IET Talk: TSSG Model & Future Internet and IPv6

Future Internet • TSSG Background • IPv6 -‐ Near Term Future Internet • IPv6 -‐ TSSG Deployment & Research • Future Internet -‐ Clean Slate – Was planning to talk about this – TSSG doing some work EU FP7 4WARD – But I have removed this element of the talk

TSSG Executive Management • Willie Donnelly – Director, TSSG • Mícheál Ó Foghlú – ExecuSve Director Research, TSSG • Barry Downes – ExecuSve Director InnovaSon & CommercialisaSon, TSSG • Eamonn de Leastar – CTO, TSSG

TSSG Balanced EcoSystem Commercial Commercial The Entrepreneur TSSG Basic Research Basic Research The Science Applied Research Applied Research The Engineering

TSSG Funded Projects Total Projects 127 projects of which TSSG led 71 % AcAve Projects Jan 2010 28 projects Completed Projects Jan 2010 99 projects Average project = €440k, Total = €56 Million 1996-‐2009 Staﬀ number = 140 (20 PhDs, 5 Faculty, 12 Postdocs) Spin-‐in/Spin-‐Out company job number = 60 Partners = 150 academic & industrial partners working on funded projects Enterprise Ireland InnovaAon Partnerships = 50 from 2007-‐2009 * * Not counted as projects -‐ small scale €5k engagements with Irish SMEs

TSSG Funding Mix !"#$% Balanced Portfolio &' 0(1 &2' () *+' ./) *&' (, -&' Total: €56 M Funding (1996 – 2010) Total: 127 Projects

TSSG Positioning • Basic Research (HEA, SFI)  One of TOP 3 academic centre's in Ireland in telecommunicaSons: WIT (TSSG), TCD (CTVR), DCU (RINCE) • Applied Research (EU FP7)  Irish winner of EU FP7 funding -‐ twice nearest compeStor  Ranked Top 10 insAtute in Europe in Future Internet research (i.e. on a par with Nokia, Ericsson, FhG FOKUS)  Engaged in many EU Technology Placorms at board level (eMobility, NEM, NESSI)

TSSG Positioning Contd… • CommercialisaAon (EI)  One of the top research groups for commercialisaAon  Leading edge innovaSon & technology development in:  IMS  Web 2.0  Mobile Commercial ‘Spin-‐oﬀs’ (Separate from TSSG)  Early stage technology clusters emerging based around TSSG  60 jobs created in 14 ‘Spin-‐Out’ and ‘Spin-‐In’ companies linked to TSSG (since 2001)  ConSnue to develop other companies in the marketplace

TSSG Research & Innovation Philosophy • Research and innovaAon is non-‐linear: good ideas come from ALL parts of an ecosystem -‐ requiring a balance of funding to maintain the flow of the ecosystem • Equal value across all parts of ecosystem: basic research, applied research, and commercialisaAon, build experSse in VC funding and following stages • Build research teams: uSlise non-‐tradiSonal staff (professional researchers) in applied and commercial research -‐ fight academic norms/assumpSons

Stokes’ Pasteur’s Quadrant A detailed Analysis of Vannevar Bush, NSF, OECD FrascaS and other ways in which basic and applied research have been split by funding mechanisms, to the detriment of technological innovaAon. Stokes, Donald E. [1997] Pasteur's Quadrant: Basic Science and Technological Innovation. Washington D.C., USA: Brookings Institution Press.

Stokes’ Pasteur’s Quadrant Considerations for Use ? No Yes Yes Pure Basic Use-‐Inspired Research Basic Research Quest for (Bohr) (Pasteur) Fundamental understanding? No Pure Applied Research Taxonomies and Tools Researchers are the users (Edison) (Adapted from Pasteur’s Quadrant: Basic Science and Technological Innovation, Stokes 1997, p. 73).

IPv6 -‐ Near Term Future Internet

Future Internet • Near Term – We have to move from IPv4 to IPv6 as this talk will explain • Longer Term – There is a lot of room for academic research into alternaSves to IP, but it will take 10 years or more to agree and then maybe another 10 to implement • Remember IP is 40 years old now, but only took oﬀ from the 1990s as the web popularised IP outside of academia and of specialist IT companies

IPv4 Exhaustion - Summary • There are around 4.3 billion IPv4 addresses 232 not all of which can actually be used • There are over 6 billion people • As countries develop it is typical for each person to have mulSple devices requiring addresses • There are more and more other services linking machines to machines that also require addresses • Therefore there are not enough IPv4 addresses • There are 2128 IPv6 addresses, this is deﬁnitely enough

Shape of IPv4 Originally, three classes of network were "good enough" ...but not for long

Class B Exhaustion Workarounds were needed Short term – Classless Inter-‐domain RouSng (CIDR) • ﬁner tuned allocaSon – Encourage private addresses (RFC1918) and NAT • avoid allocaSon – RIRs enter conservaSon mode • minimise allocaSon Long Term – New protocol with bigger address space

Workarounds: CIDR CIDR took the reigns oﬀ the subnet masks Address space now "shrinks to ﬁt” each network. Address Netmask Hosts 193.1.219.90 255.255.0.0 655342 255.255.255.252 255.255.255.248 6 255.255.255.240 14 255.255.255.224 30 255.255.255.192 62 255.255.255.128 126 255.255.255.0 254 255.255.254.0 510 255.255.252.0 1022 255.255.248.0 2046 255.255.240.0 4094 255.255.224.0 8190 255.255.192.0 16382 255.255.128.0 32766

Success of the Workarounds • So IPv4 addresses have a smaller address range than IPv6, but the life of IPv4 has been extended by: – CIDR – NAT

End of the road for Workarounds • But sSll, there is huge demand for more IPv4 addresses: – many new wireline connecSons as broadband penetrates new markets – many new wireless data access connecSons as mobile broadband picks up – many new mobile devices on the Internet, smart phones are becoming the norm – the promised new “Internet of things” where many more embedded devices have wired and wireless Internet connecSvity (e.g. mulSple electrical devices in houses and oﬃces) – every IPv4 SSL web server needs a unique IPv4 address – many geographical regions of the world (especially in Asia with later uptake of IPv4 and huge populaSons – China and India) have a much higher demand for new IPv4 addresses than we have in Europe • So… When will we run out ? ….

IPv4: How long have we got? • Tony Hain reckons 2010 (IANA /8 Pool will run out) – htp://www.cisco.com/en/US/about/ac123/ac147/archived_issues/ipj_8-‐ 3/ipv4.html • Geoff Huston reckons (*) 25 September 2011 (IANA /8 Pool will run out) – htp://www.potaroo.net/tools/ipv4/index.html “Here the exhausSon point is the date where the first RIR has exhausted its available pool of addresses, and no further numbers are available in the IANA unallocated pool to replenish the RIR's pool. The data available suggests a best fit predicSve model where this will occur on 11-‐Oct-‐2010. A related predicSon is the exhausSon of the IANA unallocated number pool, which this model predicts will occur on 25-‐Sep-‐2011.” (*) Huston’s model dynamically updated -‐ these figures taken 2010-‐02-‐24

Consensus on IPv4 exhaustion began to be reached in 2007 • On May 21, 2007, the American Registry for Internet Numbers (ARIN), the North American RIR, advised the internet community that due to the expected exhausSon in 2010 "migraSon to IPv6 numbering resources is necessary for any applicaSons which require ongoing availability from ARIN of conSguous IP numbering resources". It should be noted that "applicaSons" include general connecSvity between devices on the Internet, as some devices only have an IPv6 address allocated. • On June 20, 2007, the LaSn American and Caribbean Internet Addresses Registry (LACNIC), the South American RIR, advised "preparing its regional networks for IPv6" by January 1, 2011 for the exhausSon of IPv4 addresses "in three years Sme". • On June 26, 2007, the Asia-‐Paciﬁc Network InformaSon Centre (APNIC), the RIR for the Paciﬁc and Asia, endorsed a statement by the Japan Network InformaSon Center (JPNIC) that to conSnue the expansion and development of the Internet a move towards an IPv6-‐based Internet is advised. This with an eye on the expected exhausSon around 2010 which will create a great restricSon on the Internet.

IPv4: How Long do we have when the /8 pool is gone? • In reality this depends on unpredictable factors – The policies will probably get Sghter – There will probably be a rush – Something else could blow it apart – Note that economic crisis has slowed consumpSon of IPv4 address pool slightly giving us maybe 6-‐12 months longer than Tony Hain predicted in 2005

IPv4 Addresses are Running Out The Internet Protocol Journal -‐ Volume 8, Number 3, September 2005 A PragmaAc Report on IPv4 Address Space ConsumpAon by Tony Hain, Cisco Systems • Network Address TranslaAon (NAT) and CIDR did their jobs and bought the 10 years needed to get IPv6 standards and products developed. Now is the Ame to recognize the end to sustainable growth of the IPv4-‐based Internet has arrived and that it is Ame to move on. IPv6 is ready as the successor, so the gaAng issue is aotude. • When CIOs make firm decisions to deploy IPv6, the process is fairly straighcorward. Staff will need to be trained, management tools will need to be enhanced, routers and operaAng systems will need to be updated, and IPv6-‐enabled versions of applicaAons will need to be deployed. All these steps will take Ame—in many cases mulAple years. • The point of this arAcle has been to show that the recent consumpAon rates of IPv4 will not be sustainable from the central pool beyond this decade, so organizaAons would be wise to start the process of planning for an IPv6 deployment now. Those who delay may find that the IANA pool for IPv4 has run dry before they have completed their move to IPv6. Although that may not be a problem for most, organizaAons that need to acquire addiAonal IPv4 space to conAnue growing during the transiAon could be out of luck. hqp://www.cisco.com/en/US/about/ac123/ac147/archived_issues/ipj_8-‐3/ipv4.html

Comments on IPv6 Adoption • CAIDA (CooperaAve AssociaAon for Internet Data Analysis) – in UCSD/SDSC graphs indicate that IPv6 internet in 2005 is as complex as IPv4 internet in 2000 – htp://www.caida.org/home/ • So the topology of IPv6 is already as complex as IPv4 was at the height of the dot com boom • But, admitedly, IPv6 is sSll less than 1% of all IP traﬃc in the world today (topology good, traﬃc volumes not so good) • More promising, the allocaSon of IPv6 address space has been picking up in 2009, it had been very slow up unSl then • So we have missed the window of being able to do dual-‐stack IPv4 and IPv6 on all machines, as IPv4 will be in too short supply -‐-‐ so the change over will be more painful and later than originally planned by IETF

4th March 2005 IPv6 Topology (CAIDA.org)

IPv4 Historical Development April 2005 April 2003 April 2002 October 2000 January 2000 July 2001

Example IPv6 Address • IPv6 = 128 bit address (3.4 x 1038 max possible) • IPv4 = 32 bit address (4,294,967,296 max possible) • 2001:0db8:0010:0300:0000:0000:0ae2:510b – Long version. • 2001:db8:10:300:0:0:ae2:510b – Omit leading zeros. • 2001:db8:10:300::ae2:510b – Replace run of zeros with :: • 2001:db8:10:300::10:226:81:11 – Can write end as IPv4 address.

Dual stacking & DNS IPv4 uses A records IPv6 uses AAAA records |p.heanet.ie IN A 193.1.193.64 |p.heanet.ie IN AAAA 2001:770:18:aa40::c101:c140 Client atempts IPv6 ﬁrst (AAAA record) and if that fails, IPv4 (A record) AutomaSc transiSon to IPv6

IPv4 Workaround Impacts (Private Address Space) • Beneﬁts of private addresses have been exploited for IT security – Internal hosts are not directly addressable, therefore only reachable indirectly – Enforces a central point of administraSon – NAT used as "poor man's ﬁrewall" to disallow new connecSons inward

The Cost of Private Addressing (NAT) • NAT also provides a way of preserving IPv4 Address Space, at a price – Large number of private address spaces – Each set of private addresses funnelled via a “middle box” a Network Address TranslaSon gateway, to the real Internet – The NAT box needs to modify addresses embedded in every packet as it traverses the gateway – inefficient/CPU intensive – The NAT box breaks the original end-‐to-‐end model of the Internet making it very difficult for machines behind a NAT gateway to offer services to other machines on the Internet (hobbling peer-‐2-‐peer for example) -‐ inelegant – ApplicaSons developers are then forced to find workarounds at the higher layers of the stack for NAT problems, e.g. the use of STUN with VoIP to allow p2p traffic – inefficient to have to solve the same problem repeatedly

The Cost of Private Addressing (NAT) • AddiSonal problems with the use of NAT – It hurts security (yes, really!) e.g. your whole company/campus is blacklisted due to one user misbehaving – It's extra hassle to avoid leaks – It's bad news if networks merge (and they use the same private IP space)

The side benefit of large address space – IPv6 uses 264 addresses on a link instead of usually less than 28 for IPv4 – Aqacks based on simply scanning a whole network – would need years for performing it – would thereby consume a massive bandwidth on the scanned link – are therefore no longer appropriate – However one needs to take care about the addressing of server (use of arbitrary idenSﬁers) one needs to secure neighbour discovery messages

Cryptographically Generated Addresses – IPv6 addresses, which carry hashed informaAon about public key in the idenAfier part – Benefits CerSficate funcSonality without requiring a key management infrastructure SoluSon for securing IPv6 Neighbour Discovery (resolve chicken-‐egg problem of IPsec) Cryptographically Generated Address Subnet prefix (64 bit) CGA specific ID (64 bit) Hash of sender public key

Traceability of (mobile) users In stateless IPv6 address autoconfiguraAon idenAfiers can be derived from HW (staAc part in address) Does this mean that I‘m traceable (locaAon, sites visited, …)? • IPv6 supports also random idenSfiers for privacy reasons • These random idenSfiers are default se~ng in some operaSng systems Random or static Subnet prefix (64 bit) identifier (64 bit)

Disappearance of NATs Without NAT boxes my home / company devices will have public addresses Does this mean that I’m easily reachable from outside and therefore also more affected by aqacks? – NO, as NAT boxes do not give any security or privacy. – A (host) firewall can effecSvely shield parts which should not be reachable from outside. – Even more, a firewall can provide applicaSon layer security, a NAT box can not – BUT NAT by default denys access -‐-‐ a good thing in general FW FW Internet Company A Company B Global Addresses Public Address A Public Address B

Privacy • IPv6 has a real privacy protocol • IPv4 has no real privacy protocol • Network elements based on IPv4 need to be protected by ﬁrewalls, cable modems are a classic example, whereas IPv6 equivalents can be much more secure

IPv6 Services • Technically there’s no huge advantage for any IP-‐ based services to use IPv6 over IPv4. • The beneﬁts come from the broader infrastructural argument relaSng to the end-‐to-‐end architecture.

IPv6 Services • This is most important when looking at potenSal peer-‐2-‐peer services such as VoIP – In an IPv4 world you need a SIP gateway and a media gateway to setup a VoIP call using SIP – the media gateway allows connecSvity through NAT gateways, and transfers signalling between different types (e.g. SS7 to IP); SIP gateway more like a firewall than NAT – In an IPv6 world the SIP signalling negoSates a media stream that then can flow directly between the two clients – This the IMS architecture itself is simplified for many services using IPv6 • As developers there is no major overhead in developing dual stack applicaSons • Thus those developing services for the next generaSon internet should develop dual stack applicaSons that support IPv4 and IPv6

IPv6 - TSSG Deployment & Research IPv6 -‐ TSSG Deployment & Research

TSSG/WIT IPv6 allocations Currently running: 2 /48s 2001:770:20::/48 and 2001:770:**::/48 (darknet) 1 /48 used entirely as a darknet 1 /48 subnetted into 4 /50s 3 /50s in use 1 /50 initial darknet - now re-routed to external research network 6 /64s in use (research, Internet routed) 1 /50 production n/w + routed links (WIT) 2 /64s in use 1 /50 production n/w (TSSG) 11 /64s in use (production) 16 /64s in use (research, Internet routed) 1 additional /64 on our co-location LAN extension

IPv6 Networking • In the TSSG all our networks are dual-‐stacked, unless there is a specific reason not to. • Routed uplinks and producSon servers are assigned staSc IPv6 addresses. All other devices obtain auto-‐generated IPv6 addresses. • We use ACLs to strictly limit inbound traffic to all our networks, except the Darknet of course. • All outbound traffic is allowed and a reflexive rule is associated with each outbound session so the return traffic is allowed back in. • We originally use a combinaSon of staSc IPv6 routes and OSPFv3 for our IPv6 rouSng; now we use IS-‐IS as our primary rouSng protocol. • We have found that running IPv6 does not add any more complexity to network design or layout. It does however introduce more security issues and can make troubleshooSng more difficult. Hence the need for monitoring and tracking. • The restoraSon of the End-‐to-‐End model, whilst welcome, eliminates the “auto-‐secure” or unreachable by default protecSon of NAT/PAT.

Network & Host Monitoring • Open source tools like Nagios and Smokeping can be used to monitor network and host availability and reliability over IPv6. • Ntop provides detailed network traﬃc analysis (if an uplink port is tap’d / span’d). • However these tools only provide rudimentary informaSon and can’t really tell you what is happening on your network. • We now use Ne€low (v9) from Cisco devices to capture and log all IPv4 and IPv6 headers

Security and traffic monitoring • IniSally no commercial security or monitoring products. Some open source products but implementaSons were poor and badly maintained. No real demand. • US Department of Defense decree of full IPv6 support by July 2008 in July 2005 has improved this situaSon. • Commercial products are now becoming available with full IPv6 support for monitoring and security reporSng.

Static Vs Dynamic addresses • In the TSSG we use staSc addresses for all our servers and routed uplink interfaces. • We use dynamic address on most networks for client devices and on internal vlan interfaces. • We use the router to allocate the dynamic addresses • We do not use dynamic DNS.

Services: DNS • DNS Primary and Secondary hot-swap – DNS External 1st (bind9 on Linux ubuntu, HEAnet) – DNS External 2nd (bind9 on Solaris 10 zone, TSSG) • ns.tssg.org round robins over – ns1.tssg.org - Waterford (Solaris 10 zone, TSSG) • IPv6 enabled – ns2.tssg.org - Frankfurt (BSD Virtual Private Server, NTT Verio) • Not IPv6, yet – ns3.tssg.org - Virginia (BSD Virtual Private Server, NTT Verio) • Not IPv6, yet – ns4.tssg.org - Tokyo (BSD Virtual Private Server, NTT Verio) • IPv6 enabled

Services: Mail, Web • Mail – Software: postﬁx 2.2.8 – OS: Sun Solaris – Location: internally hosted in TSSG • Web – Software: Apache 2.2.0 – OS: Linux ubuntu – Location: externally hosted in HEAnet – Note: Acts as host for many virtual domains (from www.ofoghlu.net to www.ipv6.ie )

Research Older: EU FP5 and earlier • Converge (TSR Strand III) – Security, Quality of Service and AccounSng for next generaSon IPv6 services • Torrent (EU FP5 IST) – Use of IPv6 for Secure Provision of ISP Services • Intermon (EU FP5 IST) – Inter-‐domain Quality of Service for IPv4 and IPv6 networks and services • SEINIT (EU FP6 IST) – Security for next generaSon IPv6 networks and services • IPv6 Cluster (EU FP5 IST) – EU-‐sponsored coordinaSon acSvity bring together all EU IST FP5 projects promoSng or using IPv6

Research Recent: EU FP6, HEA, SFI – Daidalos I & Daidalos II (EU FP6 IST) • Scenario-‐based next generaSon pervasive services based on IPv6 – M-‐Zones (HEA PRTLI Cycle 3) • Managed Zones of Smart Spaces – managing next generaSon pervasive services – FoundaAons of Autonomics (SFI PI Cluster) • Modelling communicaSons networks and services to enable autonomic network & service management – ENABLE (EU FP6 IST) • Enabling eﬃcient and operaSonal mobility in large heterogeneous IP networks (built on mobile IPv6)

Research Current: EU FP7 • Autonomic CommunicaSons – 4WARD [IP FP7 ICT Call 1] – EFIPSANS [IP FP7 ICT Call 1] – AutoI [STREP FP7 ICT Call 1] • Services – PERSIST [STREP FP7 ICT Call 1] • Security – Inco-‐Trust [CA FP7 ICT Call 1] – Think-‐Trust [CA FP7 ICT Call 1] • Testbeds – PII [IP FP7 ICT Call 2] – Perimeter [STREP FP7 ICT Call 2] – VITAL++ [STREP FP7 ICT Call 2]

Research Current: HEA & Other – HEA FutureComm (PRTLI Cycle 4) • Partnered with NUI Maynooth and University of Limerick – SFI SRC FAME • Partnered with TCD, UCD, NUIM and UCC – NaAonal IPv6 Centre (DCMNR) • Partnered with NUI Maynooth, HEAnet and BT Ireland – Irish NaAonal IPv6 Task Force (DCMNR/DCENR) • Promote IPv6 in Ireland • htp://www.ipv6.ie

Irish IPv6 Summit: Event Plug • NaSonal IPv6 Summit • Wed 19th May 2010 • Dublin Castle, Dublin, Ireland • Keynote speakers: Brian Carpenter (University of Auckland) and Geoﬀ Huston (APNIC) • Panelists/Speakers: Dennis Jennings (ICANN), Daniel Karrenberg (ISOC and RIPE), Mat Ford (ISOC) • RegistraSons opening in March – htp://www.ipv6.ie/summit2010 (website launch soon) – htp://www.ipv6.ie/summit2009 (view last year’s)

Questions? • Happy to answer any quesSons

Contact Details Mícheál Ó Foghlú TSSG Oﬃces: ExecuAve Director Research TSSG (Waterford, Ireland) Headquarters TSSG, WIT ArcLabs Research & InnovaSon Building mofoghlu@tssg.org WIT West Campus, Carriganore +353 51 302963 (w) Co. Waterford, Ireland +353 86 8044640 (m) TSSG (California, USA) Investment/VC Network 101 California Street Barry Downes Suite 2450 ExecuAve Director 3CS San Francisco TSSG, WIT CA 94111 , USA bdownes@tssg.org +353 51 302932 (w) TSSG (Dublin, Ireland) Customer MeeAngs +353 87 9075535 (m) Digital Depot, Roe Lane The Digital Hub Dublin 8, Ireland

http://www.ofoghlu.net	185
http://www.slideshare.net	3
http://ofoghlu.net	1

IET Talk: TSSG Model & Future Internet and IPv6

by Mícheál Ó Foghlú on Feb 26, 2010

Accessibility

Categories

Tags

Upload Details

Usage Rights

3 Embeds 189

Statistics

IET Talk: TSSG Model & Future Internet and IPv6 — Presentation Transcript