Providing Reliable IPv6 Access Service Based on Overlay Network

Transcription

1 Providing Reliable IPv6 Access Service Based on Overlay Network Xiaoxiang Leng, Jun Bi, and Miao Zhang Network Research Center, Tsinghua University Beijing , China Abstract. During the transition from IPv4 to IPv6, it is necessary to provide IPv6 access service for IPv6 islands inside the native IPv4 network to access the native IPv6 network. The existing IPv4/IPv6 transition methods make IPv6- relay gateways maintained by IPv6 service providers become potential communication bottlenecks. In this paper, a new method PS6 is presented to reduce the reliance on these relay gateways by shifting the burden to edge gateways on each IPv6 island. In this method, direct tunnels are set up between IPv6 islands, and a overlay network is maintained between edge gateways of IPv6 islands to propagate information of tunnel end points. After describing the algorithm and overlay network design, we analyze the scalability of the algorithm. The simulation results and theoretical analysis show that the proposed method is reliable and scalable. Keywords: IPv6 Access Service, Overlay Network, IPv4/IPv6 Transition. 1 Introduction Mainly due to the fast expansion of the Internet and the lack of unallocated global IPv4 addresses, the transition from IPv4 to IPv6 [1] is now a reality and a growing trend while the Internet develops. Because of the sheer scale of the existing IPv4 network, the transition will need considerable time to complete. Some IPv4 subnets may, while having had their network infrastructure upgraded to support IPv6, still lack direct links to the native IPv6 network. That is, they will be isolated IPv6 islands inside the global IPv4 network. It is common for these IPv6 islands to use IPv6-in- IPv4 tunnels [2] via relay gateways maintained by IPv6 service providers in order to join the native IPv6 network. However, in these scenarios, all traffic from an IPv6 island to another IPv6 island will be forwarded via the IPv6-relay gateways from the source island to IPv6 network, and then be forwarded back from the IPv6 network to the destination island. While IPv6 is still emerging, a lot of IPv6 traffic may be transmitted between IPv6 islands. Therefore, these relay gateways maintained by IPv6 service providers can potentially become the communication bottlenecks. A peer-to-peer (P2P) [3] based algorithm PS6 is proposed in this paper, in which direct tunnels are built between IPv6 islands to reduce the burden of IPv6-relay gateways maintained by IPv6 service providers. A P2P overlay network is set up among the gateways of IPv6 islands to propagate TEP (tunnel end point) information (<IPv6 prefixes, IPv4 address of edge gateway>). When an IPv6 island dual-stack R. Meersman, Z. Tari, P. Herrero et al. (Eds.): OTM Workshops 2006, LNCS 4278, pp , Springer-Verlag Berlin Heidelberg 2006

2 Providing Reliable IPv6 Access Service Based on Overlay Network 1501 gateway receives a data packet sent to the IPv6 network, it firstly checks whether there is a direct tunnel to the destination address. For packets being transmitted, the shortcut tunnels between the source and destination islands are assigned higher route precedence than tunnels to relay gateways of service providers. In P6P [4], P2P technology is also utilized to build the IPv6 backbone over the existing IPv4 network. It directly uses a DHT-based [5] P2P network to forward the IPv6 data packets. There are some drawbacks for this scheme. Firstly, DHT is usually used for exact matching, and is not suitable for the longest matching in packet forwarding. Secondly, there is problem in the performance of forwarding lookup on the distributed storage P2P network. In contrast to P6P, the PS6 algorithm only uses the P2P network for transferring control messages between edge gateways of IPv6 islands. Data packets are forwarded to the destination gateways by the source gateways of IPv6 islands directly after looking up their tunnel tables, allowing for better forwarding performance. The rest of the paper is organized as follows. Section 2 shows the problem statement; Section 3 presents the PS6 algorithm; in Section 4, the design of the overlay network used in PS6 is introduced; In Section 5, the scalability of the proposed algorithm is discussed by theoretical analysis, and Section 6 summarizes this paper and proposes future work. 2 Problem Statement In the course of the deployment of IPv6, native IPv6 networks - both IPv6-only and dual stacks - will connect with each other to eventually become an IPv6 continent. The upgrade of IPv4 networks to support IPv6, due to the huge existing investment in IPv4, will necessarily be a gradual process, and native IPv4 networks and native IPv6 networks will coexist for a long time. During this period of coexistence, there are two methods for dual stack hosts in an IPv4 continent to communicate with hosts in an IPv6 continent and to use IPv6 application. The first way is to directly set up an IPv6 tunnel - with the mechanisms ISATAP [6], Teredo [7], etc. - between a dual stack host and an IPv6-relay gateway provided by a service provider. The second way is to set up an IPv6 tunnel between an edge gateway of the local network and an IPv6-relay gateway. In this second method, the local network becomes an IPv6 island. When the internal information of local network needs to be protected, it is recommended that the second solution be used [8]. Existing methods for providing IPv6 access service for IPv6 islands include: 6to4 mechanism [9] in which 6to4 IPv6 addresses are used, and IPv6 configured tunnel [2] in which global IPv6 addresses are used. Without explicit tunnel setup, 6to4 technology is a simple solution for isolated IPv6 islands to communicate with each other and access the IPv6 continent with the help of 6to4 relays. The automatic tunnels between 6to4 networks can effectively mitigate the burden of 6to4 relays. This method does, however, pose significant management challenges for ISPs, and there are also security problems with 6to4 brought about by the automatic tunneling mechanism [10]. With IPv6 configured tunnels using global IPv6 addresses, the addresses of IPv6 islands are assigned by the providers of IPv6 access service. This manual configuration makes this kind of tunnel easy to control, and the security

3 1502 X. Leng, J. Bi, and M. Zhang problems are greatly diminished when compared with 6to4. Furthermore, no extra route need be imported into the IPv6 network. The IPv6 islands can be treated as natural extensions of the IPv6 continent. For the purpose of decreasing the configuration overhead, a Tunnel Broker (TB) [11] is often used to manage the configured tunnels automatically. IPv6-in-IPv4 Fig. 1. Scenario of IPv6 islands The mechanisms with global IPv6 addresses (such as IPv6 configured tunnel and Tunnel Broker) generally use IPv6-relay gateways to provide the IPv6 access service. As shown in Figure 1, all the traffic from IPv6 islands will be forwarded by the relay gateways, even if the traffic is between IPv6 islands. The relay gateways can potentially become communication bottlenecks. Since the existing optimization algorithms are mainly focusing on the service providers, the only way to increase overall performance is to increase the performance or the number of relay gateways, which could be a costly exercise. 3 The Algorithm In this paper, we present an optimizing algorithm PS6 for the scenario above to provide high performance IPv6 access service. Besides the service providers, we also consider the customers - the edge gateways of IPv6 islands. When an IPv6 island gateway receives a data packet with a destination address in another IPv6 island, it directly forwards this packet to the destination island gateway through the IPv4 network. Otherwise, it sends the packet to the relay gateway of the service provider.

4 Providing Reliable IPv6 Access Service Based on Overlay Network 1503 Fig. 2. Forwarding flow of IPv6 island gateway As shown in Figure 2, in PS6, a lookup operation is inserted into the flow for packet forwarding of IPv6 island edge gateways. The steps of the proposed algorithm are described as follows: (1) Form a Tunnel Table (as shown in Table 1) on each IPv6 island gateway by exchanging TEP information (<IPv6 prefixes, IPv4 address of edge gateway>) between the gateways. (2) When an island gateway receives an IPv6 data packet, Firstly, it looks up the Tunnel Table to find out whether there is a direct tunnel to the destination. If yes, it then sends this packet directly to the IPv4 address specified by the Tunnel Table; Otherwise, it then forwards this packet to the IPv6-relay gateway of service provider Table 1. Tunnel Table of IPv6 island gateway IPv6 prefix IPv4 address of gateway 2001:250:f001:f002:20a::/ :250:f001:f002:28ba::/ :250:f001:f002:fe30::/ The PS6 algorithm is based on that for IPv6 configured tunnels, inheriting the advantages for control, management and security. In addition, as with 6to4, the direct tunnels between IPv6 islands can effectively reduce the burden on the IPv6 relay gateways. In contrast to 6to4, the global IPv6 addresses of IPv6 islands make it impossible for the island gateways to get the TEP information from the destination IPv6 address of a data packet. How a gateway of IPv6 island gets the TEP information of all the other IPv6 islands is the key consideration in this algorithm. One solution is to set up a

5 1504 X. Leng, J. Bi, and M. Zhang central server to hold all the information, send it to each island gateway and to propagate the updates. However, this method will make the central server a weak point of the system. Another solution is to build a P2P overlay network between the edge gateways of IPv6 islands with the help of a Registration Server. The TEP information is propagated by the P2P network. In the PS6 algorithm, we adopt this second option. IPv6 Island B IPv6 Island A Router B Router C Router A IPv4 Continent IPv6 Island C Registration Server IPv6 Continent IPv6-relay Configured Tunnel P2P Neighborhood Register Automatic Tunnel Fig. 3. The PS6 algorithm The architecture of IPv6 overlay network is shown in Figure 3. Router A, Router B and Router C are edge gateways of three IPv6 islands. A P2P network is maintained by them to share TEP information. With the TEP information, shortcut tunnels are set up on each gateway for transferring data packets between IPv6 islands. After presenting the PS6 algorithm, we describe the design of the overlay network and analyze the scalability of the proposed algorithm in the following parts. 4 Overlay Network Design 4.1 IPv6 Overlay Network An IPv6 overlay network is set up to propagate TEP information among the IPv6 island gateways. Each IPv6 island edge gateway broadcasts its TEP information inside the overlay network and gets the other gateways TEP information from its peers. There are two classes of P2P overlay networks: Structured and Unstructured [12]. In the Structured P2P networks, a lot of overhead, either from network or computing,

6 Providing Reliable IPv6 Access Service Based on Overlay Network 1505 is introduced into the system in order to maintain the structure of the network. In contrast, in the Unstructured P2P network, there is no special global structure to be maintained. Instead, a partial view of the network is held for each node. The overheads for maintaining network topology can be much lower than those for the structured ones. In the scenario proposed in this paper, the gateways of IPv6 islands are usually lightweight devices such as NAT Boxes which are not capable of maintaining large amounts of topology information. Therefore, in PS6, we have chosen to use an Unstructured P2P network in which each node chooses its neighbors randomly. Since there is no special structure to this P2P network, it is necessary to find a way to keep the nodes inside this P2P network connected with each other. A Registration Server on which the IPv4 addresses of all nodes in the IPv6 overlay network are held is set up to help the gateways of IPv6 islands join the overlay network gradually. The Registration Server has to discover the changes of the overlay network, either from the removal or failure of nodes or from the changes of IPv4 addresses. Fortunately, these are already contained within the information spread inside the overlay network. We put the Registration Server into the P2P network as a normal node. Therefore, these changes are easily noticed by the update scheme of the IPv6 overlay network. Similar to some routing protocols, such as OSPF [13], the flooding scheme is used to broadcast the TEP information inside the overlay network. When a node receives an update packet from one of its neighbors, it refreshes the related items in its local database, and then forwards the packet to all the other neighbors. Although flooding can be a waste of network resources, it s a reliable scheme to spread TEP information to all nodes in the IPv6 overlay network. 4.2 IPv6 Service Subscription In PS6, a Registration Server is set up to help the IPv6 island gateways join the IPvt overlay network. When the Registration Server receives a subscription request from a newly arrived gateway, it randomly chooses 20 of all existing nodes and sends their IPv4 addresses to the new one. The new node then gets the TEP information of all the islands corresponding to the nodes specified by the received IPv4 addresses and forms a Tunnel Tables for data forwarding. The steps of a new subscription are shown in Figure 4 and described as follows: (1) Register. The new arrived node registers at the Registration Server, and gets a list of IPv4 addresses for 20 existing nodes. (2) Make overlay neighborhoods. The new node tries to make overlay neighborhoods with the nodes specified by the received IPv4 addresses. (3) Exchange TEP information. The new node gets the TEP information of all other islands from its neighbors. Meanwhile, it spreads its TEP information inside the P2P network. (4) Form a Tunnel Table. With the TEP information received, the new node sets up a Tunnel Table for data transmission.

7 1506 X. Leng, J. Bi, and M. Zhang Fig. 4. New subscription 4.3 Failure Detection It is common to hold the overlay neighborhoods of the IPv6 overlay network by sending keep-alive messages periodically. When a node detects that it hasn t received such keep-alive message from its neighbor for a certain time, it broadcasts the failure notice to the whole IPv6 overlay network through its live neighbors. Furthermore, in order to increase the stability of the overlay network, we set the minimal degrees d for each node to be 5. When a node finds the count of its live neighbors is less than d, it randomly chooses some nodes from the TEP information stored locally and tries to make new overlay neighborhoods until the count of its live neighbors reaches d. The simulation shows that when the node number is less than 10000, the IPv6 overlay network used in PS6 can keep connected as long as the minimal degree of each node d is equal to or more than 3. We can infer that when d is equal to or more than 3, the overlay network can always keep connected. Therefore, in the PS6 algorithm, d is set to 5. This should be enough to prevent disconnection of the IPv6 overlay network. 5 Scalability Study During the transition from IPv4 to IPv6, isolated IPv6 islands will exist widely in the current IPv4 network. The PS6 algorithm must scale enough to support many IPv6 islands (i.e., 10,000). On the data plane, the forwarding performance with such a huge number of tunnels on each gateway should be considered. There are already plenty of studies on the area of fast data forwarding. A trie-tree [14] structure is used to form the Tunnel Table and limit the overhead of prefix lookup. On the control plane, the scalability of the IPv6 overlay network should be discussed. A flooding-based Unstructured P2P network (i.e., Gnutella [15]) may not be scalable because of the heavy flooding overhead cased by transient peers [15]. Fortunately, the edge gateways of IPv6 islands are much more stable, so the P2P network used in PS6 can support many more nodes. Since there is no consumed

8 Providing Reliable IPv6 Access Service Based on Overlay Network 1507 computing for each gateway upon receiving an update packet, the flooding overhead of the proposed P2P network scheme is mostly from the cost of network bandwidth. Assume the duration time that each node (IPv6 island gateway) stays connected to the IPv6 overlay network independently has an exponential distribution with parameter λ. Within one second, a single node is destroyed with probability 1-e -λ. When the node number of the IPv6 overlay network is N, the number of nodes failed in one second is expected to be N (1-e -λ ). And the expected size S of each update packet flooding inside the IPv6 overlay network is S 0 N (1-e -λ ), where S 0 indicates the size of each failure notice. According to the founding process of the IPv6 overlay network with minimal degree d, the neighbor number of node i is expected to be: E( n ) i N d d +,0 < i d + 1 l 1 l= d+ 2 = N d +, + 1 < d d i N l=+ i 1 l 1 From (1), we can see that the first d+1 nodes have the maximum neighbor number on average. These nodes may have more trouble with flooding. We consider the worst case that one of the first d+1 nodes receives the update packet from all its neighbors at the same time. Meanwhile, this node should forward the packet to all its neighbors after receiving it for the first time. In this case, the cost of network bandwidth of this node is expected to be: N 1 λ C = 2S max( E( ni )) = 2 ds0 N(1 + )(1 e ) (2) 0< i N l 1 l= d+ 2 Suppose that the bandwidths of the nodes are independent, and each can most spend 10% of its total bandwidth B on flooding control packets, we have the restriction: C B 10% (3) When B =10Mb/s, S 0 = 256bits, d =5, λ =1/1800 (the duration time of each node is 0.5 hour on average), from (2) and (3), the max node number that the IPv6 overlay network can support in worst case is This result shows that the P2P network used in PS6 scales enough to meet the scalability requirements during IPv6 transition. (1) 6 Conclusion In this paper, we present a peer-to-peer based method PS6 to provide IPv6 access service for isolated IPv6 islands. This algorithm distributes the traffic between IPv6 islands directly though IPv4 network and mitigates the burden of IPv6-relay gateways of service provider. The scalability of the proposed algorithm i also analyzed. The simulation results show that the P2P network can keep connected with the Random Recovery Scheme; and the theoretical analysis indicates that the PS6 algorithm can meet the scalability requirements during IPv6 transition. In other words, the proposed algorithm is reliable and scalable.

9 1508 X. Leng, J. Bi, and M. Zhang The PS6 algorithm inherits the advantages of IPv6 configured tunnel in control, management and security, gets the high access performance and mitigates the burden of relay gateways like 6to4. The comparison to the existing tunneling mechanisms that can be used in the IPv6 island scenario is shown in Table 2. The PS6 algorithm has better qualities in access performance, reliability and scalability as well as lower investment cost for IPv6 ISPs to provide feasible IPv6 access service, especially along with the increasing number of isolated IPv6 islands. Table 2. Comparison between PS6 and other tunneling mechanisms used for IPv6 islands H = High, M = Moderate, L = Low Performance Investment Reliability Scalability Drawbacks 1. Special 6to4 prefix 2. Difficult control and 6to4 H L H H management 3. Terrible security problems L H L L 1. Manual configure 2. That as TB 1. Single point of failure Tunnel L H L L 2.Communication Broker bottleneck Configured tunnel P6P L M H M PS6 H L H H 1. Low performance on route lookup 2. Low performance on data transmission Up to now, the architecture and protocol details of PS6 has been designed already. A prototype system has also been developed. In future, we will do some further study on more security considerations of this algorithm. Since the edge gateways of IPv6 islands are sometimes lightweight devices and cannot support the heavy overhead of an end-to-end security scheme IPSec between each pair of TEPs [16], the SPM [17] technology can be deployed to provide a lightweight security guarantee for data transmission. Besides, the robustness of the registration scheme should also be increased. The failure of the Registration Server may make it impossible for a new node to join the P2P network. Some backup scheme, for example, using multiple records for the same domain name of Registration Server in DNS, should be introduced into this algorithm. References 1. S. Deering, R. Hinden: Internet Protocol, version 6 (IPv6) specifications, RFC 2460, December E. Nordmark, R. Gilligan: Basic Transition Mechanisms for IPv6 Hosts and Routers, RFC 4213, October 2005.

10 Providing Reliable IPv6 Access Service Based on Overlay Network A. Oram: Peer-To-Peer: Harnessing the Power of Disruptive Technologies, O Reilly Press, Lidong Zhou, Robbert van Renesse: P6P: A Peer-to-Peer Approach to Internet Infrastructure, IPTPS 04, Ion Stoica, Robert Morris et al: Chord: A Scalable Peer-to-peer Lookup Service for Internet Applications, SIGCOM'01, F. Templin, T. Gleeson, M. Talwar, D. Thaler: Intra-Site Automatic Tunnel Addressing Protocol (ISATAP), draft-ietf-ngtrans-isatap-22, May, C. Huitema: Tunneling IPv6 over UDP through NATs(Teredo), draft-huitema-v6opsteredo-05, April 5, E. Davies, S. Krishnan, P. Savola: IPv6 Transition/Co-existence Security Considerations, draft-ietf-v6ops-security-overview-03, October B. Carpenter, K. Moore: Connection of IPv6 Domains via IPv4 Clouds, RFC 3056, February P. Savola, C. Patel: Security Considerations for 6to4, RFC 3964, December A. Durand, P. Fasano, D. Lento: IPv6 Tunnel Broker, RFC 3053, January Eng Keong Lua, Jon Crowcroft, Marcelo Pias: A Survey and Comparison of Peer-to-peer Overlay Network Schemes, IEEE Communications Surveys & Tutorials, Second Quarter, J. Moy: OSPF Version 2, RFC 2328, April Miguel A.Ruiz-Sanchez et al.: Survey and taxonomy of IP address lookup algorithms, IEEE Network March/April J. Guterman: Gnutella to the Rescue? Not so Fast, Napster fiends. Link to article at September R. Graveman, M. Parthasarathy, P. Savola, H. Tschofenig: Using IPsec to Secure IPv6-in- IPv4 Tunnels, draft-ietf-v6ops-ipsec-tunnels-01, August A. Bermlerand, H. Levy: Spoofing Prevention Method, INFOCOM 05, 2005.