An Efficient Quorum-Based Fault-Tolerant Approach for Mobility

2008 IEEE International Conference on Sensor Networks, Ubiquitous, and Trustworthy Computing

An Efficient Quorum-based Fault-Tolerant Approach for Mobility Agents in Wireless Mobile Networks Yeong-Sheng Chen Chien-Hsun Chen Hua-Yin Fang Department of Computer Science, National Taipei University of Education [email protected]

The traditional architecture of a single MA can not offer fault tolerance services. Usually, a single MA may not able to afford the services for a lot of MNs. And, if a MA fails, all the MNs served by it can not communicate with other CNs. To cope with these problems, multiple MAs are necessary. However, in multiple MAs environment, data will be stored in distributed storage in the different MAs. The distributed data processing will cause some problems, such as registration delay, fault tolerance, load balance, etc. To offer solutions to these problems, many fault-tolerant approaches [3, 5, 7, 8, 11] have been proposed. The following section will briefly review the related approaches.

Abstract In this paper, we propose an efficient quorumbased mechanism to the fault-tolerance problem in mobile IP protocol. In a network with N HAs, all the HAs are grouped into N quorums with logical circular structure. Every HA has ª« N º» backup quorums and divides the network that it manages into «ª N »º equal parts. According to the home address of the MN, each HA finds out the backup quorum in the network segment and stores the mobility bindings of the MN in ª« N º»  1 backup HAs. When a HA crashes, the system will select the HA with minimum load from each backup quorum to take over the bindings of the faulty HA. In comparison with previous related works, our experimental results show that the proposed fault-tolerant protocol has many advantages: better system load balance, less latency for registration process, less system resource requirements, and no extra hardware cost. Keywords: Mobile IP, Fault-Tolerant, Quorum, Mobility Agent.

2. Background and Related Works 2.1. System Architecture The system model considered in this paper consists of two major components: radio access network (RAN), and core network. The RAN provides the transmission with the far network or the equipments across the air interface. By the function of an RAN, the MNs acquire radio resources for executing the wireless data sessions. The core network provides the services of the packet switch and contains the HAs, the FAs and intermediate routers. With Mobile IP functionality, the HA and the FA offers the wireless data sessions as described above. However, the intermediate routers help the MAs forwarding the packets. Besides, there is an interconnection network between the RANs and the FAs. The MNs or the users send the data requests to the core network through the interconnect network. On the other hand, the core network will dispatch data reply packets to the MNs or the users through the interconnection networks, too.

1. Introduction The Mobile IP protocol [1, 2] is a routing protocol proposed by Internet Engineering Task Force (IETF) to support IP mobility. In the architecture of Mobile IP, there are two kinds of Mobility Agents (MAs): Home Agents (HAs) and Foreign Agents (FAs). The purpose of the MAs is to provide services without changing IP address. A MN registers with its home agent when it first arrives at a Radio Access Network (RAN). When the Correspondent Node (CN) sends the packets to the MN, these packets will be delivered to the MN’s home network by using traditional IP routing protocol. Nevertheless, when the MN moves from the home network to a foreign network, it will update its location by registering with its HA with a new temporary IP address called Care-of Address (CoA) offered by the FA in the foreign network. The packets will be tunneled by the HA to the FA and then forwarded to the MN. Thus, a mobile IP network can provide the portable devices with roaming capability and enables the mobile users to maintain continuous data connectivity without interruption while changing locations.

978-0-7695-3158-8/08 $25.00 © 2008 IEEE DOI 10.1109/SUTC.2008.9

2.2. Existing Fault Tolerance Approaches A mechanism with redundant MAs was presented by Ghosh and Varghese [11]. We call it “FTMIPP” for short. In that approach, redundant MAs backup the mobility bindings of the MNs, which are served by all MAs. When a MA receives the registration request message from the MN, it keeps a record of the message

373

each quorum (Qi, 1ЉiЉN) contains ª« N º» different HAs and every HA belongs to ª« N º» different quorums. Note that the intersection of any two quorums is nonempty. For example, consider a network environment with 8 (N = 8) HAs, which are numbered from 1 to 8 in order and are divided into groups according to the proposed scheme above. The construction of the N-ring system with 8 HAs is shown as Figure 1. Due to N=8, there are 8 HAs divided into 8 quorums. Each quorum (Qi, 1 d i d 8 ) has ª« 8 º» = 3 HAs and every HA exactly

and forwards the message to all the other MAs. At the same time, before sending a registration reply message, the MA has to acquire every backup reply message from all other MAs. Although this scheme is able to reduce the load of a single MA and tolerate the failure, it results in long registration time for the MNs and has low resource utilization since all MAs have to store and maintain the mobility binding for every MN. Ahn and Hwang [8] proposed a scheme with a stable storage in each MA. They allocate a stable storage for each MA and store the mobility bindings in the stable storage of the MA. In case that a MA crashes, other failure-free MA, which is in charge of the bindings of the faulty MA, can acquire the bindings from the stable storage in the failed MA and also take over the MNs recorded in these bindings. The scheme is able to shorten the registration time. However, a stable storage does not seem to exist in the real world. Lin and Arul [7] proposed a method with integrated OA&M (Operation Administration and Maintenance) [13] functions to detect the states of all devices in the network. When OA&M discovers a failed MA, it will select other failure-free MAs as backup members and then pick a manager from these backup members. The manager searches for the bindings of the MNs which are influenced by the failed HA in each FA and requests other backup members to maintain these bindings. Although the MAs do not have to backup the bindings beforehand, the scheme has to spend extra time on searching and delivering the bindings and have extra hardware cost of the management equipments.

belongs to ª« 8 º» = 3 different quorums, such as HA1  {Q1, Q8, Q7}. Then, we have the CQ-set = {Q1, Q2, Q3, Q4, Q5, Q6, Q7, Q8}, where Q1 = {HA1, HA2, HA3}, Q2 = {HA2, HA3, HA4}, Q3 = {HA3, HA4, HA5}, and so on. The CQ-set with 8 HAs is shown in Table 1.

Figure 1. The N-ring system with 8 HAs

3. The Proposed Approach We propose an efficient cyclic-quorum-based fault-tolerant protocol with distributed binding management mechanism to solve the problems mentioned above in Mobile IP networks.

Table 1. An example of the CQ-set with 8 HAs

3.1. Cyclic Quorum Scheme Without loss of generality, we assume that there are N HAs in a mobile network. We group the HAs into a number of quorums. Our mechanism is based on a circular numbering system with N HAs, which are organized as a logical circle. Each HA in the system is assigned a distinct number between 1 to N.

The following definitions and theorems are used to facilitate the description of our proposed mechanism.

Definition 1. A set system [9] C = {Q1, Q2,…, Qn}, 1Љn, is a collection of nonempty subsets Qi Ž U (1ЉiЉn) of a finite universe U.

Definition 4. Primary Home Agent: A home agent that takes charge of the binding of the registered MN is called the primary home agent of the MN.

Definition 2. Each element Qi of C in Definition 1 is called a quorum.

For a particular MN with its primary home agent HAk ( 1 d k d N ), we further have the following definitions.

Definition 3. A cyclic quorum set CQ-set = {Qi | Qi = {HAi, HA((i+1) mod N ), HA((i+2) mod N ), …, HA((i+d-1) mod N )}, 1ЉiЉN}, where d = ª« N º» ; i and N are integers.

Definition 5. Backup Quorum Ǻ The quorum that consists of HAk is called the backup quorum of the MN or the backup quorum of HAk.

Let the N HAs are divided into N quorums according to Definition 3. Obviously, in this CQ-set,

374

Definition 6. Backup Quorum Set Ǻ The set that

Qk except for HAk, and the bindings of MNs in the second segment are backuped by the HAs in Q((k-1) mod N) except for HAk, …, and so forth. Consider the above example again. In the network with 8 HAs, for the primary home agent HA1, the backup quorum set is {Q1, Q8, Q7}, where Q1 = {HA1, HA2, HA3}, Q8 = {HA8, HA1, HA2}, Q7 = {HA7, HA8, HA1}. Assume that the address of the network segment that is managed by HA1 is A.B.C.DX1~A.B.C.DX4. Then, it is divided into ª 8 º =3 segments and the three segments

ª Nº « »

comprises all the backup quorums of the MN is called the backup quorum set of the MN or the backup quorum set of HAk. Definition 7. Backup Quorum ArrayǺ The array that

contains all the ª« N º» backup quorums of HAk is called backup quorum array of HAk and is denoted as BQk[0..d-1]=[Qk, Q((k-1) mod N),…, Q((k-d+1) mod N)], d= ª« N º» .

«

Theorem 1. For a primary home agent HAk ( 1 d k d N ), its backup quorum set is {Qk, Q((k-1) mod N),…, Q((k-d+1) mod ª Nº » , and there are exactly d backup quorums in N)}, d= « the backup quorum set. Definition 8. Backup Home Agent (Backup HA), Backup Home Agent Set (Backup HA Set)Ǻ For a mobile node MN with its primary home agent HAk ( 1 d k d N ), every HA (except the primary HAk) in the backup quorum of HAk is called the backup HA of the MN or the backup HA of HAk. The set includes all backup HAs in the backup quorum set of HAk is called the backup HA set of HAk.

3.3. Maintenance and Backup of Bindings In the conventional Mobile IP protocol, the mobility binding consists of a MN’s home address, its CoA and registration lifetime. In our cyclic quorum-based mechanism, the binding also include the HA’s IP address and the chosen backup quorum. That is, the binding contains home address, CoA, lifetime, HA’s IP address and the backup quorum that the HA selects. We call this binding as “extended binding”. The registration and backup management mechanism is described as follows. In a mobile network with N HAs, when a MNi ( 1 d i d N ) roams to a foreign network, the FA is going to allocate a CoA for it. Supposing that the MNi’s HA is HAk ( 1 d k d N ), the MNi will send a registration request with its CoA to HAk. According to the backup mechanism based on network segments above, HAk determines that the the MNi belongs to which network segment (assume the jth segment) in accordance with the MNi’s home address and then HAk takes BQk [j-1] as the backup quorum of this MN. After that, HAk delivers a backup registration request to all active backup HAs in the quorum BQk [j-1] (except for HAk) and the request message contains the extended binding of the MNi. When a backup HA accepts the request message, it will backup the extended binding of the MNi and transmits a response message back to HAk. In case that HAk acquires all reply

Definition 9. Backup Home Agent ArrayǺThere are N HAs in mobile network. For each HAk ( 1 d k d N ), the array contains the array of all backup HAs of the HAk called backup HA array of the primary HA and presents as BHAk[0..m-1] = [HA((k-d+1) mod N), HA((k-d+2) mod N),…, HA((k-1) mod N), HA((k+1) mod N), HA((k+2) mod N),…, HA((k+d-1) mod N)],

»

are A.B.C.DX1~A.B.C.DX2, A.B.C.DX2+1~A.B.C.DX3, and A.B.C.DX3+1~A.B.C.DX4 respectively. For each MN managed by HA1, if the MN’s home address belongs to A.B.C.DX1~A.B.C.DX2 segment, the MN’s bindings will be stored and backuped in all the HAs of the backup quorum BQ1[0] = Q1. And, if the MN’s home address belongs to A.B.C.DX1+1~A.B.C.DX3 segment, the MN’s bindings will be stored and backuped in all the HAs of the backup quorum BQ1[1] = Q8. Further, if the MN’s home address belongs to A.B.C.DX3+1~A.B.C.DX4 segment, the MN’s bindings will be stored and backuped in all the HAs of the backup quorum BQ1[2] = Q7.

where m = 2( ª« N º» -1).

Theorem 2. For a primary home agent HAk ( 1 d k d N ), the backup HA set is {HA((k-d+1) mod N), HA((k-d+2) mod N), …, HA((k-1) mod N), HA((k+1) mod N), HA((k+2) mod N),…, HA((k+d-1) ª N º -1) backup HAs in » mod N)}, and there are exactly 2( « the backup HA set.

For example, in the mobile network with 8 HAs, for the MNs that register to the home agent HA1, the backup quorums of HA1 are Q1, Q8, and Q7. That is, the backup quorum set is {Q1, Q8, Q7}, where Q1 = {HA1, HA2, HA3}, Q8 = {HA8, HA1, HA2}, and Q7 = {HA7, HA8, HA1}. According to Theorem 2, the backup HA set is {HA2, HA3, HA7, HA8} and there are 2( ª« 8 º» -1) = 4 HAs in this set. 3.2. Backup Quorum Management

messages (at most ª« N º» -1) from all the active backup HAs of the quorum BQk[j-1], HAk will dispatch a registration reply message with successful authentication to the MNi. Finally, the processes of the registration and backup are finished.

Our proposed backup quorum management mechanism is based on network segmentation. In a mobile network with N HAs, the network that is managed by the primary HAk ( 1 d k d N ) is divided into d = ª« N º» network segments. The first segment is backuped with BQk [0] = Qk, the second segment is with BQk[1] = Q((k-1) mod N),…, and the dth segment is with BQk[d-1] = Q((k-d+1) mod N) in order. That is, the bindings of the MNs in the first segment are backuped by the HAs in

Consider the previously described example again. In a mobile network with 8 HAs, when a MN1 roams to a

375

ª

foreign network, the FA will allocate a CoA to the MN1 and the MN1 will send a registration request message with its CoA to HA1 after obtaining the CoA. Then HA1 determines that MN1 belongs to which network segment in accordance with the MN1’s home address. If the MN1 belongs to the third segment, HA1 will assign the BQ1[3-1] = BQ1[2] as the backup quorum of the MN. Afterward, the procedure of the registration and backup is started. This is, HA1 will deliver the backup request message with the MN1’s extended binding to all active backup HAs in the backup quorum BQ1[2]. Every active backup HA should finish the backup procedure and transmits a backup reply message back to HA1. When HA1 receives all backup reply messages from all the active backup HAs, HA1 will dispatch a registration reply message to MN1. After finishing the registration and backup process, HA1 will maintain the current extended binding for MN1 and other active backup HAs in the BQ1[2] will also store the extended binding. Table 2 shows the record of the extended binding in the primary home agent HA1 and backup HAs of BQ1[2].

º

(BQi[0], BQi[1], …,BQi[d-1], where d= « N » -1) which belongs to HAj in the backup bindings of the failed HAi. When HAk acquires the load messages from all active backup HAs of the faulty HAi, HAk will execute the takeover procedure and select the HA with minimum load (that is, number of binding maintenance) from each backup quorums (BQi[0], BQi[1], …,BQi[d-1], where d= ª« N º» -1) of the failed HAi in order. In other words, HAk that is with the minimum number in the backup HA set is responsible for selecting one HA with the minimum load (that is, minimum number of binding maintenance) to take over the backup binding of the faulty HAi from each backup quorum of the faulty HAi in order. And then, HAk broadcasts the check result to all backup HAs except for the faulty HAi. After the takeover process, the load of the chosen HA becomes the sum of the minimum load and the backup number of the bindings in the backup quorum of the failed HA. Finally, the chosen HA begins to take care of the failed HAi’s bindings and resumes the operation transparently. For maintaining the synchronization of load information sent by each HA, when all backup HAs deliver the load messages to the HA with the minimum number in the backup HA set, they will enter a critical section and do not take any registration at the same time. However, they leave the critical section and accept the registration till they obtain the messages with check result from the HA with the minimum number. After getting the check result message, supposing that HAk is the takeover home agent in a backup quorum of the faulty HA, HAk will take charge of all extended bindings of the backup quorum and serve the MNs in the extended binding. On the other hand, if a HA is not the takeover home agent in any quorum, it will just record the takeover message and leave the critical section and resume accepting new registration of MNs. For example, in a mobile network with 8 HAs, as shown in Table 3, the mobility bindings of HA1 are recorded by all the backup HAs in the BHA set of HA1. When HA1 fails, the backup HAs (HA2, HA3, HA7, HA8) in the BHA set of HA1 know that HA2 is the HA with the minimum number and they (HA3, HA7, HA8) will deliver the binding load (see Table 4) to HA2. After receiving the binding load messages from all the backup HAs, HA2 starts the takeover of the check process in each backup quorum. In Table 5(a), HA2 has minimum load (number of binding maintenance) in Q1. Hence, HA2 will take over the Q1, and, after the takeover, its binding load become 3 (the sum of maintenance number and backup number in Q1) as shown in Table 5(b). Similarly, the takeovers in Q8 and Q7 are HA8 and HA7 as shown in Tables 6 and 7, respectively. Finally, after the check process, HA2 will send the takeover reply message (see Table 8) to each backup HA in the BHA set. The backup HAs receive the takeover reply message and then leave the critical section to accept the registration or take over the bindings. The extended bindings in the backup HA of HA1 after the takeover are as shown in Table 9.

Table 2. Bindings in HA1 and in the Backup HAs

3.5. Failure Detection and Takeover The failure of a HA can be detected by using agent advertisements. In Mobile IP protocol, all MAs will send the agent advertisement [1, 2] messages periodically to advertise their existence and service for the MNs on any attached network. With the agent advertisements, we can check if a MA operates or not. A HA has N-1 timers for the other N-1 HAs except itself. When a timer runs out of time, it means that the correspondent HA fails since its agent A\advertisement has not been received after a certain period of time. Provided that a HAi crashes, other active HAj in the same network will discover the failure of HAi because of not acquiring an agent advertisement message from HAi after a period of time. According to Theorem 2, HAj is able to figure out the backup HA set from the faulty HAi and finds out the HA with the minimum number in this set, say HAk. If k is not equal to j ( k z j ), HAj will transmit a load message to HAk. The load message is taken down the amount of all the MNs served by faulty HAi at present and the quantities of the backup quorum

376

Table 3. Bindings in the backup HAs of HA1

Table 8. The takeover reply message from HA2

Table 9. Bindings in the backup HAs of HA1 after the takeover

Table 4. Binding loads of backup HAs of HA1

Table 5. The loads of HAs in Q1

4. Simulation Results and Comparisons In this section, we describe the simulation results of our proposed method. We analyze the overhead with different number of MNs, different number of HAs, and registration delay with different mobility rates. In our experiment, the registration delay includes registration time and backup time. We compare our proposed mechanism with that proposed by Ghosh and Varghese [11], which is called “FTMIPP” for short. And, our proposed cyclic-quorum-based fault-tolerant protocol is called “CQFTP” for short. In FTMIPP, the bindings of the MNs are stored in primary HA and also backuped in all other N  1 HAs. In other words, all N  1 HAs have to backup the bindings. On the other hand, in our proposed mechanism, the bindings are stored in some backup HAs of one quorum, that is, ª« N º»  1 backup HAs. Hence, in our cyclic-quorum-based protocol, the number of the backup bindings in each backup HA is less than that in FTMIPP. The comparison is shown in Figure 2.

Table 6. The loads of HAs in Q8

Table 7. The loads of HAs in Q7

377

References [1] C. E. Perkins, “IP Mobility Support,” IETF RFC 2002, Oct. 1996. [2] C. E. Perkins, “IP Mobility Support for IPv4,” IETF RFC 3220, Jan. 2002. [3] C. Graff, M. Bereschinsky, M. Patel, and L. F. Chang, “Application of Mobile IP to Tactical Mobile Internetworking,” Military Communication Conference, Vol. 2, pp. 409-414, 1998. [4] C. M. Lin, G. M. Chiu, and C. H. Cho, “A new quorum-based scheme for managing replicated data in distributed systems,” IEEE Transactions on Computers, Vol. 51, pp. 1442-1447, 2002. [5] H. Ahn and C. S. Hwang, “Low-Cost Fault-Tolerance for Mobile Nodes in Mobile IP Based Systems,” 15th International Parallel and Distributed Processing Symposiums, pp. 508-513, 2001. [6] I. H. Bae, “A quorum-based dynamic location management method for mobile computings,” in Proceedings of the 6th International Conference on Real-Time Computing Systems and Applications (RTCSA), 1999, pp. 398-401. [7] J. W. Lin and J. Arul, “An Efficient Fault-Tolerant Approach for Mobile IP in Wireless Systems,” IEEE Transactions on Mobile Computing, VOL. 2, NO. 3, Jul.-Sep. 2003. [8] J. H. Ahn and C. S. Hwang, “Efficient Fault-Tolerant Protocol for Mobility Agents in Mobile IP,” Proceedings of the 15th International Parallel and Distributed Processing Symposiums, pp. 1273 -1280, Apr. 2001. [9] M. J. Yang, Y. M. Yeh, and Y. M. Chang, “Legion Structure for Quorum-Based Location Management in Mobile Computing,” Journal of Information Science and Engineering, Vol. 20, pp. 191-202, 2004. [10] M. Naor and A. Wool, “Access control and signatures via quorum secret sharing,” IEEE Transactions on Parallel and Distributed Systems, Vol. 9, pp. 909-922, 1998. [11] R. Ghosh and G. Varghese, “Fault-Tolerant Mobile IP,” Technical Report WUCS-98-11, Washington Univ., Apr. 1998. [12] R. Jimenez-Peris, M. Patino-Martinez, G. Alonso, and B. Kernme, “How to Select a Replication Protocol According to Scalability, Availability and Communication Overhead,” in Proceedings of 20th IEEE Symposium on Reliable Distributed Systems, pp. 24-33, 2001 [13] R. Mistry, P. Savill, and A. Tofanelli, “OA&M for Full Services Access Networks,” IEEE Communications Magazine, pp. 70-77, Mar. 1997. [14] Y. Mun, Y. Kim, Y. J. Kim, and G. Hwang, “IP Mobility Support over Wireless ATM,” IEEE International Conference on Communications, pp. 319-323, 1999. [15] Y. T. Wu, Y. J. Chang, S. H. Yuan, and H. K. Chang, “A New Quorum-Based Replica Control Protocol,” in Proceedings. Pacific Rim International Symposium on Fault-tolerant System, pp. 116-121, Dec. 1997.

Figure 2. Bindings per backup HA

As shown in Figure 3, in case that the number of HAs is 2, the FTMIPP and CQFTP almost spend the same time. In such a case, the same number of messages is sent in two protocols. However, when the number of HAs is more than 4, in FTMIPP, it spends much time than our CQFTP. The reason is that the number of backup HAs is N-1 in FTMIPP and ª« N º»  1 in CQFTP.

Figure 3. Average registration delay

As shown in Figure 4, we simulate the registration delay of total 100 MNs with different mobility rates in the network with 20 HAs. It shows that our proposed protocol has smooth and smaller registration delay than FTMIPP.

Figure 4. Registration delay with different mobility rates

5. Conclusions In this paper, we propose a cyclic-quorum-based fault-tolerant protocol in the Mobile IP network with redundant HAs. Simulation results show that our proposed mechanism has many merits: it does not need the extra hardware cost; it reduces the number of the backup bindings by using the small quorum size; it balances the load of the takeover process; it has low registration overhead.

378