Upload
cori-parsons
View
214
Download
0
Embed Size (px)
Citation preview
Walt Burkhart
Andrew Chien (adjunct)
kc claffy (adjunct)
Keith Marzullo (chair)
Joe Pasquale
Stefan Savage
Alex C. Snoeren
Amin Vahdat
George Varghese
Geoff Voelker
What do you mean by Systems? Networking?
Systems. Noun. From Greek systEmat: “to combine”1. Degenerate branch of computer science, combining
bits of Theory, AI, Architecture, PL/Compilers, Crypto, Databases, etc for crass utilitarian purposes.
Networking. Noun. (1560)1. The study of systems that communicate. 2. The study of relevant systems.
Here, systems, networking (and security) all blur together.
We’re interested in solving real or emerging problems by designing, building and measuring real hardware and software artifacts.
UCSDSystems & Networking
Large group 10 faculty, ~40 students, 4 full-time staff
Broad interests High-speed storage, fault-tolerance, network &
system security, routing protocols, overlay networks, virtual machines, distributed programming, wireless networks, distributed debugging, content caching, router design, network measurement, distributed authentication, self-managing/adaptive systems, peer-to-peer systems, applications of economics/game-theory, mobile code, multimedia, grids, scheduling, etc….
Resource rich$10M+ in committed $$$ ~80 workstations, 400+ servers,
10’s of TB of storage, 10Gbps uplink, unmatched network monitoring, programmable wireless infrastructure
Good surf + high-quality espresso machine + biometric soda machine
Quick Horn Tooting
• Faculty (great)– 7 Sysnet faculty hired in last decade have all turned
down tenure-track offers at “top 5” schools to be here
– 2 Sloan Fellows, 2 ACM Fellows, 1 IEEE Fellow, 5 NSF Career/PYI winners, and 1 ONR PYI winner
• Research record (great)– In last nine: 13 SOSP/OSDI, 19 NSDI/USITS, 23
SIGCOMM, 16 INFOCOM, 6 SIGMETRICS– 12 award papers, >20 “most cited” in CiteSeer
• Bottom line: We do okay...
But… who cares?
This is all irrelevant crap!
Pick your Ph.D. program
based on where you will do
the best work
Some Recent Efforts
• Routing– Distributed Rate Limiting
• Wireless– Jigsaw/Shaman
• Measurement & emulation– dK-series
• Security– Tint/Neon/Storm…
Ken
kc
Internet Routing• Quality of wide-area routing
[SIGCOMM 99]
• Flexible inter-AS routing [SIGCOMM00, JSAC01]
• Exploiting multi-path for reliability [SOSP01, IMC03 (2)]
• Impacts of “HotPotato” routing [SIGCOMM02, SIGMETRICS04, SIGCOMM04, PAM05]
• Debugging routing failures [NSDI05,INFOCOM07]
San Francisco
Dallas
New York
ISP network
dst
9 1011
San Francisco
Dallas
New York
ISP network
dstdst
9 109 101111
Cloud Control• Resources and clients are across the world• Services combine these distributed resources
1 Gbps
Distributed Rate Limiting
• Make distributed feel centralized– Packets should experience same limiter behavior
S
S
S
D
D
D
0 ms
0 ms
0 ms
Limiters
High-speed Network Processing
• Goal: Need to process network traffic in-line at high speeds– E.g., 40 Gbps using limited (< 4Mbyte) SRAM with 1 nsec access
time using a few memory references.
• Deficit Round-Robin Scheduling [SIGCOMM95]
• Forwarding Lookups [SIGCOMM98, SIGCOMM00]
• Packet Classification [SIGCOMM98, SIGCOMM99,SIGCOMM01, Infocom 03, SIGCOMM03]
• Interface Statistics [SIGMETRICS03]
• Security processing [Infocom03,IMC04, OSDI04]
• Flow Measurement [SIGCOMM02, IMC03,SIGCOMM04, IMC05,SIGMETRICS05]
The Dude
Bottom line:
Every packet you send on
the Internet uses several of
these algorithms
Network MeasurementAnalysisMeasurement
1
22
3
2
4
2
2
5
Tim
e
• Measurement Tools (e.g., loss, BW) [USITS99,IMW02, SIGCOMM03, USENIX04, ToN04, IMC04, PAM05 ]
• Routing [SIGCOMM99, IMC03, SIGCOMM04, SIGMETRICS04, PAM05]
• Web & content distribution [USITS99, SOSP99, USITS01, WWW04, Infocom01, WCW01, WCW02, IPTPS03]
• Security Measurements [USENIX Sec01, IMW02, S&P03, S&P04, TOCS06, IMC06]
Graph Rescaling: dK series
1K 2K 3K
ModelNet: Scalable Network Emulation
[OSDI02, MASCOTS03, MASCOTS04]• Goal: answer “what if” questions
about network & application changes
• Step 1: specify target wide-area topology– Labeled w/BW, latency, loss
rates, etc.• Step 2: map topology to router
core
• Step 3: run real applications on end systems
GbSwitch
100MbSwitch
EdgeNodes
RouterCore
ModelNetcore
ipfw
Routelookup
pipe 12 pipe 43 pipe 26
IPOutput
10.1.1.410.1.2.3
VNs10.1.1.1-10.1.1.10
VNs10.1.2.1-10.1.2.10
Edge Node A Edge Node B
IP packet
del ay l oss
ModelNetcore
ipfw
Routelookup
pipe 12 pipe 43 pipe 26
IPOutput
10.1.1.410.1.2.3
VNs10.1.1.1-10.1.1.10
VNs10.1.2.1-10.1.2.10
Edge Node A Edge Node B
IP packet
del ay l oss
del ay l oss
RackNRack1
Virtual Clusters
VLAN Switch
UsherCtrl, Bind, SQL, LDAP, RO
NFS
RW NFS
node3VMM
nodeNVMM
VLAN Switch
node1VMM
node2VMM
node3VMM
node4VMM
nodeNVMM
LNM VM1
VMM (Xen)
VMN
Time Dilation
• Change OS’s perception of time via virtual machine• Physical resources appear faster
• 1-Gbps,100ms link appears as 10-Gbps,10 ms w/TDF=10• Test impact of future network hardware
DieCast
VMM
VMM VMMVMM
Gigabit Switch
VMM VMM
ModelNetModelNet
Gigabit Switch Gigabit Switch
Gigabit Switch Gigabit Switch
LoadBalancer
• Goal: test new service at scale– Similar hardware, software, workload, etc
• But without the overhead of scale
Wireless Networking• Transport-layer Mobility
[Mobicom00,USITS01]• 802.11 use characterization
[SIGMETRICS02]• 802.11 Hotspot architecture
[PCM02, WMCSA02, WMASH03]• Energy Efficient Protocols
[Sensys03] • 802.11 Denial-of-Service
[USENIX Security03]• Congestion vs Wireless loss
differentiation [MMCN02, ToN03]
• 802.11 Fast Handoff (SyncScan) [Infocom05]
• Location services and characterization [Mobisys05, M2CN06]
• Comprehensive monitoring [SIGCOMM06]
DNS ServerDNS Server
Mobile Hostfoo.bar.edu
Mobile Hostfoo.bar.edu
Location Query(DNS Lookup)Location Query(DNS Lookup)
Location Update(Dynamic DNS Update)
Connection Migration
Location Update(Dynamic DNS Update)
Connection Migration
yyy.yyy.yyy.yyy
CorrespondentHost
0
100
200
300
400
500
600
700
800
1 9 17 25 33 41 49 57 65 73 81 89 97 105 113 121 129 137 145 153
time (s)
pa
ck
ets
Attacker WinXP Linux Thinkpad Linux iPaq MacOS X
Jigsaw: Enterprise-scale 802.11 Monitoring/Analysis
• Goal: understand how production WiFi networks really work, or don’t work, and why.
• >190 software-defined 802.11 radio monitors
• Global view of wireless activity– All frequencies in all space (>1M ft3)
• Passive broadcast-based time synchronization (order 1us)
• Reconstruct traffic view at each layer (physical, datalink, network/transport)– Can directly see contention, broadband
interference, layer interactions, etc• Automatic cross-layer diagnosis of
problems
CCIED• Collaborative Center for Internet Epidemiology and
Defenses (“Seaside”)– Joint UCSD/ICSI project, 1 of 4 National CyberTrust Centers – Focused on threats posed by large-scale host compromise
• Worms, viruses, botnets, DDoS, spam, etc– Supported by >$7M from NSF, Microsoft, Cisco, Intel, HP,
Symantec, Ericsson, VMWare, AT&T, Sun, Qualcomm
• Three key areas of work– Network Epidemiology– Automated Defenses– Forensic, legal, economic drivers
• See: http://www.ccied.org
Potemkin Honeyfarm
• Provide the illusion of millions of honeypots– But use a much smaller
set of physical resources– 1 Million IP addresses on
10s of physical hosts
• Gateway multiplexes traffic onto multiple virtual machines (VMs)
• VMM multiplexes multiple VMs on physical servers
Vrable et al., Scalability, Fidelity, and Containment in the Potemkin Virtual Honeyfarm, SOSP 2005.
Currently, largest high-fidelity honeyfarm on planet
Outbreak Defense• Modern worms can infect
>1M hosts/sec [S&P03,WORM04]
• Need to detect and block new outbreaks << 1 sec [Infocom03]
SRC: 11.12.13.14.3920 DST: 132.239.13.24.5000 PROT: TCP
00F0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................0100 90 90 90 90 90 90 90 90 90 90 90 90 4D 3F E3 77 ............M?.w0110 90 90 90 90 FF 63 64 90 90 90 90 90 90 90 90 90 .....cd.........0120 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................0130 90 90 90 90 90 90 90 90 EB 10 5A 4A 33 C9 66 B9 ..........ZJ3.f.0140 66 01 80 34 0A 99 E2 FA EB 05 E8 EB FF FF FF 70 f..4...........p. . .
PACKET HEADER
PACKET PAYLOAD (CONTENT)
SRC: 11.12.13.14.3920 DST: 132.239.13.24.5000 PROT: TCP
00F0 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................0100 90 90 90 90 90 90 90 90 90 90 90 90 4D 3F E3 77 ............M?.w0110 90 90 90 90 FF 63 64 90 90 90 90 90 90 90 90 90 .....cd.........0120 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 ................0130 90 90 90 90 90 90 90 90 EB 10 5A 4A 33 C9 66 B9 ..........ZJ3.f.0140 66 01 80 34 0A 99 E2 FA EB 05 E8 EB FF FF FF 70 f..4...........p. . .
PACKET HEADER
PACKET PAYLOAD (CONTENT)
Earlybird: Line-rate network inference of worm signatures [OSDI04]
Derived Data Management
• Modern organizations wish to enforce a range of information management policies– Who may access data?– How it is accessed?– What it can be used for?
• Why?– Regulatory constraints– Trade secret protection– ID Theft– Brand Damage
However…• While most policies are about data…
– “Customer records should be encrypted on disk”– “GPLed files should not be used to build product binaries” – “Trade secret data should not leave the corporate network”
• Most enforcement mechanisms are about data containers– Encrypted files (e.g. EFS), File-based authentication– VPNs+ routing restriction (must route via mothership)
Data-oriented policy management
• Tag data with its policy• Tag any data derived from other sources with the
union of their policies• Policy tags should be preserved on disk and
across network (in enterprise)• Enforce policy during I/O
– Data leakage: no packet with “corp only” policy tag should be allowed to leave access routers
– Forced encryption: buffer with “must encrypt” policy tag must be encrypted before being written to disk
Neon: Derived Data Tracking
• Track information flow through host and network• Data is ‘tinted’ based upon its source
– Tint propagates from inputs to outputs– Implemented at the VMM level to support any OS
• Enables enforcement of data management polices – Name/SSN always encrypted on disk, Cisco source code never
leaves company, product never/only dependent on GPL, etc
+ =
Tons of other stuff…• Runtime/PL Support for Distributed Computing
[NSDI04, PLDI07]
• Low-overhead link-state routing• Machine-learning for protocol recognition
[IMC05]
• Modeling dependent failures [DISC05, EuroPar05, USENIX05, ICDCS03]
• Automated Availability Management [NSDI04, Infocom06]
• Resource Management in Federated Systems [SOSP03,WEPPS05,HPDC05,HOTOS05,EMNets05,Infocom05]
• Constant-time QoS scheduling [SIGCOMM03]
• Grid protocols, storage, group membership, etc…
Finally, we know howto have fun too…
Ultimately we faculty only make noise…
… the students make everything happen