Revamped lecture on future networks and SCION for students at the University of Amsterdam
A brief overview of the lecture. See you next year?
On Friday 25 March, we gave our updated lecture on future networks at the University of Amsterdam (UvA). We focused particularly on SCION, an architecture for enhanced inter-domain network security that we have been experimenting with at SIDN Labs. Our goal was to share our experience with the UvA students and further widen their horizon on networking architectures. Our lecture includes a hands-on lab assignment and is part of the Advanced Networking course of the UvA's Security & Network Engineering (SNE) master. In this blog post, we provide a brief overview of the lecture, to interest next year’s SNE students to attend.
Why do we contribute to education?
At SIDN Labs, we regularly give lectures and teach courses at universities on internet infrastructure, to help educate the next generation of network engineers and researchers. We believe this is one of SIDN's responsibilities as operator of the .nl top-level domain, which is a public role that centres around serving the local (in our case: Dutch) internet community (see RFC 1591).
One area that we think is particularly important is the security of the internet infrastructure, which is one of the foundations of our digital world. Our aim is to enable students to learn how they can contribute to shaping the internet so that it reflects society's evolving security expectations. To do that, we teach the students about the latest research results in fields such as DNS measurements, internet architectures and programmable networks.
Overview: future internet architectures and SCION
In the first part of our lecture at the UvA, we presented and discussed several future internet architectures, particularly SCION. We covered SCION's general properties and features, such as isolation domains (ISDs), routing, path exploration, path selection and deployment. In addition, we briefly discussed our P4 implementation of the SCION border router, based on our talk at ACM CoNEXT 2021.
One of the main differences between SCION and the current internet architecture is the way SCION routes traffic. For example, SCION allows users to compose network paths and put the full path into the packets they transmit. As a result, SCION routers make actual routing decisions by looking at the path information in packets instead of doing lookups in routing tables. The end-to-end paths that users compose are based on sets of available path segments that the network provides. More in-depth information is in the latest version of the SCION book.
The slides of our lecture are here.
SCION lab assignment
The second part of our lecture consisted of a lab assignment, which the students carried out after the lunch break. The goal of the lab assignment was for the students to gain practical experience with SCION by connecting to SCIONLab, SCION's testbed that offers an easy way to use SCION on a virtual machine.
The lab assignment consists of three exercises (details here), which we briefly discuss next.
Exercise #1: meddler-in-the-middle attack
In the first exercise, the students used SCION's path selection capabilities to evade a meddler-in-the-middle (MITM). Figure 1 shows the network topology we set up for them.
Figure 1. Topology for the first exercise.
The students used a modified version of scion-netcat, which supports path selection. They formed groups of two and used scion-netcat to send messages to each other. We instructed the students to connect their SCION virtual machines to our two gateways on SCIONLab (an-student-gw1 and an-student-gw2 in Figure 1), while the an-transit node acted as the MITM and enabled everyone to see the messages exchanged between the two gateways on the projector in the classroom through tshark. The students then used SCION's path selection capabilities to guide their messages around our an-transit via the SCIONLab network, which resulted in the messages disappearing from the classroom projector.
Exercise #2: SCION packet analysis
In the second exercise, students analysed SCION packet dumps using Wireshark. First, they pinged hosts in various autonomous systems (ASs) and ISDs and recorded that traffic using tshark. They then analysed those packet dumps with Wireshark, allowing them to inspect the SCION headers in detail and understand what path selection looks like "on the wire". In the lecture, we explained that SCION achieves path selection by putting information about the forwarding path in the SCION packet header rather than in forwarding tables.
Exercise #3: SCION multi-path communication
In the third exercise, students experimented with multipath communication, which is one of the communication primitives of the SCION architecture. Again in groups of two, they used a custom version of the SCION-IP Gateway (SIG) that supports multipath routing to route IP traffic between the two networks in Figure 1 across multiple paths. That enabled the students to see what it means to use an application and network that supports multipath connectivity.
See you next year?
We will be teaching students about future networks and SCION at the UvA again next year and hope to see you there. In the meantime, we would like to hear from you if you are interested in the topic and perhaps in doing your MSc project with us.
We will also run our lab again at the University of Twente as part of their Advanced Networking course, which will take place from September to November 2022. The lab that we gave at the University of Amsterdam is an extended version of the lab we gave at the University of Twente in 2021.
