SlideShare a Scribd company logo
1 of 25
Download to read offline
Enabling Active Flow Manipulation In 
Silicon-based Network Forwarding 
Engines 
May 28-29, 2002 1 
Tal Lavian - tlavian@ieee.org 
Nortel Networks 
Advanced Technology Labs 
Open Source - http://www.openetlab.org 
DANCE Exposition
• AN technologies => Real Network Devices 
• Main thrust of the paper 
• Commercial Active Nets Platform 
• Application Example 1 – SSL 
• Application Example 2 – ASF 
• Next Generation AN Platform 
• Conclusion 
May 28-29, 2002 2 
Outline of the talk 
DANCE Exposition
May 28-29, 2002 3 
AN Technology Transfer 
DANCE Exposition 
Active Nets Community 
Realistic 
Mechanisms 
Great Ideas 
Usable/Realizable 
Mechanisms/Products 
Active Nets Community 
Active Nets 
Ideas 
Active Nets 
Ideas 
Real AN 
Network 
Products 
Internet
Great Active Nets CCoommmmuunniittyy SSoolluuttiioonnss 
• Active networks (AN) approach opens an exciting 
opportunity for individual applications to define the 
service provided by the network through 
programmability. 
• Active Networks technologies expose a novel approach that 
allows customer value-added services to be introduced to the 
network “on-the-fly”. 
• Active Nets program has produced a new network platform 
flexible and extensible at runtime to accommodate the rapid 
evolution and deployment of network technologies. 
• The exciting opportunity exists for network service providers and 
third parties, not just the network device providers, to program 
the network infrastructure and services. 
May 28-29, 2002 4 
DANCE Exposition
Lack of industrial-strength Active Network 
devices that dispel major concerns: 
May 28-29, 2002 5 
DANCE Exposition 
AANN iissssuueess 
• AN requires substantial supports from a NOS 
• AN introduces substantial software component, 
hence delay on the data path 
• AN lacks adequate measures to addressing integrity 
and security of network devices.
May 28-29, 2002 6 
Main contributions of the paper 
• Active Flow Manipulation Concept 
DANCE Exposition 
— Flow abstraction 
— Actions on Flows 
— Control/Data separation 
• Openet Platform 
— Commercial Network Devices 
— Runtime Environment 
— Active Services 
• Applications
May 28-29, 2002 7 
Openet: An active service platform 
User Oplets 
ORE JFWD 
CPU 
JNI/Native Code 
Monitor status 
DANCE Exposition 
JVM 
MEM … 
Filtered packets New forwarding rules 
Forwarding Engine 
OpletService, 
Shell, Logger 
Jcapture, HTTP, 
IpPacket 
Standard Services 
ANTS 
Application services Firewall, DiffServ 
Function Services 
Control Plane 
Data Plane
May 28-29, 2002 8 
Active Flow Manipulation 
DANCE Exposition 
Forwarding 
Processor 
Forwarding 
Processor 
Packet 
Policy 
Filters 
AFM 
Packet 
Filte 
r 
Packet 
Action 
• A key enabling 
technology of 
Openet 
• Two abstractions 
— Primitive flows 
— Primitive actions 
• Customer network 
services exercise 
active network 
control 
— Identifying specific flows 
— Apply actions to alter 
network behavior in real-time
May 28-29, 2002 9 
Openet Alteon Active Nets Platform 
= A Powerful Platform for AN 
Technologies Transfer 
DANCE Exposition 
• A powerful and 
extensible control 
and computational 
plane 
— Partitioning 
hardware/software 
resources 
— Active service enabling 
— Content filtering in real-time 
— Active services 
accommodation 
Optical 
Wireless 
Active 
Services 
router Content 
gateway 
Edge Device 
Content 
Aware 
Computation 
Power 
Dynamic 
Service Enabling
Nortel Networks’ contributions to 
Active Networks 
• Practical Active Networks Architecture on real 
network device. 
• First Commercial Active Networks platform. 
May 28-29, 2002 10 
DANCE Exposition
May 28-29, 2002 11 
Any AN products? 
DANCE Exposition 
Active Nets Community 
Active Nets Community 
Active Nets 
Ideas 
Active Nets 
Ideas 
Realistic 
Mechanisms 
Experimental/Laboratory 
Platforms 
Commercial AN Platform? 
? 
Nortel Networks 
AN Products 
SSSSLL AASSFF IDIDSS VVPPNN
• Client sends an HTTPS request 
• Switch redirects request on port 
443 to iSD-SSL 
• iSD-SSL completes SSL 
handshake 
• iSD-SSL initiates HTTP connection 
to server on port 80 
• Switch selects real server based 
on configured LB policy 
• Server responds to HTTP request 
and replies to the iSD-SSL 
• iSD-SSL encrypts session and 
sends HTTPS response to client 
HTTPS, SMTP-S, POP3-S and IMAP-S services 
May 28-29, 2002 12 
SSL Acceleration 
How Does the iiSSDD--SSSSLL AAcccceelleerraattoorr wwoorrkk?? 
DANCE Exposition
May 28-29, 2002 13 
Client And Server Authentication 
DANCE Exposition 
1 User opens session 
2 Sends server certificate 
Requests client certificate 3 
Serves request/response 
7 
Send encrypted data to back 
6 end 
Validates the client certificate info. 
5 
Private key 
Confidential 
4 
Client sends the certificate with public key 
Public key 
Published
May 28-29, 2002 14 
ASF – Alteon Switched Firewall 
DANCE Exposition
Relate AFS to AN Technology 
• The Alteon selectively redirects new 
connection requests to the Alteon Switched 
Firewall Director to perform policy checking. 
• The Director runs the Check Point FireWall-1 
engine as an Active Service. 
• The Active Service manages the connection 
table, specifies rules for handling packets in 
the session, passes the connection table to the 
Alteon Switched Accelerator. 
• 90% of traffic is accelerated, supporting a 
throughput of 3.2 Gbps. 
May 28-29, 2002 15 
DANCE Exposition
Alteon Security Cluster 
Acceleration and intelligent integration of security applications 
Single point of secure central management 
IDS IDS 
URL 
Filtering 
Virus 
Scan 
Nortel Appliance Acceleration Protocol 
(Enables application control of switch sessions) 
May 28-29, 2002 16 
BBI, CLI, SSI, Plug and Play 
DANCE Exposition 
Application Plane 
Security Appliance 
NAAP 
Control Plane 
Controller of accelerated 
sessions 
Management Plane 
IDS IDS IDS 
Fir Fi Firewall 
SSL SSL SSL 
Security Accelerator 
Data Plane 
Switch based acceleration of 
session data 
Fir Fi VPNs 
SSL SSL
May 28-29, 2002 17 
DANCE Exposition 
What next?
iSD 
iSD 
May 28-29, 2002 18 
Disaster Recovery concept 
OmniNet Control Plane 
DANCE Exposition 
Control 
Mesg 
8600 
8600 
OmniNet 
8600 
10G 
10G 
10G 
iSD 
1G 
1G 
1G 
A B 
C 
D 
X 
Y 
Z 
B2 
B3 
[Linux] 
TL1 
Alteon 
Alteon 
Alteon 
EvaQ8 
OG - 1 
EvaQ8 
OG -2 
EvaQ8 
OG - 3 
1. Normal App flow : Client X -> Server Z 
2. Disaster Strikes at Location Z 
3. EvaQ8 OG 3 sends a signal[RSVP] to 
OG1 
4. OG1 instructs Omnit net to connect B2 
& B3 ; Server Z and Server Y data 
syncd 
5. On successful sync, OG2 instructs 
OmniNet to connect B1->B2. 
6. Service Restored for Client X ->server 
Y 
Disaster Event/ 
Environ. Sensor 
B1 
Control 
Mesg
May 28-29, 2002 19 
What next? Quotes from VIPs 
DANCE Exposition
Service-centric Active Nets Platform 
May 28-29, 2002 20 
What after next? 
DANCE Exposition 
Manage 
Service 
Enabling 
SERVICES 
Control 
Matching 
Impedance 
Intra-Service 
Comm 
Security 
• Service Enabling API 
• Control API 
• Impedance Matching API 
• Security API 
• Management API 
• Intra-service Communications API
May 28-29, 2002 21 
DANCE Exposition 
Summary 
• AN Technologies Transfer => Nortel AN 
Platform 
• New AN platform: Openet + Alteon + iSD 
— Alteon: AN platform advanced content filtering 
— iSD: powerful & extensible computation plane 
• Important Applications 
• Impact of AN on next generation networks
OpenetLab – Nortel Networks: http://www.openetlab.org/ 
May 28-29, 2002 22 
QQ&&AA 
DANCE Exposition
May 28-29, 2002 23 
BBaacckkuupp SSlliiddeess 
DANCE Exposition
May 28-29, 2002 25 
Secure XL & NAAP in Action 
TCP session 
Alteon Switched Firewall (ASF) 
5 
Update 
Conn. 
DANCE Exposition 
1 SYN 
Policy 
Check 
1 
1 
Add 
Conn. 
(F2F) 
1 
2 SYN/ACK 
3 
Update 
Conn. 
6 
4 TCP 3-way handshake complete, data for the session accelerated 
5 FIN-1 
6 FIN-2 
7 ACK 
Update 
Conn. 
Delete 
Conn. 
7 
Clients 
Servers 
3 ACK 
(TCP 3-way 
handshake 
complete)
New Focus on Integrated 
Management and Flow 
Application Clusters 
SSL FW VPN IDS Virus 
• Shift from physical management to logical management 
• Central management of multiple services 
May 28-29, 2002 27 
Intelligent Flow Management 
Security Dashboard 
• Plug and play simplicity and scalability 
DANCE Exposition 
Scanning 
URL 
SSL FW VPN IDS Virus Filtering 
Scanning 
URL 
SSL FW VPN IDS Virus Filtering 
Scanning 
URL 
SSL FW VPN IDS Virus Filtering 
Scanning 
URL 
SSL FW VPN IDS Virus Filtering 
Scanning 
URL 
SSL FW VPN IDS Virus Filtering 
Scanning 
URL 
Filtering

More Related Content

What's hot

Introduction to SDN
Introduction to SDNIntroduction to SDN
Introduction to SDNNetCraftsmen
 
Active Nets Technology Transfer through High-Performance Network Devices
Active Nets Technology Transfer through High-Performance Network DevicesActive Nets Technology Transfer through High-Performance Network Devices
Active Nets Technology Transfer through High-Performance Network DevicesTal Lavian Ph.D.
 
OpenContrail Silicon Valley Meetup Aug 25 2015
OpenContrail Silicon Valley Meetup Aug 25 2015OpenContrail Silicon Valley Meetup Aug 25 2015
OpenContrail Silicon Valley Meetup Aug 25 2015Scott Sneddon
 
Industrial Internet of Things: Protocols an Standards
Industrial Internet of Things: Protocols an StandardsIndustrial Internet of Things: Protocols an Standards
Industrial Internet of Things: Protocols an StandardsJavier Povedano
 
System integration in offshore supply vessels – how we applied DDS and redefi...
System integration in offshore supply vessels – how we applied DDS and redefi...System integration in offshore supply vessels – how we applied DDS and redefi...
System integration in offshore supply vessels – how we applied DDS and redefi...Real-Time Innovations (RTI)
 
443029825 cloud-computing-week8-9-pptx
443029825 cloud-computing-week8-9-pptx443029825 cloud-computing-week8-9-pptx
443029825 cloud-computing-week8-9-pptxAbdulqader Al-kaboudei
 
The Inside Story: Leveraging the IIC's Industrial Internet Security Framework
The Inside Story: Leveraging the IIC's Industrial Internet Security FrameworkThe Inside Story: Leveraging the IIC's Industrial Internet Security Framework
The Inside Story: Leveraging the IIC's Industrial Internet Security FrameworkReal-Time Innovations (RTI)
 
Disaggregated Networking - The Drivers, the Software & The High Availability
Disaggregated Networking - The Drivers, the Software & The High AvailabilityDisaggregated Networking - The Drivers, the Software & The High Availability
Disaggregated Networking - The Drivers, the Software & The High AvailabilityOpen Networking Summit
 
btNOG 5: Network Automation
btNOG 5: Network AutomationbtNOG 5: Network Automation
btNOG 5: Network AutomationAPNIC
 
Upgrade Your System’s Security - Making the Jump from Connext DDS Professiona...
Upgrade Your System’s Security - Making the Jump from Connext DDS Professiona...Upgrade Your System’s Security - Making the Jump from Connext DDS Professiona...
Upgrade Your System’s Security - Making the Jump from Connext DDS Professiona...Real-Time Innovations (RTI)
 
Next Steps in the SDN/OpenFlow Network Innovation
Next Steps in the SDN/OpenFlow Network InnovationNext Steps in the SDN/OpenFlow Network Innovation
Next Steps in the SDN/OpenFlow Network InnovationOpen Networking Summits
 
OpenStack and the Transformation of the Data Center - Lew Tucker
OpenStack and the Transformation of the Data Center - Lew TuckerOpenStack and the Transformation of the Data Center - Lew Tucker
OpenStack and the Transformation of the Data Center - Lew TuckerLew Tucker
 
How to Design Distributed Robotic Control Systems
How to Design Distributed Robotic Control SystemsHow to Design Distributed Robotic Control Systems
How to Design Distributed Robotic Control SystemsReal-Time Innovations (RTI)
 
How APIs are Transforming Cisco Solutions and Catalyzing an Innovation Ecosystem
How APIs are Transforming Cisco Solutions and Catalyzing an Innovation EcosystemHow APIs are Transforming Cisco Solutions and Catalyzing an Innovation Ecosystem
How APIs are Transforming Cisco Solutions and Catalyzing an Innovation EcosystemCisco DevNet
 
LF_DPDK17_DPDK on Microsoft Azure
LF_DPDK17_DPDK on Microsoft AzureLF_DPDK17_DPDK on Microsoft Azure
LF_DPDK17_DPDK on Microsoft AzureLF_DPDK
 
The Juniper SDN Landscape
The Juniper SDN LandscapeThe Juniper SDN Landscape
The Juniper SDN LandscapeChris Jones
 

What's hot (20)

Introduction to SDN
Introduction to SDNIntroduction to SDN
Introduction to SDN
 
Active Nets Technology Transfer through High-Performance Network Devices
Active Nets Technology Transfer through High-Performance Network DevicesActive Nets Technology Transfer through High-Performance Network Devices
Active Nets Technology Transfer through High-Performance Network Devices
 
TechTalk: Connext DDS 5.2.
TechTalk: Connext DDS 5.2.TechTalk: Connext DDS 5.2.
TechTalk: Connext DDS 5.2.
 
OpenContrail Silicon Valley Meetup Aug 25 2015
OpenContrail Silicon Valley Meetup Aug 25 2015OpenContrail Silicon Valley Meetup Aug 25 2015
OpenContrail Silicon Valley Meetup Aug 25 2015
 
Industrial Internet of Things: Protocols an Standards
Industrial Internet of Things: Protocols an StandardsIndustrial Internet of Things: Protocols an Standards
Industrial Internet of Things: Protocols an Standards
 
System integration in offshore supply vessels – how we applied DDS and redefi...
System integration in offshore supply vessels – how we applied DDS and redefi...System integration in offshore supply vessels – how we applied DDS and redefi...
System integration in offshore supply vessels – how we applied DDS and redefi...
 
443029825 cloud-computing-week8-9-pptx
443029825 cloud-computing-week8-9-pptx443029825 cloud-computing-week8-9-pptx
443029825 cloud-computing-week8-9-pptx
 
The Inside Story: Leveraging the IIC's Industrial Internet Security Framework
The Inside Story: Leveraging the IIC's Industrial Internet Security FrameworkThe Inside Story: Leveraging the IIC's Industrial Internet Security Framework
The Inside Story: Leveraging the IIC's Industrial Internet Security Framework
 
Disaggregated Networking - The Drivers, the Software & The High Availability
Disaggregated Networking - The Drivers, the Software & The High AvailabilityDisaggregated Networking - The Drivers, the Software & The High Availability
Disaggregated Networking - The Drivers, the Software & The High Availability
 
btNOG 5: Network Automation
btNOG 5: Network AutomationbtNOG 5: Network Automation
btNOG 5: Network Automation
 
Upgrade Your System’s Security - Making the Jump from Connext DDS Professiona...
Upgrade Your System’s Security - Making the Jump from Connext DDS Professiona...Upgrade Your System’s Security - Making the Jump from Connext DDS Professiona...
Upgrade Your System’s Security - Making the Jump from Connext DDS Professiona...
 
Next Steps in the SDN/OpenFlow Network Innovation
Next Steps in the SDN/OpenFlow Network InnovationNext Steps in the SDN/OpenFlow Network Innovation
Next Steps in the SDN/OpenFlow Network Innovation
 
How to Cut $2 Million of Your Safety Cert Costs
How to Cut $2 Million of Your Safety Cert CostsHow to Cut $2 Million of Your Safety Cert Costs
How to Cut $2 Million of Your Safety Cert Costs
 
OpenStack and the Transformation of the Data Center - Lew Tucker
OpenStack and the Transformation of the Data Center - Lew TuckerOpenStack and the Transformation of the Data Center - Lew Tucker
OpenStack and the Transformation of the Data Center - Lew Tucker
 
how to simulate ACI
how to simulate ACIhow to simulate ACI
how to simulate ACI
 
How to Design Distributed Robotic Control Systems
How to Design Distributed Robotic Control SystemsHow to Design Distributed Robotic Control Systems
How to Design Distributed Robotic Control Systems
 
How APIs are Transforming Cisco Solutions and Catalyzing an Innovation Ecosystem
How APIs are Transforming Cisco Solutions and Catalyzing an Innovation EcosystemHow APIs are Transforming Cisco Solutions and Catalyzing an Innovation Ecosystem
How APIs are Transforming Cisco Solutions and Catalyzing an Innovation Ecosystem
 
Open Programmability
Open ProgrammabilityOpen Programmability
Open Programmability
 
LF_DPDK17_DPDK on Microsoft Azure
LF_DPDK17_DPDK on Microsoft AzureLF_DPDK17_DPDK on Microsoft Azure
LF_DPDK17_DPDK on Microsoft Azure
 
The Juniper SDN Landscape
The Juniper SDN LandscapeThe Juniper SDN Landscape
The Juniper SDN Landscape
 

Similar to Enabling Active Flow Manipulation In Silicon-based Network Forwarding Engines

Enabling Active Flow Manipulation In Silicon-based Network Forwarding Engines
Enabling Active Flow Manipulation In Silicon-based Network Forwarding EnginesEnabling Active Flow Manipulation In Silicon-based Network Forwarding Engines
Enabling Active Flow Manipulation In Silicon-based Network Forwarding EnginesTal Lavian Ph.D.
 
Edge Device Multi-unicasting for Video Streaming
Edge Device Multi-unicasting for Video StreamingEdge Device Multi-unicasting for Video Streaming
Edge Device Multi-unicasting for Video StreamingTal Lavian Ph.D.
 
Banv meetup 04162014
Banv meetup 04162014Banv meetup 04162014
Banv meetup 04162014ozkan01
 
Weaving the Future - Enable Networks to Be More Agile for Services
Weaving the Future - Enable Networks to Be More Agile for ServicesWeaving the Future - Enable Networks to Be More Agile for Services
Weaving the Future - Enable Networks to Be More Agile for ServicesHuawei Enterprise Hong Kong
 
Open Networking through Programmability
Open Networking through ProgrammabilityOpen Networking through Programmability
Open Networking through ProgrammabilityTal Lavian Ph.D.
 
Weaving the Future - Enable Networks to Be More Agile for Services
Weaving the Future - Enable Networks to Be More Agile for ServicesWeaving the Future - Enable Networks to Be More Agile for Services
Weaving the Future - Enable Networks to Be More Agile for ServicesHuawei Enterprise Hong Kong
 
Banv meetup-contrail
Banv meetup-contrailBanv meetup-contrail
Banv meetup-contrailnvirters
 
Software Define Network, a new security paradigm ?
Software Define Network, a new security paradigm ?Software Define Network, a new security paradigm ?
Software Define Network, a new security paradigm ?Jean-Marc ANDRE
 
OVNC 2015-Enabling Software-Defined Transformation of Service Provider Networks
OVNC 2015-Enabling Software-Defined Transformation of Service Provider NetworksOVNC 2015-Enabling Software-Defined Transformation of Service Provider Networks
OVNC 2015-Enabling Software-Defined Transformation of Service Provider NetworksNAIM Networks, Inc.
 
Can’t Wait for 2020: Future-Proof Your Grid Today
Can’t Wait for 2020: Future-Proof Your Grid TodayCan’t Wait for 2020: Future-Proof Your Grid Today
Can’t Wait for 2020: Future-Proof Your Grid TodayEchelon Corporation
 
Innovation in SDN Tools and Platforms
Innovation in SDN Tools and PlatformsInnovation in SDN Tools and Platforms
Innovation in SDN Tools and PlatformsUmesh Krishnaswamy
 
Leveraging the strength of OSGi to deliver a convergent IoT Ecosystem - O Log...
Leveraging the strength of OSGi to deliver a convergent IoT Ecosystem - O Log...Leveraging the strength of OSGi to deliver a convergent IoT Ecosystem - O Log...
Leveraging the strength of OSGi to deliver a convergent IoT Ecosystem - O Log...mfrancis
 
Nfd18 anuta-networks
Nfd18 anuta-networksNfd18 anuta-networks
Nfd18 anuta-networksKiran Sirupa
 
All Things Open SDN, NFV and Open Daylight
All Things Open SDN, NFV and Open Daylight All Things Open SDN, NFV and Open Daylight
All Things Open SDN, NFV and Open Daylight Mark Hinkle
 
SDN - a new security paradigm?
SDN - a new security paradigm?SDN - a new security paradigm?
SDN - a new security paradigm?Sophos Benelux
 
Radisys/Wind River: The Telcom Cloud - Deployment Strategies: SDN/NFV and Vir...
Radisys/Wind River: The Telcom Cloud - Deployment Strategies: SDN/NFV and Vir...Radisys/Wind River: The Telcom Cloud - Deployment Strategies: SDN/NFV and Vir...
Radisys/Wind River: The Telcom Cloud - Deployment Strategies: SDN/NFV and Vir...Radisys Corporation
 
SDN 101: Software Defined Networking Course - Sameh Zaghloul/IBM - 2014
SDN 101: Software Defined Networking Course - Sameh Zaghloul/IBM - 2014SDN 101: Software Defined Networking Course - Sameh Zaghloul/IBM - 2014
SDN 101: Software Defined Networking Course - Sameh Zaghloul/IBM - 2014SAMeh Zaghloul
 
Future Internet: Managing Innovation and Testbed
Future Internet: Managing Innovation and TestbedFuture Internet: Managing Innovation and Testbed
Future Internet: Managing Innovation and TestbedShinji Shimojo
 

Similar to Enabling Active Flow Manipulation In Silicon-based Network Forwarding Engines (20)

Enabling Active Flow Manipulation In Silicon-based Network Forwarding Engines
Enabling Active Flow Manipulation In Silicon-based Network Forwarding EnginesEnabling Active Flow Manipulation In Silicon-based Network Forwarding Engines
Enabling Active Flow Manipulation In Silicon-based Network Forwarding Engines
 
Edge Device Multi-unicasting for Video Streaming
Edge Device Multi-unicasting for Video StreamingEdge Device Multi-unicasting for Video Streaming
Edge Device Multi-unicasting for Video Streaming
 
Banv meetup 04162014
Banv meetup 04162014Banv meetup 04162014
Banv meetup 04162014
 
Weaving the Future - Enable Networks to Be More Agile for Services
Weaving the Future - Enable Networks to Be More Agile for ServicesWeaving the Future - Enable Networks to Be More Agile for Services
Weaving the Future - Enable Networks to Be More Agile for Services
 
Open Networking through Programmability
Open Networking through ProgrammabilityOpen Networking through Programmability
Open Networking through Programmability
 
Weaving the Future - Enable Networks to Be More Agile for Services
Weaving the Future - Enable Networks to Be More Agile for ServicesWeaving the Future - Enable Networks to Be More Agile for Services
Weaving the Future - Enable Networks to Be More Agile for Services
 
Banv meetup-contrail
Banv meetup-contrailBanv meetup-contrail
Banv meetup-contrail
 
Software Define Network, a new security paradigm ?
Software Define Network, a new security paradigm ?Software Define Network, a new security paradigm ?
Software Define Network, a new security paradigm ?
 
OVNC 2015-Enabling Software-Defined Transformation of Service Provider Networks
OVNC 2015-Enabling Software-Defined Transformation of Service Provider NetworksOVNC 2015-Enabling Software-Defined Transformation of Service Provider Networks
OVNC 2015-Enabling Software-Defined Transformation of Service Provider Networks
 
Can’t Wait for 2020: Future-Proof Your Grid Today
Can’t Wait for 2020: Future-Proof Your Grid TodayCan’t Wait for 2020: Future-Proof Your Grid Today
Can’t Wait for 2020: Future-Proof Your Grid Today
 
Innovation in SDN Tools and Platforms
Innovation in SDN Tools and PlatformsInnovation in SDN Tools and Platforms
Innovation in SDN Tools and Platforms
 
Leveraging the strength of OSGi to deliver a convergent IoT Ecosystem - O Log...
Leveraging the strength of OSGi to deliver a convergent IoT Ecosystem - O Log...Leveraging the strength of OSGi to deliver a convergent IoT Ecosystem - O Log...
Leveraging the strength of OSGi to deliver a convergent IoT Ecosystem - O Log...
 
Nfd18 anuta-networks
Nfd18 anuta-networksNfd18 anuta-networks
Nfd18 anuta-networks
 
All Things Open SDN, NFV and Open Daylight
All Things Open SDN, NFV and Open Daylight All Things Open SDN, NFV and Open Daylight
All Things Open SDN, NFV and Open Daylight
 
SDN - a new security paradigm?
SDN - a new security paradigm?SDN - a new security paradigm?
SDN - a new security paradigm?
 
Radisys/Wind River: The Telcom Cloud - Deployment Strategies: SDN/NFV and Vir...
Radisys/Wind River: The Telcom Cloud - Deployment Strategies: SDN/NFV and Vir...Radisys/Wind River: The Telcom Cloud - Deployment Strategies: SDN/NFV and Vir...
Radisys/Wind River: The Telcom Cloud - Deployment Strategies: SDN/NFV and Vir...
 
PrasadResume
PrasadResumePrasadResume
PrasadResume
 
Open Networking
Open NetworkingOpen Networking
Open Networking
 
SDN 101: Software Defined Networking Course - Sameh Zaghloul/IBM - 2014
SDN 101: Software Defined Networking Course - Sameh Zaghloul/IBM - 2014SDN 101: Software Defined Networking Course - Sameh Zaghloul/IBM - 2014
SDN 101: Software Defined Networking Course - Sameh Zaghloul/IBM - 2014
 
Future Internet: Managing Innovation and Testbed
Future Internet: Managing Innovation and TestbedFuture Internet: Managing Innovation and Testbed
Future Internet: Managing Innovation and Testbed
 

More from Tal Lavian Ph.D.

Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerTal Lavian Ph.D.
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerTal Lavian Ph.D.
 
Photonic line sharing for high-speed routers
Photonic line sharing for high-speed routersPhotonic line sharing for high-speed routers
Photonic line sharing for high-speed routersTal Lavian Ph.D.
 
Systems and methods to support sharing and exchanging in a network
Systems and methods to support sharing and exchanging in a networkSystems and methods to support sharing and exchanging in a network
Systems and methods to support sharing and exchanging in a networkTal Lavian Ph.D.
 
Systems and methods for visual presentation and selection of IVR menu
Systems and methods for visual presentation and selection of IVR menuSystems and methods for visual presentation and selection of IVR menu
Systems and methods for visual presentation and selection of IVR menuTal Lavian Ph.D.
 
Grid proxy architecture for network resources
Grid proxy architecture for network resourcesGrid proxy architecture for network resources
Grid proxy architecture for network resourcesTal Lavian Ph.D.
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerTal Lavian Ph.D.
 
Systems and methods for electronic communications
Systems and methods for electronic communicationsSystems and methods for electronic communications
Systems and methods for electronic communicationsTal Lavian Ph.D.
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerTal Lavian Ph.D.
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerTal Lavian Ph.D.
 
Radar target detection system for autonomous vehicles with ultra-low phase no...
Radar target detection system for autonomous vehicles with ultra-low phase no...Radar target detection system for autonomous vehicles with ultra-low phase no...
Radar target detection system for autonomous vehicles with ultra-low phase no...Tal Lavian Ph.D.
 
Grid proxy architecture for network resources
Grid proxy architecture for network resourcesGrid proxy architecture for network resources
Grid proxy architecture for network resourcesTal Lavian Ph.D.
 
Method and apparatus for scheduling resources on a switched underlay network
Method and apparatus for scheduling resources on a switched underlay networkMethod and apparatus for scheduling resources on a switched underlay network
Method and apparatus for scheduling resources on a switched underlay networkTal Lavian Ph.D.
 
Dynamic assignment of traffic classes to a priority queue in a packet forward...
Dynamic assignment of traffic classes to a priority queue in a packet forward...Dynamic assignment of traffic classes to a priority queue in a packet forward...
Dynamic assignment of traffic classes to a priority queue in a packet forward...Tal Lavian Ph.D.
 
Method and apparatus for using a command design pattern to access and configu...
Method and apparatus for using a command design pattern to access and configu...Method and apparatus for using a command design pattern to access and configu...
Method and apparatus for using a command design pattern to access and configu...Tal Lavian Ph.D.
 
Reliable rating system and method thereof
Reliable rating system and method thereofReliable rating system and method thereof
Reliable rating system and method thereofTal Lavian Ph.D.
 
Time variant rating system and method thereof
Time variant rating system and method thereofTime variant rating system and method thereof
Time variant rating system and method thereofTal Lavian Ph.D.
 
Systems and methods for visual presentation and selection of ivr menu
Systems and methods for visual presentation and selection of ivr menuSystems and methods for visual presentation and selection of ivr menu
Systems and methods for visual presentation and selection of ivr menuTal Lavian Ph.D.
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerTal Lavian Ph.D.
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerTal Lavian Ph.D.
 

More from Tal Lavian Ph.D. (20)

Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizer
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizer
 
Photonic line sharing for high-speed routers
Photonic line sharing for high-speed routersPhotonic line sharing for high-speed routers
Photonic line sharing for high-speed routers
 
Systems and methods to support sharing and exchanging in a network
Systems and methods to support sharing and exchanging in a networkSystems and methods to support sharing and exchanging in a network
Systems and methods to support sharing and exchanging in a network
 
Systems and methods for visual presentation and selection of IVR menu
Systems and methods for visual presentation and selection of IVR menuSystems and methods for visual presentation and selection of IVR menu
Systems and methods for visual presentation and selection of IVR menu
 
Grid proxy architecture for network resources
Grid proxy architecture for network resourcesGrid proxy architecture for network resources
Grid proxy architecture for network resources
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizer
 
Systems and methods for electronic communications
Systems and methods for electronic communicationsSystems and methods for electronic communications
Systems and methods for electronic communications
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizer
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizer
 
Radar target detection system for autonomous vehicles with ultra-low phase no...
Radar target detection system for autonomous vehicles with ultra-low phase no...Radar target detection system for autonomous vehicles with ultra-low phase no...
Radar target detection system for autonomous vehicles with ultra-low phase no...
 
Grid proxy architecture for network resources
Grid proxy architecture for network resourcesGrid proxy architecture for network resources
Grid proxy architecture for network resources
 
Method and apparatus for scheduling resources on a switched underlay network
Method and apparatus for scheduling resources on a switched underlay networkMethod and apparatus for scheduling resources on a switched underlay network
Method and apparatus for scheduling resources on a switched underlay network
 
Dynamic assignment of traffic classes to a priority queue in a packet forward...
Dynamic assignment of traffic classes to a priority queue in a packet forward...Dynamic assignment of traffic classes to a priority queue in a packet forward...
Dynamic assignment of traffic classes to a priority queue in a packet forward...
 
Method and apparatus for using a command design pattern to access and configu...
Method and apparatus for using a command design pattern to access and configu...Method and apparatus for using a command design pattern to access and configu...
Method and apparatus for using a command design pattern to access and configu...
 
Reliable rating system and method thereof
Reliable rating system and method thereofReliable rating system and method thereof
Reliable rating system and method thereof
 
Time variant rating system and method thereof
Time variant rating system and method thereofTime variant rating system and method thereof
Time variant rating system and method thereof
 
Systems and methods for visual presentation and selection of ivr menu
Systems and methods for visual presentation and selection of ivr menuSystems and methods for visual presentation and selection of ivr menu
Systems and methods for visual presentation and selection of ivr menu
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizer
 
Ultra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizerUltra low phase noise frequency synthesizer
Ultra low phase noise frequency synthesizer
 

Enabling Active Flow Manipulation In Silicon-based Network Forwarding Engines

  • 1. Enabling Active Flow Manipulation In Silicon-based Network Forwarding Engines May 28-29, 2002 1 Tal Lavian - tlavian@ieee.org Nortel Networks Advanced Technology Labs Open Source - http://www.openetlab.org DANCE Exposition
  • 2. • AN technologies => Real Network Devices • Main thrust of the paper • Commercial Active Nets Platform • Application Example 1 – SSL • Application Example 2 – ASF • Next Generation AN Platform • Conclusion May 28-29, 2002 2 Outline of the talk DANCE Exposition
  • 3. May 28-29, 2002 3 AN Technology Transfer DANCE Exposition Active Nets Community Realistic Mechanisms Great Ideas Usable/Realizable Mechanisms/Products Active Nets Community Active Nets Ideas Active Nets Ideas Real AN Network Products Internet
  • 4. Great Active Nets CCoommmmuunniittyy SSoolluuttiioonnss • Active networks (AN) approach opens an exciting opportunity for individual applications to define the service provided by the network through programmability. • Active Networks technologies expose a novel approach that allows customer value-added services to be introduced to the network “on-the-fly”. • Active Nets program has produced a new network platform flexible and extensible at runtime to accommodate the rapid evolution and deployment of network technologies. • The exciting opportunity exists for network service providers and third parties, not just the network device providers, to program the network infrastructure and services. May 28-29, 2002 4 DANCE Exposition
  • 5. Lack of industrial-strength Active Network devices that dispel major concerns: May 28-29, 2002 5 DANCE Exposition AANN iissssuueess • AN requires substantial supports from a NOS • AN introduces substantial software component, hence delay on the data path • AN lacks adequate measures to addressing integrity and security of network devices.
  • 6. May 28-29, 2002 6 Main contributions of the paper • Active Flow Manipulation Concept DANCE Exposition — Flow abstraction — Actions on Flows — Control/Data separation • Openet Platform — Commercial Network Devices — Runtime Environment — Active Services • Applications
  • 7. May 28-29, 2002 7 Openet: An active service platform User Oplets ORE JFWD CPU JNI/Native Code Monitor status DANCE Exposition JVM MEM … Filtered packets New forwarding rules Forwarding Engine OpletService, Shell, Logger Jcapture, HTTP, IpPacket Standard Services ANTS Application services Firewall, DiffServ Function Services Control Plane Data Plane
  • 8. May 28-29, 2002 8 Active Flow Manipulation DANCE Exposition Forwarding Processor Forwarding Processor Packet Policy Filters AFM Packet Filte r Packet Action • A key enabling technology of Openet • Two abstractions — Primitive flows — Primitive actions • Customer network services exercise active network control — Identifying specific flows — Apply actions to alter network behavior in real-time
  • 9. May 28-29, 2002 9 Openet Alteon Active Nets Platform = A Powerful Platform for AN Technologies Transfer DANCE Exposition • A powerful and extensible control and computational plane — Partitioning hardware/software resources — Active service enabling — Content filtering in real-time — Active services accommodation Optical Wireless Active Services router Content gateway Edge Device Content Aware Computation Power Dynamic Service Enabling
  • 10. Nortel Networks’ contributions to Active Networks • Practical Active Networks Architecture on real network device. • First Commercial Active Networks platform. May 28-29, 2002 10 DANCE Exposition
  • 11. May 28-29, 2002 11 Any AN products? DANCE Exposition Active Nets Community Active Nets Community Active Nets Ideas Active Nets Ideas Realistic Mechanisms Experimental/Laboratory Platforms Commercial AN Platform? ? Nortel Networks AN Products SSSSLL AASSFF IDIDSS VVPPNN
  • 12. • Client sends an HTTPS request • Switch redirects request on port 443 to iSD-SSL • iSD-SSL completes SSL handshake • iSD-SSL initiates HTTP connection to server on port 80 • Switch selects real server based on configured LB policy • Server responds to HTTP request and replies to the iSD-SSL • iSD-SSL encrypts session and sends HTTPS response to client HTTPS, SMTP-S, POP3-S and IMAP-S services May 28-29, 2002 12 SSL Acceleration How Does the iiSSDD--SSSSLL AAcccceelleerraattoorr wwoorrkk?? DANCE Exposition
  • 13. May 28-29, 2002 13 Client And Server Authentication DANCE Exposition 1 User opens session 2 Sends server certificate Requests client certificate 3 Serves request/response 7 Send encrypted data to back 6 end Validates the client certificate info. 5 Private key Confidential 4 Client sends the certificate with public key Public key Published
  • 14. May 28-29, 2002 14 ASF – Alteon Switched Firewall DANCE Exposition
  • 15. Relate AFS to AN Technology • The Alteon selectively redirects new connection requests to the Alteon Switched Firewall Director to perform policy checking. • The Director runs the Check Point FireWall-1 engine as an Active Service. • The Active Service manages the connection table, specifies rules for handling packets in the session, passes the connection table to the Alteon Switched Accelerator. • 90% of traffic is accelerated, supporting a throughput of 3.2 Gbps. May 28-29, 2002 15 DANCE Exposition
  • 16. Alteon Security Cluster Acceleration and intelligent integration of security applications Single point of secure central management IDS IDS URL Filtering Virus Scan Nortel Appliance Acceleration Protocol (Enables application control of switch sessions) May 28-29, 2002 16 BBI, CLI, SSI, Plug and Play DANCE Exposition Application Plane Security Appliance NAAP Control Plane Controller of accelerated sessions Management Plane IDS IDS IDS Fir Fi Firewall SSL SSL SSL Security Accelerator Data Plane Switch based acceleration of session data Fir Fi VPNs SSL SSL
  • 17. May 28-29, 2002 17 DANCE Exposition What next?
  • 18. iSD iSD May 28-29, 2002 18 Disaster Recovery concept OmniNet Control Plane DANCE Exposition Control Mesg 8600 8600 OmniNet 8600 10G 10G 10G iSD 1G 1G 1G A B C D X Y Z B2 B3 [Linux] TL1 Alteon Alteon Alteon EvaQ8 OG - 1 EvaQ8 OG -2 EvaQ8 OG - 3 1. Normal App flow : Client X -> Server Z 2. Disaster Strikes at Location Z 3. EvaQ8 OG 3 sends a signal[RSVP] to OG1 4. OG1 instructs Omnit net to connect B2 & B3 ; Server Z and Server Y data syncd 5. On successful sync, OG2 instructs OmniNet to connect B1->B2. 6. Service Restored for Client X ->server Y Disaster Event/ Environ. Sensor B1 Control Mesg
  • 19. May 28-29, 2002 19 What next? Quotes from VIPs DANCE Exposition
  • 20. Service-centric Active Nets Platform May 28-29, 2002 20 What after next? DANCE Exposition Manage Service Enabling SERVICES Control Matching Impedance Intra-Service Comm Security • Service Enabling API • Control API • Impedance Matching API • Security API • Management API • Intra-service Communications API
  • 21. May 28-29, 2002 21 DANCE Exposition Summary • AN Technologies Transfer => Nortel AN Platform • New AN platform: Openet + Alteon + iSD — Alteon: AN platform advanced content filtering — iSD: powerful & extensible computation plane • Important Applications • Impact of AN on next generation networks
  • 22. OpenetLab – Nortel Networks: http://www.openetlab.org/ May 28-29, 2002 22 QQ&&AA DANCE Exposition
  • 23. May 28-29, 2002 23 BBaacckkuupp SSlliiddeess DANCE Exposition
  • 24. May 28-29, 2002 25 Secure XL & NAAP in Action TCP session Alteon Switched Firewall (ASF) 5 Update Conn. DANCE Exposition 1 SYN Policy Check 1 1 Add Conn. (F2F) 1 2 SYN/ACK 3 Update Conn. 6 4 TCP 3-way handshake complete, data for the session accelerated 5 FIN-1 6 FIN-2 7 ACK Update Conn. Delete Conn. 7 Clients Servers 3 ACK (TCP 3-way handshake complete)
  • 25. New Focus on Integrated Management and Flow Application Clusters SSL FW VPN IDS Virus • Shift from physical management to logical management • Central management of multiple services May 28-29, 2002 27 Intelligent Flow Management Security Dashboard • Plug and play simplicity and scalability DANCE Exposition Scanning URL SSL FW VPN IDS Virus Filtering Scanning URL SSL FW VPN IDS Virus Filtering Scanning URL SSL FW VPN IDS Virus Filtering Scanning URL SSL FW VPN IDS Virus Filtering Scanning URL SSL FW VPN IDS Virus Filtering Scanning URL Filtering

Editor's Notes

  1. Here is the outline of the talk. First I will identify several driving forces that led us in this direction of programmable networking Next, I review some basic functionality of a routing network element. Then I introduce our idea when we develop the AFM concept I will describe a framework for which AFM can be applied I will also describe several relevant examples using AFM and the platform Finally I conclude with a hint of what we go from here.
  2. To us as researchers: to be able to implement several of our new ideas on a real router. For Nortel Networks (if I am not wrong): potential revenue generating direction by inventing and developing advanced technology/ By looking at the Internet from users’ perspective, service providers’ perspective and network providers’ perspective, we have identified several driving forces that steered us in this direction of research: Users want intelligent services Service providers want to differentiate their service by offering new services, time to market, flexibility in managing their services Network Providers want to manage their services efficiently and economically. They want to sell, lease their resources at premium price. They want to sell bandwidth on-demand, etc.
  3. Above all we need programmability in network devices for introducing, enabling all kinds of intelligent services. What we need : a framework, a platform independent API.
  4. Database of what to be done based on SLA Database of possible filters of interests AFM defines a set of primitive flows and operation to obtain composite flows AFM defines a set of primitive actions Flow and Action can form an algebra in the most general sense. One can actually design machine with this algebra. The main interest is in identifying specific flows and applying actions to alter the behaviour in real-time.
  5. Shift from physical management to logical management o        Manage the data based on flows and apply the services depending on the user and flow o        Simplify the configuration significantly o        Essentially separate data plane from control plane to enable effective management Central management of multiple services o        Eliminate multiple points of management o        Scale management to control devices and applications Plug and play simplicity and scalability