One of the major security threats that public cloud computing platforms face today is that the active cloud virtual machine instances are visible and accessible via the public internet, which allows hackers to carry out several types of attacks such as Denial of Service (DoS) and intrusion over along durations which increases the probabilities of successful penetration. Security logs of the failed attempts attest to the real threat and the intensity and duration of these. Most systems running on public cloud instances today are not security hardened to withstand such persistent and long attacks. It is not only dangerous but also disastrous for the enterprise that uses such instances to deliver cloud services, for the users that use such services, and for the cloud provider that provides the cloud infrastructure. Therefore, what is required is a network level access control solution that facilitates delivery of cloud services while protecting the network perimeter of the solution in a useable and dynamically customisable manner. In this paper, we have described such a network-based access control solution for public cloud services that we have designed and developed and is applicable to any of the various cloud platforms available today. We have deployed our solution as part of the "Security-as-a-Service" model on IBM Smart Cloud Enterprise (SCE), and has been used for commercial delivery of cloud services. These applications have led to not only high level of security with no security attacks via network exposure on the services, but also significant savings on the cost of maintaining the security of such instances and services. We have also studied the challenges that network address translators (NATs) pose for network-based access control on public cloud, and have developed solutions for such challenges.

Crowdsourced video often provides engaging and diverse perspectives not captured by professional videographers. Broad appeal of user-uploaded video has been widely confirmed: freely distributed on YouTube, by subscription on Vimeo, and to peers on Facebook/Google+. Unfortunately, user-generated multimedia can be difficult to organize; these services depend on manual "tagging" or machine-mineable viewer comments. While manual indexing can be effective for popular, well-established videos, newer content may be poorly searchable; live video need not apply. We envisage video-sharing services for live user video streams, indexed automatically and in realtime, especially by shared content. We propose FOCUS, for Hadoop-on-cloud video-analytics. FOCUS uniquely leverages visual, 3D model reconstruction and multimodal sensing to decipher and continuously track a video's line-of-sight. Through spatial reasoning on the relative geometry of multiple video streams, FOCUS recognizes shared content even when viewed from diverse angles and distances. In a 70-volunteer user study, FOCUS' clustering correctness is roughly comparable to humans.

We present a demonstration of FOCUS [1], a system to appear in the SenSys 2013 main conference. FOCUS is a video-clustering service for live user video streams, indexed automatically and in realtime by shared content. FOCUS uniquely leverages visual, 3D model reconstruction and multimodal sensing to decipher and continuously track a video's line-of-sight. Through spatial reasoning on the relative geometry of multiple video streams, FOCUS recognizes shared content even when viewed from diverse angles and distances. We believe FOCUS can enable a new family of applications, such as instant replay, augmented reality, citizen journalism, security breach detection, and disaster assessment.

Tracing topology of services in real-time is a challenging problem in VoIP networks. The primary reason is that the VoIP networks operate with diverse interconnecting protocols, technologies, and multitude of access technologies. In addition, alliances, changing rules and regulations, mergers, new technologies and services impact architecture of VoIP networks consistently. All of these together results in heterogeneous, complex and dynamic VoIP networks where the network topology changes very frequently. Secondly, in case of voice, each call can follow a different path over the core IP infrastructure in the network. Even the signaling and media path of the same voice call can follow different paths to destination (callee's device). Stitching and providing integrated end to end cross layer view of the path in real-time of an ongoing service flow e.g. voice call under such unpredictable network conditions is difficult.

Presence, broadly defined as an event publish-notification infrastructure for converged applications, has emerged as a key mechanism for collecting and disseminating context attributes for next-generation services in both enterprise and provider domains. Current presence-based solutions and products lack in the ability to a) support flexible user-defined queries over dynamic presence data and b) derive composite presence from multiple provider domains. Accordingly, current uses of context are limited to individual domains/organizations and do not provide a programmable mechanism for rapid creation of context-aware services. This paper describes a presence virtualization architecture, where a Virtualized Presence Server receives customizable queries from multiple presence clients, retrieves the necessary data from the base presence servers, applies the required virtualization logic and notifies the presence clients. To support both query expressiveness and computational efficiency, virtualization queries are structured to separately identify both the XSLT-based transformation primitives and the presence sources over which the transformation occurs. For improved scalability, the proposed architecture offloads the XSLT-related processing to a high-performance XML processing engine. We describe our current implementation and present performance results that attest to the promise of this virtualization approach.

A growing class of applications, including VoIP, IM and presence, are enabled by the session initiation protocol (SIP). Requests in SIP typically traverse through multiple proxies. The availability of multiple proxies offers the flexibility to distribute proxy functionality across several nodes. In particular, after experimentally demonstrating that the resource consumption of maintaining state is significant, we define the problem of state distribution across multiple nodes when the goal is to increase overall call throughput. We first formulate this as an optimization problem and then derive a distributed algorithm from it. This distributed algorithm leads to the design and evaluation of SERvartuka, a more scalable SIP server that dynamically determines the number of SIP requests for which the server is stateful while delegating state maintenance for the remainder of the requests to a server further downstream. This design is in contrast to existing SIP servers that are statically configured to either be stateless or stateful and therefore result in sub-optimal call throughput. We implement SERvartuka on top of OpenSER, a commercial SIP proxy server and measure performance benefits of different server configurations. An example of our results is a 20% percent increase in call throughput when using our algorithm for a configuration of two servers in series.

Session Initiation Protocol (SIP) has begun to be widely deployed for multiple services such as VoIP, Instant Messaging and Presence. Each of these services uses different SIP messages, and depending on the value of a service, e.g. revenue, the associated messages may need to be prioritized accordingly. Even within the same service, different messages may be assigned different priorities. In this paper, we present the design and implementation of a programmable classification engine for SIP messages in the Linux kernel. This design uses a novel algorithm that in addition to classifying messages can extract and maintain state information across multiple messages. We apply the classifier for overload control using operator-specified rules for categorizing messages and associated actions, augmented with a protocol-level understanding of SIP message structure. When faced with loads beyond their capacity (e.g., during catastrophic situations and major network outages), SIP servers must drop messages. It is therefore desirable that the server process high-value messages in preference to lower-value messages. We evaluated our in-kernel classifier implementation with an open source SIP server (SER) for such an overload scenario. The workload consists of a mix of call setup and call handoff messages, and the classifier is programmed with rules that prioritize handoffs over call setups. We show that, while SER can process about 40K messages/sec (in a FIFO manner), our classifier can examine and prioritize 105K messages/sec during overload. With the classifier operating at peak throughput, SER's processing rate drops to 31.6K messages/sec, but all of the available high-value messages are processed.

This paper addresses the problem of efficient packet forwarding in a multihop, wireless "mesh" network. We present an efficient interface contained forwarding (ICF) architecture for a "wireless router," i.e., a forwarding node with a single wireless network interface card (NIC) in a multihop wireless network that allows a packet to be forwarded entirely within the NIC of the forwarding node without requiring per-packet intervention by the node's CPU. To effectively forward packets in a pipelined fashion without incurring the 802.11-related overheads of multiple independent channel accesses, we specify a slightly modified version of the 802.11 MAC, called data driven cut-through multiple access (DCMA) that uses multiprotocol label switching (MPLS)-like labels in the control packets, in conjunction with a combined ACK/RTS packet, to reduce 802.11 channel access latencies. Our proposed technique can be used in combination with "frame bursting" as specified by the IEEE 802.11e standard to provide an end-to-end cut-through channel access. Using extensive simulations, we compare the performance of DCMA with 802.11 DCF MAC with respect to throughput and latency and suggest a suitable operating region to get maximum benefits using our mechanism as compared to 802.11

The session initiation protocol (SIP) has been widely adopted for instant messaging (IM) and VoIP telephony both by the enterprise and in service provider systems. Till now, SIP functionality has been accessible to end-users primarily via computing platforms such as an IM client on a laptop or on communication platforms such as an IP phone or a cell phone. We show that wearable devices such as the IBM Linux Watch (WatchPad/spl trade/) can play a powerful role as a control device in a SIP infrastructure, given their easily accessible, always available, and visible user-interfaces. We have designed and prototyped several key control applications, using a SIP User Agent on the WatchPad, such as the ability to initiate and route incoming and outgoing phone calls, receive simple queries as instant messages, and call initiation based on address books residing on wearable devices. We discuss other examples such as video conferencing and the authentication layer for workflow. Our investigation and implementation shows that wearable devices can plug an important gap and significantly enhance user experience.

Application-level protocol abstraction is required to support seamless mobility in next generation heterogeneous wireless networks. Session initiation protocol (SIP) provides such an abstraction in providing mobility support in such networks. However, the handoff procedure with SIP suffers from undesirable delay and hence packet loss for some cases, which is detrimental to applications such as voice over IP (VoIP) or streaming video with stringent quality of service (QoS) requirements. In this paper, we propose a SIP based architecture that supports soft handoff for IP centric wireless networks alleviating the problem of packet loss. The proposed architecture ensures that there is no packet loss and the end-to-end delay jitter is kept under control, thus maintaining two important parameters dictating the QoS for streaming multimedia applications

Ad-hoc wireless networks with multi-rate radios (such as 802.11a, b, g) require a new class of MAC/PHY aware metrics that take into account factors such as physical-layer link speed and MAC-layer channel congestion. Conventional "layer 3" ad-hoc routing algorithms typically make routing decisions based on the minimum hop-count (MH). Use of the MH metric leads to the selection of paths with few hops, but one or more of these hops may turn out to be low-speed radio links due to adaptive rate selection at the physical layer We investigate a new cross-layer routing metric that takes into account both physical layer link speed and estimated channel congestion, thus aiming to minimize end-to-end delay that includes both transmission and access times. The proposed "PARMA" routing metric thus helps to spread the traffic across the "good links and nodes" in the network, increasing network capacity and reducing packet loss and delay. The paper presents the design and implementation of the proposed PARMA metric for proactive ad-hoc routing protocols, such as DSDV. DSDV modifications for incorporating the MAC/PHY aware metric into an ns-2 simulation model are given. Simulation results for typical multi-rate 802.11 ad-hoc network scenarios show that the proposed cross-layer PHY/MAC aware metric achieves significantly higher network throughput and decreases network congestion by selecting paths with high bit-rate links, while also avoiding areas of MAC congestion.

This paper presents the detailed design and performance analysis of MACA-P, a RTS/CTS based MAC protocol, that enables simultaneous transmissions in wireless mesh networks. The IEEE 802.11 DCF MAC prohibits any parallel transmission in the neighborhood of either a sender or a receiver (of an ongoing transmission). MACA-P is a set of enhancements to the 802.11 MAC that allows parallel transmissions in situations when two neighboring nodes are either both receivers or transmitters, but a receiver and a transmitter are not neighbors. The performance of MACA-P in terms of system throughput is obtained through a simulation of the protocol using ns and is compared with the 802,11 RTS/CTS MAC. Experiments with the base MACA-P protocol reveal the need for certain enhancements, especially to avoid the drawbacks associated with attempts at parallel transmissions in scenarios where such parallelism is not feasible. Studies with the enhanced MACA-P protocol also demonstrate how significant performance gains in wireless mesh network performance may be realized if the radio transceiver behavior is modified in tandem with the MAC protocol.

Session initiation protocol (SIP) is being widely adopted for VoIP, IM and other collaborative applications due to its simple yet rich functional design. However, one of the main drawbacks has been its per-application deployment (each application using its own SIP stack), leading to narrowly focused development of SIP based services. In this paper, we propose a client-side SIP service and supporting network infrastructure blocks that provide unified mechanisms to execute generic SIP functions. The composition of these building blocks allows for creating richer applications, e.g. a conferencing server coupled with a gaming server provides dynamic conferencing between current occupants of a game room. The main feature of our framework is its availability to all applications including the ones not inherently based on SIP. Also, the SIP service API is designed to be extensible and in addition to providing novel higher level functional primitives like adhoc conferencing and seamless transition of sessions, it also exports a low level interface for specialized applications. Another feature of the service is that it allows a user to plug-in an end device of his/her choice on a per-session basis. We demonstrate the richness of the API by describing prototypes for enhancing various applications as well as new converged applications.

Access to data services via wireless LANs at private (e.g., corporations or home) and public "hot-spot" (e.g., hotels and airports) setting is becoming a common place daily. Data access via (for profit) public wireless LAN (PWLAN) installations is typically based on user subscription and preconfigured services profiles pertaining primarily access to the global Internet. The goal of the ts-PWLAN project is to define an architecture and a prototype implementation that enables the provision of premium and non-premium tiers of services to transient and non-transient users. ts-PWLAN provides for dynamic renegotiations of tier of services and enables various billing modes, e.g., based on connectivity time and usage, thus enabling service providers to increase their revenue opportunities via multiple service offerings.

This paper presents the initial design and performance study of MACA-P, a RTS/CTS based MAC protocol that enables simultaneous transmissions in multihop ad-hoc wireless networks. Providing such low-cost multihop and high performance wireless access networks is an important enabler of pervasive computing. MACA-P is a set of enhancements to the 802.11 DCF that allows parallel transmissions in many situations when two neighboring nodes are either both receivers or both transmitters, but a receiver and a transmitter are not neighbors. Like 802.11, MACA-P contains a contention-based reservation phase prior to data transmission. However, the data transmission is delayed by a control phase interval, which allows multiple sender-receiver pairs to synchronize their data transfers, thereby avoiding collisions and improving system throughput.

This paper considers the problem of handoff management in an Integrated Services Packet Network supporting mobile hosts. In such a network, links may become overloaded due to a high concentration of mobile hosts within a given cell. As a result, the required Quality of Service guarantees cannot be provided to allows in that cell. However, there exist adaptive applications which can operate over a wide range of available bandwidth. Thus, it may be possible to overcome the link overload condition by reducing the bandwidth of individual rows, which we call rate adaptation. The two most important properties of a rate adaptation scheme are its network overhead and its fairness property. Rate adaptation schemes which ensure certain fairness properties, such as maxmining optimality criteria, have very high network overhead. Therefore, these schemes are not suitable for a highly mobile environment where rate adaptation may have to be invoked frequently. In this paper, we investigate the tradeoff between the network overhead and the fairness property of rate adaptation in a mobile environment. We first characterize the fairness property of rate adaptation by several measurable parameters. We then describe two rate adaptation schemes, one of which has very low network overhead but is `unfair', while the other scheme is `fair' but has a very high network overhead. Finally, we propose a new rate adaptation scheme which reconciles the two conflicting properties. Results of simulation experiments comparing the performances of the three rate adaptation schemes are presented.

This paper considers the support of real-time applications to mobile hosts in an integrated services packet network. We have proposed a service model for mobile hosts that can support adaptive applications which can withstand a wide range of available bandwidth, as well as applications which require mobility independent service guarantees. We describe an admission control scheme and a reservation protocol for implementing this service model. Our admission control scheme achieves high utilization of network resources.

This paper deals with multicasting in an internetwork with mobile hosts, particularly with regard to mobile-IP and distance vector multicast routing (DVMRP) protocols. When the source of a multicast datagram is a mobile host (MH), the datagram may not reach all group members to which the datagram is addressed, including other mobile hosts. When the source is a static host and the multicast group includes mobile hosts, a mobile group member may receive datagrams in one cell but not in another. Further when a MH enters a cell which contains no other member of the same group, the MH will experience a delay before it starts receiving datagrams addressed to that group. Mobility between campuses which result in a MH acquiring an additional unicast address, also has an effect on multicast routing. We propose enhancements to DVMRP executed at the mobility support routers (MSR) that ensure correct forwarding of multicast datagrams to and from mobile hosts. Our solutions do not require any change at hosts and routers unaware of mobility, i.e. the modifications are limited to MSRs and MHs. We also describe an implementation incorporating a subset of our proposals. Lastly, we show that alternate styles of multicasting or mobile networking, viz. link-state (MOSPF) and IETF proposal, will face similar problems and our proposed solutions are still valid in their context.

Distributed algorithms have hitherto been designed for networks with static hosts. A mobile host (MH) can connect to the network from different locations at different times. This paper presents an operational system model for explicitly incorporating the effects of host mobility and proposes a general principle for structuring efficient distributed algorithms in this model. This principle is used to redesign two classical algorithms for distributed mutual exclusion for the mobile environment. We then consider a problem introduced solely by host mobility viz, location management for groups of MHs, and propose the concept of group location as an efficient approach to tackle the problem. Lastly, we present a framework which enables host mobility to be decoupled from the design of a distributed algorithm per se, to varying degrees.>

There is a strong trend toward integrating portable computers within existing data networks. Traditional network protocols were designed assuming a static view of network connectivity. A mobile host can connect to the network from different locations at different times. This has led to the emergence of a new set of problems with regard to addressing schemes and network protocols for accommodating mobility within existing networks. The authors present a protocol for delivering a multicast message exactly once to a group of mobile destinations. The protocol is based on a system model derived from an architecture developed by J. Ioannidis et al. (1991), for mobile internetworking, relying on mobile support stations within the fixed network to communicate with mobile hosts.>