1. VyperNet A Framework for Programmable Virtual Private Networks Adam Hudson Supervisor: Bob Kummerfeld

2. A VyperNet network Client Network Client Network Client Network Client Network Client Network

3. Contributions A design for a framework that allows clients to configure Virtual Private Networks within provider networks An implementation of the framework An example application

4. VPNs A Virtual Private Network (VPN) provides a way for distributed sites to connect in a manner than emulates a LAN Comprised of tunnels  Layers of protocols that hide underlying network from applications

5. ISP Firewall ISP An example VPN

6. ISP Firewall ISP An example VPN

8. VPN control A client builds their VPN upon a network they acquire from a provider eg. ISP, carrier VPNs are usually a series of tunnels across a network, that are controlled at the edge of the network  All that the client has access to  Inefficient use of network Better option is to control the endpoints of the tunnels within the network

9. Site

10. Enter VyperNet Providers need to offer a way for clients to control the internal nodes of the network Difficult to do at present  Providers make changes at client’s request  Insecure otherwise VyperNet introduces a way to let clients gain control Allows the introduction of code into a controlled portion of the switch nodes of the network, on behalf of the client

11. Technologies used in VyperNet Multiprotocol Label Switching (MPLS) Active Networking Programmable VPNs

12. MPLS A method of producing tunnels Labels are inserted as an extra header between layer 2 and 3 of each packet Labels are allocated to packets based upon their destination as they enter the network, and are switched at each hop on to the next switch Allows many different VPNs to use the same network

13. MPLS tunnels

14. Active Networks Introduce programmability into the network Packets carry code with them in “capsules”, which can execute at active nodes along their path Creates environment for clients to access the network switches Provide them with a programmable VPN

15. VyperNet A framework to allow the client to configure an MPLS network Sends capsules at the request of the client to switches to manipulate MPLS switching tables Designed for use in creating programmable VPNs An example application can show how it works

16. Node Trader Switch VyperNet components Switch Provider Application 1 1 1 4 4 4 3 1.Startup capsule 2.Client tunnel request capsule (and response) 3.Provider tunnel request capsule (and response) 4.Switch configuration capsule (and response) Client Application 2

17. VyperNet switch configuration

18. Example – No active nodes

19. Example – 3 active nodes

20. Startup capsules Node Trader Switch Application 1 1 1

21. Example – VPN allocation

22. Example – Tunnel allocation

23. Example – Client-side tunnel activation

24. Tunnel activation Node Trader Switch Provider Application 4 4 4 3 Client Application 2 Provider application acts As a gateway for client requests

25. Example – Tunnel activated

26. Example – A VPN

27. Real world example Telstra want to deploy a framework like this into their nation-wide network of switches Would allow them to allocate portions of their network to clients, such that Telstra is acting as a VPN Service Provider Clients can quickly activate or deactivate tunnels to suit organisational needs

28. Telstra example Client Network Client Network Client Network Client Network Client Network

29. In conclusion A design for a framework that allows clients to configure Virtual Private Networks within provider MPLS networks An implementation of the framework An example application

30. Questions?