation & abstraction bind different apps/VMs to different VIs on the same physical node March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 9 Feature – Revisitation one node participates in the same virtual Internet but multiple times allows creation of VIs larger than physical resources fully decouples virtual from physical topologies March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 10 Feature – Security security in the Virtual Internet architecture is a virtual link property decoupled from topology transparently coexists with end-to-end security inside the VI transparently coexists with security underneath a VI IPsec tunnel mode IPIP tunnel + IPsec transport mode base IP IPsec VPN IP data base IP IPsec VPN IP data #2 #1 IPIP tunnels + IPsec transport mode modular tunnel mode equivalent huge IETF debate around 2000 (draft-touch-ipsec-vpn-05.txt) March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 11 The X-Bone System deployment + management system for VIs programs → standardized API humans → web interface virtual network description language high-level: express virtual topology + services XML collaborating, distributed management daemons multicast expanding-ring discovery distributed resource reservation instantiate + manage virtual network non-goals: topology optimization, non-IP VIs, … March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 12 X-Bone Status current release: 3.2 mature: 10 years of open source availability platforms: FreeBSD, Linux unofficial: NetBSD, Cisco widely used (by 2003): UCL, UPenn, Aerospace, DOD Canada, Sinica Taiwan + more March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 13 Follow-On Work at USC/ISI March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 14 DynaBone (~2001-2003) parallel inner virtual networks = algorithmic & protocol diversity spread-spectrum multiplexer, wrapped inside outer virtual network Innerlays Outerlay AES + SHA1 + BGP MUX 3DES + MD5 + RIP MUX MD5CAST128X auth +/ staticstatic Base network March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 15 TetherNet (~2001-2004) issue: firewalls, NATs, clueless ISPs broken end-to-end connectivity solution: relocate real Internet subnet real = routable IP + DNS + no fw + … tunnel subnet from anchor router totether router at remote site Internet Internet NAT March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 16 Other Related Projects X-Tend (~2003-2007?) maintain + extend X-Bone as tool for research + education GeoNet (~2000-2002) geographically-addressed overlays NetFS (~2002-2004?) access control for the network stack via a pseudo file system March 6, 2009 Copyright 2009, USC/ISI. All rights reserved. 17 .