A Versatile Storage System for Future Networking Architecture Prof. Xiaohua Jia City University of Hong Kong 1

Outline o Motivations and Objectives o System Architecture o System Design and Implementation o Conclusion 2

Motivations Giant Application Service Providers (ASPs) monopolize the markets based on ◦Users’ data ◦Users’ social relations 3

Motivations What are the consequences? o Users’ data and social relations are locked in ASPs. ASPs win users not by their QoS, but by users’ data and social relations o Small and medium companies are denied of opportunities to enter the business o User’s social relations are fragmented on multiple ASPs, and publish-subscribe of user’s data is limited within the scope of an ASP o …… 4

System Background o Many ICN (Information Centric Networks) projects, e.g., NDN, NetInf, PURSUIT, etc., cache the data in routers along the path it travels o New effort of NFV (Network Function Virtualization) replaces traditional routers by general purpose computer servers o There are huge amount of under-utilized storage and computing powers on routers all over the Internet o Our aim: build a versatile storage infrastructure for users 5

Design Objectives o Decouple users' data from ASPs The infrastructure stores users data and provides content services to ASPs. o Decouple users’ social relations from ASPs The information of users social relations is integrated into the infrastructure for data publish-subscribe. o Support general data communications The infrastructure can support data networking services, such as online video chat. 6

System Architecture Presentation Layer ASPs or APPs: use data from VSS to provide advanced services to end users. Information Layer VSS (Versatile Storage System): responsible for content storage, access control publishing/ subscribing, and distribution. 7

Example: decouple users social relations from ASPs -Manage social relations of users -Support content publish-subscribe services: access control, publishing and subscribing, …… Alice Bob Facebook Client App Weibo Client App 1. Alice sends a “friend” request to Bob in Facebook app 2. Bob sees Alice become his follower in Weibo app, then Bob “follows” Alice back. 3. Bob becomes Alice’s friend in Facebook app 8

Example: decouple users data from ASPs 4. Alice posts a message to “Friends” in Facebook app 5. Bob can see the message in Weibo app 9 Alice Bob Weibo Client App Facebook Client App

10 Vertical and Horizontal Interfaces o Vertical interface -Any ASPs can provide content services based on the information layer of VSS -Provide standard APIs User-Network Interface (UNI) to all ASPs inter-domain interface Domain 1 (China) Domain 2 (UK) Domain 3 (USA) o Horizontal interface -VSS consists of multiple autonomous service domains -Interconnected by “thin” Network-Network Interface (NNI)

Support of data networking and communications o Data communication based on file systems -Integrate data service with networking service -Support general data communication o Real-time communication -Support inter-person real-time communication 11

System Designs o Management of user data o Management of users social relations o Roaming of users o Security and privacy 12

Management of User Data VSS is currently implemented on top of HBase 13

Management of User Data Users can use either a client application or a web interface (web browser) to upload local files to or download files from the VSS system. User Client Application Web Interface 14 User

Management of social relations VSS manages basic social relations of users o VSS manages the contact lists and contact groups, decoupling users’ social relations from ASPs o ASPs calls VSS to get social relations of users for content publishing 15

Modeling of social relations VSS models general types of user social relations on the Internet o 1-way friendship: Weibo, Twitter, address book, contact list o 2-way friendship: QQ, WeChat, Line, WhatsApp, Skype, Facebook o Workgroups / teams: Dropbox shared folder, SkyDrive Groups, QQ / WeChat group chat 16

Example: ASP-independent information publication o Alice (in China) shares a photo to her friends Bob and Cathy o VSS China domain stores the photo and sends the notifications to the home domains of Bob and Cathy respectively o Bob & Cathy can see the photo via any application o Once the photo is deleted by Alice, all references to this photo is removed from the entire system China USA UK China Domain USA Domain UK Domain 17

Implementation of real-time inter-person communication o Using shared files as communication medium o The sender writes data to a file and informs the receiver by placing a token in receiver’s space o The receiver checks the token at fixed interval and reads the data from the file when the data becomes available o The synchronization frequency depends on the real-time requirement o Demo Demo 18 AliceBob Client App File

Handling of user roaming The data accessed by a roaming user shall be transferred from its home domain to the destination domain. 19

Handling of user roaming Why consider user roaming? o A user’s information is stored and managed by his home domain Requirements of roaming handling o Remote authentication of users There shall be a simple and efficient method to authenticate a roaming user so that the access permission can be assigned to the user o Local & remote execution of commands Some commands can only be executed locally (or passed back to the home domain for execution if the user is in a remote domain) for security reasons or performance reasons o Caching and data pre-fetch The domain shall be able to utilize its local cache to improve users’ roaming experience 20

Uniform security and privacy scheme Security issues o Storage security: all stored data can be auto-encrypted (if users wish) o Security for cross-domain: interoperation and communications Secure both the data storage and the communication channels! Inter-domain channel 21

Privacy-preserving publish- subscribe in multi-domains o Privacy protection of communication parties -Hide sender’s ID from the receiver’s domain -Hide receiver’s ID from the sender’s domain o Privacy protection of subscriber and publishers -Hide subscriber’s details from the foreign domain when subscribing information from a foreign domain -Hide publisher’s details from subscriber’s domain when the publisher is in a foreign domain

Secure content publish- subscribe in VSS o Content publish-subscribe: privacy against VSS o ASPs use VSS platform to publish content to users but do not want to disclose the content to VSS o Asymmetric encryption is not applicable because it requires a trusted third party to verify the true identities of all the involved parties o No key-exchange can be done through VSS o No need for users (subscribers) to manage too many keys for publishers 23

Protocol design (1): subscription o Step 1: Subscription o Subscriber sends subscription request and key material Y sub o Y sub = g Rsub mod p, // g and p are public parameters in Diffie-Hellman code o R sub = PRNG(SK sub, ID pub ), // Sk sub is the secret key of subscriber, ID pub the ID of publisher, PRNG a pseudo random number generator. 24

Protocol design (2): publishing o Step 2. Publishing o For i th publication, publisher generates a new key K i and key material Y pub o K i = Y sub Ri mod p // R i is a random number for i th publication o Y pub = g Ri mod p o Publisher encrypts data by K i and sends the ciphertext and Y pub to VSS o VSS cannot recover K i or decrypt the data, even with the key materials Y sub and Y pub (it doesn’t know R sub and R i ) 25

Protocol design (3): content delivery o Step 3. VSS delivers the i th ciphertext and Y pub to subscriber o Subscriber generates the decryption key on the fly: 1.Restore the same random number as in step 1: R sub =PRNG(SK sub, ID pub ) 2.Generate decryption key K i ’ = Y pub Rsub mod p 3.Note: K i ’ = Y pub Rsub mod p = g Ri * Rsub mod p = Y sub Ri mod p = K i o A subscriber only needs to keep its own secret key SK sub for all ASPs and it does NOT need to manage many R sub of publishers 26

Conclusion o VSS decouples ASPs from users' data and users' social relations. ASPs have to rely on better quality services to win user groups. o VSS integrates file services with traditional networking services. It can be used as universal communication platform. o VSS provides uniform security / privacy scheme, making users’ data and communication more secure. 27

Demo Demo settings: o 3 end users -Alice -Bob -Cathy o 3 ASPs / APPs -FaceBlog -SinaBlog -NetDrive o 2 domains USA China 28

Thank You! 29