Several "NewSpace" companies have launched the first of thousands of planned satellites for providing global broadband Internet service. The resulting low-Earth-orbit (LEO) constellations will not only bridge the digital divide by providing service to remote areas, but they also promise much lower latency than terrestrial fiber for long-distance routes. We show that unlocking this potential is non-trivial: such constellations provide inherently variable connectivity, which today's Internet is ill-suited to accommodate. We therefore study cost-performance tradeoffs in the design space for Internet routing that incorporates satellite connectivity examining four solutions ranging from naively using BGP to an ideal, clean-slate design. We find that the optimal solution is provided by a path-aware networking architecture in which end-hosts obtain information and control over network paths. However, a pragmatic and more deployable approach inspired by the design of content distribution networks can also achieve stable and close-to-optimal performance.

The Internet will undergo a major transformation as satellitebased Internet service providers start to disrupt the market. Constellations of hundreds to thousands of satellites promise to offer low-latency Internet to even the most remote areas. We anticipate exciting business and research opportunities. Motivated by the potential of the new satellite networks, we describe business and interconnection models for space-operating ISPs and how they could be integrated into the backbone of today's Internet. At the same time, in view of the high risk of these ventures, we study constellations under partial deployment. We take the SpaceX constellation as an example and show that even at 10% deployment it offers a high level of connectivity to most areas. However, this connectivity is intermittent, which raises challenges for integrating satellite networks into the Internet backbone.

Lighthouse projects like CompCert, seL4, IronFleet, and DeepSpec have demonstrated that full system verification is feasible by establishing a refinement between an abstract system specification and an executable implementation. Existing approaches however impose severe restrictions on the abstract system specifications due to their limited expressiveness or versatility, or on the executable code due to their use of suboptimal code extraction or inexpressive program logics. We propose a novel methodology that combines the compositional refinement of event-based models of distributed systems with the verification of full-fledged program code using expressive separation logics, which support features of realistic programming languages like heap data structures and concurrency. Our main technical contribution is a formal framework that soundly relates event-based system models to program specifications in separation logics. This enables protocol development tools to soundly interoperate with program verifiers to establish a refinement between the model and the code. We formalized our framework, Igloo, in Isabelle/HOL. We report on three case studies, a leader election protocol, a replication protocol, and a security protocol, for which we refine formal requirements into program specifications that we implement in Java and Python and prove correct using the VeriFast and Nagini tools.

No abstract