VyperNet A Framework for Programmable Virtual Private Networks Adam Hudson Supervisor: Bob Kummerfeld

A VyperNet network Client Network Client Network Client Network Client Network Client Network

Contributions A design for a framework that allows clients to configure Virtual Private Networks within provider networks An implementation of the framework An example application

VPNs A Virtual Private Network (VPN) provides a way for distributed sites to connect in a manner than emulates a LAN Comprised of tunnels  Layers of protocols that hide underlying network from applications

ISP Firewall ISP An example VPN

ISP Firewall ISP An example VPN

VPN control A client builds their VPN upon a network they acquire from a provider eg. ISP, carrier VPNs are usually a series of tunnels across a network, that are controlled at the edge of the network  All that the client has access to  Inefficient use of network Better option is to control the endpoints of the tunnels within the network

Site

Enter VyperNet Providers need to offer a way for clients to control the internal nodes of the network Difficult to do at present  Providers make changes at client’s request  Insecure otherwise VyperNet introduces a way to let clients gain control Allows the introduction of code into a controlled portion of the switch nodes of the network, on behalf of the client

Technologies used in VyperNet Multiprotocol Label Switching (MPLS) Active Networking Programmable VPNs

MPLS A method of producing tunnels Labels are inserted as an extra header between layer 2 and 3 of each packet Labels are allocated to packets based upon their destination as they enter the network, and are switched at each hop on to the next switch Allows many different VPNs to use the same network

MPLS tunnels

Active Networks Introduce programmability into the network Packets carry code with them in “capsules”, which can execute at active nodes along their path Creates environment for clients to access the network switches Provide them with a programmable VPN

VyperNet A framework to allow the client to configure an MPLS network Sends capsules at the request of the client to switches to manipulate MPLS switching tables Designed for use in creating programmable VPNs An example application can show how it works

Node Trader Switch VyperNet components Switch Provider Application Startup capsule 2.Client tunnel request capsule (and response) 3.Provider tunnel request capsule (and response) 4.Switch configuration capsule (and response) Client Application 2

VyperNet switch configuration

Example – No active nodes

Example – 3 active nodes

Startup capsules Node Trader Switch Application 1 1 1

Example – VPN allocation

Example – Tunnel allocation

Example – Client-side tunnel activation

Tunnel activation Node Trader Switch Provider Application Client Application 2 Provider application acts As a gateway for client requests

Example – Tunnel activated

Example – A VPN

Real world example Telstra want to deploy a framework like this into their nation-wide network of switches Would allow them to allocate portions of their network to clients, such that Telstra is acting as a VPN Service Provider Clients can quickly activate or deactivate tunnels to suit organisational needs

Telstra example Client Network Client Network Client Network Client Network Client Network

In conclusion A design for a framework that allows clients to configure Virtual Private Networks within provider MPLS networks An implementation of the framework An example application

Questions?