Presentation is loading. Please wait.

Presentation is loading. Please wait.

Generic AAA* based Bandwidth on Demand * Authentication Authorization & Accounting EVL at UIC meeting Chicago 18/10/2002 Leon Gommans Advanced Internet.

Similar presentations


Presentation on theme: "Generic AAA* based Bandwidth on Demand * Authentication Authorization & Accounting EVL at UIC meeting Chicago 18/10/2002 Leon Gommans Advanced Internet."— Presentation transcript:

1 Generic AAA* based Bandwidth on Demand * Authentication Authorization & Accounting EVL at UIC meeting Chicago 18/10/2002 Leon Gommans Advanced Internet Research Group University of Amsterdam

2 Content - Goals and basic list of requirements. - Lightpath and Lightpath control concepts - Generic AAA concepts - High level design and operation of proof of concept. - Example of a simple request message and policy. - Next work items

3 Goal - Allow a provisioned Lightpath to by-pass a regular internet connection. Internet connection becomes control channel. Motivation: - Routed networks are too expensive if requested bandwidth is in the order of the traffic generated by a nations NRN -TCP stack & transport channel needs tailored behavior to make optimal use of a high speed ( GB ), high delay (>100ms) channel - Modifications generates Internet unfriendly TCP traffic. - Firewalls do (not yet) statefully inspect 10 GB/S streams without delays or performance implications. - Single Packet drop causes severe performance hits. - Memory buffers in routers/switches are a concern when the road gets smaller.

4 Rough requirements list. - Allow lightpath usage in a demand driven fashion. - Allow hard or soft pre-allocation. - Must support allocation and usage across multiple domains. - Must be integrated into middleware e.g. by allowing provisioned by-pass model to be supported by GridFTP. Raised this with GGF Data Transport RG (Bill Allcock). - Allow authorized VOs or individual users to discover available lightpaths (e.g. via a OGSA/WS style interface). - Allow authorized users (with a certain role within the VO) to pre-allocate and use bypass for a limited amount of time and with limits on the allocated bandwidth. - Must integrate with existing authentication & user (role based) authorization system: Looking into EDG VOMS.

5 Rough requirements list. -Must hide complexity from user. Conceptually the user must perform the process in 3 basic steps after login: 1)Pre-allocate either manually or automatically thru a scheduling system -> system issues an authorization. 2)Allow the job to allocate the network resource whereby it uses the authorization. 3)Once the job is finished, the authorization is handed back so resources can be freed. -User (or scheduling system) must be allowed to change the reservation if the process flow so dictates. -Allocating user may be different from ultimate user. -Allocating user may subdivide capacity amongst users. -Must ultimately support Grid Economic Services Architecture features to allow ad hoc creation. -Must ultimately provide Grid Accounting records for billing in contract situations.

6 Design considerations. -Group in Amsterdam does focus on deploying Generic AAA (RFC2903/RFC2904) concepts to handle authorization of lightpath. Group members were authors. -Best suited to handle policy based authorization in a dynamic fashion either to build AuthZ tokens or process requests which contain AuthZ tokens. Note AuthZ may itself also contain policies. -Authorizations between administrative domains must be done at a fairly high-level. -Dont want to address low level networking problems (path finding/setup) as vendors and researchers like ICAIR are already active in this area -Need to identify role, messages and policies that are handled by Generic AAA components as part of the overall workflow.

7 Lightpath Def*: Any uni-directional point to point connection with effective guaranteed bandwidth Examples of LightPaths: * Analog wavelength on a CWDM or DWDM system * STS channel on a SONET or SDH circuit * ATM CBR circuit * Diff serv gold service on a packet based network * Gigabit Ethernet over dedicated fiber strand * Definition by Bill St. Arnoud of Canarie

8 Onion Lightpath model Selector Switch Distributor Switch Selector Switch Distributor Switch Domain X Domain Y Domain X DomainY

9 Daisy Chain Lightpath model Domain BDomain C Domain A Domain D

10 Daisy Chain & Onion Domain BDomain C Domain A Domain D Domain X DomainY

11 Onion control model Seector Switch Distributor Switch Domain X Domain Y AAA Domain AAA engine must control both selector and distributor switch and Interconnecting network

12 Daisy chain control model Selector Switch Distributor Switch Domain ADomain B AAA Domain AAA engine must control the selector or distributor switch and one of the AAA Servers must control intermediate network AAA

13 Generic AAA o 5 years ago a AAA server was known as a server supporting dail-in boxes thru the RADIUS protocol (at IETF). o IETF42 (in same hotel as GGF6) held first AAA BOF as it was recognized AAA could be used in other type of applications. o Amsterdam group has been participating on defining concepts for Generic AAA since march 1999 when AAA WG was formed at IETF-44 o Work became IRTF subject end of 1999 (AAA ARCH RG). o IDs that became RFCs 2903 – 2906 were submitted after the Adelaide IETF march RFCs describe framework, architecture, example applications and requirements. o Optical Networking within grid environment is a research application for Generic AAA.

14 RFC 2904 Generic AAA Framework basic principles 3 fundamentally different user initiated authorization sequences. Note: RFC2904 does not show step 5 – service access. Service AAA User Service AAA User Service AAA User Pull sequence NAS (remote access) RSVP (network QoS) Agent sequence Agents, Brokers, Proxys. Push sequence. Tokens, Tickets, ACs etc

15 Generic AAA Framework Separating the User Awareness from the Service yield Roaming Models: Example roaming pull model. Service AAA User AAA 3 4 User Home Organization Service Provider

16 Generic AAA Framework Distributed Services Models allow many types and combination of authorization sequences.. Service AAA User AAA User Home Organization Service Provider A Service AAA Service Provider B AAA Client

17 Generic AAA Architecture – RFC2903 Policy Decision Point Policy Enforcement Point Fundamental ideas inspired by work of the IETF RAP WG that in RFC 2753 describes a framework for Policy-based Admission Control. Foundation for COPS The point where policy decisions are made. The point where the policy decisions are actually enforced. Request Decision Policy Repository Basic Goal Generic AAA: Allow policy decisions to be made by multiple PDPs belonging to different administrative domains.

18 Generic AAA Architecture – RFC2903 Application Specific Module Policy Enforcement Point Archieve goal by by separating the logical decision process from the application specific parts within the PDP. Request Decision Rule Based Engine Policy Repository PDP

19 Example of Generic AAA Architecture – RFC2903 Application Specific Module Bandwidth Broker Rule Based Engine Policy Repository Application Specific Module Rule Based Engine Policy Repository Users Application Specific Module Rule Based Engine Policy Repository Contracts Budgets Registration Dept.Purchase Dept. Bandwidth Provider AAA Server AAA Server AAA Server (Virtual) User Organization QoS Enabled Network User Service Service Organization

20 802.1Q VLAN Switch Enterasys Matrix E5 A B C D 802.1Q VLAN Switch Enterasys Matrix E5 1 GB SX AA A iGrid2002 Policy DB AAA Request Generic AAA (RFC2903) based Bandwidth on Demand

21 802.1Q VLAN Switch Enterasys Matrix E5 A B C D 802.1Q VLAN Switch Enterasys Matrix E5 1 GB SX AA A iGrid2002 Policy DB AAA Request Generic AAA (RFC2903) based Bandwidth on Demand

22 Next Setup using vendor provided network provisioning system 802.1Q VLAN Switch Enterasys SS6000 A B C D 802.1Q VLAN Switch Enterasys SS6000 Managed Optical Connection Service AA A Bo DSe rv IP A IP B IP C IP D Cisc o CT M

23 Example XML Lightpath request simple JanJansen #f034d now 20

24 Policy (significant part) executed by AAA Rule Based Engine if ( ASM::RM.CheckConnection( Request::BodData.Source, Request::BodData.Destination ) && ( Request::BodData.Bandwidth <= 1000 ) ) then ( ASM::RM.RequestConnection( Request::BodData.Source, Request::BodData.Destination, Request::BodData.Bandwidth, Request::BodData.StartTime, Request::BodData.Duration ) ; Reply::Answer.Message = "Request successful" ) else ( Reply::Error.Message = "Request failed" )

25 Design Details o Onion model was chosen for first implementation. o Single AAA engine controls both ingress and egress switch by creating 802.1Q VLANs using the dot1Q Bridge MIB extentions via SNMP. o 1 GB channel between switches carry 802.1Q tagged ethernet frames. An 802.1Q trunk can carry up to 4096 VLANs. o End stations register with AAA engine and subsequently send request to reach other stations (pointed to via its public IP address). o By-pass communication channel uses a private IP address space. Destinations are identified by main IP address.

26 Technical Implementation o XML/SOAP messages for request/reply (to prepare for a future web services interface) o RBE: JAVA code running as Servlet. Uses Apache Axis to handle SOAP messages. o ASM: JAVA code currently running in Java context of RBE. Currently investigating how it could run separately e.g. as Java Bean or using CORBA. o More technical details: Bas van Oudenaarde: and Arie Taal:

27 Upcomming work: 1)Separate ASM and RBE and allow ASMs to be loaded/unloaded dynamically. 2)Implement pre-allocation mechanisms (based on GARA – collaboration with Volker Sander). 3)Create ASM for other B/W manager (e.g. Alcatel BonD, Cisco CTM, Level-3 Ontap) 4)Create ASM to talk to other domain: OMNInet 5)Allow RBEs to talk to each other (define messages). 6)Integrate BoD AAA client into middleware eg by allowing integration with GridFTP and integration with VOMS authentication and user authorization system. 7)Build WS interface abstraction for pre-allocation and subsequent usage.

28 Thank you !


Download ppt "Generic AAA* based Bandwidth on Demand * Authentication Authorization & Accounting EVL at UIC meeting Chicago 18/10/2002 Leon Gommans Advanced Internet."

Similar presentations


Ads by Google