What’s next?

1. What’s next? Nick McKeown High Performance Networking Group Stanford University nickm@stanford.edu http://www.stanford.edu/~nickm

2. The Big PictureWe’ve all seen the list… How about a global network that is • Robust against failure of infrastructure and end-points • Secure against attack • Available when you need it • Fast • Predictable in the service it does/doesn’t deliver • Evolvable as new technologies are invented • Economically viable • OK, so this is all mother-and-apple-pie. • Q1: Why do we need a clean slate? • Q2: What can we do about it at Stanford?

3. Why a Clean Slate? • Business-as-usual won’t get us there • Research-as-usual won’t get us there • It doesn’t mean we have to throw out the good parts of the current Internet

4. Stanford Clean Slate Program How would we design the Internet if – with what we know today – we started over with a clean slate? • Small, medium and large projects that – if successful – will significantly impact the Internet in 10-15 years • Not a single design: A collection of high-risk projects with the same theme • 12-15 professors and research groups from EE, CS and MS&E • Let’s get started!

5. Two Clean Slate Examples at Stanford • VLB: A clean slate architecture for backbone networks to be robust and predictable • SANE: A clean slate architecture for secure Enterprise networks

6. Backbone Networks: Emerging Structure • 10-50 Regional Nodes interconnected by long-haul optical links • Increasingly rich topology for robustness and load-balancing • Typical utilization < 25%, because • Uncertainty of traffic matrix network is designed for • Headroom for future growth • Headroom to carry traffic when links and routers fail • Minimize congestion and delay variation • Efficiency sacrificed for robustness and low queueing delay

7. Traffic Matrices ? ? ? Regional Node i To From Traffic matrix is hard to predict ri needs to be predicted anyway

8. How flexible are networks today? What fraction of allowable traffic matrices can they support? Verio Abilene 25% Over Prov: 0.0004% 50% Over Prov: 1.15% 25% Over Prov: 0.025% 50% Over Prov: 0.66% AT&T Sprint 25% Over Prov: 0.0006% 50% Over Prov: 0.15% 25% Over Prov: 0.0003% 50% Over Prov: 0.06% Note: Verio, AT&T and Sprint topologies are from RocketFuel

9. Desired Characteristics • RobustRecovers quickly; continues to operate under failure • Flexible Will support broad class of applications, new customers, and traffic patterns • PredictableCan predict how it will perform, with and without failures • EfficientDoes not sacrifice cost for robustness

10. Approach • Assume we know/estimate traffic entering and leaving each Regional Network • Requires only local knowledge of users and market estimates • Use Valiant Load Balancing (VLB) over whole network • Enables support of all traffic matrices

11. 2r1r2 /rN Valiant Load-Balancing r2 r1 1 2 3 N rN r3 4 … r4 Capacity provisioned over existing robust mesh of physical circuits

12. A Predictable Backbone Network • Performance: 100% throughput for any valid traffic matrix. • Only need to know aggregate node traffic. • Under low load, no need to spread traffic. • Robustness • Upon failure, spread over working paths • Small cost to recover from k failures: Provision 2rirj/r(N-k) • Simple routing algorithm • Efficient • VLB is lowest cost method to support all traffic matrices • Similar cost, while supporting significantly more traffic matrices.

13. How expensive would VLB be? Cost normalized to VLB routing. Cost of switching = cost of transmission for 370miles Verio Abilene 25% Over Prov: 0.0003% Cost: 0.99 50% Over Prov: 1.08% Cost: 1.19 25% Over Prov: 0.026% Cost: 0.87 50% Over Prov: 0.66% Cost: 1.04 AT&T Sprint 25% Over Prov: 0.0004% Cost: 0.94 50% Over Prov: 0.14% Cost: 1.12 25% Over Prov: 0.0002% Cost: 0.86 50% Over Prov: 0.04% Cost: 1.04 Rui Zhang-Shen will talk about SANE on February 27th

14. SANE: A Clean Slate Architecture for Secure Enterprise Networks Problem • Enterprise networks must be secure • Today they rely on a mess of distributed firewalls, NAT, VLANs, …with complicated and fragile rules SANE • Uses simple and natural high-level security policies “Allow the sales group to access the http server” • Hides topology information and services from users unless they have specific permission • Only requires one trusted entity: A single (logically) centralized Domain Controller • Communications are “default-off” • Capabilities explicitly granted by Domain Controller and enforced by network • Capabilities are encrypted source routes. Research groups: Boneh, Rosenblum, Mazieres, McKeownMartin Casado will talk about SANE on February 13th

15. What you can do • Invent • Start a study group • Come talk to me, your advisor, someone else’s advisor, an advisor you’d like as your own