We present dAuth, an approach to device authentication in private cellular networks which refactors the responsibilities of authentication to enable multiple small private cellular networks to federate together to provide a more reliable and resilient service than could be achieved on their own. dAuth is designed to be backwards compatible with off-the-shelf 4G and 5G cellular devices and can be incrementally deployed today. It uses cryptographic secret sharing and a division of concerns between sensitive data stored with backup networks and non-sensitive public directory data to securely scale authentication across multiple redundant nodes operating among different and untrusted organizations. Specifically, it allows a collection of pre-configured backup networks to authenticate users on behalf of their home network while the home network is unavailable. We evaluate dAuth's performance with production equipment from an active federated community network, finding that it is able to work with existing systems. We follow this with an evaluation using a simulated 5G RAN and find that it performs comparably to a standalone cloud-based 5G core at low load, and outperforms a centralized core at high load due to its innate load-sharing properties.

In this paper we introduce CoLTE, a solution for LTE-based community networks. CoLTE is a lightweight, Internet-only LTE core network (EPC) designed to facilitate the deployment and operation of small-scale, community owned and operated LTE networks in rural areas with limited and unreliable backhaul. The key differentiator of CoLTE, when compared to existing LTE solutions, is that in CoLTE the EPC is designed to be located in the field and deployed alongside a small number of cellular radios (eNodeBs), as opposed to the centralized model seen in large-scale telecom networks. We also provide performance results and lessons learned from a real-world CoLTE network deployed in rural Indonesia. This network has been sustainably operating for over six months, currently serves over 40 active users, and provides measured backhaul reductions of up to 45% when compared to cloud-core solutions.

We will introduce and demonstrate CoLTE, an all-in-one solution for LTE-based community networks. CoLTE is a lightweight, Internet-only LTE core network (EPC) based on OpenAirInterface. CoLTE is designed to facilitate the deployment and operation of small-scale, community owned and operated LTE networks, with a particular eye towards expanding Internet access into rural areas with limited and unreliable backhaul. CoLTE comes paired with a basic, IP-based network manager called Haulage, as well as basic locally-hosted webservices. The key differentiator of CoLTE, when compared to existing LTE solutions, is that in CoLTE the EPC is designed to be located in the field and deployed alongside a small number of cellular radios (eNodeBs), as opposed to the centralized model seen in large-scale telecom networks.

The radio interfaces and network architectures of WiFi and cellular systems are converging along many dimensions. While both systems are largely adopting the centralized architecture of traditional cellular deployments, this design comes with fundamental disadvantages that limit how these networks grow and develop. As a response, we present Distributed LTE (dLTE), an architecture offering the high radio performance of licensed and coordinated waveforms as well as the openness to organic expansion and growth of traditional WiFi. We challenge the assumption that good performance requires a centralized packet processing core, and propose hybrid approaches to coordination that prioritize system openness. We argue that dLTE is a particularly good fit for rural areas, where the LTE waveform is more appropriate than WiFi, yet it is uneconomical for centralized providers to deploy traditional cellular systems.

The de facto approach to Web security today is HTTPS. While HTTPS ensures complete security for clients and servers, it also interferes with transparent content-caching at middleboxes. To address this problem and support both security and caching, we propose a new approach to Web security and privacy called GroupSec. The key innovation of GroupSec is that it replaces the traditional session-based security model with a new model based on content group membership. We introduce the GroupSec security model and show how HTTP can be easily adapted to support GroupSec without requiring changes to browsers, servers, or middleboxes. Finally, we present results of a threat analysis and performance experiments which show that GroupSec achieves notable performance benefits at the client and server while remaining as secure as HTTPS.

We introduce a simple solution for the support of host mobility in the Internet called DIME (Dynamic Internet Mobility for End- Systems). DIME is based on dynamic address translation between the transport and network layers of end hosts, combined with a new out-of-band protocol that updates host-address bindings between communicating hosts opportunistically. It does not require modifications to the end-host operating systems, end-user applications, existing communication protocols or hardware, or the domain name system and any host-identifier namespace. A number of experiments based on a Linux daemon implementation of DIME are used to show that DIME is deployable on a wide range of hardware, and that it outperforms existing mobility proposals such as MIPv6 and HIP across a wide range of performance metrics.

All currently-implemented and proposed future architectures assume a layered design wherein the identifiers used by a particular layer are propagated up the stack and exposed to higher layers. We argue that these higher-layer exposures and bindings are the root of a large number of problems today, and present significant roadblocks to the evolution and deployment of future network architectures tomorrow. We address these problems by proposing a novel network architecture based around identifier indirection and translation between layers of the stack, and show how such an architecture (1) provides an attractive solution to problems today such as mobility and multi-homing by injecting additional flexibility into the existing network stack, (2) can be used to support the goals of future internet architecture (i.e. service-or information-centricity) within the existing network stack, and (3) relieves the ossification of the network stack and enables the incremental deployment of new protocols and layers.

The IP Internet architecture is such that applications must bind fixed IP addresses and ports before any other operations can be executed. These early bindings cause bottlenecks, reliability issues, and force applications and protocols to manage complex lower-layer issues. This poses a big challenge to the future of the IP Internet, given the large and growing numbers of nomadic Internet users, the shift in Internet usage from centralized servers to peer-to-peer content sharing, and the popularity of service replication and virtualization. To address these issues, we introduce and evaluate HIDRA (Hidden Identifiers for Demultiplexing and Resolution Architecture), a novel architecture that creates indirection between layers of any network stack. HIDRA enables sockets and protocols to evolve with the IP Internet by hiding all mobility, multihoming, and multiplexing issues from applications, does not induce significant overhead in the protocol stack, preserves backwards compatibility with today's Internet and applications, and does not require or preclude any additional identifiers or protocols to be used in the protocol stack.

Today's socket API requires an application to bind a socket to a network address before it can use the socket to communicate. Early bindings of names to addresses create significant bottlenecks, reliability problems, and force applications to manage complex lower-layer issues. Many approaches have been introduced to address this problem; however, all prior proposals introduce additional identifiers, modify applications, or require additional protocols in the protocol stack. In contrast, we propose a generalized socket API based on Internet Resource Descriptors (IRDs), which are opaque identifiers used by applications to refer to network resources and are known only within the hosts in which the applications run. IRDs enable sockets to evolve with the Internet by hiding mobility, multihoming, and multiplexing issues from applications, do not induce significant overhead in the protocol stack, preserve backwards compatibility with today's networks and applications, and do not require additional identifiers or protocols to be used in the protocol stack.

Many telecom, customers have applications with time varying reliability requirements. However, current for a service-level agreement (SLA) frameworks provide the same reliability during the entire holding time, rather than providing high reliability only when required. Recent papers describe the need for time-differentiated resilience and establish an SLA framework to support this using Critical Windows (CW). CWs are scheduled, regularly repeating time periods where additional resilience is required. We expand the previous work to a more general and dynamic network setting and further investigate the structural properties of critical windows. We propose and evaluate first an algorithm for CW-aware path assignment in mesh telecom networks, and then a CW-aware algorithm that also employs Shared-Path Protection (SPP). Our study shows: 1) that CWs provide a substantial performance improvement in mesh networks; 2) CW performance gain is insensitive to several network parameters; and 3) CWs can be implemented on top of generic SPP to provide even better performance.