The ever-growing carbon emission of information infrastructure accounts for a significant proportion of the global carbon emissions. Existing studies reduce carbon consumption mainly by improving power efficiency on specific facilities or energy source structures. However, these methods do not jointly consider the impact of computation and network resource distribution on carbon emission. In this paper, we propose a data-driven scheme named EcoNet using reinforcement learning to reduce carbon emissions by jointly scheduling computation and network resources. We dynamically monitor the status of the computation and network facilities using cloud-edge collaboration and software-defined networking. Based on the collected status information, we formulate the resource scheduling problem as an optimization problem, which comprehensively considers the carbon emission, electricity price, and quality of service. The problem has high computation complexity, and we solve the problem with the proposed EcoNet to achieve efficient scheduling and near-optimal performance based on the collected network status information. The evaluation results show that EcoNet can maintain good Quality of Service and save at least 17% of the overall cost considering the electricity bills and carbon emissions.

The sixth-generation mobile communication (6G) networks will face more complex endogenous security problems, and it is urgent to propose new universal security theories and establish new practice norms to deal with the “unknown unknown” security threats in cyberspace. This paper first expounds the new paradigm of cyberspace endogenous security and introduces the vision of 6G cyberspace security. Then, it analyzes the security problems faced by the 6G core network, wireless access network, and emerging associated technologies in detail, as well as the corresponding security technology development status and the integrated development of endogenous security and traditional security. Furthermore, this paper describes the relevant security theories and technical concepts under the guidance of the new paradigm of endogenous security.

In this paper, we propose a resilient control plane based on endogenous security for Software-Defined Networking (SDN) named SDN-ESRC to prevent vulnerability backdoor attacks. SDN-ESRC uses a set of heterogeneous controllers (e.g., RYU, OpenDayLight, ONOS) to compose the control plane and dynamically and adaptively selects several heterogeneous controller instances from the controller set to detect and correct the malicious control messages. The design of SDN-ESRC faces two challenges: (1) increasing network update delay due to multi-controller comparison and (2) maintaining high controllable security. To address the first challenge, SDN-ESRC adopts the master modification mode to reduce the network update delay and identify malicious control messages. To address the second challenge, SDN-ESRC introduces the comparison modification mode to ensure high availability in real time. We propose an evaluation model for SDN-ESRC and theoretically analyze the SDN-ESRC’s endogenous security performance under three typical backdoor attack scenarios. We implement SDN-ESRC in a prototype system and conduct simulations and experiments. The results show that SDN-ESRC can improve the backdoor damage attack security up to 98.3%, the backdoor random attack security up to 99.99%, and the backdoor coordinated attack security up to 82% at the cost of increasing network update delay less than 8.3%.

In recent years, both academia and industry in cyber security have tried to develop innovative defense technologies, expecting that to change the rules of the game between attackers and defenders. The authors start by analysing the root causes of security problems in cyberspace: (i) vulnerabilities in cyber systems are universal; (ii) current cyber systems are static, predictable and monoculture which allows adversaries to plan and launch attacks effectively; (iii) existing techniques cannot detect and eliminates attacks employing unknown vulnerabilities. Based on their analysis, they develop a novel defense framework, mimic defense (MD), that employs ‘dynamic, heterogeneity, redundancy (DHR)’ mechanism to defense cyber attacks. The main ideas behind MD are: constructing diverse functional equivalent variants for the protected target; scheduling some variants to run in parallel dynamically; and adopting policy‐based arbitration mechanism to decide whose results of current running variants are correct. Theoretical analysis and simulation results show that DHR can significantly increase the difficulties for attackers and enhance the security of cyber systems, and the security enhancement can be more than ten times. They also present a proof‐of‐principle prototype that employ MD, mimic router, to examine its effectiveness. Finally, they conclude its limitations.

With more large-scale scientific computing tasks being delivered to cloud computing platforms, cloud workflow systems are designed for managing and arranging these complicated tasks. However, multi-tenant coexistence service mode of cloud computing brings serious security risks, which will threaten the normal execution of cloud workflows. To strengthen the security of cloud workflows, a mimic cloud computing task execution system for scientific workflows is proposed. The idea of mimic defense contains mainly three aspects: heterogeneity, redundancy, and dynamics. For heterogeneity, the diversities of physical servers, hypervisors, and operating systems are integrated to build a robust system framework. For redundancy, each sub-task of the workflow will be executed simultaneously by multiple executors. Considering efficiency and security, a delayed decision mechanism is proposed to check the results of task execution. For dynamics, a dynamic task scheduling mechanism is devised for switching workflow execution environment and shortening the life cycle of executors, which can confuse the adversaries and purify task executors. Experimental results show that the proposed system can effectively strengthen the security of cloud workflow execution.

Security evaluation of SDN architectures is of critical importance to develop robust systems and address attacks. Focused on a novel-proposed dynamic SDN framework, a game-theoretic model is presented to analyze its security performance. This model can represent several kinds of players’ information, simulate approximate attack scenarios, and quantitatively estimate systems’ reliability. And we explore several typical game instances defined by system’s capability, players’ objects, and strategies. Experimental results illustrate that the system’s detection capability is not a decisive element to security enhancement as introduction of dynamism and redundancy into SDN can significantly improve security gain and compensate for its detection weakness. Moreover, we observe a range of common strategic actions across environmental conditions. And analysis reveals diverse defense mechanisms adopted in dynamic systems have different effect on security improvement. Besides, the existence of equilibrium in particular situations further proves the novel structure’s feasibility, flexibility, and its persistent ability against long-term attacks.

Security evaluation of diverse SDN frameworks is of significant importance to design resilient systems and deal with attacks. Focused on SDN scenarios, a game-theoretic model is proposed to analyze their security performance in existing SDN architectures. The model can describe specific traits in different structures, represent several types of information of players (attacker and defender) and quantitatively calculate systems' reliability. Simulation results illustrate dynamic SDN structures have distinct security improvement over static ones. Besides, effective dynamic scheduling mechanisms adopted in dynamic systems can enhance their security further.

Software defined networking (SDN) enables the network more flexible, open and programmable. However, as the network control and intelligence lay on the centralised controller, its security becomes even more important, and a minor change may have a direct crucial impact on the entire network. Numerous research results have shown that the SDN controller not only faces traditional security threats, but also has to tackle the challenges introduced by its unique centralised architecture. In this study, the authors present a novel SDN controller framework called mimic network operating system (MNOS). The main ideas behind MNOS are cyberspace mimic defence (CMD), which is proposed by academician Wu's team recently. By introducing the CMD into the design of SDN controllers, they come out with an N ‐variant controller framework with dynamic, heterogeneous and redundant characteristics. MNOS has a design‐in security mechanism, its main features are: (i) effectively protects the controller from the attacks as hijacking and data modification without relying on prior knowledge of vulnerabilities; (ii) constantly monitors the behaviours of variants to detect unknown attacks; (iii) greatly improves the reliability of controllers. Theoretical analysis and experimental results show that MNOS can achieve considerable security gains and effectively improve security performance of SDN controller.

In network virtualization, virtual network embedding is mostly static, which maps each virtual link onto a single predictable path, thus offering a significant advantage for adversaries to eavesdrop or intercept a certain virtual network. However, existing works on multipath embedding just focus on performance and survivability, instead of maximizing the routing unpredictability to avoid link attacks. In this paper, we present a mutable virtual network embedding framework which maps each virtual link onto a set of substrate links with a game-theoretic optimal stochastic routing policy. Firstly, we model the virtual network embedding in the context of stochastic routing with its effectiveness quantified by game theory. Then, in node mapping algorithm, we define a security capacity matrix to evaluate substrate nodes, thus overcoming two disadvantages of existing resource capacity metric. In link mapping algorithm, we work out the optimal stochastic routing policies with satisfying capacity, delay and cycle-free constraints. The simulation results indicate that our framework can significantly improve the probability that packets are not attacked, with little expense of request acceptance ratio and average routing hops.

Simulcasting involves transmitting the same signal simultaneously over several antennas on the same carrier frequency. We derive the optimal grouping condition for simulcasting over a massively distributed antenna system (DAS) employing orthogonal space-time block coding (STBC), where the order of the STBC coding matrix n_o is smaller than the number of remote antenna units (RAUs). While the optimum grouping minimizes the average bit error rate (BER) in the coverage area, we further propose two heuristic grouping rules and derive the corresponding stream-balanced grouping schemes in three DAS topologies, namely, linear, hexagonal and square lattice, to achieve low average BER across the area covered by the DAS. Simulation results for the different topologies confirm the superiority of the proposed grouping schemes compared with the other grouping methods. Also, when either n_o or the RAU density increases, the average BER decreases.

IP routing lookup schemes using single-step TCAM used in core routers demand entries being sorted according to prefix lengths in descending order relative to TCAM addresses. The sorting operations related to addresses have disadvantageous affections to the entry updating speed and lookup continuity. This paper provides a novel IPv4/IPv6 dual-stack routing lookup method based on BSPL (bi-search on prefix length), which using multi-step TCAM pipelining based on bi-search on prefix length. Its outstanding advantages include that no entry sorting is needed, lookup speed is high, entry updating is completed fast with pipelining, and lookup continuity is enhanced. It satisfies wire-speed (48B-packet) forwarding of OC-768 (40Gbps) interfaces of IPv4/IPv6 dual-stack core routers.

The parallel packet switch (PPS) attracts a lot of attention from the communications equipment vendors. However, a lack of the detailed analysis and understanding of the issues involved in congestion management has slowed down its recognition and deployment. We analyze the conditions of stable working for a PPS with buffered input demultiplexors. By comparing a PPS with a reference switch, we present a definition of stable working for the PPS architecture. The necessary and sufficient condition of stable working for a PPS is proposed and proved. Then we describe a family of dispatch algorithms for the PPS, and give the restriction of algorithms for guaranteeing stable working. Finally the minimum bound of PPS layers and core speedup are analyzed.

This paper presents a VLR database failure recovery scheme for cdma2000 system. We propose to backup the mobility database periodically. When failure occurs, VLR reloads the database from the backup file. However, if there is any new event (MS moving in or out) before recovery, the new information will not appear in the recovered VLR. The MS moving-in problem can be solved by autonomous registration, but the MS moving-out may result in obsolete information, we propose to periodically scan the database and remove the obsolete entries. The proposed scheme can also eliminate failure expansion and recover failures caused by radio troubles. The ratio of database backup period to scan period is analyzed.