Towards a Common System Architecture for Dynamically Deploying Network Services in Routers and End Hosts

摘要

The architectural simplicity of the core Internet is a double-edged sword. On the one hand, its agnostic nature paved the way for endless innovations of end-to-end applications. On the other hand, the inherent limitation of this simplicity makes it difficult to add new functions to the network core itself. This is exacerbated by the conservative tendency of commercial entities to "leave well-enough alone", leading to the current situation often referred to as the ossification of the Internet. For decades, there has been practically no new functionality that has been added to the core Internet on a large scale. This thesis explores the possibility of enabling in-network services towards the goal of overcoming the ossification of the Internet. Our ultimate goal is to provide a common run-time environment supported by all Internet nodes and a wide-area deployment mechanism, so that network services can be freely installed, removed, and migrated among Internet nodes of all kinds–from a backbone router to a set-top box at home. In that vision of a future Internet, there is little difference between servers and routers for the purpose of running network services. Services can run anywhere on the Internet. Application service providers will have the freedom to choose the best place to run their code. This thesis presents NetServ, our first step to realize the vision of network services running anywhere on the Internet. NetServ is a node architecture for dynamically deploying in-network services on edge routers. Network functions and applications are implemented as software modules which can be deployed at any NetServ-enabled node on the Internet, subject to policy restrictions. The NetServ framework provides a common execution environment for service modules and the ability to dynamically install and remove the services without restarting the nodes. There are many challenges in designing such a system. The main contribution of this thesis lies in meeting those challenges. First, we recognize that the primary impetus for adopting new technologies is economics. To address the challenge of providing economic incentives for enabling in-network services, we demonstrate how NetServ can facilitate an economic alliance between content providers and ISPs. Using NetServ, content providers and the ISPs operating at the network edge (aka eyeball ISPs) can enter into a mutually beneficial economic relationship. ISPs make their NetServ-enabled edge routers available for hosting content providers' applications and contents. Content providers can operate closer to end users by deploying code modules on NetServ-enabled edge routers. We make our case by presenting NetServ applications which represent four concrete use cases. Second, our node architecture must support both traditional server applications and in-network packet processing applications since content providers' applications running on ISPs' routers will combine the traits of both. To address this challenge, NetServ framework can host a packet processing module that sits in the data path, a server module that uses the TCP/IP stack in the traditional way, or a combined module that does both. NetServ provides a unified runtime environment between routers and servers, taking us a step closer to the vision of the unified runtime available on all Internet nodes. Third, we must provide a fast and streamlined deployment mechanism. Content providers should be able to deploy their applications at any NetServ-enabled edge router on the Inter- net, given that they have proper authorizations. Moreover, in some application scenarios, content providers may not know the exact locations of the target routers. Content providers need a way to send a message to install or remove an application module towards a network destination, and have the NetServ-enabled routers located in the path catch and act on the message. To address this challenge, we adopted on-path signaling as the deployment mechanism for NetServ. A NetServ signaling message is sent in an IP packet towards a destination. The packet gets forwarded by IP routers as usual, but when it transits a NetServ-enabled router, the message gets intercepted and passed to the NetServ control layer. Fourth, a NetServ-enabled router must support the concurrent executions of multiple without restarting the nodes. There are many challenges in designing such a system. The main contribution of this thesis lies in meeting those challenges. First, we recognize that the primary impetus for adopting new technologies is economics. To address the challenge of providing economic incentives for enabling in-network services, we demonstrate how NetServ can facilitate an economic alliance between content providers and ISPs. Using NetServ, content providers and the ISPs operating at the network edge (aka eyeball ISPs) can enter into a mutually beneficial economic relationship. ISPs make their NetServ-enabled edge routers available for hosting content providers' applications and contents. Content providers can operate closer to end users by deploying code modules on NetServ-enabled edge routers. We make our case by presenting NetServ applications which represent four concrete use cases. Second, our node architecture must support both traditional server applications and in-network packet processing applications since content providers' applications running on ISPs' routers will combine the traits of both. To address this challenge, NetServ framework can host a packet processing module that sits in the data path, a server module that uses the TCP/IP stack in the traditional way, or a combined module that does both. NetServ provides a unified runtime environment between routers and servers, taking us a step closer to the vision of the unified runtime available on all Internet nodes. Third, we must provide a fast and streamlined deployment mechanism. Content providers should be able to deploy their applications at any NetServ-enabled edge router on the Internet, given that they have proper authorizations. Moreover, in some application scenarios, content providers may not know the exact locations of the target routers. Content providers need a way to send a message to install or remove an application module towards a network destination, and have the NetServ-enabled routers located in the path catch and act on the message. To address this challenge, we adopted on-path signaling as the deployment mechanism for NetServ. A NetServ signaling message is sent in an IP packet towards a destination. The packet gets forwarded by IP routers as usual, but when it transits a NetServ-enabled router, the message gets intercepted and passed to the NetServ control layer. Fourth, a NetServ-enabled router must support the concurrent executions of multiple content providers' applications. Each content provider's execution environment must be isolated from one another, and the resource usage of each must be controlled. To address the challenge of providing a robust multi-user execution environment, we chose to run NetServ modules in user space. This is in stark contrast to most programmable routers, which run service modules in kernel space for fast packet processing. Furthermore, NetServ modules are written in Java and run in Java Virtual Machines (JVMs). Our choice of user space execution and JVM allows us to leverage the decades of technology advances in operating systems, virtualization, and Java. Lastly, in order to host the services of a large number of content providers, NetServ must be able to scale beyond the single-box architecture. We address this challenge with the multi-box lateral expansion of NetServ using the OpenFlow forwarding engine. In this extended architecture, multiple NetServ nodes are attached to an OpenFlow switch, which provides a physically separate forwarding plane. The scalability of user services is no longer limited to a single NetServ box. Additionally, this thesis presents our prior work on improving service discovery in local and global networks. The service discovery work makes indirect contribution because the limitations of local and overlay networks encountered during those studies eventually led us to investigate in-network services, which resulted in NetServ. Specifically, we investigate the issues involved in bootstrapping large-scale structured overlay networks, present a tool to merge service announcements from multiple local networks, and propose an enhancement to structured overlay networks using link-local multicast.