Application Enabled Open Networking Use Cases

The following use cases have been identified. Traffic Prioritization: Consistent experience of video conferencing with competing traffic. Firewall Traversal: Identification of new applications. Load Balancing: Identification of application for better load balancing without solely relying on inspection techniques. Scavenger class: Creation of a scavenger class. Use metadata to shift high-bandwidth, low priority traffic to off-peak hours. TODO: That drifts from a use-case to a solution ("use metadata to ..."). Also, it appears to mix two things: (a) scavenger class and (b) time-shifting traffic. This is confusing. Video Adaptation: Use client metadata to help video bit rate selection. Mobile Host/App Metadata: Use metadata for troubleshooting and network planning. Multi-interface selection: Use metadata to help interface selection or prioritization. In describing each use case, the following information is provided. description of the problem proposed solution user benefit operator benefit flow characteristics provided by application action taken by network as result of receiving flow characteristics feedback provided by network

Modern firewalls use application-layer gateways (ALGs) to perform policy enforcement. For example firewalls implement SIP-aware Application Layer Gateway function, which examines the SIP signaling and opens the appropriate pinholes for the RTP media. In particular firewall extracts media transport addresses, transport protocol and ports from session description and creates a dynamic mapping for media to flow through. This model will not work in the following cases: Session signaling is end-to-end encrypted (say, using TLS). Firewall does not understand the session signaling protocol, or extensions to the protocol, used by the endpoints (e.g. WebRTC signaling protocols). Session signaling and media traverse different firewalls (e.g., signaling exits a network via one firewall whereas media exits a network via a different firewall). Enterprise networks that use firewalls with restrictive policies block new applications like WebRTC and delay deployment of killer applications.

The above problems can be addressed by the host getting authorization from the Application Server trusted by the network in order to install flows and associated actions (e.g., policies). PCP third party authorization (draft-wing-pcp-third-party-authz-01) solves this problem by associating the media session with the signaling session. This is done by sending a cryptographic token in the signaling which authorizes the firewall mapping for the media session.

Enterprise networks that use firewalls with restrictive policies can deploy new applications at a faster rate for user benefit.

Enterprise firewalls can enforce restrictive policies without the need to be enhanced to perform ALG on new applications. For example Enterprise firewall could have granular policies to permit peer-to-peer UDP media session only when the call is initiated using the selected WebRTC server (Dr. Good) it trusts and block others (Dr. Evil). PCP-aware firewalls can enforce such granular security policies without performing ALG on the session signaling protocols. This mechanism can be used by any other Application Function trusted by the network to permit time-bound, encrypted, peer-to-peer traffic.

The client requests dynamic mappings to permit flows required by the application. This request includes a cryptographic token and characteristics of the flow, such as the anticipated bandwidth needs as well as the tolerance to delay, loss, and jitter.

The firewall uses the client request to permit and prioritize the traffic associated with those flows. The cryptographic token provides authorization for the flows and their prioritization.

Firewall matches the authorization data with what is requested in the request sent by the client. If the authorization sets match, the firewall processes the request made by the client. If the token is invalid or the request exceeds what is authorized by the token then firewall rejects the request.

HTTP Adaptive Streaming (HAS) is an umbrella term for various HTTP-based streaming technologies that allow a client to adaptively switch between multiple bitrates, depending on current network conditions. HAS client first requests and receives a Manifest File, and then, after parsing the information in the Manifest File, proceeds with sequentially requesting the chunks listed in the Manifest File.

The problems with HAS are: HAS client selects the initial bitrate without knowing the current network conditions which could cause start-up delay and frame freezes while a lower bitrate chunk is being retrieved. HAS client does not have a mechanism to signal the flow characteristics and flow priority to the network. HAS server can mark the packets appropriately but setting DSCP has limitations. DSCP value may not be preserved or honored over the Internet and OS may not allow to set DSCP values. Content Providers may have agreements with ISPs and need a mechanism to convey the flow characteristics and flow priority to the ISP. Existing mechanisms and the associated limitations are: ISP can be configured with the IP addresses of content providers to prioritize the traffic originating from those servers. The limitations with this approach are ISP has to keep track of content providers IP addresses. With CDNI (Content Delivery Network InterConnection) content could be served either from uCDN (upstream CDN) or any of a number of dCDNs (downstream CDN) and it will not be possible to manually track the IP addresses of all the CDN surrogates. There is also no way to differentiate content which could be available in different bitrates. If HAS client is behind NAT and content provider uses RESTful API (OneAPI) to install differentiated QoS then ISP will struggle to find the pre-NAT information. Content provider also needs to be aware of the ISP to which the client is attached and the IP address of the Policy Decision Point (PDP) in the ISP to which it needs to signal the flow characteristics. ISP can use DPI to prioritize one-way video streaming content but is expensive and fails if the traffic is encrypted.

If ISP has agreement with content provider then HAS client can use third party authorization to request network resources. At a high level, this authorization works by the client first obtaining a cryptographic token from the authorizing network element, then including that token in the request along with relevant flow characteristics. ISP validates the token and grants the request.

AEON helps increase the average play quality, reduces the start-up delay and frame freezes by avoiding attempt to retrieve a too high-bit rate chunk etc thus improving the quality of experience for end user.

Network Operators can recognize and prioritize one-way video streaming content.

HAS client signals the flow characteristics such as the anticipated bandwidth needs as well as the tolerance to delay, loss, and jitter.

Subject to local policies, a network node might perform bandwidth counting, or reconfigure the underlying network so that additional bandwidth is made available for this particular flow, or might perform other actions.

The network responds that the client request can be fully or partially accommodated. It also notifies the client when conditions change.

An increasing number of hosts are operating in multiple-interface environments and a host with multiple interfaces needs to choose the best interface for communication. Oftentimes, this decision is based on a static configuration and does not consider the link characteristics of that interface, which may affect the user experience. The network interfaces may have different link characteristics, but that will not be known without the awareness of the upstream and downstream characteristics of the access link.

TODO

Applications can choose the best interface for communication using AEON.

The network that can provide the requested flow characteristics will be selected by the application thus increasing the subscriber base of the operator.

Application signals flow characteristics over multiple interfaces and based on the response from its various interfaces sorts the source addresses according to the link capacity characteristics. Source addresses from the interface which best fulfills the desired flow characteristics are assigned the highest priority and would be tried first to communicate with the server or remote peer. For example draft-reddy-mmusic-ice-best-interface-pcp-00 explains the mechanism where Interactive Connectivity Establishment (ICE) agent on a host with multiple interfaces uses AEON to determine the link characteristics of the host's interfaces, which influences the ICE candidate priority. Similarly draft-wing-mptcp-pcp-00 explains how Multipath TCP (MPTCP) can select the best path when multiple paths are available.

The authors thank the attendees of the Bar BoF for contributing towards this set of use cases.

&I-D.eckert-intarea-flow-metadata-framework;