Postmodern Internetwork Architecture

Network-layer innovation has proven surprisingly difficult, in part because internetworking protocols ignore competing economic interests and because a few protocols dominate, enabling layer violations that entrench technologies. Many shortcomings of today’s internetwork layer result from its inflexibility with respect to the policies of the stakeholders: users and service providers. The consequences of these failings are well-known: various hacks, layering violations, and overloadings are introduced to enforce policies and attempt to get the upper hand in various “tussles”. The result is a network that is increasingly brittle, hostile to innovation, vulnerable to attack, and insensitive to concerns about accountability and privacy. Our project aims to design, implement, and evaluate through daily use a minimalist internetwork layer and auxiliary functionality that anticipates tussles and allows them to be played out in policy space, as opposed to in the packet-forwarding path. We call our approach postmodern internetwork architecture, because it is a reaction against many established network layer design concepts. The overall goal of the project is to make a larger portion of the network design space accessible without sacrificing the economy of scale offered by the unified Internet. We will use the postmodern architecture to explore basic architectural questions. These include: • What mechanisms should be supported by the network such that any foreseeable policy requirement can be explicitly addressed? • To what extent can routing and forwarding be isolated from each other while maintaining an efficient and usable network? • What forms of identity should be visible within the network, and what forms of accountability do different identities enable? • What mechanisms are needed to enable efficient access to cross-layer information and mechanisms such that lower layers can express their characteristics and upper layers can exert control downward? We plan to build and evaluate a complete end-to-end networking layer to help us understand feasible solutions to these questions. The Internet has fulfilled the potential of a complete generation of networking research by producing a global platform for innovation, commerce, and democracy. Unfortunately, the Internet also amply demonstrates the complexity and architectural ugliness that ensue when competing interests vie for benefits beyond those envisioned in the original design. This project is about redesigning the waist of the architectural hourglass to foster innovation, enhance security and accountability, and accomodate competing interests. 1 Postmodern Internetwork Architecture Network-layer innovation has proven surprisingly difficult, in part because a few protocols dominate, which enables layer violations that entrench technologies. These layer violations support the policies that were not explicitly designed for within the existing architecture. For example, few policy goals, such as privacy, accountability, and even performance, are supported by explicit mechanisms. Disruptions such as denial of service attacks, spoofing, and routing outages expose imperfections in the architecture every day. The research community has identified many problems in the Internet architecture and proposed solutions [31, 108, 32, 109, 43], most of which are constrained because they aim for some backward-compatibility. Many shortcomings of today’s internetwork layer result from its inflexibility with respect to the policies of the stakeholders: users and service providers. The consequences of these failings are well-known: various hacks, layering violations, and overloadings are introduced to enforce policies and attempt to get the upper hand in various “tussles” [34]. The result is an Internet that is increasingly brittle, hostile to innovation, vulnerable to attack, and insensitive to concerns about accountability and privacy. We propose to design, implement, and evaluate through daily use a minimalist internetwork layer and auxiliary functionality that anticipates tussles and allows them to be played out in policy space, as opposed to in the packetforwarding path. We term this design a postmodern internetwork architecture because it is a reaction against many established network layer design concepts. The overarching goal of the project, and the motivation for choosing a minimal networking layer, is to make a larger portion of the network design space accessible without sacrificing the economy of scale offered by agreeing on a common set of protocols. The primary tenets of our postmodern design are (i) strict separation of concerns, and (ii) inclusion of explicit mechanisms in support of all foreseeable policies influencing network-layer behavior. These principles lead to a design with the following novel characteristics: • We separate path determination from forwarding to allow users greater control over the paths followed by packets through the network. At the same time, providers may, if they desire, retain control over transit paths through their networks for traffic engineering purposes. We also enable users to amortize the cost of determining a path from a source to a destination over multiple packets (if they choose to do so) via a caching mechanism. • We eschew hierarchical identifiers (i.e., anything like IP addresses); components in the topology can thus be added and rearranged without concern for allocation of scarce resources (topology-based addresses) and without consulting a global authority. • We capture an unforgeable record of the path traversed by each packet to provide the accountability that would curtail denial of service, spam, and other forms of abuse. At the same time, we attempt to provide complete control to providers over the “opacity” of their network topologies and policies. The portion of the recorded path inside their network can be used to reconstruct internal topology only with the provider’s cooperation and as controlled by the provider’s policy. We thus isolate the concern of path selection from that of topology disclosure. • On the other hand (and to some extent in compensation for this isolation), our architecture requires transparency of the top-level interconnection of realms. We believe the desire for providers to hide peering relationships is an artifact of existing protocols (BGP) and the fact that realm-level customer-provider relationships are largely constrained by topology today. • We separate the customer-provider relationship from topology by providing an explicit mechanism for expressing why each router should forward a packet. A user might be a customer of several transit providers; explicitly motivating routers to forward packets enables customer-directed routing that would choose among them. • We support information flow from the network to the user (for example, about traffic conditions or path availability), and policy flow from the user to the elements of the network (for example, preferential drop policies) via cross-layer “knobs and dials.” Our research team brings to the project a wealth of experience in several critical areas, including design and implementation of novel network architectures [39, 53, 52, 15, 16, 17]; understanding and inferring service provider policies [95, 97, 70]; distributed identities and PKIs [73]; and performance optimization using cross-layer hints [64, 98]. In addition, the PIs have a strong record of building real systems and demonstrating end-to-end benefit of architectural decisions and in-network mechanisms. The team has a history of working together and blends complementary