FIA-CCN原版完整课件

NetworkingNamedContentVanJacobson,DianaK.Smetters,JamesD.Thornton,MichaelF.Plass,NicholasH.Briggs,RebeccaL.BraynardCoNEXT2009PresentedbyYeTianforCourseCS05112OverviewMotivationandIntroductionCCNNodeModelTransportRoutingContent-basedSecurityEvaluationReviewMotivationNetworkusehasevolvedsinceIPwasdesignedUsageoftheInternetisintermsofwhatnotwhereIssues:Availability:awkward,pre-planned,application-specificmechanismsarerequired.Example:P2P,CDN.Security:Trustincontentiseasilymisplaced,relyingonuntrustworthylocationandconnectioninformation.Location-dependence:Mappingcontenttohostlocationscomplicatesconfigurationaswellasimplementation.AttackDNS.MotivationEvolutionaryapproaches:IPv6IPSecMobileIPDiffServDHTIntroductionHost-CentricNetworkingIn1960’sand1970’s–resourcesharingComputers,diskdrives,tapedrives,printersetc.neededtobesharedThisleadintoacommunicationmodelwithtwomachines–oneusingandoneprovidingresourcesoverthenetworkIPpacketswithsourceanddestinationMostofthetrafficisTCPconnectionsIntroductionContent-CentricNetworking(CCN)In2009alone500exabytes(5x1020B)ofcontentcreated.Usersareinterestedinwhatcontent–notwhereitisCCN–acommunicationarchitecturebuiltonnameddata“Address”namescontent–notlocationPreservethedesigndecisionsthatmakeTCP/IPsimple,robustandscalableIntroductionFromIPtochunksofnamedcontentOnlylayer3requiresuniversalagreementOverviewMotivationCCNNodeModelTransportRoutingContent-basedSecurityEvaluationReviewCCNNodeModelTwopackettypes:InterestandDataCCNNodeModelConsumerbroadcastsitsInterestoverallavailableconnectivityDataistransmittedonlyinresponsetoInterestandconsumesthatInterestDatasatisfiesanInterestifContentNameintheInterestisaprefixofthatintheData,e.g.,Interest:cn/edu/ustc/cs/Data:cn/edu/ustc/cs/welcome.msgCCNNodeModelCCNnodehas3components:FIB,ContentStoreandPITFIB:Forwardingtable,allowsmultipleoutputfacesContentStore:Buffer,alsocachesDatapacketsPIT:PendingInterestTableCCNNodeModelCCNNodeModelNameprefixFacelistNexthopCostcn/edu/ustc/1Bcn/edu/ustc/2Ccn/edu/ustc/cs/1BExampleFIB:ExamplePIT:InterestRequestingFacescn/edu/ustc/badge.jpg3cn/edu/ustc/cs/welcome.msg34CCNNodeModelProcessinganInterest:MatchingDataisfoundintheContentStore

=>senditandconsumeInterestPendingInterestinPIT

=>addthisfacetoRequestingFaceslistUseFIBtoforwardInterestonoutgoingfaces,addtoPITProcessingData:DatafollowsachainofPITentriesbacktothesourceDuplicateandunsolicitedDataisdiscardedCCNNodeModelCCNNodeModelFIBallowsalistofoutgoinginterfaces–multiplesourcesofdataEachPITentryisa“breadcrumb”markingthepathandiserasedafterit’sbeenusedPITkeepstrackofInterestforwardedup-stream=>DatacanbesentdownstreamInterestpacketsareroutedupstream–DatapacketsfollowthesamepathdownContentStorew/LRUorLFUreplacementOverviewMotivationCCNNodeModelTransportRoutingContent-basedSecurityEvaluationReviewTransportCCNtransportisdesignedtooperateonunreliablepacketdeliveryservicesSendersarestatelessDonotrememberwhichDatahasbeensentout.ReceiverskeeptrackofunsatisfiedInterestsandaskagainafteratime-outThereceiver’sstrategylayerisresponsibleforretransmission,selectingfaces,limitingthenumberofunsatisfiedInterests,priorityOneInterestretrievesatmostoneDatapacket=>flowbalanceTransport:FlowFlowbalanceallowsforefficientcommunicationbetweenmachineswithhighlydifferentspeedsInCCN,allcommunicationislocalandflowbalanceismaintainedovereachhopThisleadsintoend-to-endflowcontrolwithoutanyend-to-endmechanismsTransport:NamingCCNisbasedonhierarchical,aggregatablenamesatleastpartlymeaningfultohumansThenamenotationusedislikeURITransport:NamingAnInterestcanspecifythecontentexactlyContentnamescancontainautomaticallygeneratedendingsusedlikesequencenumbersThelastpartofthenameisincrementedforthenextchunk(e.g.avideoframe)ThenamesformatreewhichistraversedinpreorderInthisway,thereceivercanaskforthenextDatapacketinhisInterestpacketOverviewMotivationCCNNodeModelTransportRoutingContent-basedSecurityEvaluationReviewRouting:Intra-DomainRoutingLikeIPv4andIPv6addresses,CCNContentNamesareaggregateableandroutedbasedonlongestmatchHowever,ContentNamesareofvaryinglengthandlongerthanIPaddressesTheTLV(TypeLabelValue)ofOSPForIS-IScandistributeCCNcontentprefixesTherefore,CCNInterest/DataforwardingcanbebuiltonexistinginfrastructurewithoutanymodificationtotheroutersRouting:Intra-DomainRoutingAnexampleofintra-domainroutingRouting:Inter-DomainRoutingThecurrentBGPversionhastheequivalentoftheIGPTLVmechanismThroughthismechanism,itispossibletolearnwhichdomainsserveInterestsinsomeprefixandwhatistheclosestCCN-capabledomainonthepathstowardsthosedomainsTherefore,itispossibletodeployCCNintheexistingBGPinfrastructureOverviewMotivationCCNNodeModelTransportRoutingContent-basedSecurityEvaluationReviewContent-basedSecurityInCCN,thecontentitself(ratherthanitspath)isprotectedOnecanretrievethecontentfromtheclosestsourceandvalidateitAllcontentisdigitallysignedSignedinfoincludeshashofthepublickeyusedforsigningWestillneedsomekindofaPublicKeyInfrastructure(PKI)Content-basedSecurityAssociatingnamespaceswithpublickeysKeyforauthorizingthatofusergeorge,whothenauthorizesthekeyforhisdesktopcomputer.OverviewMotivationCCNNodeModelTransportRoutingContent-basedSecurityEvaluationReviewEvaluationTheCCNarchitecturedescribedhasbeenimplementedandevaluatedVoiceoverCCNandContentDistributionweretestedwithsmallnetworksTheresultsareinterestingbutdon’treallytellusanythingaboutthescalabilityofthedesignEvaluation:DataTransferDownloadaHTMLfileContenttransferviaCCNisalwayssecure,yettheresultsshowthatitmatchestheperformanceofunsecuredHTTPandsubstantiallyoutperformssecureHTTPS.UDPhaslargerpayloadthanETHEvaluation:DataTransferTransfera6MBfileasafunctionofthewindowsize(TCP)andnumberofoutstandingInterests(CCN).BulkdatatransferefficiencyofCCNiscomparabletoTCPbutlowerduetoitslargerheaderoverhead.Evaluation:ContentDistributionAsourcenodeconnectedovera10Mbpssharedlinktoaclusterof6sinknodesallinterconnectedvia1Gbpslinks.Themachineswereofvariousarchitectures(Intel,AMD,PowerPCG5)andoperatingsystems(MacOSX10.5.8,FreeBSD7.2,NetBSD5.0.1,Linux2.6.27).Thesinkssimultaneouslypulleda6MBdatafilefromthesource.FortheTCPteststhisfilewasmadeavailableviaanhttpserveronthesourceandretrievedbythesinksusingcurl.Evaluation:ContentDistributionEvaluation:Voice-over-CCNExploittwoproperties:CansendInterestoutmultiplefacesACCNnodeisguaranteedtoseetheDatasentinresponsetoitsInterestThestrategylayertorunexperimentswhereanInterestisoccasionallysentoutallfacesassociatedwiththeprefix.Ifafacerespondsfasterthanthecurrentbest,itwillbecomethenewbestandbeusedexclusivelyfortheprefix’sInterests,untilitistimeforthenextexperiment.Evaluation:Voice-over-CCNSecureVoiceoverCCNwasimplementedusingLinphone3.0anditsperformanceevaluatedPacketizeaudiointo20msframessoaudioactivityresultedinaconstant50ppsRTPpackets.Nopacketswerelostbyeitherclient,howeverasmallnumberofVoCCNpackets(<0.1%)weredroppedforarrivingtoolate.Evaluation:Voice-over-CCN45sec.,unpluglinkA82sec.,disconnectlinkBStrategylayerswitchtolinkALostdataonlinkBretrievedfromlinkATrafficremainonlinkAevenlinkBisreconnectedat95sec.120sec.,disconnectlinkASwitchtolinkBDiscussionMeritsofCCNVeryunderstandableschemeShowntoworkalsowithstreamedmediaCleverreuseofexistingmechanis