Policy Based Architecture for Active and Programmable Network Management S. Rajeev1, K.V. Sreenaath2, A.S.Bharathi Manivannan3 1 Department of Electronics & Communication Engineering 2 Associate Software Engineer, Computer Associates, Hyderabad, India 3 Software Engineer, Caritor, Chennai, India Phone: (0422) 2572177 ext. 4436 E-mail: [email protected], [email protected],

Abstract: Active Network is a network where the nodes are dubbed active that can look inside packets and run the executable code in those packets. Real Time implementation of Active Networks has several important criterions that should be met for successful implementation. The policy-based approach can be used to manage different aspects of a network that are commonly known as policy disciplines [1]. Some examples of policy disciplines are Service Level Agreement (SLA), Quality of Service (QoS), Security, and IP address allocation [2]. Policy-based networking configures and controls the various operational characteristics of a network as a whole, providing the network operator with a simplified, logically centralized, and automated control over the entire network. Policy Based Management of Active Networks satisfies all the major criterions for efficient real time implementation. Keywords: Active Networks, Policy Based Network Management, Service Level Agreement, Quality of Service, Modified Bloom Filter. 1. Introduction The concept of Active Network is to move from static routers to active nodes that can handle "smart packets" (also called capsules) that have their own executable code. Alternatively, the capsule may contain a pointer that references some code already located on the network. Network nodes may change their behavior based on the code or modify the capsule contents in order to affect network nodes down the line. A capsule may also define its own path through the network. Policies are rules that govern the overall functioning of the system. . Policy Based Network Management (PBNM) is an over-arching technology for an automated management of networks [12, 13]. Policies encode the high-level goals and requirements of management. Policy based management is being adopted widely for different domains like Service Level Agreement (SLA), Quality of Service (QoS) [3], Security and Virtual Private Networks (VPNs) [2]. Active and Programmable networks has fundamental management issues such as SLA, QoS, Security, Self Configuration management that are crucial for its successful implementation. Policy based management of active networks addresses all the major issues in real time implementation. In this paper we propose a policy based framework for active and programmable network tested using Network

Processors [11]. A Service Level Trading [4] (SLA) algorithm for SLA trading between passive and active routers is developed along with real time implementation of Modified Bloom Filters [5] for compatibility of active networks with existing routers. The paper is organized as follows. Implementation issues of active networks are given in section 2. Architectural framework for Policy Based Management of Active Networks is presented in section 3. The SLA Trading Algorithm is explained in section 4. Test Results and Observations are provided in section 5. Conclusions are drawn in section 6. 2. Implementation Issues of Active and Programmable Networks in Real Time Implementation of active networks in real time is a difficult task. There are many issues that need be addressed while implementing active networks in real time. Some of the key issues are • Self Organization of Active Networks Active or programmable networks are used to manage and control mobile ad hoc operation and other legacy networks. Hence they should be highly self-organized and dynamic in nature that can function without the intervention of a human administrator. To achieve these for real time implementation of active networks policy based approach should be adopted. • Tradeoff in amount of Code versus data Tradeoff between the length of the code and the length of data is another important aspect in the success of real time implementation of active networks. There must be an optimized level of code that should be injected along with data in programmable networks. Several bytes of code that functions on few bytes of data in a packet virtually becomes an inefficient one. Thus there should be a tradeoff between the length of the code and length of the data for effective functioning of active networks. The optimized length of code and data are necessary for providing good QoS that adapts to link quality which can be achieved by means of writing high end policies. • Compatibility of active networks with existing routers Much of the existing routers are passive in nature which are not adaptable to active networks. With the implementation of active code and active networks, compatibility of existing passive routers in such a network becomes an important criterion. This can be achieved by means of effective Service Level Trading between the passive routers and active routers on handling packets with active codes. • Authentication and Authorization The active code can contain compressed form of data to be transported which needs to be authorized before processing them to prevent any malicious activity that may affect the entire network. This adds another level of complexity to the success of active and programmable networks. Routers are Policy Enforcement Points (PEP) on which authorization, accounting and other relevant policies can be enforced. Policy Server (Policy Decision Point-PDP) and Authentication, Accounting and Authorization (AAA) server can be used for authorization, authentication and accounting of the packets of active network. Distributed Substring Authentication Protocol (DSAP) [6] can be used as an effective authentication mechanism

3. Architecture The framework of the “Policy Based Active and Programmable Networks” is given Fig.1. The Diffserv architecture [7] of real time implementation is considered here. The architecture describes the management framework between two Diffserv domains: Domain 1 and Domain 2. Domain 1 consists of an active router A1, two passive routers P1 and P2 and a SLA Trader. An active router is a router which is compatible for processing and routing packets of an active network while a passive router is a router which is capable of routing packets of only a passive network. Domain 2 consists of two active networks A1 and A2, a passive router P1, a Policy Domain and a SLA Trader. The policy domain consists of a Policy Server, AAA (Authorization, Authentication and Accounting) Server, a Policy Management Console (PMC), Directory Server and Other Policy Relevant Servers. The Policy Server serves as the decision taking point in the active network. PMC is the console through which the policies are entered by the administrator. AAA server is responsible for authorization, authentication and accounting in the active network. High end policies are stored in the Directory Server. The communication between the Policy Server and the Directory Server is through

Fig.1 Policy Based Architecture for Active and Programmable Networks

Light Weight Directory Access Protocol (LDAP) [8]. The policy server is connected to other policy relevant servers such as Time servers and Certificates servers. The SLA Trader is the component through which the Service Level Agreement Trading between the routers within the same domain or in different domains takes place. 3.1 Component Interaction through Routers and Policy Server Policies are stored in the directory server while the authorization, authentication and accounting information are stored in the AAA server. Let us consider a packet with code and data arrives in the Domain 1 and routed to P1. P1 is a passive router which is not capable of handling packets of active networks. Initially authentication and authorization of the arrived packet needs to be resolved. Hence P1 queries the nearest Policy Server, which in this case is in Domain 2. The Policy Server takes the relevant polices for that

packet and then contacts the AAA server and responds back. Only if the packet is found to be from a legitimate source it is further processed. All the relevant policies are enforced in all the PEPs. In order to process the arrived active network packet, P1 should send it to any other active router within the same domain or in another domain. To know which neighboring routers are “active routers”, Modified Bloom Filters [5] are used. (Explained in section 3.2). After membership test, a suitable active router is found, which, in this case is A1. Then a Service Level Agreement is traded between the two routers i.e. P1 and A1 with the help of the SLA Trader and using the SLA trading algorithm given in section 4. After a suitable agreement is traded and accepted A1 processes the active network packet. SLA Trader is the component which implements the SLA Trading algorithm given in section 4 fro SLA Trading between the routers. If in case there exists no active router within the same domain and is available in some other domain, then the Service Level Agreement between the two routers which are in two different domains takes place through the SLA Trader component in the two domains. 3.2 Compatibility of active networks with existing routers using Modified Bloom Filters Compatibility of existing passive networks with active networks is achieved by means of Modified Bloom Filter and SLA Trader Component. A Modified Bloom filter [5] is a simple space efficient data structure for representing a set in order to support membership queries. It is a way of using hash transforms [9] to determine set membership. It has lower error rate and higher rejection time when compared to the Conventional Bloom Filter [9] and hence used in real time active networks. Consider an N element Modified Bloom Filter (Vector) used to represent, for example a set of Routers. All cells are initialized to ‘0’. 1 0 0

2 0 0

3 0 0

4 0 0

5 0 0

6 0 0

7 0 0

8 0 0

9 0 0

10 0 0

11 0 0

12 0 0

Let us assume that we use 3 hash transforms for demonstration h1, h2 and h3. The filter is first updated with the word ‘A1’. When the various hash transforms are applied, let us assume the following results: h1 (A1) = 3; h2 (A1) = 7; h3 (A1) = 1; time_of_updating (A1) = ‘00:00:01’;

Next the filter is updated with the word ‘A2’. Again, let us assume the following results after hashing: h1 (A2) = 4; h2 (A2) = 12; h3 (A2) = 9; time_of_updating (A2) = ‘00:00:03’;

After hashing, the filter is updated with the results: 1 A1 00:00:01

2 0 0

3 A1 00:00:01

4 A2 00:00:03

5 0 0

6 0 0

Applying membership test to a router ‘A3’,

7 A1 00:00:01

8 0 0

9 A2 00:00:03

10 0 0

11 0 0

12 A2 00:00:03

h1 (A3) = 12; h2 (A3) = 1; h3 (A3) = 4;

Now, the fields of cells 12, 1 & 4 are compared: Cell 12: Bit: set. Time of updating: 00:00:03 Cell 1: Bit: set. Time of updating: 00:00:01 Cell 4: Bit: set. Time of updating: 00:00:03

Since the times of updating are not the same, ‘A3’ is rejected as a non-member and hence it is not an active router to which the packets can be passed. This process of membership test for all the neighboring routers is tested using the Modified Bloom Filter. In this way a list of all the neighboring active routers are hashed and entered into the Modified Bloom Filter of the passive router. When the passive router wants to find out a neighboring router which can process the packet form the active network then it tests the membership of all the neighboring with the Modified Bloom Filter. When the membership of a neighboring router is confirmed then it means that it is an active router. The passive router then trades the Service Level Agreement with that active router using the SLA Trading Algorithm given in the following section. Once a suitable agreement is agreed upon between the routers the packet is passed on to the active router. In this way compatibility with existing routers is achieved. 4. SLA Trading Algorithm An SLA Trading algorithm for trading in active networks is given in Table 4.1, 4.2. A passive provisioning algorithm does wait for requests from its customers to select as to which resources to buy. Whereas an active provisioning algorithm [10] tries to forecast future needs, and will reserve resources (active routers) in advance. Reserving in advance may be based on statistical information or on trend analysis. UPDATE_PERIOD volume() send bid() accept bid() known dests MIN_REQUIREDBW MAX_ALLOWED_DELAY MAX_ ALLOWED_PL MIN_ REQUIRED_BC MAX_ ALLOWED_QD MIN_ REQUIRED_TP MAX_ ALLOWED_JI MAX_ ALLOWED_C MIN_ REQUIRED_PP MAX_ ALLOWED_COST

Table 4.1: Parameters : Time for updating : volume function for an SLA object (time x bandwidth) : sends an offered SLA to peer : sends an accept message : reachability list : Minimum required bandwidth : Maximum allowed delay : Maximum allowed packet loss : Minimum required buffer capacity : Maximum allowed queuing delay : Minimum required throughput : Maximum allowed jitter : Maximum allowed congestion : Minimum required physical paths : Maximum allowed cost

Once an SLA trader identifies its needs to buy some resource from any one of its peers, it will have to select one of the bids and buy it. The selection of the bid is made based on

the bid’s value for the SLA trader and its price. For bids of equal value, if no special policy is applied, the bid with the first lower price will be selected. The SLA trader will also have to evaluate whether the selected bid is worth buying using a profitability analysis algorithm. This algorithm helps justifying whether buying that bid is profitable; to make money through selling of derived services. This algorithm also ensures that SLA traders won’t build service loops. Table 4.2: SLA Trading Algorithm struct bid { router_dest, // router destination bw, // bandwidth delay, packet_loss, buffer_capacity, queuing_delay, throughput, jitter, congestion, physical_paths, cost } process trading () { while (true) { for each d in known_router_dests { /* buy bids */ if((bw_to_router(d)>MIN_REQUIREDBW) and (delay_to_router(d)MIN_ REQUIRED_BC) and (queuing_delay_to_router(d)MIN_ REQUIRED_TP) and (jitter_to_router(d)MIN_ REQUIRED_PP)and (cost_to_router(d)
process bid_recv() { while (true) { wait(bid_received(bid)) { if !is_router_dest_known(bid.router_dest) known_router_dests.add(bid.router_dest) } } } boolean is_profitable(bid) { expected_volume = volume(bid)*EXPECTED_USAGE; expected_income = price(bid.dest,bid.bw, delay, packet_loss, buffer_capacity, queuing_delay, throughput, jitter, congestion, physical_paths, cost ) * expected_volume if bid.price < expected_income return true else return false } void make_bid(neighbour, router_dest, bw, delay, packet_loss, buffer_capacity, queuing_delay, throughput, jitter, congestion, physical_paths, cost ) { bid = new Bid(router_dest, bw, delay, packet_loss, buffer_capacity, queuing_delay, throughput, jitter, congestion, physical_paths, cost ) bid.price = volume(bid)*price(router_dest, bw, delay, packet_loss,buffer_capacity, queuing_delay, throughput, jitter, congestion, physical_paths, cost) send_bid(neighbour, bid) }

Trading is performed by the method ‘process trading ( )’ which identifies the bid with the highest volume/cost ratio and finds out if that bid is profitable using the ‘is_profitable (bid)’ method and if found profitable accepts the bid using the ‘accept_bid (bid)’ method. Then for each neighbor (routers) if bid is not already sent then bid is sent for every UPDATE_PERIOD. The profitability is tested by comparing the bid price with the expected income. Bidding with the neighboring routers is done using the ‘make_bid ( )’ method. 5. Test Results and Observations The Test bed consists of two Diffserv domains as shown in Fig.2. The IXP 1200 Network Processors present in each domain were configured as active/passive routers. The SLA Trader is a component that is used for service level trading between routers. The passive routers have Modified Bloom Filter [5] with capacity of 20 cells (N=20) each, that allows them to identify the active routers connected to them, that could process the active code. The modified bloom filter has the main advantage of reduced error rate and increased rejection time, which is more suited for active and programmable networks. The time taken for the number of hash functions required for rejecting a non-member (to identify the active router) is called as rejection time. The expected fraction of false positive

results – cases of non-members (passive routers) being falsely identified as members (active routers) – given the parameter values is called the error rate.

Fig.2 Real Time Test Environment

The Modified bloom filter present in passive router P1 of domain1 was first initialized i.e. all the elements in the vector (20 cells) are cleared as shown below. 1 0 0

2 0 0

3 0 0

4 0 0

5 0 0

6 0 0

7 0 0

8 0 0

9 0 0

10 0 0

11 0 0

12 0 0

13 0 0

14 0 0

15 0 0

16 0 0

17 0 0

18 0 0

19 0 0

20 0 0

In a similar way the passive routers P1 and P2 of domain 2 were also initialized. After initialization the entries of all the neighboring active routers (A1 in domain 1 and A1 and A2 in domain 2) were added in the Modified Bloom Filter of P1. For m= 4 (Number of hash transform=4), the filter was first updated with key A1 (active router A1 in domain1). When the various hash transforms are applied the result was as follows: h1 (A1) = 3; h2 (A1) = 7; h3 (A1) = 1; h4 (A1) = 13; time_of_updating (A1) = ‘12:20:01’;

The updated filter was as shown below 1 1 12:20:01

2 0 0

3 1 12:20:01

4 0 0

5 0 0

6 0 0

7 1 12:20:01

8 0 0

9 0 0

10 0 0

11 0 0

12 0 0

13 1 12:20:01

14 0 0

15 0 0

16 0 0

17 0 0

18 0 0

19 0 0

20 0 0

Next the filter is updated with key AD1 (active router A1 in domain2). When the hash transforms are applied the result was as follows: h1 (AD1) = 4; h2 (AD1) = 6; h3 (AD1) = 2; h4 (AD1) = 15; time_of_updating (AD1) = ‘14:00:05’;

The updated filter was as shown below 1 1 12:20:01 11 0 0

2 1 14:00:05 12 0 0

3 1 12:20:01

13 1 12:20:01

4 1 14:00:05

14 0 0

5 0 0

15 1 14:00:05

6 1 14:00:05 16 0 0

17 0 0

7 1 12:20:01 18 0 0

8 0 0

9 0 0

10 0 0

19 0 0

20 0 0

Next the filter was updated with key AD2 (active router A2 in domain2). When the hash transforms are applied the result was as follows: h1 (AD2) = 19; h2 (AD2) = 11; h3 (AD2) = 8; h4 (AD2) = 14; time_of_updating (AD2) = ‘14:30:23’;

The updated filter is as shown below 1 1 12:20:01 11 1 14:30:23

2 1 14:00:05 12 0 0

3 1 12:20:01

13 1 12:20:01

4 1 14:00:05

14 1 14:30:23

5 0 0

15 1 14:00:05

6 1 14:00:05 16 0 0

7 1 12:20:01 17 0 0

18 0 0

8 1 14:30:23 19 1 14:30:23

9 0 0

10 0 0 20 0 0

Similarly the passive routers P1 and P2 of the domain 2 are also added with the above entries in their corresponding Modified Bloom Filters. After updating the entries for all the neighboring active routers, the passive router P1 on receiving an active code, tests for membership of all the neighboring routers for active router to send the active code for processing. Applying the membership test to P2 in domain1. h1 (P2) = 5; h2 (P2) = 16; h3 (P2 = 12; h4 (P2) = 20;

This computes to vector elements that have been set to ‘0’, thus it is not a member of the set and hence not an active router.

Applying the membership test to A1in domain1. h1 (A1) = 3; h2 (A1) = 7; h3 (A1) = 1; h4 (A1) = 13;

Now, the fields of cells 3, 7, 1 & 13 are compared: Cell 3: Bit: set. Time of updating: 12:20:01 Cell 7: Bit: set. Time of updating: 12:20:01 Cell 1: Bit: set. Time of updating: 12:20:01 Cell 13: Bit: set. Time of updating: 12:20:01

Since the time of updating is the same it is an active router to which the packets are sent for processing after trading with A1 for the service using the trading algorithm given in section 4. This is how compatibility was achieved using Modified Bloom Filter in IXP 1200 network processor for real time implementation of active networks. For m = 4, x =2 (precision of random number), f= 0.3 (fraction of cells set in the filter) (see Fig.3) it was found that the rejection time was 2.886003 to reject P2 and to choose A1 in domain1 to process the code. Fig.5 and Fig.7 shows that the rejection time increases with the increase in the number of hash transforms ‘m’ and the precision of the random number used ‘ x ’. The error rate for m=4, x =2 is given in Fig.4. The error rate was tremendously reduced with the increase in the number of hash transforms ‘m’ as shown in Fig.6 and Fig.8. Modified bloom filer Modified bloom filter

0.009 0.008

25

0.007 Error rate

Rejection time

20 15 10

0.006 0.005 0.004 0.003 0.002

5

0.001 0

0 1

2

3

4

5

6

7

Value of 'f'

Fig.3 Rejection Time (m=4, x =2)

8

1

2

3

4

5

6

Value of 'f'

Fig.4 Error rate (m = 4 )

7

8

Modified bloom filter

Modified bloom filer

20

Error rate

Rejection time

25

15 10 5 0 1

2

3

4

5

6

7

7E-13 6E-13 5E-13 4E-13 3E-13 2E-13 1E-13 0 1

8

2

3

5

6

7

8

7

8

Value of 'f'

Value of 'f'

Fig.5 Rejection Time (m=5, x =8)

Fig.6 Error rate (m = 5 )

Modified bloom filter

Modified bloom filer

25

5E-85

20

4E-85 Error rate

Rejection time

4

15 10 5

3E-85 2E-85 1E-85 0

0 1

2

3

4

5

6

7

8

Value of 'f'

Fig.7 Rejection Time (m=8, x =12)

1

2

3

4

5

6

Value of 'f'

Fig.8 Error rate (m = 8 )

6. Conclusion The Hardware Architecture for Policy Based Management of Active Networks was constructed using IXP 1200 Network Processors. Test Results show backward compatibility of active networks with passive routers by using Modified Bloom Filters in IXP 1200 network processor and also by using SLA Trading algorithm in SLA Trader component. 7. Acknowledgement The authors wish to thank the Network System Design Center In-charge in The Department of Electronics and Communication Laboratory, PSG College of Technology and Intel Inc., for providing facilities to implement the Architecture using IXP1200 Network processors. References [1] D. Verma, “Policy-Based Networking: Architectures and Algorithms”, New Riders Publishing, November 2000. [2] S. Rajeev, S.N. Sivanandam, K. Duraivel, Santosh G. Rao, P. Pradeep “Policy Based Provisioning For Wireless Differentiated Services”, Proc. IEEE 12th Annual Symposium on Mobile Computing and Applications, India 2003

[3] S.Rajeev, S.N.Sivanandam and K.V.Sreenaath, “A Policy Based QoS Management System for Diffserv Based Wireless Networks”, Proc. 12th International Conference on Advanced Computing & Communication ADCOM, India, 2004. [4] S.Rajeev, K.V.Sreenaath and A.S.Bharathimanivannan, “Policy Based SLA for Wireless Ad Hoc Networks”, Proc. International Conference on Service Management, India, 2005. [5] S.Rajeev, S.N.Sivanandam and K.V.Sreenaath, “Modified Bloom Filters for Efficient Congestion Control in Wireless Diffserv Networks”, Proc. IEEE Conference on Personal Wireless Communication (ICPWC), India, 2005. [6] S. Rajeev, S.N. Sivanandam, Santosh G. Rao, P. Pradeep, “The Distributed Substring Authentication Protocol (DSAP) for authentication in wireless devices”, 2nd International Conference on Computers and Devices for Communication (CODEC-04), Kalkatta, Jan. 2004 [7] S. Blake, D.Black, et al.: “An Architecture for Differentiated Services,” IETF RFC 2475. [8] Wahl, M., Howes, T., and S. Kille, “Lightweight Directory Access Protocol (v3)”, RFC 2251. [9] James Blustein and Amal El-Maazawi. “Bloom Filters- A Tutorial, Analysis, and Survey”, Technical Report CS-2002-10. Faculty of Computer Science, Dalhousie University, Canada. [10] Fankhauser .G, Schweikert .D, Plattner .B, “Service Level Agreement Trading for the Differentiated Services Architecture”. Swiss Federal Institute of Technology, Computer Engineering and Networks Lab, Technical Report No. 59. Nov. 1999. [11] Andreas Kind, Roman Pletka, Burkhard Stiller, “The Potential of Just-in-Time Compilation in Active Networks based on Network Processors”, Fifth IEEE Conference on Open Architectures and Network Programming, New York, Jun. 2002. [12] B. Schwartz, A. W. Jackson, W. T. Strayer, W. Zhou, R. D. Rockwell, and C. Partridge, “Smart Packets: Applying active networks to network management,” ACM Transactions on Computer Systems, vol. 18, no. 1, pp. 67–88, Feb. 2000. [13] S. Bhattacharjee, K. L. Calvert, and E. W. Zegura, “An architecture for active networking,” in Proceedings of INFOCOM ’97, Apr. 1997.