Service function chaining (SFC) establishes a service path where a sequence of functions is executed according to service requirements. However, SFC lacks a mechanism to ensure proper traversal of relay nodes in the data plane. Misconfigurations and the presence of attackers can lead to forwarding anomalies and path deviation, potentially allowing packets to bypass security network functions in the service path. To mitigate potential security breaches, ordered proof of transit (OPoT) has been proposed as a mechanism to verify whether traffic adheres to the designated path. In this paper, we realize lightweight OPoT-based path verification based on extended Berkeley Packet Filter (eBPF) for trustworthy SFC. Furthermore, by integrating it with the existing SFC proxy, we extend the proposed approach to accommodate both SFC-aware and SFC-unaware virtual network functions (VNFs) in the segment routing over IPv6 data plane (SRv6) domain. Through experiments, we demonstrate the capability of the proposed approach to detect path deviations. Additionally, we reveal the performance limitations of the proposed approach.

Integrating machine learning (ML) into kernel packet processing, such as extended Berkeley Packet Filter (eBPF) and eXpress Data Path (XDP), represents a promising strategy for achieving fast and intelligent networking on generic hardware. This includes tasks like automating network operations and discerning traffic classification, exemplified by intrusion detection systems (IDS) combining Decision Tree (DT) and eBPF. However, the potential of ML-empowered packet processing remains to be fully explored. To ensure the integrity and security of kernel operations, eBPF/XDP programs must adhere to stringent constraints such as the maximum number of jump instructions, maximum stack space, and exclusion of floating-point arithmetic. These constraints pose challenges for implementing more intricate ML techniques (e.g., neural networks (NNs)) within eBPF/XDP programs. In such scenarios, AF_XDP provides an alternative solution by allowing XDP programs to redirect packets to user-space applications, bypassing the network stack. This paper initiates an exploration into fast packet classification through two distinct approaches: (1) an in-kernel approach employing eBPF/XDP and (2) a user-space approach assisted by AF_XDP. Specifically, to tackle the eBPF constraints, the in-kernel NN classifier adopts (1) quantization of trained model in the user space, (2) executing the integer-arithmetic-only NN within the kernel space, and (3) sequential layer operations through tail calls. These approaches are evaluated based on factors including packet processing speed, resource efficiency, and detection performance. Notably, our experimental findings demonstrate that (1) Classifiers relying solely on integer arithmetic, such as NN and DT, significantly reduce inference time while maintaining binary classification performance; (2) The lightweight NN classifier can improve the detection performance for most of attacks in case of the multi-class classification compared to the lightweight DT classifier; (3) In single-core scenarios, the DT-empowered in-kernel method can almost achieve the maximum packets per second (pps), i.e., about 800,000 pps, whereas the NN-empowered one exhibits lower pps (i.e., about 450,000 pps); (4) In multi-core scenarios, the NN-empowered packet processing can almost achieve the maximum pps with two or more cores in the AF_XDP approach and four or more cores in the in-kernel approaches.

To achieve sustainable networking, network service providers have expressed significant interest in employing automated network operations that integrate network functions virtualization (NFV), software-defined networking (SDN), and machine learning (ML). In the context of NFV/SDN, a certain network service is regarded as a sequence of virtual network functions (VNFs) forming a service chain. The service chaining (SC) problem aims at establishing an appropriate service path from an origin node to a destination node where the VNFs are executed at intermediate nodes in the required order under resource constraints on nodes and links. SDN enables programmable configurations on forwarding devices (i.e., switches and routers) for traffic forwarding between VNFs. In our previous work, we formulated the SC problem as an integer linear program (ILP) based on the capacitated shortest path tour problem (CSPTP), which is an extended version of SPTP with additional node and link capacity constraints. Furthermore, we developed Lagrangian heuristics to solve the problem by considering the balance between optimality and computational complexity. In this paper, we propose a deep reinforcement learning (DRL) framework coupled with the graph neural network (GNN) to realize CSPTP-based SC that adapts to changes of service demand and/or network topology. Numerical results show that the proposed framework achieves nearly optimal SC with higher learning speed compared to the conventional deep Q-Network based approach. Moreover, it performs well when confronted with variations in service demand and exhibits competitive performance compared to the ILP solutions across the majority of 243 real-world topologies.

Network functions virtualization (NFV) realizes diverse and flexible network services by executing network functions on generic hardware as virtual network functions (VNFs). A certain network service is regarded as a sequence of VNFs, called service chain. The service chaining (SC) problem aims at finding an appropriate service path from an origin node to a destination node while executing the VNFs at the intermediate nodes in the required order under resource constraints on nodes and links. The SC problem belongs to the complexity class NP-hard. In our previous work, we modeled the SC problem as an integer linear program (ILP) based on the capacitated shortest path tour problem (CSPTP) where the CSPTP is an extended version of the SPTP with the node and link capacity constraints. We also developed the Lagrangian heuristics to achieve the balance between optimality and computational complexity. In this paper, we further propose a deep reinforcement learning (DRL) framework with the graph neural network (GNN) to realize the CSPTP-based SC adaptive to changes in service demand and/or network topology. Numerical results show that (1) the proposed framework achieves almost the same optimality as the ILP for the CSPTP-based SC and (2) it also works well without retraining even when the service demand changes or the network is partly damaged.

Network functions virtualization (NFV) can flexibly deploy diverse network services by liberating network functions from traditional network appliances and executing them as virtual network functions (VNFs) on generic hardware. A certain network service can be represented by a service chain, which consists of VNFs in required order. The service chaining problem is finding a suitable service path from the origin to the destination such that the VNFs are executed at the intermediate nodes in the required order under the resource constraints, which belongs to the complexity class NP-hard. In our previous work, considering the similarity between the service chaining problem and the shortest path tour problem (SPTP), we formulated the service chaining as the capacitated SPTP (CSPTP) based ILP, where CSPTP is an extended version of the SPTP with the node and link capacity constraints. In this paper, to address both computational complexity and optimality of resource allocation, we propose Lagrangian heuristics to solve the CSPTP-based ILP especially for the online service chaining. Through simulation results, we show that the proposed algorithm almost achieves the optimal resource allocation with much smaller execution time compared with the existing solver, CPLEX.

Blockchain-based access control (BBAC) has been highly promising to prevent unauthorized resource access in the Internet of Things (IoT). However, maintaining BBAC can be potentially expensive due to the storage cost of the blockchain. To address this issue, we propose a layered BBAC architecture by combining blockchain with blockchain oracle and tamper-proof decentralized storage (e.g., IOTA). The proposed architecture consists of three main layers: a blockchain layer, which provides distributed and trustworthy access control, a storage layer, which stores meta data (e.g., subject/object attributes and policies) used in the access control of the blockchain layer, and an oracle layer, which works as a bridge to help transfer data between the blockchain and decentralized storage. This architecture achieves robust, auditable, and cost-efficient access control by migrating the meta data from the blockchain to the decentralized storage while keeping the fascinating tamper-proof feature of the blockchain. We implement and evaluate this architecture in terms of time and monetary cost to demonstrate its feasibility and superiority over existing ones.

Efficient and reliable access control in smart cities is critical for the protection of various resources for decision making and task execution. Existing centralized access control schemes suffer from the limitations of single point of failure, low reliability, and poor scalability. This article, therefore, proposes a distributed and reliable access control framework for smart cities by combining the blockchain smart contract technology and the attribute-based access control (ABAC) model. The framework consists of one policy management contract (PMC) for managing the ABAC policies, one subject attribute management contract (SAMC) for managing the attributes of subjects (i.e., entities accessing resources), one object attribute management contract (OAMC) for managing the attributes of objects (i.e., resources being accessed), and one access control contract (ACC) for performing the access control. To show the feasibility of the proposed framework, we construct a local private Ethereum blockchain system to implement the four smart contracts and also conduct experiments to evaluate the monetary cost as well as to compare the proposed framework with an existing access control list (ACL)-based scheme. The experimental results show that although the proposed scheme consumes more money than the ACL-based scheme at the deployment stage, it introduces less monetary cost during the system running especially for large-scale smart cities.

Network functions virtualization (NFV) is a new paradigm to achieve flexible and agile network services by decoupling network functions from proprietary hardware and running them on generic hardware as virtual network functions (VNFs). In the NFV network, a network service can be modeled as a sequence of VNFs, called a service chain. Given a connection request (e.g., origin, destination, and a sequence of required functions), we have to solve both the service chaining and function placement problems to find an appropriate service path that optimizes the objective (e.g., minimization of the total path delay) while satisfying the service chain requirements. In this article, focusing on the similarity between the service chaining problem and the shortest path tour problem (SPTP) and developing the novel network model called augmented network, we formulate capacitated SPTP-based integer linear programs (ILPs) for the service chaining and function placement. Through numerical results obtained by the existing solver, we show the proposed ILP for the service chaining can support 1.22-1.90 times as large-scale systems as the existing ILP. Furthermore, we also demonstrate that the proposed ILP for both the service chaining and function placement can shorten the total delay by 15.8% compared with that only for the service chaining. For further scalability, we propose a shortest-path-based heuristic algorithm to solve the ILPs and show the heuristic for service chaining and function placement can calculate the optimal solution with high accuracy in strongly polynomial time.

Periodic update of software is one of preventive measures against malicious attacks. When the software is used by many users, e.g., Operating System (OS), the distribution server for update tends to be a bottleneck. To tackle this problem, several systems, e.g., Windows update, recently apply Peer-to-Peer (P2P) file distribution where clients called peers upload retrieved fragments of the whole content, i.e., pieces, to other peers. However, some peers will not be willing to upload pieces to others, which are called free riders, due to communication overhead. Tit-for-Tat (TFT) strategy in game theory can alleviate such free riding behavior by encouraging equivalent exchange of pieces among each pair of peers. In recent years, the optimality of P2P file distribution under strict TFT constraint has been analyzed. In this paper, considering the fact that the communication overhead inside a group, e.g., LAN or AS, is much less than that between different groups, we consider the locality-aware TFT-based P2P file distribution where the TFT constraint is relaxed for intra-group communication. We find that the minimization of average file download time in the relaxed TFT-based P2P file distribution can also be modeled as Integer Linear Programming (ILP), as in the existing work. Through numerical results, we show that the relaxed TFT model contributes to shortening the average file download time among peers by about 18.3% compared with the strict TFT-based model.

Network functions virtualization (NFV) is a new paradigm to achieve flexible and agile network services by decoupling network functions from proprietary hardware and running them on generic hardware as virtual network functions (VNFs). In the NFV network, a certain network service can be modeled as a sequence of VNFs, called a service chain. Given a connection request (origin node, destination node, and service chain requirement, which is a sequence of functions), the service chaining problem aims to find an appropriate service path, which starts from the origin and ends with the destination while executing the VNFs at the intermediate nodes in the required order. Some existing work noticed that the service chaining problem was similar to the shortest path tour problem (SPTP). To the best of our knowledge, this is the first work that exactly formulates the service chaining problem as an SPTP-based integer linear program (ILP). Through numerical results, we show the SPTP-based ILP can support 1.30-1.77 times larger scale systems than the existing ILP.

The large-scale and trustless nature of the Internet of Things (IoT) calls for distributed and trustworthy access control schemes to prevent unauthorized resource access. This paper proposes a Capability-Based Access Control (CapBAC) scheme by applying the emerging Ethereum blockchain technology. This scheme uses Ethereum smart contracts, i.e., executable codes residing in the blockchain, to store and manage the capability tokens, i.e., special data structures that maintain the allowed actions of a user (i.e., subject) on a certain resource (i.e., object). To provide more fine-grained access control and more flexible token management, this scheme defines capability tokens in units of actions, i.e., by dividing a conventional capability token containing multiple actions into multiple ones with each being associated with a certain action. In addition, this scheme uses a delegation graph instead of the delegation tree in existing smart contract-based CapBAC schemes to store the token delegation relationship among the subjects. By storing the tokens and the delegation graph in smart contracts, this scheme allows object owners to verify the ownership and validity of the capability tokens of the subjects. To demonstrate the feasibility of the scheme, we constructed a local Ethereum blockchain network and conducted extensive experiments.

Access control has been recognized as a critical issue for preventing unauthorized access to the resources in Internet of Things (IoT) systems. This paper proposes an Attribute-Based Access Control (ABAC) framework for IoT systems by using the emerging Ethereum smart contract technology. The framework consists of one Policy Management Contract (PMC), one Subject Attribute Management Contract (SAMC), one Object Attribute Management Contract (OAMC) and one Access Control Contract (ACC). The PMC, SAMC and OAMC are responsible for storing and managing the ABAC policies, the attributes of subjects (i.e., entities accessing resources) and the attributes of objects (i.e., resources being accessed), respectively. When receiving access requests, the ACC retrieves the subject attributes and object attributes as well as the corresponding policy from the SAMC, OAMC and PMC to perform the access control. Combining the ABAC model and the blockchain technology, this framework is expected to achieve distributed, trustworthy and fine-grained access control for IoT systems. To show the feasibility of the proposed framework, we construct a local private Ethereum blockchain system to implement the four smart contracts and also conduct experiments to test the monetary and time cost.

In this paper, we consider a data-flow management mechanism for data center networks, in which a centralized controller called arbiter manages data flows. We propose a simple algorithm for the arbiter to distribute flows over different time points and paths, in a preemptive scheduling and traffic load-balancing manner. The proposed algorithm is based on table-driven resource reservation, in which states of all the links in a data-center network are registered in a single table, and its information is updated whenever a new flow-request arrives at the arbiter. We evaluate the performance of the proposed algorithm through simulation experiments, investigating bit allocation rate and flow allocation rate, under different flow-size distributions. Numerical results show that the proposed algorithm can achieve high bit allocation rate without collisions. It is also shown that the proposed algorithm can allocate many flows within a small time interval even when the variance of flow-size is large.

In sparsely populated mobile ad hoc networks (MANETs), mobile nodes are chronically isolated each other and they meet very occasionally. Global clock synchronization among nodes in such networks is a challenging problem because reference clock information cannot be disseminated promptly over nodes due to the lack of stable connections among nodes. In recent years, averaging-based algorithms for distributed global clock synchronization have been studied. In this paper, we conduct the continuous-time analysis of the simplest one, called the simple averaging scheme, where two mobile nodes exchange their local clock times when they meet and adjust their own clocks to the average of them. Through the analysis and simulation experiments, we reveal how the clock accuracy of nodes and meeting rates among them affect the rate of convergence to the steady state and the accuracy of clock synchronization in steady state.

In delay tolerant networks (DTNs), custody transfer mechanism provides reliable end-to-end data transfer in which special nodes (custodians) transfer data with custody in a hop-by-hop manner. As a result, storage congestion occurs when data with custody increases and/or the network is partitioned into multiple sub-networks for a long time. The storage congestion can be alleviated with the help of message ferries. In such a scenario, data should be aggregated to some custodians so that message ferries can effectively collect them. In this paper, we propose a scheme to aggregate data into selected custodians, called aggregators, in a fully distributed and autonomous manner by using evolutionary game theoretical approach where we can also control the number of aggregators to a desired value.

With the wide spread of mobile devices, information discovery methods over mobile ad hoc networks (MANETs) are required. Recent studies have revealed that integrating a distributed hash table (DHT) substrate and network-layer routing can increase search efficiency. Furthermore, some researchers have proposed a clustering method which groups the overlay nodes according to their physical distance. However, it has also been pointed out that the search efficiency deteriorates in highly dynamic environments. In this paper, we propose a method sharing pointers among nodes in a cluster. Through simulation experiments, we show that the proposed method improves the success ratio of object search up to 40 % compared with existing method.

In a P2P file-sharing system, a node finds and retrieves its desired file. If multiple nodes cache the same file to provide others, we can achieve a file-sharing system with low latency and high file availability. However, a node has to spend costs, e.g., processing load or storage capacity, on caching of a file. Consequently, a node may selfishly behave and hesitate to cache a file. In such a case, there is a possibility that unpopular files disappear from the system. In this paper, we aim to accomplish effective caching in the whole system that emerges from autonomous and selfish node behavior. We first discuss relationship between selfish node behavior and system dynamics according to evolutionary game theory. As a result, we show that a file-sharing system can be robust to file disappearance depending on a cost and demand model for caching even if nodes behave selfishly.

Since a peer searches for its desired file in a P2P file sharing system, the structure of an overlay network determines the effectiveness of search. In this paper, based on the Barabasi-Albert (BA) model, we propose a novel scheme (LLR) to construct a low-diameter and location-aware overlay network where peers can easily find physically-close file holders. LLR has a rewiring method to improve the structure of an overlay network and a recovery method to cope with disappearance of peers. Through several simulation experiments using real physical topologies, we found that LLR could construct an overlay network that had the higher reachability than BA and the higher correlation between physical and logical distances

With the growth of computing power and the proliferation of broadband access to the Internet, media streaming has widely diffused. Although the proxy caching technique is one method to accomplish effective media streaming, it cannot adapt to the variations of user locations and diverse user demands. By using the P2P communication architecture, media streaming can be expected to smoothly react to network conditions and changes in user demands for media-streams. We propose efficient methods to achieve continuous and scalable media streaming system. In our mechanisms, a media stream is divided into blocks for efficient use of network bandwidth and storage space. We propose two scalable search methods and two algorithms to determine an optimum provider peer from search results. Through several simulation experiments, we show that the FLS method can perform continuous media play-out while reducing the amount of search traffic to 1/6 compared with full flooding.