In this paper we present a new resource management architecture, which provides end-to-end QoS guarantees to individual flows in a large, hierarchical network, such as the global Internet. This framework provides exact reservation and guaranteed resources to individual flows and, therefore, has the same expressive power as the IntServ model, while at the same time manages to overcome the scalability problem of IntServ. Furthermore, in addition to regulating per-flow resource allocation, the proposed architecture enables per-flow accounting in a secure manner. We are particularly interested in building scalable per-flow resource management architecture for the Internet, as it is known that aggregate traffic based services provided with DiffServ solutions have lower flexibility, utilization and performance assurance when compared to the services that can be provided with per-flow mechanisms.

We can now outsource data backups off-site to third-party cloud storage services so as to reduce data management costs. However, we must provide security guarantees for the outsourced data, which is now maintained by third parties. We design and implement FADE, a secure overlay cloud storage system that achieves fine-grained, policy-based access control and file assured deletion. It associates outsourced files with file access policies, and assuredly deletes files to make them unrecoverable to anyone upon revocations of file access policies. To achieve such security goals, FADE is built upon a set of cryptographic key operations that are self-maintained by a quorum of key managers that are independent of third-party clouds. In particular, FADE acts as an overlay system that works seamlessly atop today's cloud storage services. We implement a proof-of-concept prototype of FADE atop Amazon S3, one of today's cloud storage services. We conduct extensive empirical studies, and demonstrate that FADE provides security protection for outsourced data, while introducing only minimal performance and monetary cost overhead. Our work provides insights of how to incorporate value-added security features into today's cloud storage services.

In this talk I will discuss some of the lessons I've discovered about network protocol design; how to make protocols self-stabilizing, how to make networks self-configuring, how to provide optional configuration in such a way that misconfiguration does no harm, and how to design within constraints such as backward compatibility and politics. I'll also talk about some of my recent work. It is confusing enough that forwarding is done at both layers 2 and 3. Why am I designing a layer 2 1/2? And having spent most of my life in the world of computer network communication protocol design, I will share my observations about ways in which communication protocols in other areas could be improved.

This work describes a method of interconnecting links that combines the advantages of bridging and routing. The basic design is a replacement for a transparent bridge and makes no assumption about higher layer protocols. It involves creating an infrastructure of switches (which we call Rbridges, for "routing bridges") in which packets are routed, although, as with bridges, layer 2 end code location is learned through receipt of data packets. It avoids the disadvantages of bridges, since packets within the infrastructure need not be confined to a spanning tree, and packets are protected with a hop count and not proliferated while in transit, so there is no need for any artificial startup delay on ports to avoid temporary loops. This allows IP nodes to travel within a multi-link campus without changing IP addresses. The paper introduces further optimizations for IP, such as avoiding hooding ARP messages through the infrastructure, and (for IP nodes), allowing Rbridges to avoid learning on data packets.

Since IP packet reassembly requires resources, a denial of service attack can be mounted by swamping a receiver with IP fragments. In this paper we argue how this attack need not affect protocols that do not rely on IP fragmentation, and argue how most protocols, e.g., those that run on top of TCP, can avoid the need for fragmentation. However, protocols such as IPsec's IKE protocol, which both runs on top of UDP and requires sending large packets, depend on IP packet reassembly. Photuris, an early proposal for IKE, introduced the concept of a stateless cookie, intended for DoS protection. However, the stateless cookie mechanism cannot protect against a DoS attack unless the receiver can successfully receive the cookie, which it will not be able to do if reassembly resources are exhausted. Thus, without additional design and/or implementation defenses, an attacker can successfully, through a fragmentation attack, prevent legitimate IKE handshakes from completing. Defense against this attack requires both protocol design and implementation defenses. The IKEv2 protocol was designed to make it easy to design a defensive implementation. This paper explains the defense strategy designed into the IKEv2 protocol, along with the additional needed implementation mechanisms. It also describes and contrasts several other potential strategies that could work for similar UDP-based protocols.

This paper describes a new class of deadlock-free routing algorithms for irregular networks based on ordered links. In this case, the links are ordered by partitioning them into a set of layers, each layer containing a spanning tree (when possible). Deadlock free routes can then be derived by using links with non-decreasing order. The deadlock-freedom property is proved. Two different implementations of the routing algorithm are studied. The resultant performance of these algorithms is then compared to other known algorithms: the shortest-path algorithm (which may result in deadlocks) and the up*/down* algorithm. Various performance metrics are considered, including path-length, network capacity, fault tolerance and time of computation. We argue that network capacity is the most important metric to optimize. It is shown that the proposed algorithms are promising since they usually achieve higher network capacity than up*/down*, while they perform only slightly worse than up*/down* in other metrics.

It's natural to assume that network protocol design is by now a well-known science, where the designers of today's standards take care to understand the tricks and pitfalls learned from previous protocols. This talk dispells this and other myths. It is intended to be provocative, making people question the things people assume are true; instructive, giving hints as to how to avoid some of the problems in future protocols; and inspirational, convincing students that there are ample opportunities to make contributions. This talk discusses wrong turns that have been made, such as what necessitated the invention of bridges, and what caused IP multicast to be unimplementable. It also talks about how a protocol, even one “proven correct”, can go horribly wrong, such as the unstable ARPANET protocol for distributing routing information. It talks about “obvious” tricks such as version numbers, that even today protocol designers insist on misusing. And it covers some of the areas in which research is most needed.

No single LAN (local area network) technology is sufficient to interconnect all the computers in a given plant, campus, or site. Thus, it is desirable to combine different types of LANs, using a device called a bridge, to produce an extended LAN. Bridges learn their routing information from information contained in frames they forward. Besides the problems of distinguishing various kinds of encapsulated and unencapsulated frames, the encapsulating protocol used by bridges must also solve the learning problem. This leads to a new set of considerations and solutions. The authors begin with a rough solution and refine it using informal arguments and examples to lead to the final description. The stages in the description roughly mimic the design process. The protocol achieved offers generality and correctness, efficiency, compatibility, and extensibility and requires minimal storage.>

The bridge algorithm adopted by the IEEE 802.1 committee for interconnecting 802 LANs requires the topology of the Extended LAN to be a Spanning Tree. A distributed algorithm to compute a spanning tree dynamically has already been published [1], and adopted by the IEEE 802.1 committee [2]. In this paper, however, we describe an alternative distributed algorithm to compute a spanning tree. This algorithm, variants of which have been implemented, initially appears simpler than the IEEE 802.1 algorithm; we show, however, that it has subtle failure modes that makes it unattractive in practice.

A protocol and algorithm are given in which bridges in an extended Local Area Network of arbitrary topology compute, in a distributed fashion, an acyclic spanning subset of the network.

Conventional routing protocols and algorithms work most efficiently on sparsely connected networks. Network topologies today include multiaccess links which include hundreds of nodes, all of which are capable of direct communication with each other. Some of these multiaccess links have broadcasting ability. This paper presents protocols and algorithms for efficiently dealing with the characteristics of various types of multiaccess links, when they are included as links in a general topology net.

This paper defines a service class and describes how a completely general service class structure can be provided by a packet switched network. It describes the difference between a handling directive and a routing metric, and defines a service class as an arbitrary collection of handling directives and routing metrics. It describes what types of distributed routing algorithms make it possible to provide for a completely general service class concept in a network, and describes the special problems to be encountered when providing for a general service class capability in a hierarchical network.