ICT-317756 TRILOGY2 Trilogy2: Building the Liquid Net Specific Targeted Research Project FP7 ICT Objective 1.1 – The Network of the Future D1.1 Software Platforms Due date of deliverable: 31 December 2013 Actual submission date: 3 January 2014 Start date of project 1 January 2012 Duration 36 months Lead contractor for this deliverable Universitatea Politehnica Bucuresti (UPB) Version v1.0, January 3, 2014 Confidentiality status Public c TRILOGY2 Consortium 2014 Page 1 of (128) Abstract This document captures the research carried in the first year of the Trilogy2 project related to the de- velopment of software platforms. It presents advances in the design, implementation and evaluation of tools which allow the creation of bandwidth, CPU and storage liquidity. Finally, the document con- cludes by describing the setup of a testbed that Trilogy2 partners are setting up in order to support liquidity experiments. Target Audience The target audience for this document is the networking research and development community, partic- ularly those with an interest in Future Internet technologies and architectures. The material should be accessible to any reader with a background in network architectures, including mobile, wireless, service operator and data centre networks. Disclaimer This document contains material, which is the copyright of certain TRILOGY2 consortium parties, and may not be reproduced or copied without permission. All TRILOGY2 consortium parties have agreed to the full publication of this document. The commercial use of any information contained in this document may require a license from the proprietor of that information. Neither the TRILOGY2 consortium as a whole, nor a certain party of the TRILOGY2 consortium warrant that the information contained in this document is capable of use, or that use of the information is free from risk, and accept no liability for loss or damage suffered by any person using this information. This document does not represent the opinion of the European Community, and the European Community is not responsible for any use that might be made of its content. Impressum Full project title TRILOGY2: Building the Liquid Net Title of the workpackage D1.1 Software Platforms Editor Alexandru Agache, UPB Project Co-ordinator Marcelo Bagnulo Braun, UC3M Copyright notice c 2014 Participants in project TRILOGY2 Page 2 of (128) c TRILOGY2 Consortium 2014 Executive Summary This document describes various software platforms developed for the Trilogy2 project which allow pooling of resources such as bandwidth, CPU and storage. Where possible, it also provides experimental results showing the extent to which liquidity can be created and deals with important topics such as performance and security. In terms of bandwidth liquidity, we present two mechanisms, Multipath TCP and Polyversal TCP. The section on bandwidth liquidity starts by tackling three important aspects of Multipath TCP. The first is an evaluation of performance based on executing controlled experiments with MPTCP under the influence of factors such as capacity, queuing and propagation delay, loss and congestion control. The goal of these experiments is to verify if MPTCP can achieve its goals of improving throughput and balancing congestion. The results show this is possible and also provide further insight on the influence that various parameters and network phenomena have on MPTCP performance. The second deals with MPTCP security, and proposes a set of improvements. A residual threat analysis reveals a number of possible attacks, describes the prerequisite steps and information required in order to enact them, and establishes their relative threat level. Multiple security enhancements are proposed to address each shortcoming, and an outline describes the steps that will be taken as future work. The third aspect related to MPTCP is the exploration of novel use cases. We propose to use it to explicitly include middleboxes in MPTCP connections. This mechanism accommodates several widely encountered use cases, including load balancing, DDoS filtering and anycast services. We also show how MPTCP can be used in mobile devices to improve cellular connectivity. Polyversal TCP (PVTCP), the next topic of this section, provides a mean to enable liquidity across different transports. It is based on the argument that sockets are an ossified and monolithic construct. They currently fail to take into account the actual context where communication takes place, and this has a less than ideal effect on entities running in tightly coupled contexts, such as processes which find themselves running on the same machine. A polyversal network stack seeks to select the best underlying communication mechanism, while shielding the application from unnecessary details. This allows PVTCP to pool the bandwidth of different available communication avenues not limited to a single transport. We rely on virtualization as a key concept to achieve processing liquidity. We work on two flavors of CPU liquidity, one in mobiles and another one in network functions. The first mechanism for creating CPU liq- uidity presented in this document deals with virtual machine migration for mobile devices. They have been rapidly adopted by users but continue to lack a unified user experience. The goal is to transfer running apps and data between mobile devices running Android without changing the app state and preserving its network connectivity. The virtualization support can be used as a layer that separates data and applications from the environment of the mobile device. The other topic concerning CPU liquidity and efficient scaling is an ex- ample of turning specialized hardware middleboxes into one or multiple virtualized sofware devices that can run on inexpensive commodity hardware. We have used this paradigm for two key components of an ISP c TRILOGY2 Consortium 2014 Page 3 of (128) network: the Broadband Remote Access Server (BRAS) and the Customer Provider Edge (CPE). A proof-of- concept implementation based on a lightweight Xen virtual machine for the BRAS case is presented, together with performance evaluation results. The first mechanism that enables storage liquidity presented in this document is Irminsule, a Database-as- a-Service (DBaaS) solution focused on distributed storage, which presents a file-system layer solution for distributing data. It has the ability to checkpoint everything in independent branches and allows the rollback of entire distributed clusters. Storage liquidity is also enabled by Trevi, which uses fountain coding to tackle the distributed storage problem. Trevi represents a radical departure from what is currently the state of the art, by being free of TCP and incorporating fountain codes to multicast striped blobs across storage nodes. It does not require changes to the network stack or any network protocol. It is currently under implementation, and uses UDP or even raw Ethernet frames for network communication. The final section of this document summarizes the implementation work done in the project and presents the testbed created with the concerted effort of multiple Trilogy2 partners. A description of the current hardware infrastructure is provided, together with details related to authorization and guidelines regarding the use of servers. Page 4 of (128) c TRILOGY2 Consortium 2014 List of Authors Authors Alexandru Agache, Pedro Aranda, Mohamed Ahmed, Marcelo Bagnulo, Giacomo Bernini, Gino Carrozzo, Julian Chesterfield, Jon Crowcroft, Rares, Dumitrescu, Felipe Huici, Valentin Ilie, Anil Madhapeddy, Joao Martins, George Milescu, Cat˘ alin˘ Moraru, Dragos, Niculescu, Cat˘ alin˘ Nicut,ar, Christoph Paasch, Costin Raiciu, John Thomson Participants Intel, NEC, NXW, OnApp, TID, UC3M, UCAM, UCL-BE, UPB Work-package WP1 Security Public (PU) Nature R Version 1.0 Total number of pages 128 c TRILOGY2 Consortium 2014 Page 5 of (128) Contents Executive Summary 3 List of Authors 5 List of Figures 10 List of Tables 12 Acronyms 13 1 Introduction 14 1.1 Motivation............................................ 14 1.2 A brief guide to the T2 architecture and the first set of deliverables.............. 15 1.3 Deliverable outline ....................................... 16 2 Bandwidth Liquidity 17 2.1 MPTCP............................................. 17 2.1.1 Evaluating MPTCP’s resource-pooling ........................ 17 2.1.1.1 Experimental Design ............................ 18 2.1.1.2 Experimenting with MPTCP ........................ 19 2.1.1.3 Evaluation.................................. 21 2.1.1.4 Sensitivity Analysis............................. 26 2.1.2 MPTCP security improvements ............................ 26 2.1.2.1 ADD ADDR attack............................. 28 2.1.2.2 DoS attack on MP JOIN........................... 32 2.1.2.3 SYN flooding amplification......................... 32 2.1.2.4 Eavesdropper in the initial handshake.................... 33 2.1.2.5 SYN/JOIN attack .............................. 34 2.1.2.6 Next steps.................................. 34 2.1.3 New MPTCP use cases................................. 35 2.1.3.1 Integrating middleboxes with MPTCP ................... 35 2.1.3.2 Improving cellular connectivity with the Mobile Kibbutz ......... 45 2.2 Polyversal TCP......................................... 65 2.2.1 Related work...................................... 66 2.2.1.1 Name based sockets............................. 66 2.2.1.2 Protocol independent transport API..................... 66 Page 6 of (128) c TRILOGY2 Consortium 2014 2.2.1.3 ZeroMQ..................................