Sustainable Internet Architecture

Structure of theNew Internet. Figure 1 depicts the structure of the new Internet architecture that we propose. As shown in the figure, we are adding an access-on-request network to complement today’s access-by-default Internet. The access-on-request and access-by-default networks are logically separate networks which only merge at edges via end users (end users can choose to use a service on the new accesson-request network, or to use a counterpart service on the old access-by-default network). The access-onrequest network consists of two separate planes: the data plane and the administration plane. The data plane is where user traffic is actually transferred. The administration plane provides centralized administration (backed by a single trusted third party — government) for the data plane. The data plane is further divided into the edge part and the transit part. The edge part performs access control and processes semantics by contacting the administration plane. The transit part is responsible for routing. Although it can contact the administration plane as well, our access-on-request solution does not rely on such communication. This allows the maximum flexibility for routing architecture deployment (any implementation would be acceptable, e.g., any routing mechanisms or multiple routing architectures in parallel). Administration Plane. The administration plane is controlled by a single trusted third party, which is supposed to be a government body. The adminstration plane provides three basic services: (i) Identity authentication, which is the fundamental service that brings about the access-on-request network and is subject to be used massively. Therefore, its scalability is a major design concern. In Section 4.1.2, we will elaborate our solution to providing high scalability of this service. (ii) Unified incentive system, which supports aforementioned critical leverage points. It gives individual users incentive to comply with standards. It is also essential for motivating the public to help in auditing. (iii) Distributed announcement database, which is designed to announce authoritative information to public. Identity Based Capability and Keeping State. Our framework exploits capability [10, 35, 51, 55] to implement the access-on-request network. To access the network, a user must first acquire a capability, which is issued based on her permanent user identity (Section 3.2). Such identity based capability solution makes keeping state (at network devices) become readily feasible. The network design therefore benefits from ex2Currently, denial of service (DoS) attacks pose a significant threat to network devices that keep state. In our framework, we can apply identity based rate-limiting to effectively counter DoS attacks and exploit appropriate solution (e.g., [35]) to solve the bootstrap issue