Virtual IP Research Articles

Improving peer connectivity in wide-area overlays of virtual workstations

Self-configuring virtual networks rely on structured P2P routing to provide seamless connectivity among nodes through overlay routing of virtual IP packets, support decentralized hole-punching to establish bi-directional communication links among nodes behind network address translators, and dynamic configuration of virtual IP addresses. Our experiences with deployments of virtual networks in support of wide-area overlays of virtual workstations (WOWs) reveal that connectivity constraints imposed by symmetric NATs and by Internet route outages often hinder P2P overlay structure maintenance and routability, subsequently limiting the ability of WOWs to deliver high-throughput computing through aggregation of resources in different domains.In this paper, we describe and evaluate two novel approaches which are generally applicable and fully decentralized, and show that they improve routability of structured P2P networks in such connectivity constrained environments: (1) a fault-tolerant routing algorithm based on simulated annealing from optimization theory, and (2) tunneling of connections between adjacent nodes (in the P2P identifier space) over common neighbors when direct communication is not possible. Simulation-based analyses show that (1) when pairs of nodes only have 70% chance of being able to communicate directly, the described approaches improve all-to-all routability of the network from 90% to 99%, and (2) even when only 70% of the nodes are behind NATs that include symmetric NATs, these techniques improve the all-to-all connectivity of the network from less than 95% to more than 99%. We have implemented these techniques in the IP-over-P2P (IPOP) virtual network and have conducted experiments with a 180-node WOW Condor pool, demonstrating that, at 81% probability of establishing a pair-wise connection, annealing and tunneling combined allow all nodes to be connected to the pool, compared to only 160 nodes in the absence of these techniques.

Special section: Grid/distributed computing systems security

We are delighted to present to you the special section of Future Generation Computer Systems (FGCS) on grid/distributed computing systems security. This special section contains five technical papers dealing with cutting-edge research and technology related to the design,modeling, and implementation of architectures, algorithms and protocols of computer systems or environments. In the paper ‘‘Secure verifiable non-interactive oblivious transfer protocol using RSA and bit commitment in a distributed environment’’, Soongohn Kim et al. analyze the basic concept of an OT (Oblivious Transfer) protocol for exchanging secret information fairly, survey the basic idea of an interactive and secure noninteractive OT protocol, and present a new non-interactive type of OTprotocolwhich is verifiable. The amount of traffic of transferring information of the suggested method is less than or equal to that of the conventional interactive method. The paper ‘‘Structure design and test of an enterprise security management system with advanced internal security’’ by Seoksoo Kim et al., analyzes existing enterprise security management systems and, on the basis of the results, proposes and tests an enterprise security management system with reinforced internal security. For the test, the authors used a firewall through log analysis and designed Intranet work using a virtual IP system. J. H. Abawajy proposes a new two-level adaptive space-sharing scheduling policy for non-dedicated heterogeneous commodity-

WOW: Self-organizing Wide Area Overlay Networks of Virtual Workstations

This paper describes WOW, a distributed system that combines virtual machine, overlay networking and peer-to-peer techniques to create scalable wide-area networks of virtual workstations for high-throughput computing. The system is architected to: facilitate the addition of nodes to a pool of resources through the use of system virtual machines (VMs) and self-organizing virtual network links; to maintain IP connectivity even if VMs migrate across network domains; and to present to end-users and applications an environment that is functionally identical to a local-area network or cluster of workstations. We describe IPOP, a network virtualization technique that builds upon a novel, extensible user-level decentralized technique to discover, establish and maintain overlay links to tunnel IP packets over different transports (including UDP and TCP) and across firewalls. We evaluate latency and bandwidth overheads of IPOP and also time taken for a new node to become fully-routable over the virtual network. We also report on several experiments conducted on a testbed WOW deployment with 118 P2P router nodes over PlanetLab and 33 VMware-based VM nodes distributed across six firewalled domains. Experiments show that the testbed delivers good performance for two unmodified, representative benchmarks drawn from the life-sciences domain. We also demonstrate that the system is capable of seamlessly maintaining connectivity at the virtual IP layer for typical client/server applications (NFS, SSH, PBS) when VMs migrate across a WAN.

A Dynamic Topology and Routing Management Strategy for Virtual IP Networks

SUMMARY This paper describes an architecture for deploying virtual IP networks with P2P-like dynamic topology and routing management. Existing virtual IP network deployment mechanisms do not allow for dynamic topology adaptation and fault-tolerance because provisioning of IP tunnels is performed only once—when a virtual network is deployed. We propose a P2P-XBone, in which a P2P protocol such as DHT drives the topology and the routing table of a virtual IP network consistent with its neighbor node state. We describe how to extend both the existing X-Bone system and P2P mechanisms to achieve interworking between them. The P2PXBone not only provides P2P’s characteristics such as self-organization, fault-tolerance and content-based routing to virtual IP networks but also provides higher forwarding performance and simpler implementation to P2P systems due to the support for the use of existing network services. We also show several results on the evaluation of overhead of P2P-driven

Structure design and test of enterprise security management system with advanced internal security

A security system for a company network is progressing as a ESM (Enterprise Security Management) in an existing security solution foundation. The establishment of the security policy is occupying a very important area in ESM of the security system. We tried to analyze the existing ESM system for this and designed a security solution structure for enhancing the internal security. We applied implementing directly IDS system and tested it. This study examined the structure of security solutions in order to build an enterprise security management system. For this purpose, we analyzed existing enterprise security management systems and, based on the results, proposed a enterprise security management system with reinforced internal security and tested the system. For the test, we used a firewall through log analysis and designed an intra-network using virtual IP system.

On Reducing IP Mobility Cost in Mobile Networks

Hierarchical Mobile IPv6 (HMIPv6) was proposed by the Internet Engineering Task Force (IETF) for efficient mobility management. HMIPv6 reduces the amount of signaling in the wired network link that exists in Mobile IPv6. But, HMIPv6 cannot reduce the signaling cost in the wireless link. In mobile networks, the wireless link has far less available bandwidth resources and limited scalability compared with the wired network link. Therefore, the signaling overhead associated with mobility management severely degrades the wireless link. In this paper, we propose virtual-IP (VIP) allocation scheme with dynamic VIP zone to reduce the wireless signaling cost in mobile networks. The performance of the proposed scheme is compared with HMIPv6. Based on the numerical analysis and simulation, we show that VIP allocation scheme reduces the wireless signaling cost under various system conditions.

Mobility and QoS support in 4G wireless networks

Fourth-generation (4G) wireless networks will be the IP-based cellular networks integrating Internet with the existing cellular networks. Two important issues should be concerned in the IP-based cellular networks, IP mobility, and quality-of-service (QoS) guarantees. In this paper, we proposed two mechanisms to solve the problems with IP mobility and RSVP-based QoS provisioning. First, virtual-IP (VIP) allocation scheme in areas with a large rate of handoff can minimize the wireless signaling overhead due to IP mobility. The access routers (ARs) create dynamically the VIP zone by using the measured handoff rate derived from the history of the handoff into neighboring ARs. We show that VIP allocation scheme reduces the binding update messages in the wireless link than hierarchical mobile IPv6. Second, the new advance resource reservation protocol called proportional aggregate RSVP (PA-RSVP) can minimize waste of bandwidth and soft state refresh overhead due to IP mobility. It allocates the bandwidth in advance between the mobility anchor point and neighboring ARs using proportional aggregate reservation. We also show that PA-RSVP provides an improved performance over existing protocols.

MobileNAT: A New Technique for Mobility Across Heterogeneous Address Spaces

We propose a new network layer mobility architecture called MOBILENAT to efficiently support micro and macro-mobility in and across heterogeneous address spaces common in emerging public networks. The key ideas in this architecture are as follows: (1) Use of two IP addresses - an invariant virtual IP address for host identification at the application layer and an actual routable address at the network layer that changes due to mobility. Since physical address has routing significance only within a domain, it can be a private address and therefore, does not deplete the public IP address resource. (2) New DHCP enhancements to distribute the two addresses. (3) A new signaling element called Mobility Manager (MM) that uses Middlebox Communication (MIDCOM) framework to signal the changes in packet processing rules to the Network Address Translators (NATs) in the event of node mobility. Our proposal does not require any modifications to the access networks and can seamlessly co-exist with the existing Mobile IP mechanisms and therefore, can be used to provide seamless mobility across heterogeneous wireline and wireless networks. We report implementation details of a subset of our ideas in a testbed with Windows XP clients and Linux based NATs.

Virtual active IP node for collaborative environments

The present paper describes the VAIN architecture (Virtual Active IP Node), which enables users to deploy new network services based on virtual active networks, and how it solves the challenge of segmenting the incoming traffic that crosses nodes towards the services, conserving the original objective of independence of the protocol.

Virtual routers

Virtual routers are software entities, i.e. user space processes, emulating IP routers on one or several (Linux) computers. Virtual routers can be used for both networking research and education. In contrast to simulation, virtual routers process packets in real-time and the virtual router code is similar to code in real routers. In the case of research, larger network test-beds can be built using a relatively small number of computers. New functionalities such as new queuing mechanisms are supported by a modular software architecture and can be tested in a rather safe environment compared to kernel space implementations. Virtual routers can also be used as a tool aiming to allow students to perform virtual experiments within a computer networks course. Students can create and experiment with arbitrary virtual IP network topologies. The web-based user interface allows students to interact remotely with the emulated routers, but simultaneously it is very similar to commonly available configuration interfaces of network devices in reality. This enables students to configure routers like in the real world but also to experiment in a much more robust and safe environment.

Policy-based network load management

Current solutions for balancing load among Internet servers are based on the use of network address translation (NAT) and virtual Internet protocol (IP) addresses. In this work, we describe the design and implementation of an intelligent load-management prototype that is not based on the traditional approaches mentioned above, but can be efficiently built into existing high-end switch offerings from Lucent Technologies, such as the Cajun™ P550™ Gigabit Routing Switch. The key features of this prototype are (1) IP packets are not modified in any way — only Ethernet addresses are manipulated; (2) each machine that is a member of a server farm uses a shared IP address, in addition to unique IP addresses; and (3) a sophisticated tunable algorithm is used to select a server for the next incoming request.

The movement from monoliths to component-based network elements

To be competitive in a rapidly growing market requires rapid upgrades to the performance and functionality of the network. One way to manage rapid upgrades of the network with minimum risk is to deploy equipment using a modular system architecture. Modularity allows a network operator to mix and match best of breed components to achieve the desired system rather than rely on vendors to implement specific technology before making crucial business decisions. This article begins with an overview of the current global movement toward standards that support network elements with modular system architecture. The story begins with university initiatives and the forming of OpenSig and IEEE P1520 more than five years ago, continuing with related and complementary initiatives by the Parlay Group, Softswitch Consortium, Multiservice Switching Forum, and several IETF working groups. Next, special attention is given to the component-based architecture of the Multiservice Switching Forum released in summer 2000. The trend of building network equipment from components with distinctly different functional specialties is described in three examples: media gateways, IP routers, and virtual IP routers. It is envisioned that component-based network infrastructure will spawn new markets for entrepreneurial developers, spurring competition and accelerating the creation of innovative solutions for all facets of global communications. The article concludes with a smorgasbord of new market opportunities.

Proxy PNNI augmented routing (proxy PAR)

ATM networks often carry other popular communication protocols such as TCP/IP. LAN emulation techniques, with LANE and MPOA being the most prominent ones, make it possible to support existing applications, but do not take advantage of many ATM capabilities. Furthermore, such server-based solutions often suffer from a single point of failure problems. PNNI augmented routing (PAR), based on private network-network interface (PNNI), enables ATM and TCP/IP to be better integrated than in an emulation environment. In addition to that, proxy PAR has been introduced as minimal version of PAR that gives ATM attached devices the ability to interact with PNNI devices without the complexity associated with a full PAR implementation. Proxy PAR has been conceived as a client/server interaction in which the client side is much simpler than the server side, permitting fast implementation and deployment in existing IPv4 devices. The main purpose of proxy PAR is to allow non-ATM devices to use the flooding mechanisms provided by PNNI for registration and automatic discovery of services offered. Proxy PAR capable servers support filtering based on virtual private network (VPN) IDs, IP protocols and address prefixes. This enables, for example, routers in a certain VPN running OSPF to find their neighboring routers without the manual configuration implied by other technologies such as frame relay.

Host migration transparency in IP networks

Increasing portability of computers will require users in the future to access the network regardless of location. Host migration transparency will be an essential feature of wide area network environments. We proposed the concept of virtual network and the propagating cache method to achieve host migration transparency [12]. We also established the feasibility of Virtual Internet Protocol (VIP), derived from Internet Protocol (IP), as an example of a virtual network protocol. In this paper, we define VIP in detail and describe how VIP achieves host migration transparency in IP networks. We also show two VIP implementation approaches: 1) VIP as a sublayer; and 2) VIP as an IP option. By modifying an operating systems kernel in each case, we implement VIP using both approaches. We then compare both implementations in terms of overhead, backward compatibility, and other metrics. The measured performance indicates that VIP can provide host migration transparency in IP networks with negligible overhead.

A network architecture providing host migration transparency

The continued expansion of computer networks and the miniaturization of computers increase the desire to use one's computer in a consistent computational environment, regardless of location and time. In this situation, host migration transparency is very important. This paper introduces a new network architecture which provides host migration transparency in large interconnected networks and proposes a protocol based on the propagating cache method. We introduce the concept virtual network and divide the conventional network layer into two sublayers to realize host migration transparency. Virtual Internet Protocol, or VIP for short, is derived from DARPA-IP as an example of the architecture. We estimate the overhead of VIP. Host migration transparency can be realized without signi cant processing and tra c overhead. This architecture also preserves host migration transparency across virtual circuits in radio networks.