THE FUTURE OF HOME NETWORKING - pureintegration.com · The Future of Home Networking |...

THEFUTUREOFHOMENETWORKINGTheImpactofWi-Fi,RemoteUIandOpenSourceStacksonServiceProviderNetworkArchitecture

Business Integration with Clarity

TheFutureofHomeNetworking|pureIntegration

ConfidentialandProprietaryCannotbedistributedwithoutpriorconsentfrompureIntegration

TableofContents

1 Introduction.................................................................................................2

2 ProposedEvolutions....................................................................................3 AuthenticationandWebUI..............................................................................................................5 Self-Healing/Diagnostic...................................................................................................................6 SecurityandContentProtection.....................................................................................................6

3 Gatewaydesignimpact................................................................................7

4 CPEandIoTdevicesdesignimpact...............................................................8

5 Proposeddevelopmentandintegrationapproach.......................................9 Phase1:InterconnectiontestswithRDK-BorOpenWrtonRaspberryPI......................................9 Phase2:Authentication&RemoteManagementdevelopmentonRaspberryPI..........................9 Phase3:PortonProductionGateway............................................................................................9 Phase4:EndtoEndIntegration....................................................................................................10 Phase5:TR-181DataModelenhancementforSelf-Healing/Diagnostic......................................10 Phase6:IoTdevicesandLPWANTestandIntegration.................................................................10 Phase7:ImplementationofMediaIndependentHandoverServices(802.21)............................10 Phase8:SoftwareDefinedNetwork.............................................................................................11

6 Conclusion.................................................................................................12

ListofFiguresFigure1-RDK-B(CCSP)HighLevelArchitecture............................................................................4Figure2-SPNetworkproposedevolutions...................................................................................5Figure3-RDK-BHighLevelArchitecture.......................................................................................7


ConfidentialandProprietary CannotbedistributedwithoutpriorconsentfrompureIntegration 2/12

1 INTRODUCTION The advances in mobile, broadband speed and wireless technologies have enabled theconsumptionandproductionofcontentanytime,anywhere.Forinstance,withvideostreamingavailableonthegoandInternetofThings(IoT)devicesalwaysonline,consumersexpectconstantconnectivity.ThisispromptingServiceProviderstorethinktheirstrategyinregardtogateways,networkarchitectureandsecurityastheircustomers’needsareevolving.Traditionally,techcompaniessuchasApple,GoogleandAmazonorHomeGatewaycompaniessuch as Netgear and Linksys have positioned themselves as the gatekeepers of the HomeNetwork(eitherthroughHomeKit,GoogleHomeorAmazonEchoforadvancedsolutions).Thismeantthattherewereatleasttwoormorepartiesinvolvedincarryingdatabetweendevices(whetherwireless,wiredor IoT) and the “cloud.” Froma customerpointof view, aproblemarisingresultedintheneedtodealwithmultiplepartieswhentroubleshooting.Thiscouldbepotentiallydevastating,especiallywhendealingwithsecuritysolutions,sincethereisnoSLAthatcanbeappliedbetweenallthepartiesinvolved.Thechallengewiththirdpartyecosystemsisthatthelevelofsecurityoftheentiresystemlieswiththeweakestlink.Forinstance,theDNS(DomainNameSystem)DistributedDenialofServicethatoccurredinOctober2016wasduetothepoorqualityofthesoftwarethatwasembeddedinsecuritycameras, residentialgateways,andbabymonitors thatwereaffectedbytheMiraibotnetmalware.Theattacklasted9hourstotal(in3wavesofattacks)andgeneratedtrafficintheorderof1.2Tbps,impactingsitessuchasAmazon,BBC,Comcast,DirecTV,Netflix,PayPalandTwitter,tonameafew.Basedonthe levelof integrationthat theycanofferbetweentheirbackendsystem,networkinfrastructureandhomegateways,ServiceProvidershaveauniqueabilitytocreateanendtoendsolutionthatunifiestheuserexperienceacrossgateways,securesthenetworkandoffersvalue-addedservicessuchas:

• ContentProtection• IoTIntegration• QoS(QualityofService)• SLA(ServiceLevelAgreements)• Self-HealingNetworksServices• OperatorHomeNetworkVisibility

This white paper will discuss the benefits of such an end to end solution, the challenges inimplementingoneandaproposedapproachonhowtodevelop,integrateanddeployitintoaServiceProvidergradenetwork.



2 PROPOSEDEVOLUTIONS Currentgatewayarchitecturereliesonthefactthatmostofgatewayfunctionsareimplementedinhardware,mainlytoreduceproductioncosts.Managementandconfigurationfunctionsaredoneandstoredlocally(e.g.throughalocalwebserver).TheUImaybecommonbutreliesonproprietaryAPItointerfacewiththehardware.Withtheconstantreductioninprocessorsize(diesize)andincreasedCPUpower,whatrequiredadedicatedSOC(SystemonChip)cannowbeachievedwithgeneralpurposeCPUs,leavingonlythe low-level communications, such as DOCSIS and Wi-Fi, to dedicated SOCs. Firewall,Authentication,ConfigurationandRoutingarenowsoftware functions thatcanbeportedonvarious platforms.With the complexity of the gateway stack increasing, these changeswerenecessaryinordertooffermoreservices(forinstance,FirewallwithDeepPacketInspectionarefrequentlyrequired),improvedprocessorspeedandincreasedMIPSatreducedprices.SoftwarethatwaswrittenbyOEMsandChipsetmanufacturersisnowreplacedbyOpenSourceinitiativeslikeRDK-BandOpenWrt.RDKorReferenceDesignKitwascreatedtoacceleratethedeploymentofnext-generationvideoandbroadbandservices.Itisapre-integrated,open-sourcesoftwaredistributionthatprovidesacommonframeworkforpoweringcustomer-premisesequipment(CPE)suchasset-topboxes,modem/routers and other devices from communications service providers. It allows serviceproviderstostandardizecertainelementsofthesedevices,enablingthemtoquicklylaunchtheirownnewservicesorcustomizeapplicationsanduserexperiences.TheRDKspeedsuptimetomarketwhileenablingflexibilityandcompetitivedifferentiation[RDKCentral].OpenWrtisdescribedasaLinuxdistributionforembeddeddevices.Insteadoftryingtocreateasingle,staticfirmware,OpenWrtprovidesafullywritablefilesystemwithpackagemanagement.Thisfreesyoufromtheapplicationselectionandconfigurationprovidedbythevendorandallowsyoutocustomizethedevicethroughtheuseofpackagestosuitanyapplication.Fordevelopers,OpenWrtistheframeworktobuildanapplicationwithouthavingtobuildacompletefirmwarearoundit;forusers,thismeanstheabilityforfullcustomization,tousethedeviceinwaysneverenvisioned.[OpenWRT.org]TheseOpenSourceinitiatives,inwhicharepositoryoffunctionalities,relyingonaLinuxKerneland Hardware Abstraction Layer (HAL), are available to the community and can be used tocustomizeyourplatformwithspecificradiosandperipherals(DOCSISmodem,Wi-Fi,ZigBee,Z-Wave,LPWAN,Bluetooth,LoRaWAN,andmore).NotonlydotheseinitiativesallowforfasterdevelopmentbuttheyalsoofferalevelofstandardizationthatallowsServiceProviderstheabilitytoenhancetheirendtoendcapabilities.



Figure1-RDK-B(CCSP)HighLevelArchitectureSource:RDKCentral

RDK-BandOpenWrt,forinstance,offerremotemanagementcapabilitiesviaTR-69andTR-181,whichmeansthatsomeofthefunctionalitiesthattraditionallyresidedinthegatewaysuchasaWebUI,eRT(e-Router)canbemigratedintothecloud.

https://rdkcentral.com/technicolor-steps-up-focus-on-rdk-b/



InitiativessuchasComcastXFINITYxFi,whichenablesuseranddevicemanagementviaaremoteUI,arethebeginningofatransformationofthisindustry.CombinedwiththemovetoSoftware-DefinedNetworks(SDN)andNetworkFunctionsVirtualization(NFV),aServiceProvidernetworkcanoffervalue-addedservicessuchas:

• Self-Healing/Diagnostic• SecurityandContentProtection• In-HomeandOut-of-HomeSeamlessTransition• VPNService

Figure2-SPNetworkproposedevolutions

AUTHENTICATIONANDWEBUIBymovingtheWebUItotheCloudandcentralizingtheAuthenticationprocess,itispossibletocreateadatabaseofdeviceswhichcanallowseamlesstransitionbetweenin-homeandout-of-homeusage.Currently,Wi-Fideviceauthentication relieson localpassphraseauthentication;when moving out of the home you would need to use an unprotectedWi-Fi network or apredefinedSSID/passwordcombinationtoconnectbackintoyourServiceProvider.WiththeuseofacentralizedAuthenticationservice,itispossibletoregistereverysingledeviceconnectingtotheGatewayandallowtheuseofuniquecertificatesacrossthenetwork.Certificatescouldbetransmittedusingeither802.1x(Radius)orHotspot2.0(Wi-FiPasspoint™,802.11u)technology.Using x.509 certificates insteadof a login/password combination introduces another layer ofsecuritywhichenhancesthecapabilitiestodetectintrusions.Centralization of theWebUIwill allow for use of the same credentials as other services (TVservice,VoiceandIoT,forinstance)andwillfacilitateusermanagementandtroubleshooting.



SELF-HEALING/DIAGNOSTICHistorically,ServiceProvidersonlyhadthecapabilitytodiagnoseissuesoncetheyhadoccurred.MachineLearningallowedonestepfurtherinpredictingfailurebyanalyzingtheerrorsreportedbyeachofthedevices.WithSDNandNFV,whichgiveahigherlevelofunderstandinginnetworkperformanceandutilizationandallowadjustingthenetworkcapacityinreal-time,itispossibleto offer Service Level Agreements that were not previously achievable without investing insignificanthardware redundancy. This could reduce the costs and complexity for commercialservicesandimproveresidentialservicereliability.With the adoption of TR-069 and its TR-181 datamodels across Gateways and the fact thatdevicesmustbeauthenticatedtoconnecttothenetwork,thiscanallowcollectionofdatafromtheenddevicestotheexternalnetwork,facilitatingtroubleshooting,securitythreaddetectionandmaintenance.TR-069 is the industry standard CPEWANManagement Protocol defined by the BroadbandForumandhasmorethan700millionsubscribersworldwide.Itisintendedforcommunicationbetween a CPE and Auto-Configuration Server (ACS). The CPE WAN Management Protocoldefinesamechanismthatencompassessecureauto-configurationofaCPEandalsoincorporatesotherCPEmanagementfunctionsintoacommonframework.[BroadbandForum]

SECURITYANDCONTENTPROTECTIONTheuseofcertificatesacrossthenetworkallowsforestablishingsecureconnections(VPN)fromtheenddevicestoeithertheGateway,theCMTS,orevenfurtherdependingonhowthenetworkis configured. Potentially, a connection could be secured up to the backbone if using SDN(SoftwareDefinedNetwork)technology.Sincethecontentcanbeencryptedacrosstheentirenetwork,thiscouldoffercontentprovidersanalternativetoDRM(DigitalRightsManagement)orasecondlayerofprotectionasameanstosecuretheircontentdistribution.Lastandforemost,sincealldevicesmustregistertoaccessthenetwork,thiswillallowtighterdetectionofsecuritythreadsandtheirelimination.Forinstance,aServiceProvidercoulddecidethatadevicethatisnotsecuredproperlywiththelatestsecuritypatchesorproperencryptiontechnologywouldnotbeallowedontheirnetwork.



3 GATEWAYDESIGNIMPACTToenableremotemanagement,thegatewaysoftwareneedstomigratetoamodularsoftwarestacksuchasRDK-BorOpenWrtandsupportstandarddevicemessagingprotocolssuchastheTR-069andTR-181datamodels(bothstackssupporttheseprotocolsanddatamodels).Currently,CableModemprovisioning/authenticationisdoneviatheCMTSandoncetheCableModemisauthorized,networkconnectivityisestablished.Dependingonhowtheauthenticationprocessisdesignedinthebackend,itmaybenecessarytodownloadauniquecertificatetoallowaccesstotheWebUIandWi-Ficonnectivity.NotethatbothRDK-BandOpenWrthaveasoftwarearchitecture that separates basic eCM functionality (also called eDOCSIS) from the eGW(eRouter) functionality (see figurebelowforRDK-B)and it ispossible toaddanother layerofauthenticationifnecessary.

Figure3-RDK-BHighLevelArchitectureSource:Intel–CableResidentialGatewaysolutionforConvergedNetworks

https://networkbuilders.intel.com/docs/Cable-Residential-Gateway-Solution-for-Converged-Networks.pdf



4 CPEANDIOTDEVICESDESIGNIMPACTWi-Fi gateways currently allow for Guest network access in the clear or via log in using aSSID/passwordcombination.Theseauthenticationmethodologieshavebeenpronetosecurityflaws, as they do not provide strict access control of who is on the network. Once theSSID/password combination is breached thenanydevice can connect. Theuseof certificatesrequires the user to accept the device within the network, which makes it clear that theconnectionislegitimate.Thiswill,however,haveasignificantimpactonthedesignoffutureIoTdevices,astheywillhavetosupportprotocolssuchas802.1xor802.11utobeabletoconnecttoaGateway.MostofthedevicescurrentlybuiltconnectusingWi-FiProtectedAccessbutthiswillnotbesufficientoncetheGatewayistotallysecured.Duringato-be-determinedtransitionperiod,itmaybepossibletoallowforamixedmodeinwhichmultipleauthenticationmethodologiescouldbeaccepted.Assecuritygoes,theweakestencryption/authenticationlinkdeterminesthelevelofsecurityoftheentiresystem.Aswe’veseenduringtheOctober2016DDoS(DistributedDenialofService)attackthatdisabledalargeportionofthecloudinfrastructureontheEastCoast,securingthebackendwasnot sufficient - theattackpropagated from IoTdeviceswhich floodedDynDNSservers with requests. If a strict authentication and certification process (through theWi-FiAlliance,forinstance)wouldhavebeenputinplace,itislikelythatsuchaproblemwouldnothaveoccurredortheimpactwouldhavebeenreduced,attheleast.Basedonthesepremises,overtimeitwillbenecessarytodisablelowersecureprotocolsonalltheradios.IfserviceoperatorsprovideLPWAN,ZigBee,Z-WaveaccessintheirGateways,suchprotocolsmustevolvetosupporttheupdatedtothelatestadvancesinsecurity(suchasrotatingkeysandrejectionofexchangeofsecuritykeysintheclear).



5 PROPOSEDDEVELOPMENTANDINTEGRATIONAPPROACHAsdevelopmentfocusesonestablishingachainoftrustbetweencustomerdevicesandbackendsystems,itisnotnecessarytouseacompleteinfrastructuretodemonstratefunctionality.CMTSand Cable Modem functionalities can be bypassed, simulated or at least segregated.DevelopmentfocuswillbeontheGatewayandwillassumethattheWebUI,AAAserverandCertificateAuthority(per802.11ustandard)havebeendeployed.Tofacilitatetheintegrationofthesenewfunctionalities,thedevelopmentandintegrationshouldfollowaphasedapproachasdescribedhereafter.

PHASE1:INTERCONNECTIONTESTSWITHRDK-BOROPENWRTONRASPBERRYPIMostofthedevelopmentandtestingcanbedoneonaRaspberryPI,asbothRDK-BandOpenWrtareportedonthisplatformandtheirimplementationisrepresentativeofthefinalenvironment.Thegoalofthisphaseistodemonstratethatwecanconnectanenddevicetoaback-endsystemusingaWi-FiRouterrunningRDK-BorOpenWrt.Thisphasecanbeachievedinalabenvironmentonanexistingproductionsystem,asitisequivalenttosettingupaconsumerrouterbehindacablemodemoragateway.

PHASE2:AUTHENTICATION&REMOTEMANAGEMENTDEVELOPMENTONRASPBERRYPIThegoalofthisphaseistodevelopthesoftwareontheWi-Firouterthatwill:

• removethecapabilityforanendusertologinlocallyonagateway• allowalocalorremoteagent,usingTR-181datamodels,toremoteprogramagateway• modifytheWi-Fiauthenticationprocesstouse802.1xor802.11u.Ifnecessary,allowfor

a degradedmode inwhich SSID/Password can be securely communicated to the enddevice

• verify that thegatewaycanprogrammultipleSSID(onespecific totheuser,oneforaguestnetworkandoneglobal)

• verify that each individual device connecting to the gateway is registered within adatabase

• verifythattheenduserdeviceisconnectingproperlyviatheWi-FigatewaytotheInternet

PHASE3:PORTONPRODUCTIONGATEWAYThegoalofthisphaseistoportthemodificationsthatweredoneontheRaspberryPIandtestthemonaProductionGateway.BasedonthefactthatbothRDK-BandOpenWrtareplatformagnostic,nosoftwarechangesareexpected.



PHASE4:ENDTOENDINTEGRATIONThegoalofthisphaseistotestthesolutionwiththeCMTS,CableModem,andproperWebUIandAuthenticationserversinplace.Testsshouldbeperformedforthefollowingusecasesbutarenotlimitedto:

• Newcustomerregistration• NewGatewayinstallation• Deviceregistration• Devicesuspension• Deviceroaming(fromin-hometoout-of-homeusingglobalSSID)• Customersuspension• Customerde-registration• Devicede-registration• Gatewayreplacement

PHASE5:TR-181DATAMODELENHANCEMENTFORSELF-HEALING/DIAGNOSTICInthisphase,developmentshouldbefocusedonincorporatingmorenetworkstatisticsthatwillfacilitate:

• Thetroubleshootingofenduserdeviceconnectivityorperformanceissues• Thepredictionoffailureswithinthenetwork(includingGateway)usingMachine

Learning/Self-Healingtechnology

Thenetworkstatisticsandparameterswillneedtobedefinedpriortotheimplementation.

PHASE6:IOTDEVICESANDLPWANTESTANDINTEGRATIONThegoalofthisphaseistotesttheregistrationandtrackingofIoTdevicesusingeitherZigBee,Z-WaveorLPWANprotocols.

PHASE7:IMPLEMENTATIONOFMEDIAINDEPENDENTHANDOVERSERVICES(802.21)802.21allowsforseamlesshandoverbetween3Gcellularnetworksand802.11Wi-Finetworks.Thisprotocolrelieson802.11uforauthenticationandoptimizationof802.11layer2andlayer3fordetectionofconnection/disconnectionevents.Thisdevelopmentrequiresthatthegatewaybecapabletolet802.11MIHsignalingdeliveryandcompliesto802.15.3MLME(MediaLayerManagementEntity).NotethatthesestandardsareimplementedinalltheWi-Firadioscurrentlybeingshipped.AnOpenSourceSoftwareinitiativecalledODTONEprovidesaframeworktoimplementsuchaprotocol.

http://atnog.github.io/ODTONE/



PHASE8:SOFTWAREDEFINEDNETWORKThisdevelopmentwouldrequireremovingalloftheroutingandfirewallingcapabilitiesofthegatewayandmovethemtothecloud.Thegatewaywouldkeepswitching,radiomanagement,LineQoSandVLANcapabilities.ThisdevelopmentisoutofscopeforthiswhitepaperbutshouldbepartofabiggerroadmapascreatingaCentralizedWebUIserviceisthesteppingstonetosuchanevolution.



6 CONCLUSIONSecuringServiceProviders’networkinfrastructurewillbeoneofthebiggestchallenges inthenextdecade.ItisimperativefortheentireInternetecosystemtomakesurethatonlyauthorizedproductsconnecttothenetwork.AsIoTcontinuestogrowatanexponentialrate(6to8billionadditionaldevicesyear-over-year),securityrisksgrowexponentiallyaswell.As seen in thiswhitepaper, the threat starts in thehome.TheuseofunencryptedorpoorlysecuredWi-Fi,ZigBee,Z-WaveorLPWANconnectionsisputtingtheentireInternetatrisk.Thefirststepinreducingthisriskistobeawareofwhatisconnectedtothenetworkandeventuallydenyingaccesstounsecuredandpotentiallylethalproducts.By moving the authentication and registration process to the cloud and remote managinggateways,ServiceProviderswillhavetheuniqueabilitytocreateanetwork-awaresystemwhichwillallowthemtoimprove:

• securitythreatdetection• self-healinganddiagnosticcapabilities• deviceroamingcapabilities• networkoperatingcosts• customerservice

BystandardizinggatewayfunctionalitiesandusingsoftwarestackssuchasRDK-BorOpenWrt,ServiceProviderswillbenefitfromtheeffortsofanentirecommunityofexperts,whichwillleadtoimprovedtime-to-market,developmentcostsandeventuallydeploymentcosts.pureIntegrationisuniquelypositionedtohelpServiceProvidersdeploysecureconnectionsaswearecontributingtoRDK-BinstandardizingtheintegrationofLoRaWAN/LPWANdevicesintotheecosystem.WehavedevelopedpracticesinIoTandNetworkAutomationinwhichwehavespentsignificanteffortsintestingandverifyingthatdevicesaresecuredproperly.pureIntegrationhasdeployedWi-FisolutionsatCox,NetworkAutomationsolutionsatComcastandTimeWarnerCable, and IoT solutions at variousMSOs. pureIntegration enjoys a healthy relationshipwithtechnology providers such as Technicolor, Arris, and Hitron, which are key members andcontributorstoRDK-B.Contactusifyou’dliketolearnmore.

ContactUstoLearnMore703-707-9680

[email protected]://pureintegration.com

THE FUTURE OF HOME NETWORKING - pureintegration.com · The Future of Home Networking |...

Documents

Transcript of THE FUTURE OF HOME NETWORKING - pureintegration.com · The Future of Home Networking |...