Mobility in Publish/Subscribe

NetworksWalter Wong

HIIT & NomadicLab24.02.2010

OutlineMotivationBackground

Link LayerNetwork LayerTransport LayerSession Layer

Information MobilityPeer-to-peer, Content Delivery NetworksPublish/Subscribe

MotivationOriginal Internet design

Hosts are fixed IP address is both end-host identifier and locator

However, the current Internet usage is:

Mobility – Some problemsHow does a host get a new locator (IP address)?How does a host re-establish the connectivity in

the new network?How does a host tell the peer host its new

address?How can we find a host that moves frequently?How can applications maintain the seamless

connectivity between mobile hosts?

Solutions in different layers

Link

Network

Transport

Session

Identification

Simple MAC address update

DHCP (static), Mobile IP (dynamic)

Host Identity Protocol

TCP Migrate

SIP Mobility

Link Layer MobilityChange MAC address

Ex. Between access points in the same subnet (+) Transparent to higher layers (no changes in the IP

address) (–) Limited to the same subnet

MACA

MACB

IPclient

Mapping: IPclient –> MACAMapping: IPclient –> MACB

Dynamic Host Configuration Protocol (DHCP)

Provides dynamic IP addresses to end-hosts(+) simple(–) does not maintain ongoing connections

Network A Network B10.10.1/24 192.168.0/24

10.10.1.100192.168.0.11

IP Mobility – IP Semantic Overload Problem

Link

Network

Transport

Session

Application

IPsrc = 10.10.0.100

Web-browser

socket(AF_INET, …, …)

connect()socket(IPsrc/dst, portsrc/dst)

IPsrc = 192.168.0.11

Mobile IPGoals

Network layer solutionApplications are oblivious of the mobility eventLegacy application support Incrementally deployable

ApproachTwo IP addressesHome Address –> stable end-host identifierCare-of Address –> ephemeral end-host locator“Solves” IP semantic overload problem

Mobile IP – ElementsHome Agent (HA)

Responsible for location managementTunnels traffic to the registered node when it is not

in the home networkForeign Agent (FA)

Provides Care-of address of the visited networkRepresents the mobile node when it visits the

network

MN at Home Network

Internet

Home Network

Foreign Network

HomeAgent

ForeignAgent

MN IPA

CorrespondentNode

Direct communicationbetween MN and CN

IPA <–> IPC

IPC

MN Registration

Internet

Home Network

Foreign Network

HomeAgent

ForeignAgent

MN IPA

CorrespondentNode

Registration in the FAReceive Care-of Address

Inform current CoA

IPC

MN IPB

MN at Foreign Network

Internet

Home Network

Foreign Network

HomeAgent

ForeignAgent

MN IPB

CorrespondentNode

IPC

CN sends data to IPA

HA tunnels packets to IPB(IP-IP tunneling)

Route Optimization

Internet

Home Network

Foreign Network

HomeAgent

ForeignAgent

MN IPB

CorrespondentNode

IPC

Avoids the triangle between CN – HA – MN

Mobile IP – SummaryProvides mobility support in the network levelApplications are oblivious about the mobility eventSupports simultaneous node mobility (uses HA and FA

as anchor points)Uses two IP addresses:

Home address: end-host identification Care-of address: end-host location

Issues Scalability problems (triangle) Security

Host Identity Protocol (HIP)

New namespace between network and transport layersHost Identity (HI)Host Identity Tags (HIT)Security embedded128-bit identifier = hash from the public key

Fill the gap between end-host identification and location

Decouples end-host identification and locationSolves IP semantic overload

HIP Namespace

Network

Transport

Application

Identification

Link

Web-browsersocket(…)

Get end-host identifiersocket(HITsrc/dst, portsrc/dst)

Network layer is free to change

HIP ResolutionTwo steps name resolution

Name to HIT resolution –> DNSHIT to IP resolution –> Rendezvous Server (RVS)

HIP base exchange4-way handshakeResistant against Denial-of-Service attacks

Uses cost functionsCheck whether correspondent nodes are committed

to the communication

HIP MobilityRendezvous Server (RVS)Holds all HIT-to-IP mappingDistributed in the network

Ex: One per administrative domainAfter a mobility event, mobile node engages in

the locator update procedureUPDATE message along with the verification

protocol

HIP SummaryNew namespace composed of cryptographic

identifiersHost Identifiers (HI) and Host Identity Tags (HIT)

Detaches host identification from locationResistant against Denial-of-service attacks

Base exchangeSupports simultaneous node mobility

RVS is the anchor point

TCP MigrateEnd-host mobility in the transport layerGoal: to maintain end-host seamless connectivity

during TCP sessionsApproach

Uses DNS names to provide stable end-host identifier

Saves TCP state during migration, restoring after mobility event

No new location management deviceNo Home Agent and Foreign Agent

TCP MigrateMobility procedure

Inform current IP address to the peer nodeAfter mobility event, mobile node sends a TCP SYN

message to the peer node informing the new IP address

Update current IP address in order to be globally reachableMobile host updates its current mapping in the DNSEx. www.acme.org –> 69.64.156.78

TCP MigrateTCP session migration

New TCP optionTCP SYN MIGRATEInforms to migrate to a new TCP sessionUse tokens to inform to which TCP session it was

associatedThe mobile host opens a new socket with the new

IP address and sends the TCP SYN message with MIGRATE option and a token with the current state

The peer host opens the a new TCP session to the new IP address and restores the session

TCP Migrate – SummaryBenefits

SimpleNo network infrastructure changes

DrawbacksChanges in the default TCPSecurity issuesDoes not support simultaneous node mobility

There is no anchor point

Session Initiated ProtocolSignaling protocol used for controlling

multimedia sessionsUsed for establishing, modifying and terminating

sessionsUses URI to identify users

Relies on two other protocolsReal-time protocol (RTP)

Carries streaming dataSession description protocol (SDP)

Session parameters, e.g, ports, protocols, etc

SIP Message Flow

DNSOutboundProxy

InboundProxy

Client Client

INVITE

Resolve URI to Inbound Proxy Server IP

INVITEOK OKACK ACK

RTP Traffic

Home Network

Foreign Network

SIP Mobility

OutboundProxy

Client

SIP Redirect ProxyCorrespondent

Node INVITE

Moved Temporarily

INVITEOK

ACK

SIP – SummarySignaling protocol for controlling multimedia

sessionsUses URIs to identify user agentsMobility is handled by SIP proxies

Mobility Support – Summary

Link

Network

Transport

Session

Identification

Simple MAC address update – switches can beconfigured to handle it

Mobile IP – creates a new IP address, the HomeAddress to be the end-host identifier, while theCare-of Address is the real locator

Host Identity Protocol – introduces a new namespaceto fill the gap between identification and location

TCP Migrate – adds a new option in the TCP stack,MIGRATE, to provide TCP session migration. Relieson DNS to provide correct mapping

SIP Mobility – uses SIP proxies to locate user agents.End users are identified by URI and mapped to SIPProxies, which are the anchor points.

Information-centric NetworksWhat happens when we migrate to information-

centric networks?Location decoupledTime decoupled

There is no IP end-point to locate hosts

Data ‘Mobility’ in Host-centric Networks

Peer-to-peer Networks Users search for content Request is translated to a query in a DHT Users receive a list of closest peers

Content Delivery Networks (CDNs) URL links contain CDN DNS entries Dynamic mapping of DNS name resolutions to the closest

surrogate server Dynamic mapping of content into an IP addressContent is ‘detached’ from locator (new naming system,

e.g, flat identifier, etc)

Data Mobility in Information-centric Networks

Native Publish/SubscribeEach content has a unique identifierContent is totally detached from specific location

Can be anywhere, intermediate caches, end-nodes, replicated, etc

Usually content is stored close to the consumersPopular content is cached near to consumersSupport flash crowd events

End-node Mobility in Information-centric Networks

Network Attachment procedureDuring bootstrap process, subscribe re-subscribes

to the publicationRVS receives notificationRVS notifies the publisher and topology manager

Publisher re-publishes the content in the new RVSTopology manager computes new path between

publisher and subscribers Updates delivery tree

End-node Mobility in Information-centric Networks

Some optimizationsDefault communication model: MulticastMulticast Assisted Mobility

Possibility to reduce handoff lossDistribution of data around the area where the mobile

user residesMakes data available when mobile user arrives

Packet lossBuffering and return channel (algorithmic IDs)

Delivery orderSubscription to separate IDs, e.g. algorithmic IDs

Questions?Comments?Thanks!

Content Authentication in Information-centric Networks

Walter WongHIIT & NomadicLab

24.02.2010

OutlineBackground

Host-centric security solutionsMerkle Hash Trees

Information-centric authenticationSkewed Hash Trees

Implementation & EvaluationConclusion

MotivationCurrent security solutions

Authentication of the container/storage device/mirror

And what about the content itself?We trust in the container! (shouldn’t we trust in

the content?)Paradigm problem

In the Internet, we want ‘what’And we get ‘where’

Example – Content Delivery Networks

ContentProvider

SSL

Are they the same movie?Wrong trust model!

Host-centric Security Solutions

SSL/TLS and IPSec Provides host authentication (IP address) IPSec = network layer solution => IP SSL/TLS = transport layer solution => IP !! Security channel between end-hosts

Mainly: data transfer between authenticated end-hosts (IP addresses)

Security data results from the connection parameters Transient data => can’t be reused in other context Time coupled

Towards Information-centric Networking

Migration from host-centric to information-centric networking

Data is decoupled from the location (data is not part of the storage location)

Communication is decoupled in time and synchronization

ScenariosPeer-to-peer, Content delivery networks Publish/Subscribe

Towards Information-centric Networking

Client/server modelScenario: low resourcesServices centralized in a ‘powerful’ serverRoles: well-defined clients and serversStorage is centralized in the serverDrawbacks

Bottleneck – scalability issuesServer could be distant geographically

Towards Information-centric Networking

Peer-to-peer modelScenario: file-sharingDistributed resources among peersRoles: peer is both producer and consumerStorage: distributed in the network, but in the peer

storage diskDrawbacks

Some are location oblivious – peer with highest bandwidth might not be the closest one

Paradox: consumer peers need to queue for the same resource, while the provider peer needs to send it multiple times

Towards Information-centric Networking

Publish/SubscribeScenario: news feed deliveryDistributed resources in the networkRole: mixed between publishers and subscribersStorage: distributed in the network along cachesBenefits

Multicast – no p2p paradoxSimpler – no scheduling algorithm for resourcesContent retrieval from the closest cache

Resources are within the network

Motivation – SecurityHow do we secure content with:

Location decoupledData can not be authenticated with some IP

Time decoupledData can not be authenticated based on direct

connection

Information-centric Security

Original ideaPer packet signatureSign each packet with a digital signature

DrawbacksCostly

CPU expensive to sign and verify each signature

RequirementOptimize signature mechanism

Merkle Hash TreeSignature amortization technique

binary tree built over a set of data blocksUses hash functions to authenticate data blocks

MD5, SHA-1, SHA-256Requires just one digital signature for an entire

piece of contentRegardless of the number of data blocks!

DrawbacksWorks only on binary trees!

Merkle Hash Tree

FileD0 D1 D2 D3Data blocks

H0 H1 H2 H3Leaf nodes

H01 H23Internal nodes

H03Root Hash

Merkle Hash Tree

FileD0 D1 D2 D3Data blocks

H0 H1 H2 H3Leaf nodes

H01 H23Internal nodes

H03Root Hash

D0

H1

H1

H23

H23

H0 H1

H23H01 +

H03

Skewed Hash TreeMotivation

Many possibilities to build a skewed treeGoal

New algorithm to support random size filesApproach

Separate balanced and unbalanced treesAppend remaining blocks under the balanced treeDeal with each one separatelyMaintain, at most, one level of difference

Skewed Hash Tree – Overview

FileD0 D1 D2 D3

H0 H1 H2 H3

H01 H23

H03h = 0

D4 D5

H4 H5

H45

H05

h = – 1

1 level diff

BenefitsAmortized signature schemeBased on hash functions (efficiency)Data carries its own proof of authenticity

Data and authentication information can come separately

Any sequence authenticationTime decoupling (no interaction between producers/consumers - asynchronous)Random size file authenticationOn-path network verification

Application Scenario On-path Authentication

Application ScenarioContent Delivery Networks

Evaluation (1/3)

Evaluation (2/3)

Evaluation (3/3)

ConclusionCurrent security solutions (TLS/IPSec) do not fit in information-centric networksSkewed Hash Tree provides:

amortized signatureindependent packet authenticationrandom file size authenticationtime decoupled

On average, 8 and 3 times faster than RSA, while preserving the same level of security

Questions?Comments?Thanks!