IP Control Gateway (IPCG)

1
IP Control Gateway (IPCG)

• Xiaojun Zhang
• Email zxj_at_pku.edu.cn
• Computer Center, Peking University

2
Contents

• Background information
• Network access control
• IPCG design implementation
• IPCG network accounting system
• Conclusion

3
Background(1/2)

• Old network accounting system
• Based on HTTP proxy
• Application dependence
• Poor performance

4
Background(2/2)

• User-based Network Management

Administrator
control
User
Application
Network
5
Network access control(1/1)

• Network Device-ACL
• limited, coarse granularity
• HTTP Proxy
• application dependent
• poor performance
• Firewall-ACL, Pattern, Rule
• focus on network security
• General open platform-(PC server NIC)
• low cost
• Other specific technology
• RD, high cost

6
IPCG design implementation(1/4)

• Objectives
• Application independent
• High speed bandwidth 1 gigabit
• Access control granularity individual IP
• User-based triggered by user, customize on
  demand
• Controller IP range B-class address block
• Flexibility configuration, employment, etc.

7
IPCG design implementation(2/4)

• Functions
• Access control
• Access Permission
• Traffic statistics
• Collect traffic usage information (for
  accounting)
• Record IP packet content (for query)

8
IPCG design implementation(3/4)

• System configuration
• CPU Intel Xeon up 2.0GHz x 2
• MEM 1GB
• HD gt80GB
• Control NIC Intel 1000M NICx2(internal,
  external)
• Management NIC
• OS RedHat Linux 7.2

9
IPCG design implementation(4/4)

• Traffic graph

bit/s
packet/s
10
IPCG network accounting system(1/1)

• User Authentication
• HTTPS
• User management
• LDAP
• IPCG query service
• User logon/logoff
• Traffic

11
Conclusion(1/2)

• Features
• user-based network access control
• support up to 1 Gbps
• adopt general and open platform
• low cost, investment protection
• wide applicable

12
Conclusion(2/2)

• Next plan
• network behavior analysis
• support IPv6
• up to 10 Gbps

13
Thank you