1.4.2. Discovery Performance

This document describes discovery performance for certain scenarios that use RTI Security Plugins. The methodology and the tests are similar to the ones explained in the Discovery Performance section for the Core Libraries. The “No Security Libraries” values in the graphs below are equivalent to the Core Libraries (multicast) numbers, so you can compare Connext performance with and without the Security Plugins.

These numbers should only be used as a first rough approximation, since the results are highly dependent on the hardware, software configuration, and network infrastructure of the tested system. These numbers are taken with multicast enabled, since this is the default mode used by Connext for discovery.

1.4.2.1. Testing Different Security Governance Configuration Levels

Endpoint Discovery

The following graph displays the time it takes to complete endpoint discovery, per number of participants. There is one endpoint for each participant; across all participants, half the endpoints are DataWriters and half are DataReaders. For each scenario, we graph three values: the maximum, median, and minimum times that the participants took to complete endpoint discovery. (Maximums and minimums are the dashed lines; medians are the solid lines.)

The parameters for testing this scenario are:

Number of hosts: 12

Participants in the system: <Variable we increase>

Topics in the system: 1

Readers per topic: Half of the Participants

Writers per topic: Half of the Participants

QoS profiles used: DynamicProfile_security.

Software Information

RTI developed a testing framework specifically designed for discovery benchmarking. This framework was used to perform the tests detailed in this section. This framework is capable of distributing and executing the different DDS entities across the different machines available in RTI’s Performance and Discovery Lab. It will also gather information about the discovery time as well as network usage and memory usage.

The Middleware version used to perform these tests is:

RTI Connext DDS 7.1.0 Host and Target Libraries for x64 Linux (x64Linux4gcc7.3.0)

Hardware Information

Linux Nodes

Dell R340 Servers (13 Units)
Processor: Intel Xeon E-2278G (3.4-5GHz, 8c/16t, 16MB cache, 2 memory channels @2666MHz)
RAM: 4x 16GB 2666MHz DIMM (64GB RAM)
HD: 480GB SATA SSD
NIC 1: Intel 710 dual port 10Gbps SFP
OS: Ubuntu 20.04 -- gcc 9.3.0

Switch

Dell 2048 -- 10Gbps switch

QoS Used

<?xml version="1.0"?>
<dds xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
     xsi:noNamespaceSchemaLocation="https://community.rti.com/schema/6.1.1/rti_dds_qos_profiles.xsd">
    <qos_library name="QosLibrary">

        <qos_profile name="FactoryDefault" is_default_participant_factory_profile="true">
            <participant_factory_qos>
                <entity_factory>
                    <autoenable_created_entities>false</autoenable_created_entities>
            </entity_factory>
                <!-- <logging>
                    <verbosity>WARNING</verbosity>
                </logging> -->
            </participant_factory_qos>
        </qos_profile>

        <qos_profile name="DynamicProfile_DefaultQoS" base_name="QosLibrary::FactoryDefault">
            <participant_qos>
                <!-- This does not affect performance, but it is needed for > 1000 participants -->
                <wire_protocol>
                    <rtps_well_known_ports>
                        <domain_id_gain>500</domain_id_gain>
                    </rtps_well_known_ports>
                </wire_protocol>
                <!-- To make the test a bit more fair -->
                <transport_builtin>
                    <mask>UDPv4</mask>
                </transport_builtin>
                <property>
                    <value>
                        <element>
                            <name>dds.transport.UDPv4.builtin.parent.allow_interfaces_list</name>
                            <value>$(interface_name)</value>
                        </element>
                        <element>
                            <name>dds.transport.UDPv4.builtin.parent.max_interface_count</name>
                            <value>1</value>
                        </element>
                        <element>
                            <name>dds.participant.property_validation_action</name>
                            <value>1</value>
                        </element>
                        <element>
                            <name>dds.transport.UDPv4.builtin.gather_detailed_statistics</name>
                            <value>$(gather_detailed_statistics)</value>
                        </element>
                    </value>
                </property>
            </participant_qos>
        </qos_profile>

        <qos_profile name="DynamicProfile" base_name="QosLibrary::DynamicProfile_DefaultQoS" is_default_qos="true">
            <participant_qos>
                <resource_limits>
                    <type_object_max_serialized_length>0</type_object_max_serialized_length>
                    <type_code_max_serialized_length>0</type_code_max_serialized_length>
                </resource_limits>
                <discovery_config>
                    <initial_participant_announcements>5</initial_participant_announcements>
                    <participant_liveliness_lease_duration>
                        <sec>200</sec>
                        <nanosec>0</nanosec>
                    </participant_liveliness_lease_duration>
                    <participant_liveliness_assert_period>
                        <sec>5</sec>
                        <nanosec>0</nanosec>
                    </participant_liveliness_assert_period>
                    <remote_participant_purge_kind>LIVELINESS_BASED_REMOTE_PARTICIPANT_PURGE</remote_participant_purge_kind>
                    <max_liveliness_loss_detection_period>
                        <sec>10</sec>
                        <nanosec>0</nanosec>
                    </max_liveliness_loss_detection_period>
                </discovery_config>
                <property>
                    <value>
                        <element>
                            <name>dds.transport.UDPv4.builtin.recv_socket_buffer_size</name>
                            <value>5048576</value>
                        </element>
                    </value>
                </property>
            </participant_qos>
        </qos_profile>

        <qos_profile name="DynamicProfile_DefaultQoS_SPDP2" base_name="QosLibrary::DynamicProfile_DefaultQoS">
            <participant_qos>
                <discovery_config>
                    <builtin_discovery_plugins>SPDP2|SEDP</builtin_discovery_plugins>
                </discovery_config>
            </participant_qos>
        </qos_profile>

        <qos_profile name="DynamicProfile_SPDP2" base_name="QosLibrary::DynamicProfile">
            <participant_qos>
                <discovery_config>
                    <builtin_discovery_plugins>SPDP2|SEDP</builtin_discovery_plugins>
                </discovery_config>
            </participant_qos>
        </qos_profile>

        <qos_profile name="Unicast_10Gbps_lab_snippet">
            <participant_qos>
                <discovery>
                    <initial_peers>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.20</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.21</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.22</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.23</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.24</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.25</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.26</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.27</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.28</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.29</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.30</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.78.31</element>
                    </initial_peers>
                    <multicast_receive_addresses></multicast_receive_addresses>
                </discovery>
            </participant_qos>
        </qos_profile>

        <qos_profile name="Unicast_1Gbps_lab_snippet">
            <participant_qos>
                <discovery>
                    <initial_peers>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.20</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.21</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.22</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.23</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.24</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.25</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.26</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.27</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.28</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.29</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.30</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.31</element>
                    </initial_peers>
                    <multicast_receive_addresses></multicast_receive_addresses>
                </discovery>
            </participant_qos>
        </qos_profile>

        <qos_profile name="Unicast_pi_lab_snippet">
            <participant_qos>
                <discovery>
                    <initial_peers>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.41</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.42</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.43</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.44</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.45</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.46</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.47</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.48</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.49</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.50</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.51</element>
                        <element>$(participant_locators_id_limit)@builtin.udpv4://10.2.74.52</element>
                    </initial_peers>
                    <multicast_receive_addresses></multicast_receive_addresses>
                </discovery>
            </participant_qos>
        </qos_profile>

        <qos_profile name="DynamicProfile_unicast" base_name="QosLibrary::DynamicProfile">
            <base_name>
                <element>QosLibrary::Unicast_10Gbps_lab_snippet</element>
            </base_name>
        </qos_profile>

        <qos_profile name="DynamicProfile_unicast_eno2" base_name="QosLibrary::DynamicProfile">
            <base_name>
                <element>QosLibrary::Unicast_1Gbps_lab_snippet</element>
            </base_name>
        </qos_profile>

        <qos_profile name="DynamicProfile_unicast_eth0" base_name="QosLibrary::DynamicProfile">
            <base_name>
                <element>QosLibrary::Unicast_pi_lab_snippet</element>
            </base_name>
        </qos_profile>

        <qos_profile name="DynamicProfile_unicast_DefaultQoS" base_name="QosLibrary::DynamicProfile_DefaultQoS">
            <base_name>
                <element>QosLibrary::Unicast_10Gbps_lab_snippet</element>
            </base_name>
        </qos_profile>

        <qos_profile name="DynamicProfile_unicast_SPDP2" base_name="QosLibrary::DynamicProfile_SPDP2">
            <base_name>
                <element>QosLibrary::Unicast_10Gbps_lab_snippet</element>
            </base_name>
        </qos_profile>

        <qos_profile name="DynamicProfile_unicast_SPDP2_eno2" base_name="QosLibrary::DynamicProfile_SPDP2">
            <base_name>
                <element>QosLibrary::Unicast_1Gbps_lab_snippet</element>
            </base_name>
        </qos_profile>

        <qos_profile name="DynamicProfile_unicast_SPDP2_eth0" base_name="QosLibrary::DynamicProfile_SPDP2">
            <base_name>
                <element>QosLibrary::Unicast_pi_lab_snippet</element>
            </base_name>
        </qos_profile>

        <qos_profile name="DynamicProfile_unicast_DefaultQoS_SPDP2" base_name="QosLibrary::DynamicProfile_DefaultQoS_SPDP2">
            <base_name>
                <element>QosLibrary::Unicast_10Gbps_lab_snippet</element>
            </base_name>
        </qos_profile>

        <qos_profile name="DynamicProfile_unicast_cds" base_name="QosLibrary::DynamicProfile">
            <participant_qos>
                <discovery>
                    <initial_peers>
                        <element>rtps@10.2.78.32:7400</element>
                    </initial_peers>
                    <multicast_receive_addresses></multicast_receive_addresses>
                </discovery>
            </participant_qos>
        </qos_profile>

        <qos_profile name="StaticProfile" base_name="QosLibrary::DynamicProfile">
            <participant_qos>
                <discovery_config>
                    <builtin_discovery_plugins>SPDP</builtin_discovery_plugins>
                </discovery_config>
                <property>
                    <value>
                        <element>
                            <name>dds.discovery.endpoint.lbediscovery.library</name>
                            <value>rtilbedisc</value>
                        </element>
                        <element>
                            <name>dds.discovery.endpoint.lbediscovery.create_function</name>
                            <value>DDS_LBEDiscoveryPlugin_create</value>
                        </element>
                        <element>
                            <name>dds.discovery.endpoint.load_plugins</name>
                            <value>dds.discovery.endpoint.lbediscovery</value>
                        </element>
                    </value>
                </property>
            </participant_qos>
        </qos_profile>

        <!-- Security -->
        <qos_profile name="DynamicProfileSecurity" base_name="QosLibrary::DynamicProfile">
            <participant_qos>
                <property>
                    <value>
                        <element>
                            <name>com.rti.serv.load_plugin</name>
                            <value>com.rti.serv.secure</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.library</name>
                            <value>nddssecurity</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.create_function</name>
                            <value>RTI_Security_PluginSuite_create</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.authentication.ca_file</name>
                            <value>resources/secure/certAuthority/$(discovery_security_algo)/ca/$(discovery_security_algo)RootCaCert.pem</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.authentication.private_key_file</name>
                            <value>resources/secure/certAuthority/$(discovery_security_algo)/identities/$(discovery_security_algo)Peer01Key.pem</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.authentication.certificate_file</name>
                            <value>resources/secure/certAuthority/$(discovery_security_algo)/identities/$(discovery_security_algo)Peer01Cert.pem</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.access_control.permissions_authority_file</name>
                            <value>resources/secure/certAuthority/$(discovery_permissions_authority_file_algo)/ca/$(discovery_permissions_authority_file_algo)RootCaCert.pem</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.access_control.governance_file</name>
                            <value>resources/secure/certAuthority/$(discovery_security_algo)/governances/signed_governance_$(security_governance).xml</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.access_control.permissions_file</name>
                            <value>resources/secure/certAuthority/$(discovery_security_algo)/signed_myPermissions.xml</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.authentication.key_establishment_algorithm</name>
                            <value>auto</value>
                        </element>
                        <element>
                            <name>dds.participant.trust_plugins.authentication_timeout.sec</name>
                            <value>$(discovery_security_authentication_timeout)</value>
                        </element>
                        <element>
                            <name>dds.participant.trust_plugins.authentication_request_delay.sec</name>
                            <value>$(discovery_security_authentication_request_delay)</value>
                        </element>
                        <element>
                            <name>dds.participant.trust_plugins.authentication_request_timeout.sec</name>
                            <value>$(discovery_security_authentication_request_timeout)</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.authentication.enable_custom_algorithms</name>
                            <value>true</value>
                        </element>
                    </value>
                </property>
            </participant_qos>
        </qos_profile>

        <!-- Security -->
        <qos_profile name="DynamicProfileSecurity_SPDP2" base_name="QosLibrary::DynamicProfileSecurity">
            <participant_qos>
                <discovery_config>
                    <builtin_discovery_plugins>SPDP2|SEDP</builtin_discovery_plugins>
                </discovery_config>
            </participant_qos>
        </qos_profile>

        <!-- Security HMAC ONLY -->
        <qos_profile name="DynamicProfileSecurity_HMAC" base_name="QosLibrary::DynamicProfile">
            <participant_qos>
                <property>
                    <value>
                        <element>
                            <name>com.rti.serv.load_plugin</name>
                            <value>com.rti.serv.secure</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.library</name>
                            <value>nddssecurity</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.create_function</name>
                            <value>RTI_Security_PluginSuite_create</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.hmac_only.enabled</name>
                            <value>1</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.hmac_only.cryptography.key</name>
                            <value>str:SecretKey</value>
                        </element>
                    </value>
                </property>
            </participant_qos>
        </qos_profile>


        <!-- Security + PSK-->
        <qos_profile name="DynamicProfileSecurity_PSK" base_name="QosLibrary::DynamicProfileSecurity">
            <participant_qos>
                <discovery_config>
                    <default_domain_announcement_period>
                        <sec>DURATION_INFINITE_SEC</sec>
                        <nanosec>DURATION_INFINITE_NSEC</nanosec>
                    </default_domain_announcement_period>
                </discovery_config>
                <property>
                    <value>
                        <element>
                            <name>com.rti.serv.secure.cryptography.rtps_protection_preshared_key</name>
                            <value>SecretKey</value>
                        </element>
                    </value>
                </property>
            </participant_qos>
        </qos_profile>

        <!-- LW Security + PSK -->
        <qos_profile name="DynamicProfileLWS_PSK" base_name="QosLibrary::DynamicProfile">
            <participant_qos>
                <discovery_config>
                    <default_domain_announcement_period>
                        <sec>DURATION_INFINITE_SEC</sec>
                        <nanosec>DURATION_INFINITE_NSEC</nanosec>
                    </default_domain_announcement_period>
                </discovery_config>
                <property>
                    <value>
                        <element>
                            <name>com.rti.serv.load_plugin</name>
                            <value>com.rti.serv.secure</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.library</name>
                            <value>nddslightweightsecurity</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.create_function</name>
                            <value>RTI_Security_PluginSuite_create</value>
                        </element>

                        <element>
                            <name>com.rti.serv.secure.cryptography.rtps_protection_preshared_key</name>
                            <value>SecretKey</value>
                        </element>
                        <element>
                            <name>com.rti.serv.secure.cryptography.rtps_protection_preshared_key_algorithm</name>
                            <value>$(lws_psk_algorithm)</value>
                        </element>
                    </value>
                </property>
            </participant_qos>
        </qos_profile>

    </qos_library>
</dds>

Security Profiles

In this set of tests, we compared the discovery times, increasing the number of endpoints, for different levels of security. We will differentiate among four levels:

No Security Libraries: This test will use RTI Connext Professional without Security Plugins.

Secure Libraries, RTPS None + Discovery None: This test uses Security Plugins and requires authentication, but doesn’t protect any messages (no encryption and no “MAC’ing”). This test uses this governance file:

<dds>
  <domain_access_rules>
      <domain_rule>
        <domains>
          <id_range>
            <min>0</min>
          </id_range>
        </domains>
        <allow_unauthenticated_participants>FALSE</allow_unauthenticated_participants>
        <enable_join_access_control>TRUE</enable_join_access_control>
        <discovery_protection_kind>NONE</discovery_protection_kind>
        <liveliness_protection_kind>NONE</liveliness_protection_kind>
        <rtps_protection_kind>NONE</rtps_protection_kind>
        <topic_access_rules>
          <topic_rule>
            <topic_expression>*</topic_expression>
            <enable_discovery_protection>FALSE</enable_discovery_protection>
            <enable_read_access_control>TRUE</enable_read_access_control>
            <enable_write_access_control>TRUE</enable_write_access_control>
            <metadata_protection_kind>NONE</metadata_protection_kind>
            <data_protection_kind>NONE</data_protection_kind>
          </topic_rule>
        </topic_access_rules>
      </domain_rule>
    </domain_access_rules>
</dds>

Secure Libraries, RTPS Sign + Discovery None This test is similar to the one above but setting the rtps_protection_kind to SIGN:

<dds>
  <domain_access_rules>
      <domain_rule>
        <domains>
          <id_range>
            <min>0</min>
          </id_range>
        </domains>
        <allow_unauthenticated_participants>FALSE</allow_unauthenticated_participants>
        <enable_join_access_control>TRUE</enable_join_access_control>
        <discovery_protection_kind>NONE</discovery_protection_kind>
        <liveliness_protection_kind>NONE</liveliness_protection_kind>
        <rtps_protection_kind>SIGN</rtps_protection_kind>
        <topic_access_rules>
          <topic_rule>
            <topic_expression>*</topic_expression>
            <enable_discovery_protection>FALSE</enable_discovery_protection>
            <enable_read_access_control>TRUE</enable_read_access_control>
            <enable_write_access_control>TRUE</enable_write_access_control>
            <metadata_protection_kind>NONE</metadata_protection_kind>
            <data_protection_kind>NONE</data_protection_kind>
          </topic_rule>
        </topic_access_rules>
      </domain_rule>
    </domain_access_rules>
</dds>

Secure Libraries, RTPS Sign + Discovery Encrypt In this test we set the rtps_protection_kind to SIGN and the discovery_protection_kind and liveliness_protection_kind to ENCRYPT:

<dds>
  <domain_access_rules>
      <domain_rule>
        <domains>
          <id_range>
            <min>0</min>
          </id_range>
        </domains>
        <allow_unauthenticated_participants>FALSE</allow_unauthenticated_participants>
        <enable_join_access_control>TRUE</enable_join_access_control>
        <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
        <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
        <rtps_protection_kind>SIGN</rtps_protection_kind>
        <topic_access_rules>
          <topic_rule>
            <topic_expression>*</topic_expression>
            <enable_discovery_protection>TRUE</enable_discovery_protection>
            <enable_read_access_control>TRUE</enable_read_access_control>
            <enable_write_access_control>TRUE</enable_write_access_control>
            <metadata_protection_kind>NONE</metadata_protection_kind>
            <data_protection_kind>NONE</data_protection_kind>
          </topic_rule>
        </topic_access_rules>
      </domain_rule>
    </domain_access_rules>
</dds>

Secure Libraries, RTPS None + Discovery Encrypt In this test we set the discovery_protection_kind and liveliness_protection_kind to ENCRYPT:

<dds>
    <domain_access_rules>
      <domain_rule>
        <domains>
          <id_range>
            <min>0</min>
          </id_range>
        </domains>
        <allow_unauthenticated_participants>FALSE</allow_unauthenticated_participants>
        <enable_join_access_control>TRUE</enable_join_access_control>
        <discovery_protection_kind>ENCRYPT</discovery_protection_kind>
        <liveliness_protection_kind>ENCRYPT</liveliness_protection_kind>
        <rtps_protection_kind>NONE</rtps_protection_kind>
        <topic_access_rules>
          <topic_rule>
            <topic_expression>*</topic_expression>
            <enable_discovery_protection>TRUE</enable_discovery_protection>
            <enable_read_access_control>TRUE</enable_read_access_control>
            <enable_write_access_control>TRUE</enable_write_access_control>
            <metadata_protection_kind>NONE</metadata_protection_kind>
            <data_protection_kind>NONE</data_protection_kind>
          </topic_rule>
        </topic_access_rules>
      </domain_rule>
    </domain_access_rules>
</dds>

1.4.2.2. Testing Different Digital Signature and Key Establishment Algorithms