EdgeVPNio
/
evio
mirror of https://github.com/EdgeVPNio/evio.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Editorial updates for JOSS paper

master
Ken 2024-02-06 22:05:55 +00:00
parent ad25b6a7cc
commit fc10e0e7b1
2 changed files with 107 additions and 68 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

137
paper.bib
View File

@ -1,3 +1,65 @@
@misc{rfc3920,
series = {Request for Comments},
number = 3920,
howpublished = {RFC 3920},
publisher = {RFC Editor},
doi = {10.17487/RFC3920},
url = {https://www.rfc-editor.org/info/rfc3920},
author = {Peter Saint-Andre},
title = {{Extensible Messaging and Presence Protocol (XMPP): Core}},
pagetotal = 30,
year = 2004,
month = oct,
}
@inproceedings{manku_symphony:_2003,
location = {Berkeley, {CA}, {USA}},
title = {Symphony: Distributed Hashing in a Small World},
url = {http://dl.acm.org/citation.cfm?id=1251460.1251470},
series = {{USITS}'03},
shorttitle = {Symphony},
pages = {10--10},
booktitle = {Proceedings of the 4th Conference on {USENIX} Symposium on Internet Technologies and Systems - Volume 4},
publisher = {{USENIX} Association},
author = {Manku, Gurmeet Singh and Bawa, Mayank and Raghavan, Prabhakar},
urldate = {2018-10-30},
date = {2003},
}
@article{10.1145/1355734.1355746,
author = {McKeown, Nick and Anderson, Tom and Balakrishnan, Hari and Parulkar, Guru and Peterson, Larry and Rexford, Jennifer and Shenker, Scott and Turner, Jonathan},
title = {OpenFlow: enabling innovation in campus networks},
year = {2008},
issue_date = {April 2008},
publisher = {Association for Computing Machinery},
address = {New York, NY, USA},
volume = {38},
number = {2},
issn = {0146-4833},
url = {https://doi.org/10.1145/1355734.1355746},
doi = {10.1145/1355734.1355746},
journal = {SIGCOMM Comput. Commun. Rev.},
month = {mar},
pages = {69–74},
numpages = {6},
keywords = {ethernet switch, flow-based, virtualization}
}
@misc{rfc7047,
series = {Request for Comments},
number = 7047,
howpublished = {RFC 7047},
publisher = {RFC Editor},
doi = {10.17487/RFC7047},
url = {https://www.rfc-editor.org/info/rfc7047},
author = {Ben Pfaff and Bruce Davie},
title = {{The Open vSwitch Database Management Protocol}},
pagetotal = 35,
year = 2013,
month = dec,
}
@article{subratie_edgevpn_2023,
title = {{EdgeVPN}: Self-organizing layer-2 virtual edge networks},
volume = {140},
@ -6,7 +68,6 @@
url = {https://www.sciencedirect.com/science/article/pii/S0167739X22003235},
doi = {10.1016/j.future.2022.10.007},
shorttitle = {{EdgeVPN}},
abstract = {The advent of virtualization and cloud computing has fundamentally changed how distributed applications and services are deployed and managed. With the proliferation of {IoT} and mobile devices, virtualized systems akin to those offered by cloud providers are increasingly needed geographically near the network’s edge to perform processing tasks in proximity to the data sources and sinks. Latency-sensitive, bandwidth-intensive applications can be decomposed into workflows that leverage resources at the edge — a model referred to as fog computing. Not only is performance important, but a trustworthy network is fundamental to guaranteeing privacy and integrity at the network layer. This paper describes Bounded Flood, a novel technique that enables virtual private Ethernet networks that span edge and cloud resources — including those constrained by {NAT} and firewall middleboxes. Bounded Flood builds upon a scalable structured peer-to-peer overlay, and is novel in how it integrates overlay tunnels with {SDN} software switches to create a virtual network with dynamic membership — supporting unmodified Ethernet/{IP} stacks to facilitate the deployment of edge applications. Bounded Flood has been implemented as the core of the {EdgeVPN} open-source virtual private network software system for edge computing. Experiments with the software demonstrate its functionality and scalability — one of which includes Kubernetes with Flannel across Raspberry Pi 4 edge devices behind different {NATs}.},
pages = {104--116},
journaltitle = {Future Generation Computer Systems},
shortjournal = {Future Generation Computer Systems},
@ -15,55 +76,31 @@
date = {2023-03-01},
langid = {english},
keywords = {Edge computing, Fog computing, Overlay networks, Peer-to-peer, Software-defined networks, Virtualization},
}
@inproceedings{manku_symphony:_2003,
address = {Berkeley, CA, USA},
series = {{USITS}'03},
title = {Symphony: {Distributed} {Hashing} in a {Small} {World}},
shorttitle = {Symphony},
url = {http://dl.acm.org/citation.cfm?id=1251460.1251470},
abstract = {We present Symphony, a novel protocol for maintaining distributed hash tables in a wide area network. The key idea is to arrange all participants along a ring and equip them with long distance contacts drawn from a family of harmonic distributions. Through simulation, we demonstrate that our construction is scalable, flexible, stable in the presence of frequent updates and offers small average latency with only a handful of long distance links per node. The cost of updates when hosts join and leave is small.},
urldate = {2018-10-30},
booktitle = {Proceedings of the 4th {Conference} on {USENIX} {Symposium} on {Internet} {Technologies} and {Systems} - {Volume} 4},
publisher = {USENIX Association},
author = {Manku, Gurmeet Singh and Bawa, Mayank and Raghavan, Prabhakar},
year = {2003},
pages = {10--10},
}
@article{gershenfeld_internet_2004,
title = {The {Internet} of {Things}},
volume = {291},
number = {4},
journal = {Scientific American},
author = {Gershenfeld, Neil and Krikorian, Raffi and Cohen, Danny},
year = {2004},
pages = {76--81},
file = {ScienceDirect Full Text PDF:C\:\\Users\\kcrat\\Zotero\\storage\\3WAJTUYB\\Subratie et al. - 2023 - EdgeVPN Self-organizing layer-2 virtual edge netw.pdf:application/pdf;ScienceDirect Snapshot:C\:\\Users\\kcrat\\Zotero\\storage\\ESJLWR3K\\S0167739X22003235.html:text/html},
}
@article{satyanarayanan_pervasive_2001,
title = {Pervasive {Computing}: {Vision} and {Challenges}},
volume = {8},
issn = {1070-9916},
shorttitle = {Pervasive computing},
doi = {10.1109/98.943998},
abstract = {This article discusses the challenges in computer systems research posed by the emerging field of pervasive computing. It first examines the relationship of this new field to its predecessors: distributed systems and mobile computing. It then identifies four new research thrusts: effective use of smart spaces, invisibility, localized scalability, and masking uneven conditioning. Next, it sketches a couple of hypothetical pervasive computing scenarios, and uses them to identify key capabilities missing from today's systems. The article closes with a discussion of the research necessary to develop these capabilities.},
number = {4},
journal = {IEEE Personal Communications},
author = {Satyanarayanan, M.},
month = aug,
year = {2001},
keywords = {Resource management, land mobile radio, research, mobile computing, wireless LAN, Pervasive computing, Access protocols, computer systems research, Computer vision, distributed processing, distributed systems, invisibility, localized scalability, Mobile computing, pervasive computing, Scalability, smart spaces, Space technology, TCPIP, Transcoding, uneven conditioning masking, Wireless application protocol},
pages = {10--17},
@software{subratie_edgevpnioevio_2024,
title = {{EdgeVPNio}/evio: Release 24.1.1.1047},
url = {https://zenodo.org/records/10583025},
shorttitle = {{EdgeVPNio}/evio},
abstract = {{EdgeVPN} software release.},
version = {v24.1.1.1047},
publisher = {Zenodo},
author = {Subratie, Kensworth},
urldate = {2024-02-06},
date = {2024-01-30},
doi = {10.5281/zenodo.10583025},
}
@misc{noauthor_ryu_nodate,
title = {Ryu {SDN} {Framework}},
url = {https://osrg.github.io/ryu/},
urldate = {2018-06-29},
}
@misc{rosenberg_interactive_2010,
title = {Interactive {Connectivity} {Establishment} ({ICE}): {A} {Protocol} for {Network} {Address} {Translator} ({NAT}) {Traversal} for {Offer}/{Answer} {Protocols}},
url = {https://www.rfc-editor.org/rfc/rfc5245.txt},
author = {Rosenberg, Jonathan},
year = {2010},
@misc{rfc8926,
series = {Request for Comments},
number = 8926,
howpublished = {RFC 8926},
publisher = {RFC Editor},
doi = {10.17487/RFC8926},
url = {https://www.rfc-editor.org/info/rfc8926},
author = {Jesse Gross and Ilango Ganga and T. Sridhar},
title = {{Geneve: Generic Network Virtualization Encapsulation}},
pagetotal = 34,
year = 2020,
month = nov,
}

38
paper.md
View File

@ -4,6 +4,7 @@ tags:
- SDN
- NFV
- VPN
- Edge Networks
- Fog Computing
- IoT
authors:
@ -15,49 +16,50 @@ authors:
orcid: 0000-0001-9841-6060
equal-contrib: true
affiliation: "University of Florida"
date: 01 January 2024
date: 01 February 2024
bibliography: paper.bib
---
# Summary
The advent of virtualization and cloud computing has fundamentally changed how distributed applications and services are deployed and managed. With the proliferation of IoT and mobile devices, virtualized systems akin to those offered by cloud providers are increasingly needed geographically near the network’s edge to perform processing tasks in proximity to the data sources and sinks. Latency-sensitive, bandwidth-intensive applications can be decomposed into workflows that leverage resources at the edge – a model referred to as fog computing. Not only is performance important, but a trustworthy network is fundamental to guaranteeing privacy and integrity at the network layer. This paper describes `EdgeVPN.io` [@subratie_edgevpn_2023], a novel technique that enables virtual private Ethernet networks that span edge and cloud resources – including those constrained by NAT and firewall. `EdgeVPN.io` builds upon a scalable structured peer-to-peer overlay, and is novel in how it integrates overlay tunnels with SDN software switches to create a virtual network with dynamic membership – supporting unmodified Ethernet/IP stacks to facilitate the deployment of edge applications. `EdgeVPN.io` has been implemented as an open-source virtual network software solution, and experiments with the software have demonstrated its functionality and scalability.
This paper describes the `EdgeVPN.io` [@subratie_edgevpnioevio_2024] software, a novel technique that enables virtual private Ethernet networks that span edge and cloud resources – including those constrained by NAT and firewall. `EdgeVPN.io` has been implemented as an open-source virtual network software solution, and experiments with the software have demonstrated its functionality and scalability. The design and evaluation are discussed further in the paper EdgeVPN: Self-organizing layer-2 virtual edge networks [@subratie_edgevpn_2023].
# Statement of need
Emerging IoT and smart spaces applications exhibit requirements that are difficult to meet using existing cloud computing models [5]. These appications can leverage lightweight data centers distributed across the network’s edge as processing nodes to bring compute and short-term storage closer to the data sources and sinks. This eliminates the latency and throughput penalties incurred from moving data across large geographic distances and through high contention, bandwidth-limited links. However, it introduces an operation and management problem: it is necessary to interconnect all widely distributed components to create a virtualized computing environment. Unfortunately, software and methodologies designed for the data center are typically poorly suited for fog computing operations along the Internet’s edge due to constraints of the Internet Protocol (IP).
Network virtualization stands at a unique point to address these challenges. While existing Virtual Private Networks (VPNs) can mitigate hurdles such as endpoint addressing and secure communication, current models are infeasible for operation and management at the proposed scale of future IoT applications. A decentralized, scalable system that supports dynamic membership, virtualizes addressable endpoints and provides secure communication such as `EdgeVPN.io` is needed.
The advent of virtualization and cloud computing has fundamentally changed how distributed applications and services are deployed and managed. Emerging IoT and smart-spaces applications exhibit requirements that are difficult to meet using existing cloud computing models [5]. With the proliferation of IoT and mobile devices, virtualized systems akin to those offered by cloud providers are increasingly needed geographically near the network’s edge to perform processing tasks in proximity to the data sources and sinks. Latency-sensitive, bandwidth-intensive applications can be decomposed into workflows that leverage resources at the edge – a model referred to as fog computing - to bring compute and short-term storage closer to the data sources and sinks. This eliminates the latency and throughput penalties from moving data across large geographic distances and through high contention, bandwidth-limited links. However, it introduces an operation and management problem: it is necessary to interconnect all widely distributed components to create a virtualized computing environment. Unfortunately, software and methodologies designed for the data center are typically poorly suited for fog computing operations along the Internet’s edge due to Internet Protocol (IP) constraints.
Network virtualization stands at a unique point to address these challenges. While existing Virtual Private Networks (VPNs) can mitigate hurdles such as endpoint addressing and secure communication, current models are infeasible for operation and management at the proposed scale of future IoT applications. A decentralized, scalable system that supports dynamic membership, virtualizes addressable endpoints and provides secure communication is needed.
A illusrative use case of `EdgeVPN.io` is a software service that improves safety and effectiveness during multi-agency emergency response operations by enabling data-driven strategic and tactical decision-making. The networking core, along with web services and applications facilitate the definition, deployemnt and creation of ad hoc overlay networks. These virtual networks will span multiple organizations collaborating towards a specific goal, regardless of their location, proving the necessary connectivity and condidentiality for intra-group communication across the public Internet. `EdgeVPN.io` virtual response network aggregates and integrates heterogeneous resources such as IoT sensors and actuators, analytic compute engines, and operation personnel via their client devices (tablets, laptops, phones, etc.) across multiple organizations' networks for seamless connectivity and interactions.
An illustrative use case of `EdgeVPN.io` is a software service that improves safety and effectiveness during multi-agency emergency response operations by enabling data-driven strategic and tactical decision-making. The networking core, web services, and applications facilitate the definition, deployment, and creation of ad hoc overlay networks. These virtual networks will span multiple organizations collaborating towards a specific goal, regardless of location, providing the necessary connectivity and confidentiality for intra-group communication across the public Internet. The `EdgeVPN.io` virtual network aggregates and integrates heterogeneous resources such as IoT sensors and actuators, analytic compute engines, and operation personnel via their client devices (tablets, laptops, phones, etc.) across multiple organizations' networks for seamless connectivity and interactions.
`EdgeVPN.io` allows existing smart resources to be aggregated, securely accessed, and utilized in novel ways.
# Features
Multiple independent layer 2 overlays for zero trust.
Hybrid overlays supporting native Tincan and Geneve tunnels.
Self assembling and maintaining overlays.
Dynamic membership - switching nodes can leave and join an overlay.
Multiple roles - a node can participate in an overlay as a switch or as a pendant device anchored to a switching node.
Tincan tunnels are encrytped and support ICE bootstrapping via WebRTC data channel. Each Tincan tunnel runs in its own process.
Geneve tunnels provide low latency communications with lower overheads.
The `EdgeVPN.io` software integrates the following features:
- Self-assembling and self-maintaining overlays that require only the definition of authorized participants.
- Software-defined switching via the OpenFlow [@10.1145/1355734.1355746] protocol and Open vSwitch[@rfc7047].
- Dynamic membership within overlays allows nodes to join or leave an active overlay.
- Concurrent active and independent layer 2 overlays within a single node.
- Hybrid overlays supporting two tunneling technologies: user-mode WebRTC (Tincan) and kernel-mode GENEVE [@rfc8926] tunnels. Tincan tunnels are encrypted and support ICE [@rosenberg_interactive_2010] bootstrapping for NAT traversal. GENEVE tunnels provide low latency communications with lower overheads.
- Role selection allows a node to act as a switch or pendant device anchored to a switching node when joining an overlay.
# Design
![Fig. 1. System Overview.\label{fig:sysov}](system_overview.jpg)
The goal of `EdgeVPN.io` is to deliver scalable layer 2 forwarding for dynamic edge and cloud network environments where the peer nodes act as software-defined bridges. `EdgeVPN.io` integrates a Symphony (1-D Kleinberg routable small-world network [@manku_symphony:_2003]) topology and a decentralized SDN-enabled layer-2 switching fabric. Each node runs two major modules \autoref{fig:sysov}: (1) the topology controller creates and maintains the overlay, while (2) the Openflow layer 2 controller programs the corresponding switching rules. Each peer node runs the same software with the same functional capabilities and independently maintains its controllers. While there are no centralized components for overlay management and SDN-programmed switching, it uses XMPP [@] for peer authentication and messaging, and ICE[@] for endpoint discovery and tunnel bootstrapping.
The goal of EdgeVPN.io is to deliver scalable layer 2 forwarding for dynamic edge and cloud network environments where the peer nodes act as software-defined bridges. `EdgeVPN.io` integrates a Symphony (1-D Kleinberg routable small-world network [@manku_symphony:_2003]) topology and a decentralized layer-2 switching into a network fabric. Each node runs three components \autoref{fig:sysov}: (1) the topology controller creates and maintains the overlay, while (2) the OpenFlow layer 2 controller programs the corresponding switching rules, and (3) Tincan, the default datapath. While each node is parameterized to be independently tuned, they are true peers with identical functional capabilities, and each is independently maintained by its local controllers. While there are no centralized components for overlay management and SDN-programmed switching, it uses XMPP [@rfc3920] for peer authentication and messaging, and ICE for endpoint discovery and tunnel bootstrapping.
# Source Code and Packaging
`EdgeVPN.io` is available as an MIT-licensed opensourced project at https://github.com/EdgeVPNio. The two primary repos are EdgeVPNio/Controllers and EdgeVPNio/tincan. The SDN controllers maintain the node-local topology and Openflow-based layer 2 switching rules. They are implemented in Python and layer 2 switching, via the BoundedFlood module, is built on the Ryu framework.
`EdgeVPN.io` is available as an MIT-licensed open-source project hosted on [Github](https://github.com/EdgeVPNio). The two primary repositories are [EdgeVPNio/evio](https://github.com/EdgeVPNio/evio) and [EdgeVPNio/tincan](https://github.com/EdgeVPNio/tincan).
Tincan is the `EdgeVPN.io` native datapath. It is implemented in C++ and creates the fundamental tunnel abstraction consisting of a Linux TAP device and a WebRTC data link. Tincan requires WebRTC source code or prebuilt libraies for compiling. The tools repo provide several scripts that assist with the builing and packaging process. Additionally both repos include `devcontainer` entries.
Evio is the Python implementation of SDN controllers for topology, layer 2 switching, and other auxillary function. Tincan is the `EdgeVPN.io` default datapath. It is implemented in C++ and creates the fundamental tunnel abstraction consisting of a Linux TAP device and a WebRTC data link. Tincan requires WebRTC source code or prebuilt libraries for compiling. The tools repo provides several scripts that assist with building and packaging.
`EdgeVPN.io` releases are distributed as a Debian Package (a file with the .deb extention) and hosted on public server for installation via `apt-get`. A ready-to-run docker image is also hosted publicly for retrival using `docker pull`.
`EdgeVPN.io` releases are distributed as a Debian Package for Ubuntu 20 and 22, and hosted for installation via `apt-get`. A ready-to-run docker image is also hosted publicly for retrieval using `docker pull`.
# Acknowledgements
This material is based upon work supported by the National Science Foundation, USA under Grants OAC-2004441, OAC-2004323, and CNS-1951816. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation.
# References
# References