Professional Documents
Culture Documents
SIGCOMM 2021 Research Paper - Planning For An Internet Apocalypse
SIGCOMM 2021 Research Paper - Planning For An Internet Apocalypse
SIGCOMM 2021 Research Paper - Planning For An Internet Apocalypse
ABSTRACT One of the greatest dangers facing the Internet with the potential
Black swan events are hard-to-predict rare events that can signi�- for global impact is a powerful solar superstorm. Although humans
cantly alter the course of our lives. The Internet has played a key are protected from these storms by the earth’s magnetic �eld and
role in helping us deal with the coronavirus pandemic, a recent atmosphere, they can cause signi�cant damage to man-made in-
black swan event. However, Internet researchers and operators are frastructure. The scienti�c community is generally aware of this
mostly blind to another black swan event that poses a direct threat threat with modeling e�orts and precautionary measures being
to Internet infrastructure. In this paper, we investigate the impact taken, particularly in the context of power grids [41, 43]. However,
of solar superstorms that can potentially cause large-scale Internet the networking community has largely overlooked this risk during
outages covering the entire globe and lasting several months. We the design of the network topology and geo-distributed systems
discuss the challenges posed by such activity and currently avail- such as DNS and data centers.
able mitigation techniques. Using real-world datasets, we analyze A Coronal Mass Ejection (CME), popularly known as solar storm,
the robustness of the current Internet infrastructure and show that is a directional ejection of a large mass of highly magnetized parti-
submarine cables are at greater risk of failure compared to land cles from the sun. When the earth is in the direct path of a CME,
cables. Moreover, the US has a higher risk for disconnection com- these magnetized and charged solar particles will interact with
pared to Asia. Finally, we lay out steps for improving the Internet’s the earth’s magnetic �eld and produce several e�ects. In addition
resiliency. to spectacular auroral displays, they produce Geomagnetically In-
duced Currents (GIC) on the earth’s surface through electromag-
CCS CONCEPTS netic induction. Based on the strength of the CME, in extreme cases,
GIC has the potential to enter and damage long-distance cables that
• Networks → Network reliability; Network structure;
constitute the backbone of the Internet.
The largest solar events on record occurred in 1859 and 1921, long
KEYWORDS
before the advent of modern technology. They triggered extensive
Internet Resilience, Internet Topology, Solar storms power outages and caused signi�cant damage to the communica-
ACM Reference Format: tion network of the day, the telegraph network. The probability of
Sangeetha Abdu Jyothi. 2021. Solar Superstorms: Planning for an Internet occurrence of extreme space weather events that directly impact
Apocalypse. In ACM SIGCOMM 2021 Conference (SIGCOMM ’21), August the earth is estimated to be 1.6% to 12% per decade [42, 65]. More
23–27, 2021, Virtual Event, USA. ACM, New York, NY, USA, 13 pages. https: importantly, the sun was in a period of low activity in the past three
//doi.org/10.1145/3452296.3472916
decades [61] from which it is slowly emerging. Since this low phase
of solar activity coincided with the rapid growth of technology on
1 INTRODUCTION the earth, we have a limited understanding of whether the current
What will happen if there is a global Internet collapse? A disruption infrastructure is resilient against powerful CMEs.
lasting even a few minutes can lead to huge losses for service In this paper, we analyze the threat posed by solar superstorms
providers and damages in cyber-physical systems. The economic to the Internet infrastructure and the steps to be taken to mitigate
impact of an Internet disruption for a day in the US is estimated to its e�ects. First, we ask a key question: is the threat signi�cant, and
be over $7 billion [1]. What if the network remains non-functional should we factor this in Internet topology design and infrastructure
for days or even months? This is the worst-case scenario, which, deployment (§ 2)? Second, we study the impact of solar storms on
fortunately, we have never encountered in recent history. Threats to key building blocks of the Internet infrastructure — long-haul land
the Internet range from man-made cyber attacks to natural disasters and submarine cables (§ 3). Third, using real-world datasets and
such as earthquakes. The Internet is also a�ected by black swan a wide range of failure models, we quantify the impact of solar
events such as the Covid-19, which profoundly alter human lives superstorms on the Internet infrastructure (§ 4). Finally, we lay out
and, in turn, our Internet usage. However, the in�uence of these steps to manage the perils associated with solar superstorms (§ 5).
indirect threats on the Internet is only secondary, with the worst- Long-distance �ber cables and communication satellites are sus-
case impact often limited to reduced speeds. ceptible to damage from solar storms through induced currents and
direct exposure, respectively (§ 3). In cables, the optical �ber itself
is immune to GIC. However, long-haul cables have repeaters to
boost the optical signals spaced at intervals of 50 150 km which
This work is licensed under a Creative Commons Attribution-
NonCommercial-ShareAlike International 4.0 License. are powered using a conductor. These repeaters are vulnerable to
SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA GIC-induced failures, which can lead to the cable being unusable.
© 2021 Copyright held by the owner/author(s). GPS and communication satellites which are directly exposed to
ACM ISBN 978-1-4503-8383-7/21/08.
https://doi.org/10.1145/3452296.3472916 solar storms will su�er from lost connectivity during the event,
692
SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA Sangeetha Abdu Jyothi
potential damage to electronic components, and in the worst case, 2 MOTIVATION: A REAL THREAT
orbital decay and reentry to earth (particularly in low earth orbit In this section, we present a discussion on threats posed by solar
satellites such as StarLink [14]). activity and the likelihood of extreme solar events that can a�ect
In order to study the impact of CMEs on terrestrial networks, we the earth.
use a comprehensive set of Internet topology datasets, including
submarine and land cables, DNS root servers, IXPs, Internet routers,
etc. Since accurate modeling of repeater failures is not available, 2.1 Solar �ares and CMEs
we employ a broad range of failure models derived based on GIC Solar activity waxes and wanes in cycles, with a period length
characteristics. of approximately 11 years [23]. During solar maxima, there is an
Our experiments provide several interesting insights regarding increase in the frequency of two solar phenomena, solar �ares and
the Internet topology and its vulnerabilities. First, the topology is Coronal Mass Ejections (CMEs), both caused by contortions in the
skewed with respect to Internet user distribution. There is a higher sun’s magnetic �elds [35].
concentration of infrastructure elements on higher latitudes that Solar �ares involve large amounts of emitted energy as electro-
are more vulnerable to solar superstorms. Second, submarine ca- magnetic radiation. Although �ares can reach earth in 8 minutes,
bles are more vulnerable than land cables, primarily due to their they a�ect only the upper layers of the atmosphere, particularly
larger lengths. Third, di�erent regions will be impacted di�erently. the ionosphere, causing disruptions to satellite communication and
The US is highly susceptible to disconnection from Europe. Eu- GPS. Solar �ares do not pose any threat to terrestrial communica-
rope is in a vulnerable location but is more resilient due to the tion or other infrastructure.
presence of a larger number of shorter cables. Asia has relatively A Coronal Mass Ejection (CME) involves the emission of electri-
high resilience with Singapore acting as a hub with connections cally charged solar matter and accompanying magnetic �eld into
to several countries. Finally, we analyze the impact on various In- space. It is typically highly directional. This cloud of magnetized
ternet systems. DNS root servers are less vulnerable since they are particles can take 13 hours to �ve days to travel to the earth. They
highly geo-distributed. Google data centers have better resilience cannot penetrate the atmosphere and a�ect humans directly. How-
than Facebook’s. A large fraction of Autonomous Systems have a ever, they will interact with the earth’s magnetic �eld and induce
presence in the higher latitudes, but a majority of them are geo- strong electric currents on the earth’s surface that can disrupt and
graphically restricted to a smaller area. even destroy various human technologies. This will occur only if
Although the highest priority system for recovery during a solar the earth happens to be on the path of a CME.
event will be the power grid, the Internet is also a critical infrastruc-
ture necessary for disaster management. While this paper focuses
2.2 Past CME events
on the vulnerabilities of the Internet infrastructure alone, a dis-
cussion on the interdependence with power grids and associated The �rst recorded CME with a major impact on the earth is the Car-
challenges are presented in § 5. rington event (Sep 1, 1859) [21]. This cataclysmic CME reached the
earth in just 17.6 hours owing to its very high speed. The commu-
In summary, we make the following contributions: nication network of the day, the telegraph network, su�ered from
• We present the �rst study that analyzes threats to the Internet equipment �res, and several operators experienced electric shocks.
infrastructure posed by a high-risk event: solar superstorms. This caused large-scale telegraph outages in North America and
Europe. Even when power was disconnected, telegraph messages
• We identify several vulnerabilities in the design of current Inter- could be sent with the current generated by the CME. A recent
net topology and associated geo-distributed infrastructure such study [50] which analyzed the risks posed by a Carrington-scale
as DNS and Autonomous Systems. event to the US power grid today found that 20 40 million people
• We show that the Internet infrastructure distribution is skewed could be without power for up to 2 years, and the total economic
with respect to the user population. Internet infrastructure com- cost will be 0.6 2.6 trillion USD. To the best of our knowledge,
ponents are concentrated in higher latitudes that are susceptible there are no existing studies on the risks posed to the Internet
to solar events. infrastructure by such an event.
The largest geomagnetic storm of the 20C⌘ century, which oc-
• We investigate the impact of Geomagnetically Induced Currents
curred in May 1921, named the New York Railroad superstorm
on various infrastructure components and show that submarine
based on its impact on NY telegraph and railroad systems, also
cables are at the highest risk of damage.
caused widespread damage across the globe [47]. Note that the
• We demonstrate that the potential impact of solar superstorms strongest CME of the past century happened before widespread
on di�erent regions varies widely. The US is highly vulnerable electri�cation. A smaller-scale CME had caused the collapse of the
to disconnection compared to Asian countries. power grid in the entire province of Quebec, Canada, and over 200
• We discuss several open questions on improving Internet re- grid problems at various locations in the US in 1989 [59]. However,
siliency, including how to factor in solar superstorms during the this was only a moderate-scale CME.
design of Internet topology and other Internet sub-systems. A CME of Carrington-scale missed the earth by merely a week
in July 2012 [62]. Fortunately, given the highly directional nature
This paper does not raise any ethical concerns. of CMEs, they can cause signi�cant damage only when the earth is
in the direct path.
693
Solar Superstorms: Planning for an Internet Apocalypse SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA
694
SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA Sangeetha Abdu Jyothi
3.2 Impact on Long-Distance Cables During the moderate storm of March 1989 [59] (one-tenth the
3.2.1 Understanding the vulnerabilities. Long-distance land and strength of 1921 storm), considerable potential variations were
submarine cables carry signals in optical �bers. The �ber in the measured on the only long-distance submarine cable of the time,
cable is immune to GIC, unlike the previous generation of coaxial the AT&T cable between New Jersey, US and the UK [56]. Since
cables, since it carries light and not electric current. However, long- the variations were of moderate magnitude, the PFE at landing
haul cables that stretch hundreds or thousands of kilometers also stations could control the impact. However, the cost for designing
have an accompanying conductor that connects repeaters in series and deploying PFEs that are able to handle the highest possible
along the length of cables called the power feeding line [4]. This variations is exorbitant and hence, not practical [45]. A TVSS device
conductor is susceptible to GIC [5, 49]. at the landing point cannot protect repeaters along the length of
Power Feeding Equipments (PFEs), located in landing stations the cable.
at the ends of the cable, power the repeaters which are connected Modeling the impact of GIC on repeaters and cables is an ex-
in series via the power feeding line with a 1.1 Ampere regulated tremely di�cult task. During a CME, induced GIC at a location will
current. The resistance of the power feeding line is approximately depend on the strength of the induced electric �eld, its direction,
0.8 ⌦/km. However, the actual voltage requirement is in�uenced ground/crust composition, and a variety of other factors. More-
by several factors, including earth potential di�erence at either over, while long-distance cable endpoints are well-known, we have
end of the cable, the number of spare repeaters in the cable, etc. limited information about intermediate grounding points and the
Considering these factors, a 10 Gbps 96-wave 9000 km long cable extent of GIC possible between them based on terrestrial charac-
typically requires a power feeding voltage of about 11 kV and teristics. In short, a detailed analysis of the impact of CMEs on
approximately 130 repeaters connected in series [76]. In practical long-distance cables is hindered by the limited availability of data
deployments, inter-repeater distance vary from 50 to 150 km [48, as well as the lack of tools and techniques that facilitate analysis at
66]. the intersection of astrophysics, electrical engineering, and optical
Note that the repeaters are designed to operate at ~1A current [73, engineering.
76]. However, as discussed in § 3.1, GIC during strong solar events
In this paper, we take the �rst step towards bridging the gap in
can be as high as 100 130 Amperes. This is ~100⇥ more than the
our understanding of the impact of CMEs on terrestrial communica-
operational range of these repeaters. Thus, in the event of a solar
tion infrastructure using an extensive set of infrastructure datasets
superstorm, repeaters are susceptible to damage from GIC. Moreover,
and a broad range of failure models. To the best of our knowledge,
even a single repeater failure can leave all parallel �bers in the cable
this is the �rst e�ort to bring together various pieces required to
unusable due to weak signal strength or disruption of power.
understand this threat in the context of the Internet. Note that
3.2.2 Recovery challenges. The speci�ed lifetime of repeaters more sophisticated models, particularly for repeater failures, can be
in submarine cables is 25 years [24]. Once deployed under the plugged into our analyses in the future when they become available.
ocean, they are typically highly resilient unless the cable is damaged This paper uses a wide range of probabilistic models to study the
by human interference. This is a design requirement since the space since accurate modeling is not available. Real-world datasets
replacement/repair of repeaters or parts of the cable is expensive. and models are used in all contexts where feasible and available.
Commonly, underwater cable damages are localized, and typical
causes are �shing vessels, ship anchors, or earthquakes. When 3.3 Impact on Satellites
damage occurs, the location of the damage is �rst identi�ed using Communication satellites are among the severely a�ected systems.
tests from the landing sites, and then a cable ship is sent to the The damages are not caused by GIC but due to direct exposure to
location for repair. This repair process can take days to weeks for a highly charged particles in CMEs. These particles do not reach the
single point of damage on the cable. earth’s surface since they are mostly blocked by the atmosphere.
The current deployment of submarine cables has never been Threats to communication satellites include damage to electronic
stress-tested under a strong solar event. Due to the lack of real- components and extra drag on the satellite, particularly in low-
world data on GIC e�ects on repeaters, the potential extent of earth orbit systems such as Starlink [14], that can cause orbital
damage (the number of repeaters that could be destroyed) and the decay and uncontrolled reentry to earth [39].
time required to repair signi�cant portions of a cable are unknown. Thus, both surface-based and satellite-based communication sys-
However, the extent of damage is not dependent on the distance tems are under high risk of collapse if a Carrington-scale event
between the repeaters. It depends on the distance between the occurs again.
ground connections. GIC enters and exits the power feeding line
at the points where the conductor is grounded, even when the
cable is not powered. The potential di�erence between these earth 4 ANALYZING THE IMPACT
connections determines the strength of GIC entering the cable. To better understand the risk, we analyze various infrastructure
A short cable (<50 km) without any repeaters does not require a components that constitute the current Internet topology. In addi-
ground connection. However, longer cables are grounded at several tion to the threats posed to physical infrastructure, we also evaluate
intermediate points, at intervals of 100s to 1000s of kilometers. the implications for software building blocks of the Internet. All
For example, Google’s Equiano cable connecting South Africa to datasets except the private ITU land cables and the code used for ex-
Portugal has nine branching units [9] which are connected to the periments in this paper are available at https://github.com/NetSAIL-
sea earth. UCI/Internet-Resilience.
695
Solar Superstorms: Planning for an Internet Apocalypse SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA
exact latitude and longitude information are not available for this
dataset. But nodes labeled with location names and the links are
available. A snapshot of submarine cables, long-haul �ber, and IXP
locations from the ITU website [10] is shown in Figure 1.
4.1.5 DNS root servers. DNS root server locations of 1076 in-
stances across 13 root servers are obtained from the root server
directory [3].
4.1.6 IXP dataset. The IXP dataset obtained from the PCH In-
ternet Exchange directory [13] contains 1026 locations across the
globe, including their coordinate information.
696
SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA Sangeetha Abdu Jyothi
180W 0 180E
90
100
60
0
40
40 S
-45
Population 20
Submarine endpoints
-90 0
0 2 4 6 8 10 90 80 70 60 50 40 30 20 10 0
Probability Density Function (%)
|Latitude| threshold
(a) Long-Distance Cable endpoints
Figure 3: PDF of population and submarine cable end points
with respect to latitude.
100
697
Solar Superstorms: Planning for an Internet Apocalypse SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA
698
SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA Sangeetha Abdu Jyothi
40 40 40
20 20 20
0 0 0
0.001 0.01 0.1 1 0.001 0.01 0.1 1 0.001 0.01 0.1 1
Probability of repeater failure Probability of repeater failure Probability of repeater failure
(a) Repeater distance 50 km (b) Repeater distance 100 km (c) Repeater distance 150 km
Figure 6: The impact of repeater failure on cables under uniform probability of failure of repeaters. A cable fails if at least one
of its repeaters fails. Error bars denote standard deviation computed over 10 trials.
40 40 40
20 20 20
0 0 0
0.001 0.01 0.1 1 0.001 0.01 0.1 1 0.001 0.01 0.1 1
Probability of repeater failure Probability of repeater failure Probability of repeater failure
(a) Repeater distance 50 km (b) Repeater distance 100 km (c) Repeater distance 150 km
Figure 7: The impact of repeater failure on nodes under uniform probability of failure of repeaters. A node is unreachable
when all cables connecting to it fail. Error bars denote standard deviation computed over 10 trials.
50 S1 (High failure) S2 (Low failure) a�ected. However, the densely populated city of Shanghai loses
45 all its long-distance connectivity even under this scenario. This is
Cables failed or
40
35 because all cables connecting to Shanghai are at least 28, 000 km
30 and interconnect multiple cities. Under high failures (( 1 ), China
25 loses all its long-distance cables except one (connecting to Japan,
20
15 Philippines, Singapore, and Malaysia).
10
5 India: The majority of cables connecting to India are una�ected,
0 and none of the cities are disconnected at low failure probabilities
50 100 150 50 100 150 (( 2 ). Even under the high-failure scenario (( 1 ), some international
connectivity remains (e.g., India to Singapore, Middle East, etc.).
Inter-repeater distance (km)
Unlike in China, the key cities of Mumbai and Chennai do not lose
connectivity even with high failures.
Singapore: Even under high failures, several cables connecting
Figure 8: Cable and nodes failures under two states of non-
to Singapore remain una�ected. Reachable destinations under ( 1
uniform repeater failures (( 1 , ( 2 ). In each state, repeaters in a
include Chennai (India), Perth (Australia), Jakarta (Indonesia), etc.
cable are assigned a failure probability based on the highest
latitude (!) endpoint of the cable. Three levels of failure are UK: While the UK loses most of its long-distance cables under the
! > 60, 40 < ! < 60, and ! < 40. Assigned failure probability high failure scenario, its connectivity to neighboring European loca-
per repeater in ( 1 is [1, 0.1, 0.01] and in ( 2 is [0.1, 0.01, 0.001] tions such as France, Norway, etc. remains. However, connectivity
across the three levels respectively. to North America is lost.
699
Solar Superstorms: Planning for an Internet Apocalypse SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA
80
ASes with presence
700
SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA Sangeetha Abdu Jyothi
consider public information on data center locations of Google [6] • A large fraction of ASes have a presence in vulnerable regions,
and Facebook [38]. however, the vast majority have a small spread. The extent of
While the majority of Google data centers [6] are located in the impact on an AS and its customers will depend on a combination
US, they are spread across latitudes and longitudes. In the event of of these factors.
high failures, data centers in South Carolina and Georgia as well as • Google data centers have a better spread, particularly in Asia and
Las Vegas are more likely to be located close to active long-distance South America. Facebook is more vulnerable.
cables. In Asia, one of Google’s data centers is located in Singapore, • DNS root servers are highly distributed and hence not vulnerable.
a location less likely to lose connectivity during solar superstorms.
European Google data centers are located in countries with short 5 PLANNING FOR THE FUTURE
interconnecting submarine cables to the rest of Europe. While this Although we have sentinel spacecraft that can issue early warn-
area is highly susceptible to power failures, Internet failures due ings of CMEs providing at least 13 hours of lead time, our defenses
to repeater damage are less probable due to the shorter length of against GIC are limited. Hence, we need to prepare the infras-
cables in this region. tructure for an eventual catastrophe to facilitate e�cient disaster
Facebook’s data centers [38] are predominantly located in the management. Towards this goal, we outline several directions.
northern parts of the Northern hemisphere. Facebook does not
operate any hyperscale data centers in Africa or South America, 5.1 Internet Infrastructure Design
unlike Google. Owing to the limited geographic spread of data
centers, Facebook will have less resilience in the event of solar As shown in our analysis, the current Internet infrastructure is
superstorms. heavily concentrated in higher latitudes that are at a greater risk
for GIC. We need to factor in this threat during infrastructure
4.4.3 Implications for DNS servers. DNS root servers are expansion.
highly geographically distributed. Although the distribution is not With the increased melting of Arctic ice, there are ongoing e�orts
proportional to Internet users (Africa with more Internet users than to lay cables through the Arctic [11, 12]. While this is helpful for
North America has nearly half the number of DNS servers), DNS improving latency, these cables are prone to higher risk. During
root servers are widely present on all continents. Hence, DNS root topology design, we need to increase capacity in lower latitudes
servers are resilient in the face of solar superstorms. for improved resiliency during solar storms (although latency is
While location information of all DNS root servers is publicly higher). Moreover, since links from the US and Canada to Europe
available (including all anycast server locations), data on more than and Asia are highly vulnerable, adding more links to Central and
1500 Top-Level Domain servers and other DNS root zone servers are South America can help in maintaining global connectivity. South
limited. While the IP address of these servers can be obtained from America is more likely to maintain connectivity to Europe and
DNS records, it is di�cult to identify their locations, particularly Africa.
because they typically employ anycast. At submarine cable landing points, particularly in the low lati-
tudes, it is important to have mechanisms for electrically isolating
cables connecting to higher latitudes from the rest, to prevent cas-
4.4.4 Summary.
cading failures.
• The distribution of Internet infrastructure is skewed when com- A higher density of data centers and IXPs in northern parts of
pared to the distribution of Internet users. The infrastructure Europe and America also poses a threat to Internet services. Data
concentration in higher latitudes poses a greater risk during center and application service providers should be cognizant of
solar storms. solar threats during new deployments. We need to develop stan-
• The investigation on the impact of GIC shows that submarine dardized tests for measuring end-to-end resiliency of applications
cables have a higher risk of failure compared to land cables. This under such extreme events. Speci�cally, systematic modeling of
is primarily due to their large lengths. potential disruptions to the Internet, from the physical layer to
• The US is one of the most vulnerable locations with a high risk various applications, through collaborations between astrophysi-
of disconnection from Europe during extreme solar events. Intra- cists, electrical engineers, and networking researchers is critical for
continental connections in Europe are at a lower risk due to the improving Internet resiliency.
presence of a large number of shorter land and submarine cables This paper focused on terrestrial infrastructure only. With in-
interconnecting the continent. creasing deployments of low earth orbit satellites [14], it is also
• In Asia, Singapore will retain good connectivity to neighboring important to study the impact of solar superstorms on satellite
countries even under severe storms. Chinese cities are more prone Internet constellations that are directly exposed to powerful CMEs.
to lose connectivity than Indian cities because they connect to
much longer cables. The cables running along the eastern and 5.2 How to Use the Lead Time?
western coasts of Africa are less prone to failures. A CME that originates in the sun reaches the earth at least 13 hours,
• The cable between Brazil and Europe has less probability of being typically 1-3 days, later. This provides the infrastructure operators
a�ected compared to cables connecting the US and Europe. an opportunity to devise a shutdown strategy that minimizes con-
• Australia, New Zealand, and other island countries in the region nectivity loss during and after impact. In power grids, since GIC
will lose most of their long-distance connections. But local con- is superimposed with generated current, a key strategy involves
nectivity, as well as connections to Singapore, are less vulnerable. reducing or completely shutting down power generation.
701
Solar Superstorms: Planning for an Internet Apocalypse SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA
In the Internet infrastructure, the shutdown strategy needs to 74]. Today, there is a tight interdependence between power grids
focus on two aspects: (i) protecting the equipment during a solar and networks. Smart grids rely on either their own private WAN
event, and (ii) ensuring the continuation of services after the event networks or the public Internet for their functioning. As a result,
anticipating partial damage to infrastructure (damaged submarine failures of power grids and the Internet and other communication
cables, satellites, etc.). Similar to power grids, powering o� is the eas- networks are more tightly coupled.
iest solution for equipment damage prevention. However, note that Although power grids and the Internet have varying levels of
this only provides limited protection since GIC can �ow through impact on society, there are several di�erentiating features in the
a powered-o� cable. Since the peak current is reduced slightly by nature of failures and hence, the recovery mechanisms required.
powering o�, this can help only when the threat is moderate. First, power grids and the Internet di�er in their structure and
Planning for post-impact connectivity is a much harder prob- organization. For example, in the US, there are three regional power
lem, especially with limited modeling available for the extent of grids. If the power grid in New York fails, it will not cause any
cable damage. Search engines, �nancial services, etc. should geo- signi�cant e�ects in California. The Northeast will be without
distribute critical data and functionalities so that each partition power, but it is not possible to transfer electricity from California
(potentially disconnected landmasses such as N. America, Eurasia, to New York and cause any power overload in California. On the
Australia, etc.) can function independently. Also, service and con- other hand, when all submarine cables connecting to NY fail, there
tent providers should pre-provision high priority service for critical will be signi�cant shifts in BGP paths and potential overload in
applications such as 911, hospitals, �re departments, etc. Internet cables in California. In short, the Internet is more global
compared to power grids, and even regional failures can result in
5.3 Piecing Together a Partitioned Internet signi�cant consequences for the broader Internet.
We need to rethink the network environment in the event of a Second, the length of power cables will closely follow the ITU
partial or complete disconnection [57]. This includes designing ad- land dataset. Both power lines and Internet cables on land are typi-
hoc network connectivity mechanisms (e.g., Project Loon [36]) and cally in close proximity to road and rail networks. Hence, longer
peer-to-peer applications that can bootstrap connectivity locally. submarine cables may be susceptible to higher risks. The key road-
User-powered mesh networks [7] that proved valuable during other block associated with replacing transformers in power grids is the
natural disasters such as earthquakes can also help during solar manufacturing time for new equipment. For submarine cables, in
superstorms. However, unlike other localized disasters, wide-area addition to equipment availability, access to failure location for
connectivity disruption is a unique challenge associated with solar repair is also a challenge.
storms. To tackle this problem, we need to examine alternatives Modeling of the interdependence of power grids and the Internet,
such as backup interdomain protocols that allow multiple paths potential cascading failures between the two systems due to their
and more resilient Internet architectures (e.g., SCION [18]). More coupling, and design of recovery mechanisms for the mutually de-
broadly, designing and installing in advance a seamless protocol that pendent systems are problems that need to be tackled for increasing
can piece together all available modes of communication, includ- the robustness of our critical infrastructure.
ing cables, satellites, and wireless, across multiple administrative
domains is critical for fast recovery. 6 CONCLUSION
In this paper, we show that a powerful solar superstorm has the po-
5.4 Devising New Resilience Tests for Internet
tential to cause massive disruption of the Internet. Astrophysicists
Systems estimate the likelihood of a solar storm of su�cient strength to
Current best practices on fault tolerance and resilience evaluation cause catastrophic disruption occurring within the next decade to
in software systems revolve around failure models that consider a be 1.6 12%. Paying attention to this threat and planning defenses
limited number of failures within and across locations. Large-scale against it, like our preliminary e�ort in this paper, is critical for
infrastructure failures spanning broad swaths of the Internet are the long-term resilience of the Internet. Several challenges remain
absent in the literature. This was primarily due to the fortuitous open in this space. How can we model infrastructure failures more
absence of such a catastrophic event in the past two decades when accurately? How do we factor in solar threat during Internet in-
the Internet infrastructure grew rapidly. Hence, our understanding frastructure and systems design? How can we help operators in
of the impact of a solar superstorm on Internet sub-systems (e.g., making disaster preparation and recovery plans? We anticipate that
Autonomous Systems) and Internet-based systems (e.g., cloud ser- this paper will provide an initial impetus towards answering these
vices, Voice over IP) is very limited. We need to devise standard important questions.
practices in resilience testing involving large-scale failures.
702
SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA Sangeetha Abdu Jyothi
REFERENCES [33] Adriana Garcia and Zadig Mouradian. 1998. The Gleissberg cycle of minima.
[1] [n.d.]. Cost of Shutdown Tool. https://netblocks.org/cost/. (Accessed on Solar Physics 180, 1-2 (1998), 495–498.
06/07/2021). [34] Manaf Gharaibeh, Anant Shah, Bradley Hu�aker, Han Zhang, Roya Ensa�, and
[2] [n.d.]. Data Centers Map. https://www.datacentermap.com/. Christos Papadopoulos. 2017. A look at router geolocation in public and com-
[3] [n.d.]. DNS root servers. https://root-servers.org/. mercial databases. In Proceedings of the 2017 Internet Measurement Conference.
[4] [n.d.]. Geomagnetic E�ects on Communication Cables. https://www.spaceweath 463–469.
er.gc.ca/tech/se-cab-en.php/. [35] Max Gleber. [n.d.]. CME Week: The Di�erence Between Flares and CMEs. https:
[5] [n.d.]. Geomagnetic Storms – Reducing the Threat to Critical Infrastructure in //www.nasa.gov/content/goddard/the-difference-between-�ares-and-cmes.
Canada. http://www.solarstorms.org/CanadaPipelines.html. [36] Google. [n.d.]. Project Loon. https://loon.com.
[6] [n.d.]. Google Data Center Locations. https://www.google.com/about/datacenters [37] YB Han and ZQ Yin. 2019. A decline phase modeling for the prediction of solar
/inside/locations/. cycle 25. Solar Physics 294, 8 (2019), 1–14.
[7] [n.d.]. GoTenna Mesh Networks. https://gotennamesh.com/products/mesh. [38] Kim Hazelwood, Sarah Bird, David Brooks, Soumith Chintala, Utku Diril, Dmytro
[8] [n.d.]. Internet Statistics. https://www.internetworldstats.com/stats.htm/. Dzhulgakov, Mohamed Fawzy, Bill Jia, Yangqing Jia, Aditya Kalro, et al. 2018.
[9] [n.d.]. Introducing Equiano, a subsea cable from Portugal to South Africa. https: Applied machine learning at Facebook: A datacenter infrastructure perspective.
//cloud.google.com/blog/products/infrastructure/introducing-equiano-a-subs In 2018 IEEE International Symposium on High Performance Computer Architecture
ea-cable-from-portugal-to-south-africa. (HPCA). IEEE, 620–629.
[10] [n.d.]. ITU interactive transmission map. https://www.itu.int/itu-d/tnd-map-pu [39] RB Horne, SA Glauert, NP Meredith, D Boscher, V Maget, D Heynderickx, and D
blic/. Pitchford. 2013. Space weather impacts on satellites and forecasting the Earth’s
[11] [n.d.]. Major step towards a Europe-Asia Arctic cable link. https://thebarentsobse electron radiation belts with SPACECAST. Space Weather 11, 4 (2013), 169–186.
rver.com/en/industry-and-energy/2019/06/mou-signed-set-arctic-telecom-ca [40] John Kappenman. 2010. Geomagnetic storms and their impacts on the US power
ble-company. grid. Citeseer.
[12] [n.d.]. Melting Arctic Ice Opens a New Fiber Optic Cable Route. https://spectrum.i [41] John G Kappenman. 2001. An introduction to power grid impacts and vulnerabil-
eee.org/tech-talk/telecom/internet/melting-sea-ice-opens-the-floodgate-for-a ities from space weather. In Space Storms and Space Weather Hazards. Springer,
-new-fiber-optic-cable-route/. 335–361.
[13] [n.d.]. PCH Internet Exchange Directory. https://www.pch.net/ixp/dir. [42] Kathrin Kirchen, William Harbert, Jay Apt, and M Granger Morgan. 2020. A Solar-
[14] [n.d.]. Starlink. https://www.starlink.com/. Centric Approach to Improving Estimates of Exposure Processes for Coronal
[15] [n.d.]. Telegeography’s Submarine Cable Map. https://github.com/telegeography Mass Ejections. Risk Analysis (2020).
/www.submarinecablemap.com. [43] Harold Kirkham, Yuri V Makarov, Je�ery E Dagle, John G DeSteese, Marcelo A
[16] L Barnard and Mike Lockwood. 2011. A survey of gradual solar energetic particle Elizondo, and Ruisheng Diao. 2011. Geomagnetic storms and long-term impacts
events. Journal of Geophysical Research: Space Physics 116, A5 (2011). on power systems. Technical Report. Paci�c Northwest National Lab.(PNNL),
[17] L Barnard, M Lockwood, MA Hapgood, Matt J Owens, Chris J Davis, and F Richland, WA (United States).
Steinhilber. 2011. Predicting space climate change. Geophysical research letters [44] Anukool Lakhina, John W Byers, Mark Crovella, and Ibrahim Matta. 2003. On
38, 16 (2011). the geographic location of Internet resources. IEEE Journal on Selected Areas in
[18] David Barrera, Laurent Chuat, Adrian Perrig, Raphael M. Reischuk, and Pawel Communications 21, 6 (2003), 934–948.
Szalachowski. 2017. The SCION Internet Architecture. Commun. ACM 60, 6 [45] Louis J Lanzerotti, Lester V Medford, Carol G Maclennan, and David J Thomson.
(June 2017), 56–65. https://doi.org/10.1145/3085591 1995. Studies of large-scale Earth potentials across oceanic distances. AT&T
[19] Prantika Bhowmik and Dibyendu Nandy. 2018. Prediction of the strength and technical journal 74, 3 (1995), 73–84.
timing of sunspot cycle 25 reveal decadal-scale space environmental conditions. [46] FY Li, DF Kong, JL Xie, NB Xiang, and JC Xu. 2018. Solar cycle characteristics
Nature communications 9, 1 (2018), 1–10. and their application in the prediction of cycle 25. Journal of Atmospheric and
[20] DH Boteler, RM Shier, T Watanabe, and RE Horita. 1989. E�ects of geomagnet- Solar-Terrestrial Physics 181 (2018), 110–115.
ically induced currents in the BC Hydro 500 kV system. IEEE Transactions on [47] Je�rey J Love, Hisashi Hayakawa, and Edward W Cliver. 2019. Intensity and
Power Delivery 4, 1 (1989), 818–823. impact of the New York Railroad superstorm of May 1921. Space Weather 17, 8
[21] Richard C Carrington. 1859. Description of a singular appearance seen in the (2019), 1281–1292.
Sun on September 1, 1859. Monthly Notices of the Royal Astronomical Society 20 [48] Adam Markow. [n.d.]. Summary of Undersea Fiber Optic Network Technology and
(1859), 13–15. Systems. http://hmorell.com/sub_cable/documents/Basics%20of%20Submarine
[22] BA Carter, E Yizengaw, R Pradipta, JM Weygand, M Piersanti, A Pulkkinen, MB %20System%20Installation%20and%20Operation.pdf.
Moldwin, R Norman, and K Zhang. 2016. Geomagnetically induced currents [49] James A Marusek. [n.d.]. Solar storm threat analysis. Impact, 2007.
around the world during the 17 March 2015 storm. Journal of Geophysical [50] Trevor Maynard, Neil Smith, and Sandra Gonzalez. 2013. Solar storm risk to the
Research: Space Physics 121, 10 (2016), 10–496. north american electric grid. Lloyd’s 1 (2013), 11.
[23] SC Chapman, SW McIntosh, RJ Leamon, and NW Watkins. 2020. Quantifying the [51] KG McCracken, GAM Dreschho�, DF Smart, and MA Shea. 2004. A study of the
solar cycle modulation of extreme space weather. Geophysical Research Letters frequency of occurrence of large-�uence solar proton events and the strength of
(2020), e2020GL087795. the interplanetary magnetic �eld. Solar Physics 224, 1-2 (2004), 359–372.
[24] Valerie Co�ey. 2014. Sea change: The challenges facing submarine optical com- [52] KG McCracken, GAM Dreschho�, EJ Zeller, DF Smart, and MA Shea. 2001. Solar
munications. Optics and Photonics News 25, 3 (2014), 26–33. cosmic ray events for the period 1561–1994: 1. Identi�cation in polar ice, 1561–
[25] Valerie Co�ey. 2014. Sea change: The challenges facing submarine optical com- 1950. Journal of Geophysical Research: Space Physics 106, A10 (2001), 21585–21598.
munications. Optics and Photonics News 25, 3 (2014), 26–33. [53] Scott W McIntosh, Sandra Chapman, Robert J Leamon, Ricky Egeland, and
[26] Steven Constable. 2007. Conductivity, Ocean Floor Measurements. Springer Nicholas W Watkins. 2020. Overlapping magnetic activity cycles and the sunspot
Netherlands, Dordrecht, 71–73. https://doi.org/10.1007/978-1-4020-4423-6_30 number: forecasting sunspot cycle 25 amplitude. Solar Physics 295, 12 (2020),
[27] T Divett, M Ingham, CD Beggan, GS Richardson, CJ Rodger, AWP Thomson, 1–14.
and M Dalzell. 2017. Modeling geoelectric �elds and geomagnetically induced [54] Dan McMurrow. 2011. Impacts of Severe Space Weather on the Electric Grid.
currents around New Zealand to explore GIC in the South Island’s electrical https://fas.org/irp/agency/dod/jason/spaceweather.pdf.
transmission network. Space Weather 15, 10 (2017), 1396–1412. [55] AG McNish. 1940. The magnetic storm of March 24, 1940. Terrestrial Magnetism
[28] ZL Du. 2020. The solar cycle: predicting the peak of solar cycle 25. Astrophysics and Atmospheric Electricity 45, 3 (1940), 359–364.
and Space Science 365, 6 (2020), 1–5. [56] LV Medford, LJ Lanzerotti, JS Kraus, and CG Maclennan. 1989. Transatlantic
[29] Ramakrishnan Durairajan, Paul Barford, Joel Sommers, and Walter Willinger. earth potential variations during the March 1989 magnetic storms. Geophysical
2015. InterTubes: A study of the US long-haul �ber-optic infrastructure. In Research Letters 16, 10 (1989), 1145–1148.
Proceedings of the 2015 ACM Conference on Special Interest Group on Data Com- [57] David Mendonça, Theresa Je�erson, and John Harrald. 2007. Collaborative ad-
munication. 565–578. hocracies and mix-and-match technologies in emergency management. Commun.
[30] J Feynman and A Ruzmaikin. 2011. The Sun’s strange behavior: Maunder mini- ACM 50, 3 (2007), 44–49.
mum or Gleissberg cycle? Solar physics 272, 2 (2011), 351. [58] Satoko Nakamura, Yusuke Ebihara, Shigeru Fujita, Tada-nori Goto, N Yamada,
[31] J Feynman and A Ruzmaikin. 2014. The Centennial Gleissberg Cycle and its S Watari, and Y Omura. 2018. Time domain simulation of geomagnetically
association with extended minima. Journal of Geophysical Research: Space Physics induced current (GIC) �owing in 500-kV power grid in Japan including a three-
119, 8 (2014), 6027–6041. dimensional ground inhomogeneity. Space Weather 16, 12 (2018), 1946–1959.
[32] Jennifer L. Gannon. [n.d.]. Geomagnetic Storms and Geomagnetically Induced [59] Sten Odenwald. [n.d.]. The Day the Sun Brought Darkness. https://www.nasa.gov
Currents. https://electricenergyonline.com/energy/magazine/966/article/Geoma /topics/earth/features/sun_darkness.html.
gnetic-Storms-and-Geomagnetically-Induced-Currents.htm. [60] Edward J Oughton, Andrew Skelton, Richard B Horne, Alan WP Thomson, and
Charles T Gaunt. 2017. Quantifying the daily economic impact of extreme space
weather due to failure in electricity transmission infrastructure. Space Weather
703
Solar Superstorms: Planning for an Internet Apocalypse SIGCOMM ’21, August 23–27, 2021, Virtual Event, USA
704