Petri Jokela

LIPSIN: line speed publish/subscribe inter-networking

A large fraction of todays Internet applications are internally publish/subscribe in nature; the current architecture makes it cumbersome and inept to support them. In essence, supporting efficient publish/subscribe requires data-oriented naming, efficient multicast, and in-network caching. Deployment of native IP-based multicast has failed, and overlay-based multicast systems are inherently inefficient. We surmise that scalable and efficient publish/subscribe will require substantial architectural changes, such as moving from endpoint-oriented systems to information-centric architectures. In this paper, we propose a novel multicast forwarding fabric, suitable for large-scale topic-based publish/subscribe. Due to very simple forwarding decisions and small forwarding tables, the fabric may be more energy efficient than the currently used ones. To understand the limitations and potential, we provide efficiency and scalability analysis via simulations and early measurements from our two implementations. We show that the system scales up to metropolitan WAN sizes, and we discuss how to interconnect separate networks.

Self-Routing Denial-of-Service Resistant Capabilities Using In-packet Bloom Filters

In this paper, we propose and analyze an in-packet Bloom-filter-based source-routing architecture resistant to Distributed Denial-of-Service attacks. The approach is based on forwarding identifiers that act simultaneously as path designators, i.e. define which path the packet should take, and as capabilities, i.e. effectively allowing the forwarding nodes along the path to enforce a security policy where only explicitly authorized packets are forwarded. The compact representation is based on a small Bloom filter whose candidate elements (i.e. link names) are dynamically computed at packet forwarding time using a loosely synchronized time-based shared secret and additional in-packet flow information (e.g., invariant packet contents). The capabilities are thus expirable and flow-dependent, but do not require any per-flow network state or memory look-ups, which have been traded-off for additional, though amenable, per-packet computation. Our preliminary security analysis suggests that the self-routing capabilities can be an effective building block towards DDoS-resistant network architectures.

Handover performance with HIP and MIPv6

Mobility management in the current Internet is designed to work with mobile IPv4 and, when IPv6 is available, with mobile IPv6. These solutions are based on the current architecture in the Internet, where the IP address represents both the locator and the identifier of the node. In the IETF, identity and location information separation has raised a lot of discussion and new ideas have emerged to separate these. Host identity protocol is one candidate that can be used for this separation. It introduces also a new way of handling mobility management taking advantage on the mentioned identity and location separation.

MPSS: Multiprotocol Stateless Switching

The Multiprotocol Label Switching (MPLS) architecture has become a true success story in the world of telecommunications. However, MPLS becomes cumbersome if multicast communication is needed, as aggregating of labels is not easy. Because of that, when providing Multicast VPNs, operators need to trade-off bandwidth usage with the amount of multicast state, sacrificing efficiency. Forwarding with Bloom filters in the packet headers offers the opportunity to have quasi-stateless network elements; the amount of forwarding plane state does not depend on the number of paths/trees the node participates in. In this paper, we propose Multiprotocol Stateless Switching (MPSS), the marriage of MPLS and Bloom filter based forwarding. The forwarding architecture inherits the flexibility of MPLS and gives operators the opportunity to offer Multicast VPN services while avoiding the difficult process of fine-tuning the trade-off between bandwidth usage and state.

Autonomicity in Virtual Private Network provisioning for enterprises

Large enterprises usually require Virtual Private Network (VPN) services provisioned by the network operator. Also, there is an emerging need for supporting multicast communications, i.e. one host communicate with other hosts located in multiple remote sites. While MPLS-based IP VPNs are proven to be scalable, current approaches for extending it with multicast features involve potential state explosion, some bandwidth inefficiencies in the operator network or complex management tasks to find a good balance between forwarding state and bandwidth usage. These properties are direct consequences of the current MPLS and network-layer multicast forwarding approaches, as state should be maintained in the forwarding plane for each tree in each intermediate node. In this paper, we build on a stateless Bloom-filter-based forwarding plane installed in the service providers network. By moving the state into the packet headers from the nodes, new trade-offs appear due to the probabilistic nature of Bloom filters. We highlight autonomic scenarios, such as self-configuration of addresses, resource management in the network, simple autonomic provisioning of dynamic multicast trees and self-optimization of forwarding performance.