Transcript Document
ELA: A Fully Distributed VPN over P2P Network Sadanori Aoyagi, Makoto Takizawa, Masato Saito, Hiroto Aida, and Hideyuki Tokuda Keio University, Japan Outline ﻪVirtual Private Network (VPN) ﻪELA ﻩAbstract ﻩDesign and Implementation ﻩEvaluation of ELA ﻪRelated Work ﻪFuture Works and Conclusion Background VPN ﻪWhat’s VPN. ﻩAn architecture to construct a virtual private connection across a public network. ﻪClassification by ﻩSite-to-Site VPN (usual) ﻩOverlay VPN What’s Site-to-Site VPN ﻪWhat’s Site-to-Site VPN ﻩUsed for replace dedicated line. Tunnel Overlay VPN ﻪWhat’s overlay VPN. ﻩConstructing VPN over overlay network. ﻩOverlay VPN is independent from existing network. 論理的に 等価 The Internet LAN 1 LAN 2 LAN 3 LAN 4 LAN Overlay VPN ﻪTopology ﻩClient/Server ﻪProblem ﻩRequire server ﻯCost, single point of failure, bottleneck. Company The Internet Branches Company VPN The Internet VPN LAN LAN LAN Outside The Issue ﻪ Can we satisfy both of the following issues? 1. To secure connection between nodes directly. 2. Easy setting if there are many applications. Proposal ﻪSystem that constructs a secure base between user nodes extemporarily. ﻪELA (Everywhere Local Area network) ELA ～Abstract～ Abstract of ELA ﻪPurpose ﻩTo construct a secure base between user nodes ﻪMethod ﻩELA constructs an overlay VPN between user nodes extemporarily. The Internet VPN Example of the Utility ﻪUse applications that user nodes connect each other directly ﻩInstant Messenger, Video Chat ﻪUse applications for LAN ﻩGroupware ﻩWindows Network, NFS ﻩSome network games ﻪAssumption ﻩAll user of nodes are acquaintance ﻩUnder 30 nodes. The reason ELA constructs Overlay VPN ﻪThere are 3 reasons. ﻩNo modification of existing applications. ﻩLittle risk of security. ﻩIndependent network from unknown users. Protocol Issue ﻪTransport Protocol used by VPN ﻩNodes in NAT connects other node with TCP easily. ﻩUDP is more simple protocol than TCP. Protocol Merit Demerit TCP Node in NAT connects other node easily TCP over TCP UDP Simple and Fast Requirement of port forward setting in NAT Remarkable Points of ELA ﻪNetwork of ELA ﻩOverlay VPN ﻩP2P Topology ↑ ﻯELA creates automatically. ﻪTunneling Protocol ﻩUse 2 protocols as a restrict of network. ﻯUDP if there is no restrict by NAT or firewall. ﻯTCP if node cannot use UDP. ELA ～Design～ Image of ELA ﻪELA constructs a virtual network. ↑Define this as ELA-VPN ELA-VPN Position of ELA ﻪELA relays a data over ELA-VPN ﻩUsers can use application like in LAN. ﻩELA replays a data via other node if necessary 10.0.0.1 Application 10.0.0.2 ELA ELA Data flow by ELA 10.0.0.3 Application ELA The Internet Example of how ELA is used 1. Starting ELA ﻩ ﻩ Type “ela”, and ELA requires user authorization. “ela0” network interface is created. 2. Communication using IP address of ELA-VPN ﻪ For example, a node uses samba and fetches the PDF file from other node. # ela # ifconfig ela0 ela0 Link encap:Point-to-Point Protocol inet addr:10.0.0.1 P-t-P:10.0.0.1 Mask:255.255.255.0 UP POINTOPOINT RUNNING NOARP MTU:1400 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:10 RX bytes:0 (0.0 b) TX bytes:0 (0.0 b) Step 1 # smbclient \\\\10.0.0.3\\home -U sada Smb: \> get thesis.pdf Step 2 Sequence of Start inside ELA 1. Preparation 2. Constructing ELA-VPN 3. Using ELA-VPN 1. Preparation 1. Look up other node. • • ELA doesn’t have this future. Look up other node of ELA-VPN by using WWW or E-mail 2. User Authentication • • Nodes of ELA-VPN share list of users. Nodes authenticate a new node with list of users. 1. Preparation 3. ELA assigns private IP address on ELA - VPN. • New node can use IP address not used by the other nodes. 4. ELA classifies into 2 types. • Core node (CN)： • • • The node can send and receive a data with UDP. The node can be connected from other nodes with TCP. Edge node (EN)： • • Except CN. The node can connect to other nodes with TCP. ２．Constructing ELA-VPN ﻪClockwise rotation by ID ﻩID = hash(IP address) ﻪCN: ﻩInside of P2P network. ﻩCNs make full mesh topology, and connects each other with UDP. ﻪEN: ﻩOutside of P2P network. ﻩEach EN connects to CN whose ID is next of the EN. 3. Connection Over ELA-VPN ﻪAll core nodes share the routing table. ﻩKey: ID ﻩValue: ﻯIf CN, IP address on the Internet. ﻯIf EN, IP address on the Internet of Core Node that EN connects to. Example of Relay ﻪNode 27→14 ﻩNode 27 : relay to 3 ﻩNode 3:search from routing table → relay to 16 ﻩNode 16: relay to 14 ﻪNumber of maximum relay is 3. Required Futures ﻪConstructing P2P network ﻩConstructing topology ﻩRouting ﻪUsing as VPN ﻩNetwork Pseudo Device ﻩCapsulating ﻩSending, Receiving ELA ～Implementation～ Structure of modules Application Send IP packet Receiving IP packet ELA Constructing Topology Send Capsulated IP packet Update Send Message Search Routing Receive Capsulated IP packet Routing Table NO Is to me? YES Capsulating User layer Sending Message Recieving Recive data Kernel layer Network Pseudo Device When sending a data ﻪApplication ﻩSending a data ﻪNetwork Pseudo Device ﻩGetting an IP packet. ﻪCapsulating Module ﻩCapsulating ﻪRouting Module ﻩSearching the node to relay ﻪSending Module ﻩRelaying to other node. When relaying a data ﻪReceiving Module ﻩReceiving a data which is not to me. ﻪRouting Module ﻩSearching the node to relay ﻪSending Module ﻩRelaying to other node. When receiving a data ﻪReceiving Module ﻩReceiving a data which is to me ﻪCapsulating Module ﻩEncapsulating ﻪNetwork Pseudo Device ﻪApplication ﻩGetting a data Proto-type Implementation ﻪEnvironment ﻩRed Hat Linux 7.2 (Kernel 2.4.18) ﻪImplementation Method ﻩC Language ﻩNPD is implemented at Kernel layer ﻩThe others are implemented at User layers Implemented Modules ﻪFinished ﻩNPD, Capsulating Module, Sending Module, Receiving Module ELA ～Evaluation～ Evaluation ﻪQualitative Evaluation ﻩHow easy to construct between many user nodes? ﻪQuantitative Evaluation ﻩOverhead of ELA ﻩRelation between relay count and delay Qualiative Evaluation ﻪComparing with … ﻩPoint-to-Point VPN ﻩClient/Server VPN Qualiative Evaluation Cost Saving work of users Automatic selection of Tunneling Protocol Many nodes Point-to-Point型 Client/Server型 ○ △ × × ○ × ELA ○ △ ○ × ○ ○ ﻪELA is most suitable when many nodes construct VPN each other! Quantitive Evaluation ﻪEvaluation Environment ﻩConstructin on VMware ﻯPC (CPU Pentium4 EE 3.6GHz, Memory 2.0GB) ﻩHost OS: Windows XP (SP1) ﻩGuest OS: Knoppix 3.1 for VMware VMware ① VMware ① ② ② 192.168.88.128 192.168.88.132 ③ 192.168.88.133 TCP UDP ④ 192.168.88.134 ③ EN 10.0.0.3 CN 10.0.0.1 CN 10.0.0.2 ELA-VPN ④ EN 10.0.0.4 Overhead of ELA ﻪ Measuring RTT by using Ping 1. No ELA （①⇔②） 2. ELA, tunneling protocol is UDP（①⇔②） 3. ELA, tunneling protocol is TCP（①⇔③） VMware ① ② １ VMware ① ② ２ CN ③ UDP TCP ④ ③ EN CN ELA-VPN ④ EN Result of Overhead of ELA 1.4 1.219 RTT (msec) 1.2 1 0.892 0.8 0.6 0.4 0.304 0.2 0 Without ELA With ELA （UDP) With ELA （TCP) With/Without ELA ﻪThere is overhead by ELA. ﻪThere is more overhead when TCP than when UDP. Relation between relay count and delay ﻪMesuaring RTT by using ping ﻩ ﻩ ﻩ ﻩ 1 relay （③⇔①） 2 relays （③⇔① ⇔② ） 3 relays （③⇔① ⇔② ⇔④） ※ There is no case of more than 4 relays. CN ③ EN VMware ① ② ３ ELA-VPN UDP TCP CN ④ EN Result of between relay count and delay 3 2.453 RTT (msec) 2.5 1.799 2 1.5 1.219 1 0.5 0 1 hop 2 hops ﻪMore relay counts, more delay. ﻪBut they are a little delay. 3 hops Related Work Related Work ﻪIVGMP (Internet VPN Group Management Protocol) ﻩOne VPN System ﻩEvery nodes connects to other with IPSec. ﻩVNOC provides a policy. ﻩNo mention to detail of VNOC and topology. Future Works and Conclusion Future Works ﻪImplementation ﻩConstructing Topology Module ﻩRouting Module ﻪEvaluation ﻩUse ELA at an actual environment ﻯHow scalable? How robust? ﻪImprovement of Design ﻩSupports QoS, Improvement of scalability. Conclusion ﻪProposal of ELA ﻩPurpose is to construct secure base. ﻪDesign ﻩELA constructs VPN over P2P network. ﻪEvaluation ﻩELA is most suitable when constructing VPN between many user nodes. ﻩOverhead is little Thank you. ﻪThank you for your kind attention! トポロジ構築モジュール ﻪP2Pネットワークの形成＆維持 ﻩノードの参加処理（認証、IPアドレス割当など） ﻩノードの種類に基づくP2Pネットワークの形成 ﻩノードの参加・離脱に応じてルーティングテー ブルを更新 ルーティングモジュール ﻪコアノードの場合 ﻩ通信内容の転送先を、ルーティングテーブルを参照し て決定 ﻪエッジノードの場合 ﻩ常に親のコアノードに転送指示 NPD (Network Pseudo Device) ﻪ仮想ネットワークデバイス ﻩアプリケーションがELA-VPN上のノードと通信 する際に利用 ﻩELA-VPNにおけるIPアドレスやネットマスクを 割当て カプセリングモジュール ﻪ送信時 ﻩIPパケットのカプセリング（ELA独自のヘッダの付加、 ペイロードの暗号化） ﻪ受信時 ﻩIPパケットのカプセリング除去 送信モジュール ﻪルーティングテーブルの指示に従い、デー タを送信 受信モジュール ﻪ他ノードからデータを受信 ﻩメッセージ：トポロジ構築モジュールへ ﻩ自分宛のIPパケット：カプセリングモジュールへ ﻩ他ノード宛のIPパケット：ルーティングモジュールへ Related work (2) ﻪIPv6 P2P VPN システム ﻩ株式会社DITが開発 ﻩIPv6 のIPsecを用いたVPN ﻩEnd-to-Endの通信 ﻯ管理が煩雑化 ﻩIPv6 の導入が必要