Content Centric Networking

Transcription

1 Content Centric Networking Van Jacobson Palo Alto Research Center (PARC) IETF77 ISOC Internet Researchers meeting Anaheim, CA 24 March 2010

2 This talk describes ongoing PARC work on CCN (Content-centric Networking) by: Jim Thornton Diana Smetters Nick Briggs Michael Plass Rebecca Braynard Tim Diebert Elaine Shi Simon Barber Ignacio Solis Mark Mosko Philippe Golle and me

3 CCN offers... (provably) optimal content distribution painless mobility, wireless, virtualization,... same scalability & efficiency as TCP/IP simple, secure, robust configuration an easy, incremental, evolutionary path much better security

4 For 150 years communication has meant a conversation over a wire connecting two devices.

5 For 150 years communication has meant a conversation over a wire connecting two devices. For consumers, the Web forever changed that.

6 Circuit model requires a spanning tree Introduces global dependencies that remove local choice. Acts as a lens to magnify attacks. Makes load near source scale with popularity. 6

7 Today, wires and memories solve complimentary aspects of the same problem: wires move information in space memories move information in time We need a communications architecture that unifies both aspects.

8 What has to change? For sharing, packets must describe what you want, not the process of getting it. An address has to name data, not conversation endpoints. For asynchrony (time-shifting, intermittent connectivity, mobility,...) memory has to be explicit in the communication model. Have to stop pretending container-based security can work and start securing data. 8

9 the IP model FIB DST SRC src dst

10 FIB DST SRC src dst Intermediate nodes are invisible Intermediate nodes can t choose. Intermediate nodes can t measure success

11 Content store FIB Prefix Name Data Packets say what not who (no src or dst) communication is local entire net runs in flow balance memory damps large scale dynamics

12 Content store FIB Prefix Name Data topology is an optimization node gets fine-grained choice of upstream(s) upstream performance is measurable

13 Example: Content Distribution nytimes A B C D E F G H I J K client1 client2 client3

14 Example: Content Distribution nytimes A B C D E F G H I J K client1 client2 client3

15 Example: Content Distribution nytimes A B C D E F G H I J K client1 client2 client3

16 Example: Content Distribution nytimes A B C D E F G H I J K client1 client2 client3

17 Example: Content Distribution nytimes A B C D E F G H I J K client1 client2 client3

18 Example: Content Distribution nytimes A B C D E F G H I J K client1 client2 client3

19 Example: Content Distribution nytimes A B C D E F G H I J K client1 client2 client3

20 Example: Content Distribution nytimes A B C D E F G H I J K client1 client2 client3

21 Content goes only where there s interest. B nytimes A C It takes at most one trip across any link. D E F G Average latency is minimized. H I J K client1 client2 client3 Total bandwidth is minimized. There s no routing or control traffic associated with the replicas.

22 Name tree solves discovery problem nytimes.com web frontpage v v Newest nytimes: nytimes.com/web/frontpage <rightmost child> Newest that s more recent than mine: nytimes.com/web/frontpage/v <rightmost sibling> s0 s1 s2 Conventions: name tree child nodes are lexically ordered <next> assumed if no relationship specified

23 Name tree solves discovery problem nytimes.com web frontpage v v Newest nytimes: nytimes.com/web/frontpage <rightmost child> Newest that s more recent than mine: nytimes.com/web/frontpage/v <rightmost sibling> s0 s1 s2 Conventions: name tree child nodes are lexically ordered <next> assumed if no relationship specified

24 Internet security sucks This is our problem: Communication Information + Trust

25 Files, hosts and network connections are containers for information A secured perimeter is the only way to secure containers. For today s network use, any realistic perimeter encloses the planet.

26 Forget containers secure the content Do it as the final production step to minimize attack surface. Ron Rivest s SDSI has shown this can be done if any consumer can assess solely from the data: Integrity (is data intact and complete?) Relevance (what question does this answer?) Provenance (who asserts this is an answer?)

27 CCN data /nytimes.com/web/frontpage/v /s0/0x3fdc96a4... signature 0x1b key nytimes.com/web/george/desktop public key Signed by nytimes.com/web/george Signed by nytimes.com/web Signed by nytimes.com Note: Content networking has no key distribution problem since keys are content.

28 Evidentiary Trust Rich web of trustable, interconnected information arises from signed content: Content Content Content Key Key Key Key Content Content Content Content Key Key Key Key Key Key Attacks have to be consistent with information and links get exponentially harder as information base grows.

29 New Layering WWW phone... SMTP HTTP RTP... TCP UDP IP browser, chat,... File, Stream,... Security Content Chunks ethernet PPP Strategy CSMA async sonet... copper fiber radio... TCP, P2P, Brdcast... copper fiber radio... 24

30 Information on CCN is available at including a GPL d open-source release of our current research prototype.

31

32 Naming 27

33 Names and meaning Like IP, CCN imposes no semantics on names. Meaning comes from application, institution and global conventions reflected in prefix forwarding rules. For example, /parc.com/people/van/presentations/fiss09 might be the name of a presentation s data and /thisroom/projector the name of the projector it should display on. The former is a globally meaningful name leveraging the DNS global naming structure. The latter is local and context sensitive it refers to different objects depending on the room you re in. 28

34 Scaling 29

35 Names Route Interests FIB lookups are longest match (like IP prefix lookups) which helps guarantee log(n) state scaling for globally accessible data. Although CCN names are longer than IP identifiers, their explicit structure allows lookups as efficient as IP s. Since nothing can loop, state can be approximate (e.g., bloom filters). 30

36 But... this doesn t handle conversations or realtime. Yes it does - see ReArch VoCCN paper. this is just Google. This is IP-for-content. We don t search for data, we route to it. this will never scale. Hierarchically structured names give same log(n) scaling as IP but CCN tables can be much smaller since multi-source model allows inexact state (e.g., Bloom filter).

37 Strategy 32

38 Strategy layer (mobility management) If you don t care who you re talking to, you don t care if they change. If you ask for a few pieces at a time, it s ok if one gets delivered where you used to be. If you can use all your links simultaneously it s easy for the stack learn what s best. If all communication is flow balanced, you know exactly what s working and how well.

39 Performance-based interest re-expression IPC Alice IPC Bob

40 Performance-based interest re-expression IPC Alice IPC Bob

41 Basics 35

42 CCN packets interest Interest packet Content Name Selector (order preference, publisher filter, scope,...) Nonce data Data packet Content Name Signature (digest algorithm, witness,...) Signed Info (publisher ID, key locator, stale time,...) Data There are two CCN packet types: interest (a question) and data (an answer). Both are encoded in an efficient binary XML.

43 Internally, CCN names are opaque, structured byte strings /parc.com/van/cal/417.vcf/v3/s0/0x3fdc96a4... is represented as a component count then, for each component, a byte count followed by that many bytes: 7 8: parc.com 3: van 3: cal... 32: 3FDC96... The only assumption CCN makes about names is hierarchical structure. E.g., names or components can be encrypted or contain arbitrary binary data.

44 Basic CCN forwarding Consumer broadcasts an interest over any available communications media: want /parc.com/van/presentation.pdf Interest identifies a collection of data - all data items whose name has the interest as a prefix. Anything that hears the interest and has an element of the collection can respond with it: HereIs /parc.com/van/presentation.pdf/p1 <data> 38

45 Basic CCN transport Data that matches an interest consumes it. (network always operates in flow balance.) Interest must be re-expressed to get new data. (Controlling the re-expression allows for traffic management and environmental adaptation.) Multiple (distinct) interests in same collection may be expessed (similar to TCP window).

46 Node Model 40

47 CCN node model Name Content Store Data Face 0 /parc.com/videos/widgeta.mpg/v3/s0... Pending Interest Table (PIT) Prefix Requesting Face(s) Index ptr type C Face 1 /parc.com/videos/widgeta.mpg/v3/s1 0 P F FIB Prefix Face list C = Content store P = PIT F = FIB Face 2 Application /parc.com 0, 1

48 Comparison Transport FIB lookup Check & decr. TTL N Y Dst is me? Interface 0 Prefix FIB Interface Interface 1 Name Content Store Data Face 0 /parc.com/videos/widgeta.mpg/v3/s * 2 Interface 2 Pending Interest Table (PIT) Prefix Requesting Face(s) Index ptr type C Face 1 /parc.com/videos/widgeta.mpg/v3/s1 0 P F FIB Prefix Face list C = Content store P = PIT F = FIB Face 2 Application /parc.com 0, 1

49 IP node model Transport FIB lookup Check & decr. TTL N Y Dst is me? Interface 0 Prefix FIB Interface Interface 1 10.* 2 Interface 2

50 CCN node model Name Content Store /parc.com/videos/widgeta.mpg/v3/s0 Data Pending Interest Table (PIT) Prefix Face 0... get /parc.com/videos/ WidgetA.mpg/v3/s2 Requesting Face(s) Index ptr type C Face 1 /parc.com/videos/widgeta.mpg/v3/s1 0 /parc.com/videos/widgeta.mpg/v3/s2 0 P P F FIB Prefix Face list C = Content store P = PIT F = FIB Face 2 Application /parc.com 0, 1