asap: a low-latency transport layer - sigcomm

ASAP: A Low-Latency Transport Layer

Wenxuan Zhou, Qingxi Li, Matthew Caesar, Brighten Godfrey

Saturday, December 3, 2011

Not so fast, Internet...

2



• Fetching a popular website

2




time wget www.phdcomics.com

2


http://www.phdcomics.com




time wget www.phdcomics.comreal 895ms

2







100%[==================>] 10,560 65.2K/s in 200ms

real 895ms

2






• Single packet latency


100%[==================>] 10,560 65.2K/s in 200ms

real 895ms

ping 69.17.116.124 (www.phdcomics.com)

time=76.3ms

2








• Single packet latency

• Why is the web so slow?


100%[==================>] 10,560 65.2K/s in 200ms

real 895ms

ping 69.17.116.124 (www.phdcomics.com)

time=76.3ms

2






3

What’s a few hundred milliseconds?



4

sear

ches

per

use

r

[Jake Brutlag, Google, 2009]

+200ms+400ms

--- actual—— trend

0.2%

0%

-0.2%

-0.4%

-0.6%

-0.8%

-1%

week1 week2 week3 week4 week5 week6



4

sear

ches

per

use

r

[Jake Brutlag, Google, 2009]

+200ms+400ms

--- actual—— trend

0.2%

0%

-0.2%

-0.4%

-0.6%

-0.8%

-1%

week1 week2 week3 week4 week5 week6

$200 M/yr


Protocols cause delay

Client

Web server

5



Client

Web server

We wish...

5



Client

Local DNS

Auth. DNS

Web server

6



Client

Local DNS

Auth. DNS

Web server

Name Resolution

6



Client

Local DNS

Auth. DNS

Web server

TCPHandshake

Name Resolution

6


Local DNS

Auth. DNS

Sources of Delay

Web server

Client

7


Local DNS

Auth. DNS

Sources of Delay

Name Resolution

Web server

Client

7


Local DNS

Auth. DNS

Sources of Delay

TCPHandshake

Name Resolution

Web server

Client

7


Local DNS

Auth. DNS

Sources of Delay

TCPHandshake

Name Resolution

Waiting forFirst Byte

Web server

Client

7


Local DNS

Auth. DNS

Sources of Delay

TCPHandshake

Name Resolution


DataTransmission

Web server

Client

7


Local DNS

Auth. DNS

Sources of Delay

TCPHandshake

Name Resolution


DataTransmission

41.5% 20.5% 24.6% 13.4%

Web server

Client

7


Local DNS

Auth. DNS

Sources of Delay

TCPHandshake

Name Resolution


DataTransmission

41.5% 20.5% 24.6% 13.4%

Web server

Fat pipe primarily helps here

Client

7


Our Design: ASAP

8


Our Design: ASAPGoals:

8



Reduce latency

8



Reduce latency

Retain security and deployability

8



Reduce latency


Key idea 1: Piggyback connection setup on name resolution

8



Reduce latency



Add connection information into name lookup message.

8



Reduce latency




Key idea 2: Bypass handshaking

8



Reduce latency




Key idea 2: Bypass handshaking

Servers respond to the request with data directly.

8


Client

Local DNS

Auth. DNS

Our Design: ASAP

Web server

9


Client

Local DNS

Auth. DNS

Our Design: ASAP

CI: connection information

Web server

9


Client

Local DNS

Auth. DNS

Our Design: ASAP


Address of “CI.x.com”?

Web server

9


Client

Local DNS

Auth. DNS

Our Design: ASAP



Web server

9

Source IP, Source Port, Dest IP, Dest Port,

Sequence #,...HTTP GET index.html


Client

Local DNS

Auth. DNS

Our Design: ASAP


Web server

10


Client

Local DNS

Auth. DNS

Our Design: ASAP



Web server

10


Client

Local DNS

Auth. DNS

Our Design: ASAP


Web server

11


Client

Local DNS

Auth. DNS

Our Design: ASAP

CI


Web server

11


Client

Local DNS

Auth. DNS

Our Design: ASAP


Web server

12


Client

Local DNS

Auth. DNS

Our Design: ASAP


Data

Web server

12


Client

Local DNS

Auth. DNS

ASAP Improvement

Web server

13


Client

Local DNS

Auth. DNS

ASAP ImprovementCurrent Internet

Web server

13


Client

Local DNS

Auth. DNS

ASAP ImprovementASAPCurrent Internet

Web server

13


Client

Local DNS

Auth. DNS

ASAP Improvement

Time we save:

ASAPCurrent Internet

Web server

13


Challenges and Solutions

14



14

Problem: Breaks DNS caching



14


Solution: Client also sends a standard DNS query



14



Problem: All queries traverse a single Auth. DNS



14




Solution: Another layer of Auth. DNS at servers



14





Problem: Eliminating 3-way handshake makes DoS attacks easier



14





Problem: Eliminating 3-way handshake makes DoS attacks easier

Solution: Hand reusable certificates to clients


Security Problem: DoS Attack

Attacker

Victim

Web server

Web server

Web server

Web server

Reflection/Amplification DoS attack

15



Attacker

Victim

Web server

Web server

Web server

Web server


I’m the Victim, I want this data.

15



Attacker

Victim

Web server

Web server

Web server

Web server


I’m the Victim, I want this data.

Data

15


Security Mechanism

16


Security MechanismGoal: Servers verify client’s address without adding an RTT

16



Solution: Cryptographic proofs

16




16

ProvenanceVerifier (PV)




Choices of PV:•Web server•CDN•Trusted 3rd party•…

16






16


Client




Web Server


16


Client




Web Server

Certificate Choices of PV:•Web server•CDN•Trusted 3rd party•…

16


Client

I certify this client uses IP address xxx




Web Server

Certificate Choices of PV:•Web server•CDN•Trusted 3rd party•…

16


Client




Security Mechanism (cont’d)Problem: Eavesdropping

17



17

PV



17

PV

Attackable



Solution: Multiple PVs

18




PV2

18

PV1




PV2

18

PV1

Attackable


Results: Eavesdropping Defense

0%

20%

40%

60%

80%

100%

1 PV 2 PVs 3 PVs TCP

19

Attackability

TCPASAP ASAPASAP


Results: Eavesdropping Defense

0%

20%

40%

60%

80%

100%

1 PV 2 PVs 3 PVs TCP

• One PV is vulnerable to the attacker• Two PVs reduce the attacker’s effectiveness dramatically

19

Attackability

TCPASAP ASAPASAP


Deployability

ASAP requires changes to some parts of the Internet

But only to devices under the client’s and server’s control

Auth. DNS, End host clients, Server

This simplifies deployability

20


Experimental Results

21



21

ASAP has both benefits and costs



21


Improved latency, at the cost of some additional processing overhead



21



Metrics



21



Metrics

Reduced latency



21



Metrics

Reduced latency

Processing overhead



21



Metrics

Reduced latency

Processing overhead

Implementation



21



Metrics

Reduced latency

Processing overhead

Implementation

Linux Kernel



21



Metrics

Reduced latency

Processing overhead

Implementation

Linux Kernel

User-space on planet-lab


Results: Latency of a Download

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 0.5 1 1.5 2

fract

ion o

f tr

ials

time (seconds)

Round Trip Time

22



0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 0.5 1 1.5 2

fract

ion o

f tr

ials

time (seconds)

Round Trip Time

ASAP

23



0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 0.5 1 1.5 2

fract

ion o

f tr

ials

time (seconds)

Round Trip Time

ASAP

TCP

24



0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 0.5 1 1.5 2

fract

ion o

f tr

ials

time (seconds)

Round Trip Time

ASAP

TCP

• ASAP provides a significant reduction in latency over TCP

24


Results: Computational Overhead

0

0.2

0.4

0.6

0.8

1

0.1 1 10

fract

ion o

f tr

ials

time (ms)

Serv

er

PV

Clie

nt

25


Results: Computational Overhead

0

0.2

0.4

0.6

0.8

1

0.1 1 10

fract

ion o

f tr

ials

time (ms)

Serv

er

PV

Clie

nt

25

• Client, PV, and server overheads are low• A single PV server could handle tens of millions of clients


Related Work: TCP Fast Open

26

ASAP TCP Fast Open

Similarities

DifferencesDifferences

Bypass three way handshakeUse a security proof verifying address ownershipBypass three way handshakeUse a security proof verifying address ownership

Piggyback connection setup on name resolutionRequire changes to Auth. DNS

Name resolution not involved

Certificates for security proof (can be used across domains)

Cookies for security proof (easier to compute)


Conclusions

27


Conclusions

27

ASAP merges functions of DNS and TCP, and eliminates 3WH to reduce latency of interactive requests


Conclusions

27


Reduces latency by up to 2 RTTs


Conclusions

27



Retains protection against attacks


Conclusions

27




Implementation:


Conclusions

27




Implementation:

User-space and Kernel-space


Conclusions

27




Implementation:

User-space and Kernel-space

Available at: http://www.cs.illinois.edu/~wzhou10/asap.tar.gz


http://www.cs.illinois.edu/~wzhou10/asap




Backup: Security Mechanism

28


Client

Web Server



28


Client

Web Server

1. {Kcpub, dc}



28


Client

Web Server

1. {Kcpub, dc}

2. PC={Kcpub, ac, t, d} Kpv

priv



28


Client

Web Server

1. {Kcpub, dc}

2. PC={Kcpub, ac, t, d} Kpv

priv

3. meta, PC, RC, datawhere

RC={hash(meta,data),treq} Kcpriv


asap: a low-latency transport layer - sigcomm

Documents