Separating identifiers from locators to scale the Internet

Transcription

1 Separating identifiers from locators to scale the Internet Olivier Bonaventure Department of Computing Science and Engineering Université catholique de Louvain (UCL) Place Sainte-Barbe, 2, B-1348, Louvain-la-Neuve (Belgium)

2 Outline Issues with the current Internet architecture Locators and identifiers Host based solutions Network-based solutions

3 Issues with the current Internet architecture Interdomain routing scalability Growth of BGP routing tables Internet bubble CIDR works well Growth is back again! Growth is back pre-cidr fast growth Source :

4 Issues with the current Internet architecture (2) Reasons for the BGP growth Number of distinct ASes?

5 Issues with the current Internet architecture (3) Fragmentation of IPv4 addressing space Most ASes advertise several prefixes

6 Issues with the current Internet architecture (4) In comparison, the IPv6 addressing space is (fortunately still) much less fragmented

7 Issues with the current Internet architecture (5) Reasons for the BGP growth Multihoming Client : AS4567 R1 I can reach / /16 R2 I can reach /16 and / /23 I can reach /23 Provider AS123 R /16 Provider AS789 I can reach /16 and /23 Global Internet

8 Issues with the current Internet architecture (6) Reasons for the BGP growth Traffic engineering I can reach /16 Client : AS /24 and /23 R2 R /23 I can reach /24 and /23 R /16 Provider AS789 I can reach /16 Provider AS123 and /24 and /23 I can reach /16 and /24 and /23 Internet

9 Issues with the current Internet architecture (7) Interdomain routing security Only Best Current Practices from network operators prevent a customer network from using BGP to announce the prefix of someone else Misconfigurations (fat fingers) are frequent O. Bonaventure, 2007

10 Issues with the current Internet architecture (8) Limited size of IPv4 addressing space We ve seen this problem before and NAT, CIDR and IPv6 have been proposed... Source

11 Issues with the current Internet architecture (9) Mobility is not cleanly supported by the Internet architecture Applic. Transport Network DataLink /24 R1 R2 R3 Applic. Transport Network / /24 DataLink Mobile IP is a possible but not widely deployed solution to this problem

12 Outline Issues with the current Internet architecture Locators and identifiers Host based solutions Network-based solutions

13 The complementary roles of IP addresses The IP addresses currently used by endhosts play two complementary roles Identifier role : the IP address identifies (with port) the endpoint of transport flows Locator role : the IP address indicates the paths used to reach the endhost these paths are updated by routing protocols after each topology change Applic. Transport Network DataLink R1 R3 R4 R2 R5 R6 Applic. Transport Network DataLink

14 Existing identifiers Loopback addresses are already used as identifiers, but only on routers R / /32 R / /30 R3 R5 In contrast with endhost addresses and normal addresses on routers, loopback addresses are not tied to a particular physical interface a loopback address is always reachable provided that one of the router s interfaces remains up loopback addresses are often used as identifiers this is only possible because the loopback addresses are directly advertised by the routing protocols

15 Outline Issues with the current Internet architecture Locators and identifiers Host based solutions Network-based solutions

16 Transport layer Identifier : Id.A Specific sublayer Locators IP routing { Green.1, Red.2} sublayer Principle of the Host-based solutions Roles Translates the packets so that Transport layer always sees only the host identifier IP Routing sublayer sees only locators Manages the set of locators Securely switches from one locator to another upon move or after link failure each host maintains some state R R R R

17 Example Standalone multihomed ILNP host SRC: 2001:AAA:1235::EDC DST:2001:BBBB:789::AAAA DNS Nonce: Request : dhost? Context : From SRCId= EDC, Nonce=87654 TCP SYN+ACK (I:EDC,pref=100) (L:2001:EEEE:456, pref=10) (L:2001:AAA:1235, pref=999) AS3 2001:BBBB Identifier : AAAA Locator 2001:BBBB:789: Provider1 - AS1 2001:AAA Provider2 - AS2 2001:EEEE SRC:2001:BBBB:789::AAAA DST: 2001:AAA:1235::EDC Nonce: TCP SYN ICMP Locator update SRC:2001:EEEE:456::EDC DST: 2001:BBBB:789:AAAA Nonce: Identifier : EDC New Loc: 2001:EEEE:456 Locators : :EEEE: :AAA:1235 Context : From SRCId= AAAA, Nonce=12345

18 Identifiers Host Identity Protocol (HIP) Comparison of host-based solutions Public key Host Identity Tag : hash of host s key public key SHIM6 IPv6 hostbased multihoming one of the IPv6 addresses of host Identifier Locator Network Protocol upper 64 bits of IPv6 address Locators IPv6 address IPv6 address lower 64 bits of IPv6 address How to map identifiers to locators? Security DNS Host may announce its locators during session establish. public key crypto IPSEC DNS Host announces its locators during shim6 session estab. CGA and HBA addresses DNS Nonce option

19 Challenges of host-based solutions How to securely map one identifier onto the corresponding locators? DNSSec in most cases How to deal with link failures? Failure detection protocol, ICMP When a destination host has multiple locators, how does the source select the best one? How to update the locators attached to a host when it moves? Specific protocol, ICMP How to deploy a new host-based solution incrementally while maintaining interoperability with the existing Internet?

20 Outline Issues with the current Internet architecture Locators and identifiers Host based solutions Network-based solutions

21 Principles of the Network-based solutions Host s IP stack unchanged Each host has one stable IP address used as identifier not globally routed Transport layer Identifier : IPA IP routing sublayer Each edge router owns globally routed addresses used as locators Mapping mechanism is used to find locator associated to one identifier Packets from hosts are modified before being sent on Internet R R R R Locators { IPGreen.A, IPRed.A}

22 LISP : simple example Mapping reply for 0100: DD::8765 RLOC1 2001:BBB:456:AAAA RLOC2 2001:EEEE:123::CCCC AS3 2001:BBBB Mapping request Where is 0100: DD::8765 Locator: 2001:BBB:456:AAAA S: 0100: FF::1234 D: 0100: DD::8765 R R Identifier 0100: DD::8765 Locator 2001:EEEE:123::CCCC Outer header S: 2001:AAA:234:1111 D: 2001:BBB:456:AAAA Inner S: 0100: FF::1234 D: 0100: DD::8765 Provider1 - AS1 2001:AAA Locator 2001:AAA:234:1111 Provider2 - AS2 2001:EEEE R1 R R R2 Locator 2001:EEEE:678:2222 S: 0100: FF::1234 D: 0100: DD::8765 Identifier 0100: FF::1234 R S: 0100: FF::1234 D: 0100: FE::2345 R Identifier : 0100: FE::2345

23 LISP Locator Identifier Separation Protocol Identifiers Locators How to map identifiers to locators? How to forward packets across global Internet? Locator Identifier Separation Protocol (LISP) IPv4/v6 addresses not advertised on global Internet IPv4/v6 addresses advertised on global Internet NERD, ALT, CONS, LISP- DHT,... packets from hosts are encapsulated by edge routers

24 Challenges for network-based solutions How to securely map one identifier onto the corresponding locators? (too) many proposals security not addressed convincingly When an identifier has multiple locators, how does the edge router select the best one? How does a site performs traffic engineering? How to deal with mobile hosts? Is there enough incentive for edge networks to deploy this solution while they don t suffer from the cost of huge BGP routing tables? How to deploy a new network-based solution incrementally while maintaining interoperability with the existing Internet?

25 Conclusion IRTF s Routing Research Group is working on developing a more scalable Internet architecture Identifiers and Locators Host-based solutions HIP, SHIM6, ILNP,... Network-based solutions LISP,...

26 Remaining open issues What is an identifier and how do we allocate them? flat space, hierarchical, crypto-based,... Do we need host/network-based solutions? Some environments likely need host-based solutions while others need network-based How do we map identifiers onto locators Scalability, security and performance are key concerns Do we need to change interdomain routing? How to interoperate with current Internet? What are the incentives for edge networks to deploy new mechanisms? IRTF RRG s progress is very slow