Presentation is loading. Please wait.

Presentation is loading. Please wait.

Token Based Authorization of GMPLS Networks By: Leon Gommans, Paola Grosso, Fred Wan, Cees de Laat, Marten Hoekstra, Li Xu University of Amsterdam By:

Published byZavier Maude Modified over 9 years ago

Similar presentations

Presentation on theme: "Token Based Authorization of GMPLS Networks By: Leon Gommans, Paola Grosso, Fred Wan, Cees de Laat, Marten Hoekstra, Li Xu University of Amsterdam By:"— Presentation transcript:

1 Token Based Authorization of GMPLS Networks By: Leon Gommans, Paola Grosso, Fred Wan, Cees de Laat, Marten Hoekstra, Li Xu University of Amsterdam By: Leon Gommans, Paola Grosso, Fred Wan, Cees de Laat, Marten Hoekstra, Li Xu University of Amsterdam

2 -Enables fast link access at network ingress - Deals with complex authorization process separately and in advance. - Can be linked to reservations. - Allows multi-domain support: Network egress generates token for next domain. - Tokens support both billing and pre-paid models. T T T T T T T T T T T T T T T T Why are tokens a useful concept to implement with GMPLS networks?.

3 Main rationale: Time consuming service authorization process can be separate from fast service access. Service HRM Network Service Network Service Provider A Service Provider A User Home Org User Home Org Finance Work Group Work Group Service Provider B Service Provider B Network Service Network Service T T T T T

4 Functional overview Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

5 Application sends reservation request link Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

6 Generic AAA server fetches and executes policy Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

7 Generic AAA server calls Elastic Scheduler as part of policy Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

8 Elastic Scheduler merges request in planned schedule Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

9 Elastic Scheduler replies Request ID Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

10 Generic AAA Server generates Token Key which is placed into planned schedule using the Request ID. Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

11 Generic AAA Server sends Token Key with Request ID to Application Client. Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

12 Generic AAA Server pushes Planned Schedule to Active Schedule via Policy Enforcement Point. Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

13 The Application Client Generates Token with Key and hands Token to the VLSR Client. Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

14 Token Key Token Key Token generation at VLSR Client - detailed RSVP TE RSVP TE Source Address Destination Address Request ID Request ID HMAC-SHA1

15 The VLSR client sends a RSVP-TE PATH request. VLSR sends part of PATH request to the Policy Enforcement Point Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

16 Token validation at Policy Enforcement Point - detailed RSVP TE RSVP TE Request ID Source Address Destination Address Active Schedule Table Active Schedule Table   Token verify Time slot verify HMAC-SHA1

17 Policy Enforcement Point signals go-ahead to VLSR. Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client 

18 VLSR sends RSVP-TE PATH on to next VLSR Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcement Point Policy Enforcement Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

19 VLSR sends PATH on to VLSR Client of Host B. Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcment Point Policy Enforcment Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

20 VLSR Client B returns RESV to VLSR Client of Host A provisioning the VLAN switches along the way. Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcment Point Policy Enforcment Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

21 Host A and B can now communicate. Policy Manager Policy Manager Generic AAA Server Generic AAA Server SCU Elastic Scheduler SCU Elastic Scheduler Policy Enforcment Point Policy Enforcment Point Active Schedule Active Schedule Application Client Application Client Policy Repository Host A Host A 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch 802.1Q VLAN Switch Host B Host B Planned Schedule Planned Schedule DRAGON VLSR DRAGON VLSR DRAGON VLSR DRAGON VLSR Client VLSR Client VLSR Client VLSR Client

22 Santa Clara University: Elastic Scheduler Sumit Naiksatam, Cameron Boehmer, Silvia Figueira Internet2: Conceptual Input regarding authorization models John Vollbrecht DRAGON Project: GMPLS control plane Chris Tracey SARA: Network Testbed Ronald van der Pol. Acknowledgement..

23 Thank you for watching

Download ppt "Token Based Authorization of GMPLS Networks By: Leon Gommans, Paola Grosso, Fred Wan, Cees de Laat, Marten Hoekstra, Li Xu University of Amsterdam By:"

Similar presentations

Authentication Authorization Accounting and Auditing

Authentication Authorization Accounting and Auditing
Photonic TeraStream and ODIN By Jeremy Weinberger The iCAIR iGRID2002 Demonstration Shows How Global Applications Can Use Intelligent Signaling to Provision.

Photonic TeraStream and ODIN By Jeremy Weinberger The iCAIR iGRID2002 Demonstration Shows How Global Applications Can Use Intelligent Signaling to Provision.
© 2006 Open Grid Forum Network Services Interface Introduction to NSI Guy Roberts.

© 2006 Open Grid Forum Network Services Interface Introduction to NSI Guy Roberts.
G.7713.2: DCM Signaling Mechanism Using GMPLS RSVP-TE ITU-T Workshop on IP-Optical, Chitose, Japan 7/11/2002 Dimitrios Pendarakis, Tellium, Inc. ITU-T.

G : DCM Signaling Mechanism Using GMPLS RSVP-TE ITU-T Workshop on IP-Optical, Chitose, Japan 7/11/2002 Dimitrios Pendarakis, Tellium, Inc. ITU-T.
All rights reserved © 2005, Alcatel Grid services over IP Multimedia Subsystem  Antoine Pichot, Olivier Audouin, Alcatel  GridNets ’06.

All rights reserved © 2005, Alcatel Grid services over IP Multimedia Subsystem  Antoine Pichot, Olivier Audouin, Alcatel  GridNets ’06.
Resource Brokering: Your Ticket Into NetherLight Paola Grosso Jeroen van der Ham Cees de Laat UvA - AIR group.

Resource Brokering: Your Ticket Into NetherLight Paola Grosso Jeroen van der Ham Cees de Laat UvA - AIR group.
Advance in Design and Implementation of VLSR in Support of E2E VLAN DRAGON Meeting, 2005 Xi Yang Information Sciences Institute University of Southern.

Advance in Design and Implementation of VLSR in Support of E2E VLAN DRAGON Meeting, 2005 Xi Yang Information Sciences Institute University of Southern.
8/10/2001GGF - 3 / Leon Gommans - UvA1 Observations on the CAS architecture made from the Generic AAA perspective. 3rd Global Gridforum Oct. 7-10th 2001.

8/10/2001GGF - 3 / Leon Gommans - UvA1 Observations on the CAS architecture made from the Generic AAA perspective. 3rd Global Gridforum Oct. 7-10th 2001.
IEEE 802.1ag Ethernet OAM Ronald van der Pol SARA Architecture Workshop, 1-2 Dec, Amsterdam.

IEEE 802.1ag Ethernet OAM Ronald van der Pol SARA Architecture Workshop, 1-2 Dec, Amsterdam.
DRAGON Dynamic Resource Allocation via GMPLS Optical Networks Tom Lehman University of Southern California Information Sciences Institute (USC/ISI) National.

DRAGON Dynamic Resource Allocation via GMPLS Optical Networks Tom Lehman University of Southern California Information Sciences Institute (USC/ISI) National.
Multi-Domain Lightpath Authorization Architecture using Tokens By: Leon Gommans, Paola Grosso, Fred Wan, Cees de Laat, Marten Hoekstra, Yuri Demchenko,

Multi-Domain Lightpath Authorization Architecture using Tokens By: Leon Gommans, Paola Grosso, Fred Wan, Cees de Laat, Marten Hoekstra, Yuri Demchenko,
IRTF - AAAARCH - RG Authentication Authorisation Accounting ARCHitecture RG chairs: J. Vollbrecht and C. de Laat www.aaaarch.org RFC 2903, 2904, 2905,

IRTF - AAAARCH - RG Authentication Authorisation Accounting ARCHitecture RG chairs: J. Vollbrecht and C. de Laat RFC 2903, 2904, 2905,
Authorization of a QoS path based on Generic AAA SC2002 Baltimore NOV 16-22 Bas van Oudenaarde Advanced Internet Research Group University of Amsterdam.

Authorization of a QoS path based on Generic AAA SC2002 Baltimore NOV Bas van Oudenaarde Advanced Internet Research Group University of Amsterdam.
Generic AAA model in Grids IRTF - AAAARCH meeting IETF 52 – Dec 14 th Salt Lake City Leon Gommans Advanced Internet Research Group.

Generic AAA model in Grids IRTF - AAAARCH meeting IETF 52 – Dec 14 th Salt Lake City Leon Gommans Advanced Internet Research Group.
Generic AAA based provisioning Of Network Elements Status update EVL 9/10/03 Leon Gommans University of Amsterdam.

Generic AAA based provisioning Of Network Elements Status update EVL 9/10/03 Leon Gommans University of Amsterdam.
AAA-ARCH IRTF-RG Authentication Authorisation and Accounting ARCHitecture Research Group chairs: C. de Laat J. Vollbrecht Content of this talk has contributions.

AAA-ARCH IRTF-RG Authentication Authorisation and Accounting ARCHitecture Research Group chairs: C. de Laat J. Vollbrecht Content of this talk has contributions.
May 22 2007 - TNC2007 Network Description Language - Semantic Web for Hybrid Networks Network Description Language: Semantic Web for Hybrid Networks Paola.

May TNC2007 Network Description Language - Semantic Web for Hybrid Networks Network Description Language: Semantic Web for Hybrid Networks Paola.
IRTF - AAAARCH - RG Authentication Authorisation Accounting ARCHitecture RG chairs: C. de Laat and J. Vollbrecht www.phys.uu.nl/~wwwfi/aaaarch RFC 2903,

IRTF - AAAARCH - RG Authentication Authorisation Accounting ARCHitecture RG chairs: C. de Laat and J. Vollbrecht RFC 2903,
1 Reminding - ARP Two machines on a given network can communicate only if they know each other’s physical network address ARP (Address Resolution Protocol)

1 Reminding - ARP Two machines on a given network can communicate only if they know each other’s physical network address ARP (Address Resolution Protocol)
A Study of MPLS Department of Computing Science & Engineering DE MONTFORT UNIVERSITY, LEICESTER, U.K. By PARMINDER SINGH KANG

A Study of MPLS Department of Computing Science & Engineering DE MONTFORT UNIVERSITY, LEICESTER, U.K. By PARMINDER SINGH KANG

Similar presentations

Ads by Google