Security Level Towards Software Defined ICN based Edge

Security Level: Towards Software Defined ICN based Edge Cloud Services IEEE, Cloud. Net, 2013 Ravindran, Xuan Liu, Asit Chakraborti, Xinwen Zhang, Guo-Qiang Wang (Huawei Research Lab, Santa Clara) Version: V 1. 0(20131109) HUAWEI TECHNOLOGIES CO. , LTD. www. huawei. com

ICN Motivation • About a ~2 years back, ICN-RG (IRTF Working Group) was formed, which made the term ICN official. – Umbrella of many protocols CCN/NDN, Mobility. First, Net. Inf, PSIRP etc. • ICN aims at making information as the waist rather than connectivity as in IP. • ICN is a unified platform which addresses several IP issues with Multicast, Multi-homing, Security, and Mobility. • But why Deploy it ? – New “Things”, Applications/Services – Connectivity: Adhoc + Infrastructure interactions, Multi-Cloud – Do things in an efficient and scalable manner than existing applications. • This paper focuses on a way Operators can gain from ICN.

Industry Trends and Opportunities Services/Applications Control Plane SDN Forwarding Plane Software (Network Functions) NFV Hardware Long Term Applications ICN (Adhoc/ Infrastru cture) Transport • De-coupling increases flexibility, encourages innovation and faster evolution. • Services/Applications will drive new technologies, same is the case for ICN too. • The SDN/NFV allows ICN introduction atleast in an experimental manner.

New Opportunity : NFV + SDN + ICN • NFV enables a platform to virtualize network functions. § Edge clouds are Closer to the users. § Service Virtualization, applications are tightly bound to service locators. • SDN drives service-centric network programmability. § Today realized as overlaid service engineering or at the edge (Data centers) • ICN inter-connects Consumers with Services at the information level, in a receiver-centric model. NFV enabled service virtualization, with SDN’s service-centric network programmability, and Information-Centric Service Connectivity can realize rich services. NFV: Service Virtualization Consumers ICN Services SDN : Servicecentric Network Programmability Creates a win-win model for both Operators and ASPs. HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential

ICN Edge Cloud Service : ICN Service Router Platform • A NFV-based ICN Platform to host several ICN Services • Envision a high performance ICN based router, with Virtualized Service Plugins • Software defined in the sense that service connectivity is managed by specific service controllers. • Supports both real-time and non-real time services, and multiple ICN protocols • Overlaid model, ICN service layer components extends to the User Entity. • Contextualized service delivery. HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 5

ICN Edge Cloud Service V 2 V ICN UNI-API ICN D 2 D ICN Service Router Software Defined: Service Driven Virtualiztion NFV Cloud ICN Service Router Enterprise NFV Cloud First Responder Services NFV Cloud Home Networks High Speed Optical NFV Cloud Enterprise • Targets natural Information-centric Applications: § § Io. T (V 2 V, Home Networks, Sensor Networks, . . ) Enterprise (Conferencing, WAN Optimization Solutions. . ) Web ( Video Distribution. . ) … HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 6 Home Networks

What are Information-Centric Applications ? Has Characteristics of : • Being Shareable § Versus Host-centric : ‘I can only trust information from a specific host/device/user’ § Location Independent Exploit these with Service Virtualization and Network Programmability • Transport Independent § Benefits from Name based routing § Mobility (Producer)/Multi-homing/Anycast • Leverage Network Caching § Multicast/Mobility (Consumer) • Content level Security § Rather than session level. HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 7

Comparing Service-Centric Protocols Service Layer Protocols Naming Name Resolution Heterogenous (Anycast, Routing, L 2 ) Application API Security Context/Service Orchestration Mobility ICN (CCN/NDN/Mobi lity. First/Net. Inf etc. ) (Cleanslate) Flexible (Flat, Hierarchical) Coupled/decoupled. Caching/Multic asting Transport Agnostic, highly adaptable (Ad hoc) (inherent features) Get ()/Put()/Intere st/Data (Receiver Oriented) Content Level Contextcentric/Service Composability/N atural Extension Besteffort/Late binding (control plane) SERVAL (Incremental*) Flat Service ID Online Resolution. No Caching Consideration Adaptation at SERVAL level Session based (TCP/UDP) Session Level (Segmented) No specific Consideration, but Locator/ID Split / IP Based Open. ADN (Incremental*) Application tag/Application Level Switching Online Resolution. No Caching Consideration Adaptation at Open. ADN Level (SDN) Session based (TCP/UDP) Session Level (Segmented) Application Meta -tags IP Based So. A (Web Services) (Deployed) URI/URL Service Broker/UDDI. Caching can be enabled Not Internetworking technology Session based (TCP/UDP) Connection level security (HTTPS, SSL/TLS) SOAP/Web Service Description Language (WSDL) IP Based HTTP (Deployed) URI/URL DNS / Reverse/Forward Proxy. Caching Enabled Application Specific/ IP Based Get()/Put()/SGet()/ Session based (TCP/UDP) Connection level security (HTTPS, SSL/TLS) So. A Based or Other Protocols IP Based (Princeton, Prof. Rexford) (Washington State. Univ. Prof. Raj Jain) (“http as a narrow Waist”, Prof. Ion Stoica) IP Based. Incremental* : Changes affects the client stack, and introduces new network functions HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 8

S-UNI Origin Service-1 Origin Service-2 Origin Service-3 ICN Service Gateway ICN Network Controller ICN Services ICN Service Profile Manager ICN Service Gateway SDN Components ICN Service Router ICN Service Controller ICN Service Router A-UNI NFV Platform Network Core ICN Network Controller NFV Platform ICN Service SAL. ICN Service Gateway App. ICN Cloud Orchestrat or ICN Controller ICN Service ICN Cloud Orchestrator ICN Service Controller -2 ICN Cloud Ochestrator ICN Service ICN-Edge Cloud Service: High Level View ICN Service Router ICN Cloud Orchestrat or

Interfaces and Functions : S-UNI A-UNI Users A-UNI : Service Discovery/Service Management /Service Contextualization/ Application Delivery (Interest/Data) S-UNI: Service Virtualization (Provisioning, Scaling)/ Service Monitoring ICN Service Control API: Service Event Processing (Context, Migration, ICN Flow handling. ) – Per ICN Service ICN Network Control API: Programming ICN Service Forwarding Policies/Transport Routing (e. g. configuring CCN FIBs) HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 10

Service Contextualization: ICN-UNI API (SAL-SAP) Service Adaptation through Contextualization and Service Orchestration HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 11

Scenario -1: Device Context Adaptation Video Client SAL Service Gateway Controller App. Video Service Controller App. Interest(/video-service/content/segment-x) Service Gateway Video Service Origin Video Service ICN Controller ICN Interest<service discovery, Attachment> Video Client ICN SAL Interest<service namespace, {service attributes}> Interest(service_gate way/migrate<{service attributes>/<migratio n_attributes>) NFV Cloud (Edge) ICN Platform Storage Service • • Service Composition : Interest(/video/content/{session _state}) Interest ( /video/content/{session_state}, {storage + transcoding}) Data(/video-service/content/segment-x) Interest(/video-service/content/segment-x) • • (Core) ICN Service Router Transcoding Service In this example user changes the device from the smart phone to a smart TV. The device simulataneosly signals the action to the service gateway and the peer device, the gateways forwards the control message to the Video Service Controller Application. The controller orchestrates a new service composing the fetching of video and real-time transcoding service. Here the service is virtualized among device applications.

Scenario-2: BYOD Enterprise Conferencing Push Notifications/Heartbeat/Recovery Conference Controller Content Interest/Data Conf Client SAL ICN Platform SAL Conf Client Conference Proxy ICN Service Gateway ICN Conf Client Conference Proxy ICN Platform Conf Client ICN SAL Conference Proxy ICN Platform ICN Service Gateway Conference Proxy Heterogeneou s Devices ICN Platform ICN Service Gateway • Here we realize instance of conference proxy’s per Enterprise site and one Conference Controller. • We implement Notification/Heartbeat/Recovery using “Push” model compared to “Pull” of Chrono. Sync [NDN, Tech Report]

Realizing Conferencing Service over ISR Sync Service Controller Sync Service proxy SC Legacy Router Cache PULL c ontent Cache Internet ISR on Push Notificati Sync Service proxy Legacy Router ISR Legacy Router UE 3 UE 1 Gateway UE 2 Gateway Step 1: PUB/SUB Content Step 2: Push Notification Step 3: Retrieve Content (Interest/Data Flow) ICN Service Router

Conference Design – User Equipment Content Interest/Data Push notification msgs Chat … VWB Other App Service API to Applications Internal flow Heartbeat signaling Other Service-related flows App-based Control Info Digest log Fingerprint Processor Cache Heartbeat Signal Processor Sync Service Client Service layer Cache ICN Layer Application layer Service API to App Other service management blocks L 2/L 3 Sycn Service Client Service Layer ICN Layer L 2/L 3 S-UNI (Data) S-UNI (Control) ICN-Enabled UE L 2/l 3 Access L 2/L 3 Access ISR Internet ISR SC

Conference Design – Conference Proxy/Controller Service Access Proxy Service 1 Access Proxy (VM 1) Service n Access Proxy (VMn) … Application Pool Service API to Applications Hypervisor App-based Control Info Digest log Heartbeat Signal Processor Fingerprint Processor Cache Other service management blocks Sync Service Proxy Application layer Service API to App Service layer ICN layer Sycn Service Client Cache L 2/L 3 Service Layer ICN Layer L 2/L 3 Interest/Data S-UNI ICN-Enabled UE L 2 Access S-NNI L 2 Access SRN Heartbeat signaling Push notification msgs Content Interest/Data Internal flow Internet SRN SC SRN • The controller design is similar to the conference proxy, except in the details of the digest tree it maintains.

Digest Tree & Log Example Current Digest Tree C P 1 U 1 dc 3 P 2 U 2 P 3 U 5 dp 1, 2 fp 1, 1 U 4 Logic connectivity at t 3 (steady state) Digest Tree Log New join at t 4 dp 2, 1 fp 2, 1 dc 3 dp 1, 2 fp 3, 1 dc 2 dp 2, 1 dc 1 dp 1, 1 dp 2, 1 dp 1, 1 fp 1, 0 fp 3, 0 fp 1, 1 New join at t 5 fp 1, 1 Current Digest @P 1 dp 1, 2 fp 1, 1 Log @ P 1 dr 1, 5 dc 3 fp 2, 1 Current Digest @P 2 dp 2, 1 fp 3, 1 dr 2, 4 dc 3 <dr 5> : <dp 1, 2, dc 3>: fp 2, 1 <dr 4> : <dp 1, 2, dc 2>: fp 2, 1 <dr 3> : <dp 1, 1, dc 2>: fp 3, 1 <dr 2> : <dp 1, 1, dc 1>: fp 1, 1 <dr 1> : <dp 1, 1, dc 0>: fp 1, 1 <dr 0> : <dp 1, 0, dc 0> Log @ P 2 <dr 4> : <dp 2, 1, dc 3>: fp 2, 1 <dr 3> : <dp 2, 1, dc 2>: fp 3, 1 <dr 2> : <dp 2, 1, dc 1>: fp 3, 1 <dr 1> : <dp 2, 0, dc 1>: fp 1, 1 <dr 0> : <dp 2, 0, dc 0>: fp 2, 1 Current Digest @ U 1 <dr 1, 5>, fp 2, 1 Current Digest @ U 3 <dr 2, 4>, fp 2, 1 fp 3, 1 Log @ U 1 dr 1, 5: fp 2, 1 dr 1, 4 : fp 2, 1 dr 1, 3 : fp 3, 1 dr 1, 2 : fp 1, 1 dr 1, 1 : fp 1, 1 dr 1, 0 : Log @ U 3 dr 2, 4: fp 2, 0 dr 2, 3: fp 3, 0 dr 2, 2 : fp 3, 0 dr 2, 1 : fp 1, 0 dr 2, 0 , : Current Digest @ U 2 <dr 5>, fp 2, 1 Log @ U 2 dr 5: fp 2, 1 dr 4: fp 2, 1 dr 3: fp 3, 1 dr 2: fp 1, 1 dr 1: fp 1, 1 dr 0 dc 0

Tracking the number of updates Hierarchical View of Connectivity C P 1 U 1 … … P 2 Um Um+1 The digest tree at time t at P 1 Pn Um+k dr 1, k dp 1, j fp 1, fp 1(t) … • Generic form of digest tree at a Sync Service Proxy (P 1) at time t– Steady State • The digest tree at the Sync Service Proxy has to track updates from both Sync Service Clients and the Sync Service Controller • Digest values at different levels of the digest tree are updated at different time • We use the subscripts to track the number of updates occurred. dcw fpm, fp 2(t) • The network load (for n updates) scales linearly with number of proxy nodes rather than O(n 2 ) in a peer-to-peer mode Local update state Remote update state

Simulation Evaluation HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 19

Simulation • Objective: To study the convergence time as we scale with number of participants and compare with peer-to -peer case. • Core Topology : Abilene and 3 x 3 Grid • Access Topology : 2 Level Tree Topology • Parameters § # of participants : 60 -300 § Poisson Content Generation (0. 510)contents/sec § Core link Capacity : 1 -5 Gbps § Core Link propagation delay : 10 ms • P 2 P Case: Simple 3 User Case. HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 20

1 Convergence time 2 3 Single Update Convergence • Fig. 1. & 2 corresponds to two topologies, shows convergence among all participant. • Fig. 3, shows multiple update convergence. Notifications and content convergence is deterministic. • Participants in the same cluster synchronize faster than remote clusters HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 21

Scaling Number of Participants • The scenarios with 50 and 100 participants are invariant to Content Generation rate. • In the 300 case, the access link capacity begins to get congested, hence the convergence time increases. HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 22

Varying Content Generation Rate and Network Conditions • Here the Link capacity is set to 0. 1 Gpbs. • The content rate causes proportional increase in data traffic, hence the convergence time increases. HUAWEI TECHNOLOGIES CO. , LTD. • The convergence time improves as long as the capacity of the network link is planned correctly. Huawei Confidential Page 23

Peer-to-Peer Conferencing Case: • Here the Participants synchronize through pulling information over a name space. • In-determinants : Multiple Updates, Exclusion of multiple contents to same name, Rate of Interest expression, • High control overhead to improve convergence time, but doesn’t require a control infrastructure. HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 24

Conclusions • ICN based Service Layer a possible way to introduce ICN into Operator’s domain. • Can Leverage all ICN features : Name based Routing, Multicasting, Security, Mobility Handling. • Combined with NFV and SDN allows to achieve the goal of true Service Centric Networking. • Platform suitable for ICN applications: Conferencing, Io. T/M 2 M, Video Multicasting. • Conferencing can be enabled as a VNF over the platform. • Showed through simulation analysis the scalability of the conferencing framework. • We are prototyping this platform, hope to share our experience on this in the future. . ! HUAWEI TECHNOLOGIES CO. , LTD. Huawei Confidential Page 25

Thank you www. huawei. com Copyright© 2011 Huawei Technologies Co. , Ltd. All Rights Reserved. The information in this document may contain predictive statements including, without limitation, statements regarding the future financial and operating results, future product portfolio, new technology, etc. There a number of factors that could cause actual results and developments to differ materially from those expressed or implied in the predictive statements. Therefore, such information is provided for reference purpose only and constitutes neither an offer nor an acceptance. Huawei may change the information at any time without notice.