Data Integrity Check using Hash Functions in Cloud environment

Data Integrity Check using Hash Functions in Cloud environment

Selman Haxhijaha 1, Gazmend Bajrami 1, Fisnik Prekazi 1

1 Faculty of Computer Science and Engineering, University for Business and Tecnology – UBT

{selman.haxhijaha, gazmend.bajrami, fisnik.prekazi}@ubt-uni.net

 

Abstract. The concept of cloud computing is currently being widely adopted by many business and organizations. Cloud Computing offers immense amount of resources, available for end users by employing various paying methods. The opportunity to choose between several cloud providers is referred by complexity of integrated cloud computing solution. Cloud services offer many benefits to the data owner and users, but to take advantage of the benefits of cloud computing and to make the cloud viable as a computing platform, the data and the service hosted in the cloud must be fully secured. This research paper points out how third party auditors can be avoided and proposes a specific solution which involves the customer safeguarding the data integrity by himself in a very simple and efficient way by utilizing existing hash generating algorithm.

The paper can be downloaded here:

Data Integrity Check using Hash Functions in Cloud environment

Maximum Transmission Unit (MTU) in IPv6 Networks

Maximum Transmission Unit (MTU) in IPv6 Networks

Selman HAXHIJAHA, Petrit SHALA

University for Business and Technology, Prishtinë, Kosovë

University for Business and Technology, Prishtinë, Kosovë

selman.haxhijaha@ubt-uni.net, petrit.shala@ubt-uni.net

Abstract

Every day we are witnesses of IPv6 networks being widely used as a part of global IPv6 Internet. This paper analyses IPv6 Path MTU Discovery mechanism when implemented in a pure IPv6 network infrastructure. It explains a step by step process of discovering the most efficient and most suitable size of the MTU during a particular packet transmission session. It also analyses the ICMPv6 error messages that are being communicated between network nods and implications that arise in case these messages do not reach the sender such as Path MTU black hole. This can greatly degrade the performance of the IPv6 network and at some cases bring it to a halt.

Keywords: IPv6, MTU, ICMPv6, PMTUD

Introduction

As a part of TCP/IP protocol stack, the purpose of internet Protocol is to transport a data packet through interconnected networks from source to the destination. When a packet of data is sent between hosts on different networks, they are carried along the path by routers, one hop at a time, traversing many physical network links. On each step along the path every packet data is encapsulated in data-link layer frame which in turn are sent over to the physical network links for transmission. The size of these packets that are transmitted over the network is determined by a mechanism called Maximum Transmission Unit – MTU.

Since MTU is an essential part of any packet-switched network technology, it is important to explain terminology that is in use describing the concepts.

Link MTU – represents the maximum size of the data packet that can traverse a link between tow network nodes. The size of the link MTU varies due to the different networking technologies that operate under the OSI Network layer.

Path MTU – represents the maximum size of the data packet that can travel a path from source to destination without being fragmented. Therefore, path MTU equals to the smallest packet size of link MTU on the path from source to destination.

IPv6 MTU Packet size

For a data packet to be successfully transported along the route, its size must be small enough to fit within the lower layer frame at each hop of the internetwork. The term Maximum Transmission Unit – MTU defines the packet size limit for any given technology of the physical network. If in a particular part of the network the packet size is larger than the specified MTU of the network, it must be broken into smaller pieces, which in networking terms this process is called fragmentation. These fragments will be reassembled at the destination device.

All these issues apply to transmitting packets in both versions of the protocols, in IPv6 as well as they do in IPv4. However, when we analyze specifications of both protocols, some very important details emerge about the changes of how fragmentation and reassembly is done.

Some very important differences and improvements between IPv4 and IPv6 in relation to the MTU packet size and the process of fragmentation and reassembly are:

Minimum Default MTU – in IPv4 specification [1] is stated that every internet router and physical links must be able to forward a packet of 68 octets, while the recommended MTU of 576 octets without further fragmentation. Different transmission technologies support different MTU sizes as seen in the table 1.

Table 1. Various MTU size

Network            

MTU (bytes)

16 Mbps Token Ring

17914

4 Mbps Token Ring

4464

FDDI

4352

Ethernet

1500

IEEE 802.3/802.2

1492

PPPoE (WAN Miniport)

1480

X.25

576

But in IPv6 specification [2], it is required that every internet router and physical links must be able to forward a packet with MTU size not smaller than 1280 octets. This more than doubling of the MTU packet size in IPv6 networks will results in improved transmission efficiency by increasing the ratio of maximum payload to header length, as well as, reducing the frequency with which packet fragmentation is required. This difference in MTUs of IPv4 and IPv6 could possibly create a packet fragmentation issue in IPv6 over IPv4 network tunneling as it will be explained.

Packet Fragmentation – in IPv4 networks packets can be fragmented by either the source device, or by routers along the path to the destination network. In IPv6 networks, only the source device can fragment the packet, routers along the path cannot do that. Therefore, it is responsibility of the source device to fragment the packet to the smallest MTU of the route before transmitting it to the network.

MTU Size Error reporting – Since in IPv6 networks [2] routers along the path cannot fragment packets, then they must drop them if they are forced to send a too-large packet over a physical link. To resolve the problems that might appear by this issue, a feedback process has been defined using ICMPv6 mechanism that informs the sending device that is using packets that are too large for the route.

MTU Path Discovery Process

In IPv4 networks, routers handle packet fragmentation at every step of the path, causing a variety of processing and performance issues. In contrast, IPv6 routers no longer perform fragmentation. Instead, a discovery process is used by the source IPv6 device to determine the optimum MTU to use during a given packet transmission session. During this discovery process, the source IPv6 device attempts to send a packet at the size that is specified by the upper IP layers, for example, the transport and application layers. If the source IPv6 device receives an Internet Control Message Protocol for IPv6 (ICMPv6) type 1 – destination unreachable [5] and type 2 “packet too big” message, it retransmits the MTU discover packet with a smaller MTU. This process is repeated until the device receives a response that the discover packet arrived at the destination intact. Upon the completion of this process the transmitting device then sets the MTU for the session. During packet transmission process, each source device tracks the MTU size for each session by utilizing the flow label in the IPv6 packet header.

The Path MTU Discovery (PMTUD) process is illustrated in the figure 1. Source Host A wants to send a packet to destination Host D. Host A starts the session by sending a packet to a destination Host D using its local link layer MTU of 6455 octets.

MTU Size

Figure. 1. Path MTU discovery process

The first packet arrives at the Router B which cannot forward the packet because the MTU of the next link is smaller. Router B discards the packet and sends back to Host A an ICMPv6 error message “Packet to Big” and the MTU of the next link of Router B which is 3820 octets. The source Host A uses this newly received information about the size of MTU of 3820 octets and resends the packet to the destination Host D. This time the packet will pass Router B and will be stopped at Router C because the MTU size of the next link is smaller than the MTU of the arriving packet. In a similar way, Router C discards a packet and sends back a ICMPv6 error message which contains information about the size of the MTU, of about 1500 octets, for the destination link on the Router C. Now Host A uses this new information of MTU size of 1500 octets and resends the packet to the Host D. This time Host D will receive the packet correctly. Host A then will select the last MTU packet size of 1500 octets as the Path MTU for all the future communications with Host D. For every transmission session, Host A will build and maintain a table of Path MTUs.

 

Issues with Path MTU Discovery (PMTUD)

As seen in the previous example, the host that initiates the communication session performs Path MTU Discovery (PMTUD) by sending the packet with MTU of its local link and with the Do not Fragment (DF) [3] bit set in the IP header. When the MTU of the packet was too large for a router to forward it on a particular link the router sent back ICMPv6 error message type1 and type 2. The sending host than adjusts MTU packet size based on the ICMPv6 message.

The issue arises with Path MTU discovery when along the path a router or firewall blocks ICMPv6 message. This issue is illustrated in the figure 2.

MTU BlackHole

Figure. 2. Failed delivery of ICMPv6 message type 1 and type 2

Host A initiates communication session by sending packet with MTU 1500 octets to the firewall, which in turn forwards the packet to the ISP-1 Router. Since arriving packet is larger than the MTU of the local link on ISP-1 Router, it discards the packet and sends back to Host A ICMPv6 type 1 and type 2 message. On the return path ICMPv6 message is blocked by the firewall.

Because the returning ICMPv6 message from Router ISP-1 is blocked by firewall, Host A is not aware that it should reduce the size of packets that it sends. As a result, Host A will continue sending packets that are too large, and ISP-1 Router will continue to discard the packets and generate ICMPv6 messages.

The process where ICMP message does not reach the sending host to inform it that it needs to adjust the size of MTU is called Path MTU Black Hole [3]. This can happen as a result of a router due to its misconfiguration or some software bugs, or for security reasons incoming ICMPv6 messages are blocked by firewalls.

The path MTU discovery process is beneficial for network performance because, as routing paths change, a new MTU might be more appropriate. Devices perform an MTU discovery every 5 minutes [4] to see whether the size of MTU has increased or decreased along the path. Application and transport layers for IPv6 accept MTU reduction notifications from the IPv6 layer. If for some reason these upper layers do not accept the notifications, IPv6 has a mechanism for source devices to reduce packets that are too large.

Conclusion

IPv6 is a next generation protocol of the Internet that incorporates a lot of improvements compared to its predecessor IPv4. IPv6 employs Path MTU Discovery mechanism find out which is the most suitable packet MTU size for a particular transmission session. The source node sends a packet that has the MTU of its local physical link, and that will represent an upper limit of the MTU for that path. If the packet transmission proceeds without errors until the destination, than this will be a definite size of the MTU for this session. If for some reason along the path a particular router sends back a message Packet too Big, than the sending node will try again using smaller packet. The advantage of Path MTU Discovery mechanism is that it figures out the best MTU for the communication session and eliminates the need for unnecessary packet fragmentation by networking devices along the path.

Path MTU Discovery mechanism is a stable and dynamic feature of IPv6 Protocol implementation. It requires from sending node to keep track of MTUs for different communication routes, and update them regularly. This is done periodically every 5 minutes [4], or when a node receives a ICMPv6 message packet too big.

The IPv6 networks open the door for strong support of a diverse MTU size in different locations in the Internet. Such as Internet Backbones can use bigger size MTUs for their top layer data intensive users and at the same time numerous ISPs that are serving millions of small customers can efficiently use smaller 1500 octet MTUs.

Reference

[1].   Internet Engineering Task Force (IETF), Internet Protocol (RFC791), September 1981, date accessed 24 April 2012, http://www.ietf.org/rfc/rfc791.txt

[2].   Internet Engineering Task Force (IETF), Internet Protocol, Version 6 (IPv6) Specification (RFC2460), December 1998, date accessed 28 April 2012, http://tools.ietf.org/html/rfc2460

[3].   Internet Engineering Task Force (IETF), TCP Problems with Path MTU Discovery (RFC 2923), September 2000, date accessed 2 May 2012, http://www.ietf.org/rfc/rfc2923.txt

[4].   Diane Teare, Catherine Paguet, Building Scalable Cisco Internetworks – BSCI 3rd Edition, Cisco Press, January 2005

[5].   Internet Assigned Numbers Authority – IANA, Internet Control Message Protocol version 6 Parameters,  March 2012, date accessed 3 May 2012, http://www.iana.org/assignments/icmpv6-parameters