Open Programmable Architecture for Java-enabled Network Devices
Download as PPT, PDF0 likes388 views
The document discusses the evolution of programmable network devices and the introduction of intelligent features through a Java-enabled architecture. It highlights the growing market demand for openness and programmability, supported by various industry partners, and introduces the Oplet Run-Time Environment (ORE) as a framework for dynamically deploying services on network devices. Additionally, it addresses key applications like active network management, intrusion detection, and collaboration among network devices, emphasizing the need for secure and efficient performance.
Open Programmable Architecture for Java-enabled Network Devices
- 1. Open Programmable Architecture for Java-enabled Network Devices 9/29/99 1 A Revolution! Tal Lavian Technology Center tlavian@NortelNetworks.com http://openet.lab.baynetworks.com
- 2. 9/29/99 2 Programmable Network Devices Openly Programmable devices enable new types of intelligence on the network
- 3. Agenda • The market is changing • Local Computation • Architecture • New types of applications • ORE - Oplet Run-time Environment • API’s • Summary 9/29/99 3
- 4. 9/29/99 4 Our Market is Changing • Customers demand for Openness & programmability • IEEE P1520 • Lucent’s Programmable Networks • Intel as driving force
- 5. Lucent in Open Programmable Networks • Lucent’s Programmable Network Conference 9/15- 16 9/29/99 5 — Cosponsored: Sun, HP, Oracle, Novell, Compaq ……. — Over 500 participants, enthusiastic response • SoftSwitch as programmable network — 70 developers — Jun 99 - PR, Sept 99 - Prog Conference, October 99 - SDK, Jan 00 - APIs, Feb 00 - Dev Conference, May 00 - 3rd party Test Lab • 7 R/E program • $1.7B- Excel Switching acquisition (Programmable switch) • Other products and directions in Openness and Programmability • Marketing and PR on Lucent’s Openness
- 6. 9/29/99 6 ES - Openet Center • Create an open development community to deliver customer-valued solutions based on Nortel Networks’ and partners’ products and technologies • Openet Center creates a focus to open Nortel Networks platforms • Promotes Open Network Computing • This potentially changes landscape and rules of the networking industry
- 7. Vision: JOOSE - the OS of Choice for Programmable Network Devices • JOOSE - Java Oplet Operation System Environment • JOOSE is OS of choice for routers and network devices. • Be the Microsoft for Routers • (or better way the Linux for Programmable Network Devices) 9/29/99 7
- 8. Agenda • The market is changing • Local Computation • Architecture • Applications • ORE - Oplet Run-time Environment • API’s • Summary 9/29/99 8
- 9. 9/29/99 9 Evolution vs. Revolution HW Net Static Net SW Net SW Intelligence Dynamic Time Performance / Enhancement Logarithmic Now 10M 100M 1G 10G Web Bandwidth x200 Last Mile 56kb ==>10Mb
- 10. 9/29/99 10 Changing the Rules of the Game • Move Turing Machine onto device —Add local intelligence to network devices while (true) { doLocalProcessingOnDevice () }
- 11. 9/29/99 11 Technology Concept Applet Web Server Web Browser The JVM is in the Browser DDoowwnnllooaadd aapppplliiccaattiioonnss ffoorr llooccaall pprroocceessssiinngg Reversed Applet Server
- 12. 9/29/99 12 The Web Changed Everything • Browsers —Introducing JVM to browsers allowed dynamic loading of Java Applets to end stations • Routers —Introducing JVM to routers allows dynamic loading of Java Oplets to routers This Capability WILL Change Everything
- 13. 9/29/99 13 D Example: Doowwnnllooaaddiinngg IInntteelllliiggeennccee Network Device Dynamic loading JVM OS HW Monitor React Authentication Security Intelligence application
- 14. 9/29/99 14 Security and Stability • secure download of Java Applications • safe execution environment —insulate core router applications from dynamically loaded applications
- 15. 9/29/99 15 Device-based Intelligence • Static-vs-Dynamic Agents —Static – SNMP set/get mechanisms – Telnet, User Interfaces (cli, web, etc…) —Dynamic closed-loop interaction on nodes – capable of dealing with new and difficult situations – autonomous and rational properties. – dynamically system monitoring & modification – report status and trends
- 16. Agenda • The market is changing • Local Computation • Architecture • Applications • ORE - Oplet Run-time Environment • API’s • Summary 9/29/99 16
- 17. 9/29/99 17 ORE - Oplet Run-time Environment Service A Service B ORE JVM Oplet 1 Oplet 2 Service C Why ORE?
- 18. 9/29/99 18 Java-enabled Device AArrcchhiitteeccttuurree JNI ORE Service Device HW Oplet JVM Operating System C/C++ API Java API Device Code Oplet Runtime Env Device Drivers JFWD API Download
- 19. 9/29/99 19 Architecture Issues • Green Threads -vs- Native Threads —Native threads: – provides non-interference between Java applications – difficult thread-to-thread communication and sharing of data between threads – creates a dependency on underlying RTOS – multiple JVM instances consume resources —Green Threads – single JVM must manage CPU & memory resources between concurrently running threads
- 20. RRoouuttiinngg ssooffttwwaarree ww// rroouutteerr OOSS Added scalability, Flexibility, extensibility 9/29/99 20 Evolution of Router Architecture LLiinnee ccaarrdd ((ffoorrwwaarrddiinngg bbuuffffeerriinngg)) LLiinnee ccaarrdd ((ffoorrwwaarrddiinngg bbuuffffeerriinngg)) LLiinnee ccaarrdd ((ffoorrwwaarrddiinngg bbuuffffeerriinngg)) LLiinnee ccaarrdd ((ffoorrwwaarrddiinngg bbuuffffeerriinngg)) RRoouuttiinngg ssooffttwwaarree ww// CCOOTTSS OOSS OOSS CCPPUU BBuuffffeerr mmeemmoorryy NNII aass lliinnee ccaarrdd NNII aass lliinnee ccaarrdd NNII aass lliinnee ccaarrdd ...... RRoouuttiinngg CCPPUU BBuuffffeerr mmeemmoorryy CCeennttrraalliizzeedd,, CCPPUU--bbaasseedd MMooddeell DDiissttrriibbuutteedd,, lliinnee--ccaarrdd bbaasseedd MMooddeell CCoonnttrrooll ++ FFoorrwwaarrddiinngg FFuunnccttiioonnss ccoommbbiinneedd CCoonnttrrooll sseeppaarraatteedd FFrroomm ffoorrwwaarrddiinngg
- 21. 9/29/99 21 Explicit Separation of Control Plane from Data Forwarding Control Element Forwarding Routing Shared Memory Forwarding Element Forwarding Element Forwarding Element Packet Flow Forwarding Forwarding Forwarding Forwarding/ Flow/filter Table Traditional device CPU Download Line Card Line Card
- 22. 9/29/99 22 Separation of Control and Forwarding Planes CCeennttrraalliizzeedd,, CCPPUU--bbaasseedd RRoouutteerr FFoorrwwaarrddiinngg--PPrroocceessssoorrss bbaasseedd RRoouutteerr Routing SW Control Plane CCoonnttrrooll ++ FFoorrwwaarrddiinngg FFuunnccttiioonnss ccoommbbiinneedd Control separated FFrroomm ffoorrwwaarrddiinngg CPU CPU Forwarding Processor Forwarding Processor Forwarding Processor Slow Wire Speed
- 23. Application server Control element 9/29/99 23 Open Networking Architecture IP Telephony VPN Server Operating System Network Services Protocol Network Services Objects Network OS Connect Transport Interface Real-time OS Network Si Unified policy-based management Forwarding element Vertical Proprietary Networking Box Level Hardware Proprietary Apps Proprietary NOS Custom Switch ASIC’s Today Open Policy Server Firewall Copyright - Intel
- 24. Dynamic Configuration ooff FFoorrwwaarrddiinngg 9/29/99 24 RRuulleess CPU Forwarding Processor Forwarding Processor Forwarding Processor Forwarding Processor Forwarding Rules SW HW Forwarding Rules Forwarding Rules Forwarding Rules AN Apps
- 25. Real-time forwarding SSttaattss aanndd MMoonniittoorrss 9/29/99 25 CPU SW HW AN Apps Forwarding Rules Forwarding Processor Statistics &Monitors Forwarding Rules Forwarding Processor Statistics &Monitors Forwarding Rules Forwarding Processor Statistics &Monitors
- 26. 9/29/99 26 Dynamic - On the FFllyy CCoonnffiigguurraattiioonn Forwarding Processor Forwarding Processor Packet Policy Filters Dynamic Apps Packet Packet Filte r
- 27. 9/29/99 27 PPaacckkeett CCaappttuurree CPU Forwarding Processor Forwarding Processor Forwarding Processor Forwarding Processor Oplet JFWD to Divert or Copy Wire Speed Packet
- 28. 9/29/99 28 Java Environment • Green Threads -- Present RTOS with single unified task that includes: —Java VM (JVM) —Java Resource Manager (JRM) – thread scheduling – manages CPU utilization –JVM time-slice is managed by the JRM preemptive thread scheduler – internal memory manager (intercepts “new”) – garbage collection with priority based on available memory
- 29. 9/29/99 29 Non-Interference w/ Single JVM • Multiple threads compete for resources —memory —CPU —persistent storage • Denial-of-service attacks possible —memory or CPU consumption attacks —trusted/untrusted service interactions
- 30. Agenda • The market is changing • Local Computation • Architecture • Applications • ORE - Oplet Run-time Environment • API’s • Summary 9/29/99 30
- 31. 9/29/99 31 Applications • Active Network Management — Proactive Network Management — Diagnostic Agents • Dynamic DiffServ Classifier • Active Intrusion Detection • Multicast Caching • IP Accounting • Application-Layer Router-Server Collaboration • Pseudo Default Drop Capability
- 32. No more polling 9/29/99 32 Active Network Management • Download Oplet Service to the device. • Monitor MIB variables • Might be complex conditions • Trend analysis • DiffServ, RMON-II, etc… MIBs • Report “events” to NMS — drop rate, packets/second • Allow Service to take action • Download application • Adjust parameters based on direction from NMS Extensive access to internal resources Monitor Appropriate Application Download Download Complex Condition Exceeded NMS router
- 33. 9/29/99 33 An Open Service API Example —SNMP API for Network Management – generated automatically – allows device-based applications to query MIB – device-based application -- query local MIB – report trends or significant events – initiate downloading of problem specific diagnostic code – take corrective action
- 34. 9/29/99 34 Proactive Network Management • Device-based Intelligence is Dynamic —Static Management – SNMP set/get mechanisms – Telnet, User Interfaces (cli, web, etc…) —Dynamic Closed-loop Management at Network Node – capable of dealing with new and difficult situations – autonomous and rational properties. – dynamically system monitoring & modification – report status and trends —Monitor MIB to identify poor performance and notify NMS prior to failures —Downloaded service can instantiated new services
- 35. 9/29/99 35 Diagnostic Mobile Agents • Automatic trace-route from edge router where problem exists. —Each node reached generates a report to NMS —Trace-route code “moves” to next node in path —Mobile agents identify router health —Create logs for NMS
- 36. Dynamic DiffServ Classifier • Set router filters to sample packets from edge device host ports • Identify real-time traffic (RTP flows) • Set filter on port to adjust DS-byte value based on policy • Keep track of filters set • Remove filters no longer in use 9/29/99 36
- 37. 9/29/99 37 Dynamic DiffServ CCllaassssiiffiiccaattiioonn Forwarding Processor Control Plane Forwarding Processor Policy Filters ORE Service Packet Packet Filte r Packet • Sample packets, set filters to modify DS-byte for Per-Hop-Behavior modification
- 38. 9/29/99 38 Active Intrusion Detection • Intruder is identified by Intrusion Detection software • Intruder signature is identified • Mobile agent is dispatched in direction of intruder (based on physical port of entry) • Mobile agent “chases” intruder and terminates him (shuts down link, reboot host, notify NMS)
- 39. Multicast Caching • Reliable Multicasting • Distribute error control throughout multicast tree • Retransmission a local node keeps control close to lossy links • Balances processor load away from multicast source 9/29/99 39
- 40. 9/29/99 40 IP Accounting • Project ABCD (Active Bean Counter in Device) • Perform usage accounting at edge node • PreCorrelate/aggregate/reduce accounting record on-site • $1 rule for billing • Real-time billing can be realized • Customize billable resources
- 41. 9/29/99 41 Server Collaboration • Supports distributed computing applications in which network devices participate — router to router — server to router • Supports Intelligent Agents • Supports Mobile Agents Java-based Application Java-based Application Java-based Application
- 42. Application Layer Collaboration Among Routers and Servers 9/29/99 42 • Server farm load balancing — server state monitored; rerouting based on congestion/load • Auctioning Applications • Bandwidth Broker
- 43. 9/29/99 43 Collaboration with Business Applications • New paradigm of distributed applications • Network devices collaborating with business applications • Application aware routing JVM Oracle DB E-Commerce Business apps SAP , ERP, Optivity RMI, XML, CORBA Apps Accelar Passport Shasta BayRS BS450 Apps JVM Apps Server Oplet Oplet
- 44. 9/29/99 44 Bandwidth Broker Collaboration • Routers Monitor RMON and DIFFSERV MIB • Report Per-IPAddress, Per Protocol statistic to resource broker • Adjust DS-byte and Per Hop Behavior based on Bandwidth Broker directions
- 45. 9/29/99 45 Dynamic - On the FFllyy CCoonnffiigguurraattiioonn • From downloadable Java application, we can modify the behavior of the ASICs
- 46. Agenda • Our market is changing • Local Computation • Architecture • Applications • ORE - Oplet Run-time Environment • API’s • Summary 9/29/99 46
- 47. 9/29/99 47 Oplet Runtime Environment An Overview • A platform to dynamically deploy services on network elements • Desirable properties — Portable to many different devices — Secure, reliable — Low impact on device performance — Open — Provide a framework to structure code – Reusable, maintainable, robust • Implemented in Java
- 48. 9/29/99 48 ORE - Basic Concepts • Oplet Runtime Environment (ORE) — A kernel that manages the life cycle of oplets and services — Provides a registry of services • Service — The value being added. Minimal constraints, could be anything… — Represented as a Java interface • Oplet — The unit of deployment: a JAR file — Contains meta-data (eg signatures, dependency declarations) — Contains services and other resources (data files, images, properties, JAR files)
- 49. 9/29/99 49 Dependencies • A service S can use facilities provided by another service T • This means that the oplet containing S has a dependency on service T • Before an oplet can be started, all of its dependent services must have be started • ORE manages dependencies and lifecycle of oplets and services
- 50. 9/29/99 50 ORE Architecture Oplet Service Oplet Runtime Environment Java Virtual Machine API Extensions Oplet Service Oplet Service Oplet Service Service
- 51. 9/29/99 51 Oplet Lifecycle • Install — Loaded from URL • Start — Services that are depended on must already be started • Stop — Any oplets that depend on this oplet’s services will be stopped — Code and data can be unloaded from ORE • Uninstall
- 52. 9/29/99 52 Some services • Bootstrap — Basic configuration • Log — Centralized logging for oplets • HTTP server — Simple servlet support • Command line shell • Administration commands — Manage oplets and services
- 53. 9/29/99 53 An Example Servlet Engine Log Native MIB Variables RSVP MIB Group MIB Engine Loopback SNMP Access HTTP Server Traffic Monitor JFWD
- 54. 9/29/99 54 Security Issues • Sandbox — Each oplet provides a Java name space and applet-like sandbox • Signed oplets — Oplets can be signed for assigning trust • Denial of service — Vulnerable to DoS (memory, cycle, bandwidth, peristent storage, monitors) like all Java applications
- 55. 9/29/99 55 ORE Status • Done now — Runs on Accelar and workstations — First release of ORE SDK available internally • To be done — More APIs and services (MIB, JFWD, Wrapper) — Security (authentication) — Oplet updates — Persistent storage
- 56. 9/29/99 56 ORE Future work • Capabilities — Revocable services • Security — Java 2 style permissions • Resource limits, DoS protection — Probably requires support from JVM • Jini, Oplet Directory • Mobile Agents • Open source
- 57. Agenda • Our market is changing • Local Computation • Architecture • Applications • ORE - Oplet Run-time Environment • API’s • Summary 9/29/99 57
- 58. 9/29/99 58 Initial APIs • Console Logging API • Generic MIB Access API • Optimized MIB Access APIs • Trap Interception API • Management Authentication API • Web-Based Management Extensions API • CLI Extensions API • MIB Extensions API • Pluggable Authentication API • Network Forwarding API
- 59. 9/29/99 59 Tools • MIB API — Monitor device Management Information Base variables – MIB – RMON and RMON-II – DiffServ • Network API (JFWD) — Interface to Filters – set packet drop filters – intercept packets – carbon copy packets while forwarding at line-speed
- 60. 9/29/99 60 MIB API Example Java Virtual Machine Client API Abstract Variable Interface MIB Map Native Variable Interface SNMP PDU Layer Instrumentation & Annotation Layer Real Time Operating System Processor and other Hardware Client Bean •API uses a MIB Map to dispatch requests to variable access routines •Different parts of the MIB tree can be serviced by different mechanisms •Two main schemes: •An ad hoc interface to the SNMP instrumentation layer •A generic SNMP loopback
- 61. 9/29/99 61 An Open Service API Example —SNMP API for Network Management – generated automatically – allows device-based applications to query MIB – device-based application -- query local MIB – report trends or significant events – initiate downloading of problem specific diagnostic code – take corrective action
- 62. 9/29/99 62 Java MIB API - Proxy Mode • Uses SNMP loopback mechanism to target a remote network element • API can be used to control devices that don’t have an embedded JVM AApppplliiccaattiioonn SSeerrvveerrss Router with No JVM JSNMP API Proxy mode JVM on PC Java Oplet
- 63. Agenda • Our market is changing • Local Computation • Architecture • New types of applications • ORE - Oplet Run-time Environment • API’s • Summary 9/29/99 63
- 64. 9/29/99 64 Summary • JOOSE - OS of Choice for Open Routers • Programmable —Turing Machine on network devices —dynamic agents vs. static agents —dynamic loading • Our market is changing • Openness - successfully proven paradigm —Facilitates innovation —Domain experts - virtual development community —With 3rd parties we can change the networking landscape • Application aware routing
- 65. 1903 the Wright brothers 9/29/99 65 This is only the first step Compare to this first flight and look where aviation is today
- 67. 9/29/99 67 Why Java • Dynamic Loading • Reuse security mechanisms —byte-code verifier —security manager —classloader • System stability —constrains applications to the JVM —Prohibits native code applications • Extensible, portable, & distributable services
- 68. • Intel web hosting - BIG pipes • Last mile bandwidth x 200 • Multimedia and new applications will drive the demand. 9/29/99 68 Bandwidth x200 - start of new demand Bandwidth Content Applications
- 69. 9/29/99 69 The P1520 Reference Model Algorithms for value-added communication services created by network operators, users, and third parties Algorithms for routing and connection management, directory services etc. Value Added Services Level Virtual Network Device (software representation) Physical Elements (hardware, namespace) L interface Network Generic Services Level Virtual Network Devices Level End User Applications V interface U interface CCM interface PE Level
- 70. 9/29/99 70 CSIX Consortium • Common switch interface for switch fabric independence — www.csix.org — Detailed interface specification between port/packet processor logic and interconnect fabric logic — Similar to common media interface such as Utopia, but for switch fabric interface — Targeted at scalable switches at higher end — Permits mix-and-match of silicon and software components
- 71. 9/29/99 71 Multi-Services Switching Forum (MSF) www.msforum.org • Open Multi-service Switching — Common transmission and switching infrastructure — Modular, layered architecture — Integration at a module level through open interfaces — Multi-vendor model with 3rd party software options SSwwiittcchh AAddaappttiioonn SSwwiittcchh AAddaappttiioonn Voice Service IP Services Source: MSS ATM Services
Editor's Notes
- #10: The Internet has had a profound, and not-yet-complete impact on the ways corporations do business with other corporations, governments, and consumers. The “Net Economy” is based on the fact that companies can be connected to each other without regard to the barriers of distance, time zones, and differing legacy computing systems. Thus, companies are free to seek business relationships with customers and suppliers based on the greatest economic return. In addition to reducing the costs of doing business with its existing business partners, a company can now establish new business relationships based on its business assets. (word choice here). Marketmakers - Deliver services to large communities of partners, suppliers and customers e.g. Citibank Commerce Leaders- Set up commerce shops to transact business outside corporate boundaries e.g. GMBuyPower Service Providers - Supply hosted communications & commerce services to consumers & small-medium businesses e.g. Netcom
- #70: U interface -- provides a means for creating a representation of specific services (DIFF SERV or INT SERV).