FIRMS: a Future InteRnet Mapping System

Size: px

Start display at page:

Download "FIRMS: a Future InteRnet Mapping System"

Ruby Mason
6 years ago
Views:

1 Institute of Computer Science Department of Distributed Systems Prof. Dr.-Ing. P. Tran-Gia FIRMS: a Future InteRnet Mapping System Michael Menth, Matthias Hartmann, Michael Höfling

2 Overview The FIRMS architecture Basic components Operation Scalability Security Resilience Summary 2

3 ID Assignment Structure (Example) IANA IANA Delegates ID ranges to 5 RIRs Regional Internet t registry (RIR) Assigns ID ranges to users APNIC ARIN Delegates ID ranges to LIRs AfriNIC Local Internet registry (LIR) Associated with single RIR Assigns ID ranges to users RIR RIPE NCC LACNIC LIR D LIR A LIR E LIR G LIR B LIR C LIR LIR F 3

Finds and queries Caches entries P distribution network Collects all Ps in table Pushes P table to all MRs

4 Basic Components Map-base () Authoritative source of mapping data EID/EID prefix RLOC list Data controlled by ID owner or trusted agent pointer (P) ID prefix list Map-resolver (MR) Answers map-requests Holds P table Finds and queries Caches entries P distribution network Collects all Ps in table Pushes P table to all MRs Ingress tunnel router (ITR) Needs mapping data Issues requests to MR Caches entries ITR and MR may be collocated 4

Cascading Mapping Retrieval ITR Caches mappings Queries MR in case of cache miss Map-resolver (MR) Caches mappings Returns mapping if available Otherwise cache miss Looks up in P

5 Cascading Mapping Retrieval ITR Caches mappings Queries MR in case of cache miss Map-resolver (MR) Caches mappings Returns mapping if available Otherwise cache miss Looks up in P table Queries Stores mapping on receipt Forwards mapping to ITR Map-base () Holds mappings in DB Answers map-requests Involved entities Depends on caches ITR ITR and MR ITR, MR, and 5

6 Cascading Packet Forwarding ITR Sends packets to ETR Cache miss Tunnels packet to MR Map-resolver (MR) Sends packets to ETR Cache miss Tunnels packet to Map-base () Sends packets to ETR 6

P Distribution Network LIRs/RIRs Run P exchange

P info to Own LIRs and other RIRs Registered MRs P

7 P Distribution Network LIRs/RIRs Run P exchange nodes (PX) Prefix owners Register P at LIR/RIR LIR forwards P to RIR RIR Constructs P table Sequentially numbered updates (SNUs) LIRs/RIRs Push P info to Own LIRs and other RIRs Registered MRs P info Entire table on system start Incremental SNUs under normal operation 7

8 Normal Operation without P Distribution Network Map-requests do not need public infrastructure Prefix owner Prefix owner Prefix owner Prefix owner. Prefix owner Prefix owner MR : Authorized changes : Map-requests/replies 8

9 Scalability Does a global P table scale? Size: 170 ytes 1,000,000 allocated prefixes ([45] R. NCC, RIS Statistics Report, Average size of P: 170 bytes Churn of P table: 160 KBytes/day P changes every 3 years ([47] P. Martin, Zen Internet UK Small Medium Enterprise (SME) survey, ) Update traffic at RIRs: 12 KByte/s RIR with more than 6000 LIRs (subscribers) 9

10 Security Concept Securing P Information Resource certificates for EID sub-spaces Assigned in a chain from IANA over RIRs, LIRs to prefix owners Prefix owners Use resource certificates for authentication at LIR and LIRs/RIRs Authorization and secure transmission of P data through P DN to MR 10

11 Security Concept Securing Mapping Data Prefix owner Includes public key of in P Map-bases Sign map-replies with private key Map-resolvers Extract public keys of s from P table Validate map-replies using these keys 11

12 Resilience Locator failure Mapping data contains multiple l locators Map-resolver failure ITRs configured with multiple MRs Map-base failure P contains multiple l s PX failure Map-resolvers register with multiple PXs P table available in multiple PXs ITR MR MR!!! ITR MR PX ETR ETR MR PX! Locator 1 Locator 2 Backup MR Backup PX PX PX 12

forwarding in case of cache miss Strong trust Strong resilience Public

13 Summary Assumption: ID prefixes assigned by authorities Components Map-bases (s) Map-resolvers (MRs) pointer distribution ib ti network Properties Packet forwarding in case of cache miss Strong trust Strong resilience Public infrastructure not needed for queries Further steps Simulation in Omnet Prototype in G-Lab 13

RPKI Trust Anchor. Geoff Huston APNIC

RPKI Trust Anchor. Geoff Huston APNIC RPKI Trust Anchor Geoff Huston APNIC Public Keys How can you trust a digital signature?? What if you have never met the signer and have no knowledge of them or their keys? One approach is transitive trust