Data spaces are an emerging concept with significant potential to enable a data-centric economy by fostering seamless and secure data sharing across diverse stakeholders. These environments are designed to unlock the value of data by ensuring interoperability and collaboration, which are essential for innovation and informed decision-making. However, managing access control in data spaces poses unique challenges, as it must account for complex relationships not only among stakeholders but also among data items themselves, requiring a flexible and context-aware approach. To this end, in this paper we present the design, implementation, and evaluation of an access control solution tailored for data spaces. Our solution leverages the paradigm of Relationship-Based Access Control (ReBAC), enabling the definition and enforcement of access control policies that consider the relationships between entities within the data space, as well as data consumer organisational structures. Furthermore, we propose a distributed version of our solution to facilitate the segregation of access control management across different administrative domains. Our approach supports fine-grained, continuous access control by dynamically evaluating the context of both the protected data items and the consumers of the data space. To ensure compatibility with existing data-sharing standards, we have integrated our solution with ETSI NGSI-LD API, a standardised interface for interacting with data spaces.

Biometric authentication has become integral to digital identity systems, particularly in smart cities where it enables secure access to services across governance, transportation, and public infrastructure. Centralised architectures, though widely used, pose privacy and scalability challenges due to the aggregation of sensitive biometric data. Decentralised identity frameworks offer better data sovereignty and eliminate single points of failure but introduce new security concerns, particularly around mutual trust among distributed devices. In such environments, biometric sensors and verification agents must authenticate one another before sharing sensitive biometric data. Existing authentication schemes rely on classical public key infrastructure, which is increasingly susceptible to quantum attacks. This work addresses this gap by proposing a quantum-secure communication protocol for decentralised biometric systems, built upon an enhanced Quantum Key Distribution (QKD) system. The protocol incorporates quantum-resilient authentication at both the classical and quantum layers of QKD: post-quantum cryptography (PQC) is used to secure the classical channel, while authentication qubits verify the integrity of the quantum channel. Once trust is established, QKD generates symmetric keys for encrypting biometric data in transit. Qiskit-based simulations show a key generation rate of 15 bits/sec and 89% efficiency. This layered, quantum-resilient approach offers scalable, robust authentication for next-generation smart city infrastructures.

The proliferation of Internet of Things (IoT) devices that operate unattended providing a multitude of important and often sensitive services highlights the need for seamless interoperability and increased security. We argue that digital twins of IoT devices, with the right design, can enhance the security, reliability, auditability, and interoperability of IoT systems. The salient features of digital twins have made them key elements for the IoT and Industry 4.0. In this paper, we leverage advances in W3C's Web of Things (WoT) standards and Distributed Ledger Technologies (DLTs) to present a novel design of smart contract-based digital twins with enhanced security, transparency, interoperabilty, and reliability. We provide two different variations of that general design using two different blockchains (one public and one private, permissioned blockchain), and we present design trade-offs. Furthermore, we introduce an architecture for accessing and controlling IoT devices securely, reliably, providing full auditability, while at the same time using the proposed digital twins as an indirection mechanism (proxy). The proposed architecture leverages the blockchain to offer notable properties, namely, decentralization, immutability, auditability, non-repudiation, availability, and reliability. Moreover, it introduces mass actuation, easier management of IoT devices, enhanced security to the IoT gateways, it enables new business models, and it makes consumer devices (vendor-)agnostic.

Emerging energy management systems (EMS) involve devices and services provided by multiple stakeholders. In order to improve the interoperability of these systems, state of the art efforts propose an interoperability middleware that mediates the communication between end-user applications and EMS components. The potential lack of trust between the different stakeholders raises the need for fine-grained access control mechanisms. However, extending the middleware to support access control in a secure and usable way is a challenging problem. In this paper, we present a solution that achieves fine-grained authorization using Verifiable Credentials (VCs). Our solution leverages VC properties to enable end-users to combine authorizations issued by different entities. Additionally, our solution integrates a cloud-based VC wallet that hides the authorization process from end-user applications, thus facilitating interoperability among EMSes and the development of new, secure applications.

The proliferation of Internet of Things (IoT) devices and applications that need to cooperate unattended highlights the need for seamless interoperability and intrinsic security. We argue that Distributed Ledger Technologies (DLTs), due to their decentralized nature, transparent operations, immutability, and availability, can enhance the security, reliability, and interoperability of such IoT systems. In this paper, we advance the integration of W3C's Web of Things (WoT) standards with DLTs and smart contracts, introducing smart contracts as “Digital Twins” of (physical) devices, or whole Cyber-Physical subsystems. Namely, we introduce a DLT-based architecture for controlling devices across federated IoT systems, securely, reliably, and with full auditability. The proposed architecture provides mass actuation and service composition with notable security properties, such as full auditability, transparency, and high availability. Specifically, a single request, with multiple action parameters and conditions, can trigger the reliable and secure actuation of a large number of possibly physically dispersed actuators.

Named Data Networking (NDN) is a realization of the Information-Centric Networking (ICN) paradigm, where routing is based on content identifiers rather than on network location identifiers. The routing state in NDN can grow exponentially, not only due to the huge number of content identifiers (as opposed to network addresses) but also because it is difficult to detect "fake" routing advertisements. For example, in contrast to IP-based routing, a potentially valid routing entry in NDN can be advertised from multiple network locations, making NDN susceptible to Denial-of-Service attacks at the routing layer. In this paper, we leverage Decentralized Identifiers (DIDs) to build self-verifiable "content advertisements." With our solution, any router can verify that a content advertisement originates from an "authorized" entity, without requiring any trusted third party. We implement our solution and we evaluate it in a scenario where filtering is implemented by the edge routers. We show that our solution reduces fake routing advertisements with minimal computational overhead.

We propose a capability-based access control technique for sharing Web resources, based on Verifiable Credentials (VCs) and OAuth 2.0. VCs are a secure means for expressing claims about a subject. Although VCs are ideal for encoding capabilities, the lack of standards for exchanging and using VCs impedes their adoption and limits their interoperability. We mitigate this problem by integrating VCs into the OAuth 2.0 authorization flow. To this end, we propose a new form of OAuth 2.0 access token based on VCs. Our approach leverages JSON Web Tokens (JWT) to encode VCs and takes advantage of JWT-based mechanisms for proving VC possession. Our solution not only requires minimum changes to existing OAuth 2.0 code bases, but it also removes some of the complexity of verifying VC claims by relying on JSON Web Signatures: a simple, standardized, and well supported signature format. Additionally, we fill the gap of VC generation processes by defining a new protocol that leverages the OAuth 2.0 “client credentials” grant.

In IPFS content identifiers are constructed based on the item's data therefore the binding between an item's identifier and its data can be deterministically verified. Nevertheless, once an item is modified, its identifier also changes. Therefore when it comes to mutable content there is a need for keeping track of the “latest” IPFS identifier. This is achieved using naming protocols on top of IPFS, such as IPNS and DNSlink, that map a constant name to an IPFS identifier, allowing at the same time content owners to update these mappings. Nevertheless, IPNS relies on a cryptographic key pair that cannot be rotated, and DNSlink does not provide content authenticity protection. In this paper, we propose a naming protocol that combines DNSlink and decentralized identifiers to enable self-verifiable content items. Our protocol provides content authenticity without imposing any security requirement to DNSlink. Furthermore, our protocol prevent fake content even if attackers have access to the DNS server of the content owner or have access to the content owner secret keys. Our proof of concept implementation shows that our protocol is feasible and can be used with existing IPFS tools.

Service providers usually require detailed statistics in order to improve their services. On the other hand, privacy concerns are intensifying and sensitive data is protected by legislation, such as GDPR (General Data Protection Regulation). In this paper, we present the design, implementation, and evaluation of a marketplace that allows “data consumers” to buy information from “data providers”, which can then be used for generating meaningful statistics. Additionally, our system enables “system operators” that can select which data providers are allowed to provide data, based on filtering criteria specified by the data consumer. We leverage local differential privacy to protect the data provider's privacy against data consumers, as well as against system operators, and we build a blockchain-based solution for ensuring fair exchange, and immutable data logs. Our design targets use cases that involve hundreds or even thousands of data providers. We prove the feasibility of our approach through a proof-of concept implementation of a measurement sharing application for smart-grid systems.

HTTPS enhances end-user privacy and is often preferred or enforced by over-the-top content providers, but renders inoperable all intermediate network functions operating above the transport layer, including caching, content/protocol optimization, and security filtering tools. These functions are crucial for the optimization of integrated satellite-terrestrial networks. Additionally, due to the use of end-to-end and per- session encryption keys, the advantages of a satellite's wide- area broadcasting capabilities are limited or even negated completely. This paper investigates two solutions for authorized TLS interception that involve TLS splitting. We present how these solutions can be incorporated into integrated satellite- terrestrial networks and we discuss their trade-offs in terms of deployment, performance, and privacy. Furthermore, we design a solution that leverages satellite broadcast transmission even in the presence of TLS (i.e. with the use of HTTPS) by exploiting application layer encryption in the path between the satellite terminal and the TLS server. Our findings indicate that even if no other operation than TLS splitting is performed, TLS handshake time, which involves roundtrips through possibly a Geosynchronous satellite, can be reduced by up to 94%. Moreover, by combining an application layer encryption solution with TLS splitting, broadcast transmissions can be exploited as well as proactive caching, content pushing, request aggregation, and other optimizations.

Blockchains and smart contracts are an emerging, promising technology, that has received considerable attention. We use the blockchain technology, and in particular Ethereum, to implement a large-scale event-based Internet of Things (IoT) control system. We argue that the distributed nature of the “ledger,” as well as, Ethereum's capability of parallel execution of replicated “smart contracts”, provide the sought after automation, generality, flexibility, resilience, and high availability. We design a realistic blockchain-based loT architecture, using existing technologies while by taking into consideration the characteristics and limitations of IoT devices and applications. Furthermore, we leverage blockchain's immutability and Ethereum's support for custom tokens to build a robust and efficient token-based access control mechanism. Our evaluation shows that our solution is viable and offers significant security and usability advantages.

We present and evaluate models that allow clients to access IoT resources using secure and trusted device-to-device (D2D) communication, while utilizing smart contracts to obtain the benefits of blockchain technology. These benefits include decentralized trust, immutability, transparency, and high availability. The models consider different network connection capabilities of the clients and the IoT resources, namely continuous network connectivity and D2D-only connectivity. We describe two approaches for utilizing blockchains and smart contracts in the authorization process: in the first approach, only hashes of the authorization information are recorded on the blockchain. In the second approach, a smart contract handles authorization requests. We implement the approaches using the OAuth 2.0 delegated authorization framework and evaluate the implementations on the public Ethereum testnet Rinkeby, in terms of execution cost, contract creation cost, and delay. Our evaluation quantifies the tradeoffs of blockchain cost and smart contract functionality, such as blocking and non-blocking operation, and the reduction of the transaction cost that can be achieved when multiple authorization requests are concatenated in a single transaction.

We present and experimentally evaluate procedures for efficient IoT data collection while achieving target requirements in terms of data accuracy and privacy protection. The procedures adjust the time period between consecutive measurements following an additive increase and multiplicative decrease (AIMD) scheme based on a target data accuracy and add noise to measurements using differential privacy techniques. The experimental evaluation involves real temperature and humidity measurements obtained from two testbeds through the FIESTA-IoT platform. Our results show that the AIMD adaptation of the measurement period is robust to different types of measurements from different testbeds, without having any tuning parameters, and the addition of noise to the sensor measurements using differential privacy has a negligible effect on the aggregate statistics.

We present our recent work investigating how mobility prediction can be exploited for improving the performance of mobile users in two directions: proactive caching requested content close to the network attachment points where a mobile has a high probability to connect to and DASH (Dynamic Adaptive Streaming over HTTP) video quality adaptation. For proactive caching we discuss a new model to proactively cache content based on both mobility prediction and content popularity. An important feature of the model is that it dynamically adapts caching decisions to the relative importance of the two factors. For DASH adaptation we discuss a procedure that exploits mobility and throughput prediction to select the quality levels of video segments requested by a DASH player in order to achieve improved QoE, in terms of both high video quality and few video quality switches.

Over the last decade or so, significant research has focused on defining Quality of Experience (QoE) of Multimedia Systems and identifying the key factors that collectively determine it. Some consensus thus exists as to the role of System Factors, Human Factors and Context Factors. In this paper, the notion of context is broadened to include information gleaned from simultaneous out-of-band channels, such as social network trend analytics, that can be used if interpreted in a timely manner, to help further optimise QoE. A case study involving simulation of HTTP adaptive streaming (HAS) and load balancing in a content distribution network (CDN) in a flash crowd scenario is presented with encouraging results.

We present testbed experiments of multi-source mobile video streaming that jointly exploits mobility and throughput prediction to prefetch video data in caches located at hotspots that the mobile will encounter and device-to-device (D2D) communication to opportunistically obtain parts of a video from neighboring mobile devices. A contribution of this paper includes a procedure to efficiently utilize multirate Wi-Fi links, which can be legacy Wi-Fi hotspot links and device-to-device links using Wi-Fi direct.

We present intrusion detection algorithms to detect physical layer jamming attacks in wireless networks. We compare the performance of local algorithms on the basis of the signal-to-interference-plus-noise ratio SINR executing independently at several monitors, with a collaborative detection algorithm that fuses the outputs provided by these algorithms. The local algorithms fall into two categories: simple threshold that raise an alarm if the output of the SINR-based metrics we consider deviates from a predefined detection threshold and cumulative sum cusum algorithms that raise an alarm if the aggregated output exceeds the predefined threshold. For collaborative detection, we use the Dempster-Shafer theory of evidence algorithm. We collect SINR traces from a real IEEE 802.11 network, and with the use of a new evaluation method, we evaluate both the local and the Dempster-Shafer algorithms in terms of the detection probability, false alarm rate, and their robustness to different detection threshold values, under different attack intensities. The evaluation shows that the cusums achieve higher performance than the simple threshold algorithms under all attack intensities. The Dempster-Shafer algorithm when combined with the simple algorithms, it can increase their performance by more than 80%, but for the cusum algorithms it does not substantially improve their already high performance.Copyright © 2013 John Wiley & Sons, Ltd.

This short paper describes the objectives and initial results of project I-CAN: Information-Centric Future Mobile and Wireless Access Networks. I-CAN seeks to radically advance the integration of cellular and wireless access technologies by developing and evaluating architectures and procedures for future access networks based on Information-Centric Networking (ICN).

The current paper presents extensions to a distributed user mobility-based proactive caching scheme that supports individual users' requests, and a brief discussion of the benefits from exploiting user-centric features. The approach applies to Heterogeneous Wireless Networks (HWNs) for offloading traffic volumes to small cells and for reducing delay for specific categories of mobile users and mobile application scenarios through Efficient Proactive Caching (EPC) decisions at small cells. The approach is designed to support mobile users' requests for content not treated by popularity-based caching. Here, we discuss how proactive caching decisions can jointly utilize individual user mobility and data popularity to enhance the benefits of cache decisions for individuals to a broader set of mobiles requesting the same data.

We present a distributed proactive caching approach that exploits user mobility information to decide where to proactively cache data to support seamless mobility, while efficiently utilizing cache storage using a congestion pricing scheme. The proposed approach is applicable to the case where objects have different sizes and to a two-level cache hierarchy, for both of which the proactive caching problem is hard. Our evaluation results show how various system parameters influence the delay gains of the proposed approach, which achieves robust and good performance relative to an oracle and an optimal scheme for a flat cache structure.

We present a detailed evaluation of procedures that exploit mobility prediction and prefetching to enhance offloading of traffic from mobile networks to WiFi hotspots, for both delay tolerant and delay sensitive traffic. We consider empirical measurements and evaluate the percentage of offloaded traffic, data transfer delay, and energy consumption of the proposed procedures. Our results illustrate how various factors such as mobile, WiFi and hotspot backhaul throughput, data size, number of hotspots, along with time and throughput estimation errors, influence the performance and energy efficiency of mobile data offloading enhanced with mobility prediction and prefetching.

We consider an environment where self-interested IEEE 802.11 Wireless Local Area Networks (WLANs) have overlapping coverage, and investigate the incentives that can trigger handovers between the WLANs. Our focus is on the incentives for supporting handovers due solely to the improved performance for all wireless networks. Such incentives arise due to a well-known property of 802.11 networks, where low rate users that send traffic significantly degrade the performance of high rate users that are associated with the same access point. A key difference of this paper compared to other works is that WLANs are self-interested, seeking to improve the performance of their own clients. We develop a comprehensive analytical model for accurately identifying and quantifying the handover gains. The model captures cases such as uplink and downlink traffic, wired link capacity constraints, and nonsaturated traffic conditions, and yields a practical handover decision policy. Simulations and experiments on a real testbed verify the accuracy of the model, and indicate that significant gains can be achieved through performance-induced handover incentives.

Wireless mesh networks (WMNs) have attracted much attention lately for providing efficiently wireless services with high quality of service (QoS). Metropolitan WMNs are a low-cost solution for providing broadband wireless internet access in large areas. One of the fundamental issues of wireless communications is interference. In WMNs interference can be caused by simultaneous transmissions at links internal to the mesh network or by external sources. In this work we perform extensive measurements in a multi-radio metropolitan WMN deployed in the city of Heraklion, Greece. The basic goal is to investigate the impact of interference on the performance of the multi-path WMN. Towards that goal, we perform measurements with FTP, video streaming and raw data traffic for two scenarios, one with an efficient channel assignment (CA) that accounts for interference and another with a random CA that results in high internal and external interference in the network. The results prove that interference creates severe performance degradation, with regards to high delay, high packet losses, low throughput and low signal-to-interference and noise ratio (SINR). As a result, the metropolitan WMN becomes unable to support multi-path flows and demanding applications with an acceptable QoS.

It gives us great pleasure to introduce the technical program of the third IEEE Workshop on Hot Topics in Mesh Networking (HotMESH 2011). Following the success of the previous editions, the HotMESH workshop is now a well-established, high profile forum for researchers, engineers, and practitioners to present state-of-the-art research in the field of wireless mesh networking. Although significant advances have taken place in this field in the last few years, fundamental open questions and technical challenges still remain to build highly scalable, reliable and cost-effective wireless backbones for mobile users. One of the issues of particular interest to this workshop edition is how wireless mesh networks could be integrates with and/or influence existing mobile and fixed broadband networks in order to create an integrated infrastructure that supports emerging services. Then, the main purpose of this workshop is to promote discussions on recent advances in the analysis design and implementation of systems, protocols and services for next generation mobile mesh networks. It also aims at increasing the synergy between academic and industry professionals working in this area.

Wireless mesh networks (WMNs) are comprised of nodes with multiple radio interfaces and provide broadband residential internet access or connectivity to temporal events. Our goal is to simplify the network deployment of such a mesh network, and towards that we are presenting procedures for automatic configuration and optimisation of the network. We first present an architecture framework that supports the integration of key mechanisms to ensure the optimisation of the performance of a wireless mesh network. Secondly, we present three key mechanisms, namely auto-configuration, channel assignment and quality of service (QoS) enforcement based on QoS routing. We provide a method for automatic mesh start-up, joining a node into an existing mesh network and automatic repair of temporary connectivity outage, targeting at simplifying the node configuration as much as possible. The second mechanism supports an efficient algorithm for joint channel selection and topology control, supporting different target objective expressed as utility functions. The third mechanism supports QoS, by allowing routing and admission control decisions, in order to ensure that all flows are handled with the demanded QoS. Finally, we give some simulation results that show the increased performance of our framework.

We define a utility-based framework for joint channel assignment and topology control in multi-rate multi-radio wireless mesh networks, and present a greedy algorithm for solving the corresponding optimization problem. Key features of the proposed approach are the support for different target objectives, which are expressed as utility functions of the MAC layer throughput, and the efficient utilization of wired network gateways, while guaranteeing that for every mesh node there exists a path to a gateway. Investigations show the influence of different target objectives on the channel assignment and network topology, demonstrate the proposed approach's load balancing properties in mesh networks containing multiple gateways, show the effect of 802.11a adjacent channel interference on the channel assignment, and compare the performance of the proposed procedure with a rate-based channel assignment scheme.

In this paper we investigate the performance that can be achieved by exploiting path diversity through multipath forwarding together with redundancy through linear network coding, in wireless mesh networks with directional links. A key contribution of the paper is to capture the tradeoff between packet delay and throughput achieved by combining multipath forwarding and network coding, and compare this tradeoff with that of simple multipath routing where different flows follow different paths, the transmission of multiple copies of packets over multiple paths, and single path routing. The analytical framework considers the case of end-to-end retransmission for achieving reliability, and is generalized for an arbitrary number of paths and hops. We also derive the minimum and maximum number of coded packets that are needed at the receiver to retrieve all packets sent by the sender; this can be used to obtain a lower and upper bound for the delay in the case of linear network coding with multipath forwarding.

Abstract Wireless mesh networking allows network operators and service providers to offer nearly ubiquitous broadband access at a low cost to customers. In this paper, we focus on QoS‐aware mesh networks operated by multiple operators in a cooperative manner. In particular, we identify the general security requirements of such networks and we give an overview on the available design options for a security architecture aiming at satisfying those requirements. More specifically, we consider the problems of mesh client authentication and access control, protection of wireless communications, securing the routing, key management, and intrusion and misbehavior detection and recovery. Our aim is to structure this rich problem domain and to prepare the grounds for the design of a practically usable security architecture. Copyright © 2008 John Wiley & Sons, Ltd.

An emerging approach for improving the performance of TCP in ad hoc multihop networks is to limit the maximum congestion window (CWNDmax) that a TCP connection is allowed to reach, in order to eliminate the number of outstanding segments and increase the TCP stability. In the present work, we propose an adaptive scheme to bound the CWNDmax value in an IEEE 802.11 ad hoc network. Our contributions are the following. First, we conduct simulation experiments to establish the argument that the optimum CWNDmax value depends on the buffer availability, when the network is not saturated, and is irrelevant to it, otherwise. Then, we introduce a time based expression for the network's bandwidth-delay product (BDP), in order to set CWNDmax dynamically. This expression accounts both for spatial reuse and for the packets' queue waiting time. The latter is necessary, since the TCP timer is set according to the round-trip delay, which includes the buffering latency in all hops. The proposed model can be implemented in a real environment, whereas the simulation experiments show that it improves the TCP window stability. The idea of limiting CWNDmax proves interesting, mainly because it aims to leave TCP unchanged.

We present our initial work on the design and of an opportunistic forwarding scheme for a wireless network. The main focus in our work is to take advantage of the interplay of the lower layer parameters and thus decide the design aspects of the forwarding decisions for an adaptive probabilistic opportunistic forwarding scheme. We have already shown that our opportunistic scheme can outperform single path routing for moderate channel error values, we have also identified a tradeoff between differentiating the forwarder's back-off value to avoid collisions and reducing delay.

We demonstrate the channel assignment in a metropolitan wireless multi-radio mesh network with directional antennas. A channel assignment approach is presented using suitable algorithms with key components the interference model, the link ordering and the channel selection metric. We have implemented and evaluated the proposed channel assignment in an actual metropolitan mesh network which covers an area of 60 km2in the city of Heraklion and consists of 14 nodes, among which seven are core nodes with up to four 802.11a wireless interfaces each, and one for management and monitoring. Finally, we developed a Java application to demonstrate the channel assignment process in a metropolitan mesh network in a graphical environment.

We investigate the problem of channel assignment in a metropolitan wireless multi-radio mesh network with directional antennas. We first present a new conflict graph model for capturing the interference between links in a mesh network with a known wireless interface communication graph. Then we present a channel assignment procedure which accounts for interference both between links internal to the mesh network, and from external sources. Key components of the channel assignment procedure are the interference model, the link ordering, and the channel selection metric. We have implemented and evaluated the proposed channel assignment procedure in an actual metropolitan mesh network with link distances from 1.6 to 5 Km. The experimental results demonstrate how link ordering and the channel selection metric affect performance, in terms of the average packet delay and http latency. Moreover, the experimental results show that the proposed channel assignment procedure achieves performance that is within approximately 11% of a lower bound of the average packet delay, and significantly higher than the performance achieved with a simpler interference-unaware procedure.

We present a new routing metric for multi-rate multi-radio mesh networks, which takes into account both contention for the shared wireless channel and rate diversity in multi-radio multi-channel mesh networks. A key property of the proposed contention-aware transmission time (CATT) metric is that it is isotonic, hence can be applied to link-state routing protocols. We have implemented the CATT metric in the OLSR routing protocol, and evaluate it in a test-bed with mesh nodes each equipped with four radio interfaces. Our experiments show that the proposed routing metric significantly outperforms other metrics that have appeared in the literature, in a number of scenarios that correspond to different mesh network topologies.

We investigate the problem of access point selection in wireless LANs based on the IEEE 802.11 standard, when a station is within the vicinity of more than one access points. According to the proposed approach, the selection is based on the packet transmission delay for each access point that a station can associate to, which is related to the throughput that the station can achieve. Important features of the approach is that it considers the contention-based nature of IEEE 802.11's MAC layer, it can be applied to the 802.11e standard which can support different classes in terms of the minimum contention window, and it can be implemented solely at the wireless stations, which passively monitor the activity of each access point's channel, without requiring modifications to the access points. Experiments show that the proposed approach can achieve significantly higher throughput fairness compared to other approaches, without a significant decrease of the aggregate throughput.

The IEEE 802.11e MAC protocol specifies an enhanced distributed channel access (EDCA) mechanism with adjustable protocol parameters, providing differentiated access to wireless stations. The EDCA parameters are: CWminand CWmax(minimum and maximum contention window), AIFS (arbitration interframe space), and TXOP (transmit opportunity). In this paper we study the joint setting of these parameters to maximize capacity and optimize performance under QoS constraints. We first revisit the analytical modeling in saturation and non-saturation conditions and provide more detailed approximations of the mean channel access delay and throughput. Considering two classes of wireless stations with higher and lower QoS demands, and optimizing with respect to average measures and constraints, we provide Pareto optimal pairs for the number of supported stations from the two classes for different parameter set configurations and load conditions. Further, we examine optimal parameter selection for a class of elastic traffic, in the presence of a delay-sensitive class whose parameters are fixed. Our findings show that drastic service differentiation can undermine capacity of a WLAN. They also demonstrate the optimality of jointly setting high values for TXOP and AIFS in order to maximize the throughput of the elastic traffic class while guaranteeing delay of the delay-sensitive class. We also reveal different optimal settings for CWminfor different load conditions. We summarize our findings as guidelines for the setting of 802.11e parameters in a scenario with data and real-time service classes.

Network dimensioning is typically based on a traffic matrix that contains the bandwidth demand for each source-destination pair. We consider a different approach, which assumes that only the maximum amount of premium traffic that can be carried across each access link is known. Based on this information, we present three algorithms for determining the bandwidth required for premium traffic in the core network. The first algorithm intermediately estimates the traffic matrix based on the "gravity model". The other two algorithms compute the worst-case requirements for premium traffic when there are no link failures and fixed routing is used (second algorithm), and when there are link failures and alternative routing paths are available (third algorithm). An important feature of the two worst-case algorithms is that they allow admission control decisions to be based solely on the availability of bandwidth for premium traffic at the access links. We apply and compare the three algorithms for the Greek Research and Technology Network (GRNET), which currently uses the third algorithm for its premium IP service.

In this paper we present the design, implementation, and experience in using network layer mechanisms for service differentiation in 802.11 wireless LANs (WLANs). In particular, we use the class-based weighted fair queuing (CBWFQ) mechanism with weights that are dynamically adjusted based on the achieved throughput of the wireless stations and their physical layer transmission rate. The scheme was implemented in a Linux-based testbed, and experiments show that it can effectively support throughput differentiation, and deal with important WLANs problems, such as unfairness due to location-dependent channel errors, uplink-downlink unfairness, and performance degradation for the whole WLAN when a station transmits at a small rate. The experiments involved best-effort traffic, as well as streaming video and voice-over-IP

We investigate the problem of efficient resource control for elastic traffic over the EDCA (Enhanced Distributed Channel Access) and HCCA (Hybrid Coordination Function - HCF - Controlled Channel Access) mechanisms of IEEE 802.11e. Our approach considers an economic modelling framework based on congestion pricing that captures how various factors, such as the probability of attempting to transmit a frame, the transmission opportunity (TXOP), and the physical layer transmission rate, contribute to congestion. Additionally, we consider the joint control of the EDCA and HCCA mechanisms, which allows us to determine the optimal sharing of the wireless channel between the two access mechanisms.

We investigate the problem of efficient resource control for elastic traffic in IEEE 802.11e's enhanced distributed channel access (EDCA) mechanism. Our approach considers an economic modelling framework based on congestion pricing that captures how various factors, such as the probability of attempting to transmit a frame, the use of the basic CSMA/CA or the RTS/CTS procedure, and the physical layer transmission rate, contribute to congestion. We discuss the application of the framework for achieving class-based throughput differentiation, for performing explicit congestion notification (ECN) marking based on the level of congestion in the wireless channel, and for modelling the performance of TCP congestion control over EDCA. In these application scenarios we discuss how to estimate the optimum minimum contention window and the congestion prices based on the 802.11e parameters and actual measurements, in order to achieve efficient channel utilization

We investigate a model to achieve throughput differentiation and efficient channel utilization for TCP uplink traffic over IEEE 802.11e's enhanced distributed channel access (EDCA) mechanism, when TCP acknowledgement packets are given higher priority for accessing the wireless channel compared to data packets. The proposed model can be used to tune the minimum contention window of EDCA to support efficient throughput differentiation according to a weight parameter, while taking into account factors such as the CSMA/CA and RTS/CTS procedure and different physical layer transmission rates. Simulation results validate the accuracy of the proposed model, and show its effectiveness in supporting weighted throughput differentiation.

DiffServ is the basis of contemporary QoS-enabled networks. Setting up DiffServ QoS requires extensive engineering effort in dimensioning and provisioning, especially for adjacent networks under different administrations linked in a "federated" hierarchy. In this paper we present a case study for QoS techniques employed in the GRNET MAN networks of Athens and Crete. After introducing the supported QoS mechanisms and service types, we discuss our dimensioning methodology and present two algorithms for worst-case dimensioning. We explain the provisioning mechanisms of GRNET and we present in brief our new automated provisioning ANS tool. Finally, we deal with the extension of our mechanisms and tools in hierarchically federated networks and give some future directions of our work

In this paper we address the issue of service differentiation in wireless networks based on the IEEE 802.11 standard. Wireless local area networks (WLANs) of this type are becoming increasingly prevalent, counting millions of deployed networks in homes, offices and hot spots. However, the medium access control (MAC) protocol and the unpredictability of the wireless channel prohibit the direct employment of classical wireline service differentiation algorithms. The main contribution of this paper is a network layer mechanism, capable of differentiating service, while improving fairness and aggregate throughput in the presence of both uplink (TCP) and downlink traffic. We exploit a class based weight fair queuing (CBWFQ) scheme, properly supplemented by two algorithms that perform periodical weight adjustments. The two algorithms deal effectively with important WLANs problems, such as, unfairness due to location dependent channel errors, uplink-downlink unfairness and decreased throughput for all nodes, when a station transmits at a small rate. The proposed solution has been implemented in a testbed and the conducted experiments confirmed its resultfulness in real life scenarios

We investigate statistical anomaly detection algorithms for detecting SYN flooding, which is the most common type of denial of service (DoS) attack. The two algorithms considered are an adaptive threshold algorithm and a particular application of the cumulative sum (CUSUM) algorithm for change point detection. The performance is investigated in terms of the detection probability, the false alarm ratio, and the detection delay. Particular emphasis is on investigating the tradeoffs among these metrics and how they are affected by the parameters of the algorithm and the characteristics of the attacks. Such an investigation can provide guidelines to effectively tune the parameters of the detection algorithm to achieve specific performance requirements in terms of the above metrics.

We investigate the problem of efficient resource control for loss-sensitive traffic in CDMA networks, using an economic modelling framework that takes into account the joint control of the transmission rate and the signal quality. Although the corresponding global optimization problem has a non-trivial structure, and we cannot in general guarantee that a solution can be found using the Lagrangian method, we have strong experimental evidence that this is possible for a wide range of user utilities. In this case the global optimum can be achieved in a decentralized manner, using shadow prices to influence the individual user resource requests. Based on this evidence, the main contribution of the paper is to discuss how existing rate control and outer-loop power control procedures can obtain a simple and attractive form that takes into account, through shadow prices, the level of demand and supply in order to achieve efficient resource utilization. Moreover, we describe and evaluate approximations of the proposed resource control model that can simplify its application, and we present extensions of the model for the case where the packet success ratio depends on the transmission rate in addition to the signal quality, and for network paths containing multiple wireless links.

We present a model, based on economic theory, for efficient and robust resource control in hybrid code and time division scheduling wireless systems. Based on this model, we propose procedures for combined rate allocation and time slot allocation to achieve efficient utilization of wireless resources, while taking into account user requirements. These procedures can be applied using a class-based framework, which allows simple implementation, and where users select a service class reflecting their valuation for the average throughput and for the percentage of time slots in which they can transmit data.

We present a framework for resource control in CDMA networks carrying elastic tra#c, considering both the uplink and the downlink direction. The framework is based on microeconomics and congestion pricing, and seeks to exploit the joint control of the transmission rate and the signal quality in order to achieve e#cient utilization of network resources, in a distributed and decentralized manner. An important feature of the framework is that it incorporates both the congestion for shared resources in wireless and wired networks, and the cost of battery power at mobile hosts. We prove that for elastic tra#c, where users value only their average throughput, the user's net utility maximization problem can be decomposed into two simpler problems: one involving the selection of the optimal signal quality, and one involving the selection of the optimal transmission rate. Based on this result, the selection of signal quality can be performed as done today using outer loop power control, while rate adaptation can be integrated with rate adaptation at the transport layer.

We present a model based on congestion pricing for resource control in wireless CDMA networks carrying traffic streams that have fixed-rate requirements, but can adapt their signal quality. Our model considers the resource usage constraint in the uplink of CDMA networks, and does not differentiate users based on their distance from the base station. We compare our model with other economic models that have appeared in the literature, identifying their similarities and differences. Our investigations include the effects of a mobile's distance and the wireless network's load on the target signal quality, the transmission power, and the user benefit.

We evaluate usage-based pricing schemes that are based on bounds of the effective bandwidth. The schemes include ones that require simple measurements (time and volume) for the whole duration of a call, and two schemes that require measurements in distinct time intervals, smaller than the duration of a call: pricing with renegotiation and the virtual bucket scheme. Using MPEG-1 compressed video, the schemes are compared for different link capacities and buffer sizes in terms of their fairness, i.e., the ability to capture the relative amount of resources used by connections.

Accurate yet simple methods for traffic engineering are important for efficient dimensioning of broadband networks. The goal of this paper is to apply and evaluate large deviation techniques for traffic engineering. In particular, we employ the recently developed theory of effective bandwidths, where the effective bandwidth depends not only on the statistical characteristics of the traffic stream, but also on a link's operating point through two parameters, the space and time parameters, which are computed using the many sources asymptotic. We show that this effective bandwidth definition can accurately quantify resource usage. Furthermore, we estimate and interpret values of the space and time parameters for various mixes of real traffic demonstrating how these values can be used to clarify the effects on the link performance of the time scales of burstiness of the traffic input, of the link parameters (capacity and buffer), and of traffic control mechanisms, such as traffic shaping. Our approach relies on off-line analysis of traffic traces, the granularity of which is determined by the time parameter of the link, and our experiments involve a large set of MPEG-1 compressed video and Internet Wide Area Network (WAN) traces, as well as modeled voice traffic.