Facilitating the Deployment of Ad-Hoc Virtual Organizations With
Total Page：16
File Type：pdf, Size：1020Kb
FacilitatingtheDeploymentofAd-hocVirtual Organizations with Integrated Social and Overlay Networks Renato J. Figueiredo, P. Oscar Boykin, Pierre St. Juste, and David Wolinsky Advanced Computing and Information Systems, University of Florida Gainesville, FL 32611 [email protected]fl.edu, [email protected]fl.edu, ptony82@ufl.edu, davidiw@ufl.edu ABSTRACT fact that, while commodity computers have become increas- Deploying virtual organizations (VOs) is difficult for small- ingly cheaper and faster, the management overhead asso- and medium-scale collaborations: the overheads in estab- ciated with deploying cross-organization, wide-area cyber- lishing and managing trust, and in deploying and managing infrastructures can be larger than researchers are able to computational resources distributed across multiple organi- afford. This is often the case in small- and medium-scale zations are daunting to many potential users, presenting a efforts and those involving institutions which do not have barrier to entry that significantly hinders wider deployment extensive personnel to manage the requirements of main- of VOs. We advocate an approach where social networking taining complex computational resources. and self-configuring overlay virtual networks are integrated A key management overhead associated with initiating a in a novel way that allows simple deployment and manage- VO is the establishment of trust among its participating ment of ad-hoc infrastructures for VOs. There are three cen- entities, typically by means of establishing a Public Key tral principles in our approach: (1) user relationships which Infrastructure (PKI) certificate authority. Furthermore, a have been increasingly recorded in social networking systems key management overhead in sustaining a VO is the sys- provide the opportunity to bootstrap trust relationships; (2) tem administration of distributed, cross-domain computing connections established at a social networking layer can effi- resources and associated software and middleware. In this ciently be mapped to the IP layer of virtual network overlays paper we investigate a systems approach which can reduce to support existing TCP/IP applications for collaboration both overheads through a novel approach integrating social and resource sharing while maintaining security against un- and overlay networks into social virtual private networks trusted parties; and (3) systems integrating social and vir- (VPNs). Social VPNs are self-managing network overlays in- tualnetworkscanbeself-configuring,enablingdeployment terconnecting wide-area resources where trust is established of collaborative infrastructures by non-experts. We discuss by leveraging relationships taken from social networks. motivations for this approach, describe a prototype imple- Today’s social networking infrastructures allow users to mentation which integrates the Facebook social network and manage and document their connections to others, thereby the IPOP overlay network, and discuss a use case scenario recording some aspect of the trust relationships between towards ad-hoc social cycle-sharing virtual Condor pools. users. Users record their personal information in profiles and are able to discover profiles of other peers in the system. In typical social networking infrastructures, the information Categories and Subject Descriptors stored in these profiles allows users to make decisions about C.2.4 [Distributed systems] whether they would be willing to be linked to other peers. These infrastructures have been proven to have Web-based General Terms interfaces that are very user-friendly: surveys have shown that a large percentage of Internet users now routinely in- Security, Human Factors teract with social networking Web sites [9]. We argue that the user interfaces of social networking infrastructures can 1. INTRODUCTION be leveraged to facilitate the establishment of trust among While there are several examples of successful large-scale users to bootstrap ad-hoc small- and medium-scale VOs. Virtual Organizations (VOs) in computational science and Furthermore, the social infrastructure can be used to facil- engineering, wide-spread adoption of VOs has yet to be at- itate the exchange of cryptographic keys that can then be tained. A major contributing factor to this situation is the used for secure communication among peers through inte- gration with IP overlay networks that establish peer-to-peer connectivity even in the presence of NATs and firewalls [5]. The goal is to securely interconnect Internet users, where Permission to make digital or hard copies of all or part of this work for end-to-end, point-to-point virtual network links are created, personal or classroom use is granted without fee provided that copies are automatically, as a result of connections established through not made or distributed for profit or commercial advantage and that copies social network infrastructures. In this approach, the only bear this notice and the full citation on the first page. To copy otherwise, to configuration required from users is the creation and man- republish, to post on servers or to redistribute to lists, requires prior specific agement of social connections; the configuration and mainte- permission and/or a fee. HPDC’08, June 23–27, 2008, Boston, Massachusetts, USA. nance of IP network connections is self-managing and com- Copyright 2008 ACM 978-1-59593-997-5/08/06 ...$5.00. 201 carol.facebook.ipop 10.10.0.2 virtual IP address automatically via DHCP, generates a pri- PrivKc, PubKa0-2, PubKb node0.alice.facebook.ipop vate/public key pair, binds Alice’s user name in the social 10.10.0.3 network and her virtual IP address to a self-signed certifi- Overlay network cate, and publishes her public key to the social networking Bob.facebook.ipop (e.g. IPOP) site. The virtual router also periodically polls for her list 10.10.0.1 node1.alice.facebook.ipop PrivKb, PubKa0-2, PubKc 10.10.0.4 of friends in the social network, and configures their X.509 Social certificates to be used by its IPsec stack. Bob and Carol Network API go through the same exact process of downloading and in- Alice: keys=PubKa0, PubKa1, PubKa2, links={Bob, Carol} Bob: key=PubKb, links={Alice, Carol} stalling the self-configuring virtual router. At the end of Carol: key=PubKc, links={Alice, Bob} this procedure, the three users can communicate seamlessly Social network Information system and securely with each other for collaboration tasks such Social network as conferencing, desktop sharing, data sharing, even though (e.g. Facebook) they might be behind different NATs and firewalls. As other Alice Social users are added to an individual’s social network list, they Network Web interface are also added to the list of social VPN participants for that Bob Carol individual only through point-to-point cryptographically au- thenticated/encrypted links. Figure 1: Integration of social and overlay networks to Use case scenario 2: ad-hoc cycle sharing: Encouraged support ad-hoc VOs. In the example, users Alice, Bob by their accomplishment, Alice, Bob and Carol now plan to and Carol have used a Web interface and information share pools of local resources each one has in their own labs. available from profiles to establish social links (bottom The social VPN virtual router they download is packaged half). The information stored in the social networking in a virtual machine appliance which also integrates a batch infrastructure is accessed through an API by overlay vir- job scheduler which self-configures a pool of resources for tual networking middleware to exchange keys and con- opportunistic computing, such as in the Condor-based [10] figure a VPN stack (e.g. IPsec) and establish secure Grid appliance. Each appliance instance obtains a different connections among user resources. Resources are bound virtual IP address, which again is automatically and trans- to virtual private IP addresses belonging to an isolated parently self-signed with the owner’s respective key, allowing IP namespace in the overlay; virtual DNS entries are de- multiple appliances to be bound to the same identity. rived from social network identities and mapped to the Use case scenario 3: grouping and trust delegation: Alice, numeric virtual IP addresses to facilitate discovery. Bob and Carol start interacting with other researchers in their field and the number of interested participants starts to grow. Initially adding such participants to their indi- pletely transparent to users. Social networking enables ad- vidual list of contacts, they eventually decide to delegate hoc VOs where no central administration is needed and users management to an entity they trust, Trent. In doing so, are able to establish and maintain their individual trust re- they configure their virtual router appliances to also trust lationships with friendly interfaces in a way that can be ac- Trent’s friends list. Every participant in this VO should cessed through APIs. Overlay networking is key to enable now seek a connection with Trent to be able to exchange a system where private tunneling is setup and maintained keys with other participants. This scenario is now similar without requiring central administration. to a typical VO, where Trent acts as a certificate authority The social VPN functionality is thus accomplished with- responsible for adding trusted users to the group according out burdening users with the complex, error-prone config- to some policy established by the group, and revoking those uration typically required to bring up public key and net- who may no longer be trusted.