366

6G networks will be highly dynamic, reconfigurable, and resilient. To enable and support such features, employing AI has been suggested. Integrating AI in networks will likely require distributed AI deployments with resilient connectivity, e.g., for communication between RL agents and environment. Such approaches need to be validated in realistic network environments. In this demo, we use ContainerNet to emulate AI-capable and autonomic networks that employ the routing protocol KIRA to provide resilient connectivity and service discovery. As an example AI application, we train and infer deep RL agents learning medium access control (MAC) policies for a wireless network environment in the emulated network.

Increasingly flexible and dynamic network infrastructures, due to softwarization, virtualization and increasing mobility (5G and 6G networks), challenge network management. To cope with the increasing dynamics and complexity, recent research focuses on autonomic network management solutions that do not require human intervention. However, autonomic network management solutions often require up-to-date topological information during network bootstrapping or to quickly react to dynamic events. Therefore, a fast, efficient, and scalable link-layer topology discovery, providing autonomic network management solutions with topological information in highly dynamic and large-scale networks, is required. This paper introduces KeLLy an efficient, scalable link layer topology discovery algorithm for large-scale networks (evaluated with up to 100 000 nodes). KeLLy is fast, discovering large topologies within a few seconds, guarantees discovery of all nodes and all links while inducing low, predictable overhead by querying only a subset (generally below 4 percent) of nodes. It achieves these properties regardless of the type of underlying topology.

Network infrastructures are becoming increasingly flexible and dynamic not only due to softwarization and virtualization, but also due to increasing mobility in 5G and 6G networks, which consider drones and satellites to be part of the core infrastructure. Since the network topology may change frequently, it becomes challenging to get an up-to-date view of its current state. This paper introduces KeLLy, an efficient, scalable link layer topology discovery algorithm focussing on large-scale networks (evaluated up to 100,000 nodes). KeLLy discovers various large topologies in seconds, guarantees discovery of all nodes (and a high percentage of links), while inducing low, predictable overhead by querying only a subset (4%) of nodes.

Increasing dynamics and an ever growing number of devices make current and future mobile network infrastructures more and more complex. Managing such networks thus becomes progressively challenging. Introducing more autonomic behavior in network management becomes indispensable to not only handle the growing complexity, but also to make these infrastructures more resilient as they constitute a critical component of overall public infrastructures. Autonomic control planes provide a fundamental set of resilient, autonomic infrastructure services (e.g., connectivity) for higher-level autonomic behavior to build upon. In this demo we show how a first real-world implementation of the routing architecture KIRA provides zero-touch control plane connectivity to enable an autonomic 5G network infrastructure. The demonstrator allows an in-depth view of each step in the process of bootstrapping a 5G infrastructure as well as of KIRA's resilience when challenged by failures and dynamics. Based on this autonomic connectivity solution we present our vision of more dynamic and resilient autonomic control networks toward the future design of 6G core networks.

Power synchronicity and limited line capacities will become critical challenges in future power systems. In order to tackle them, we advance the energy packet grid (EP grid), which is an alternative energy grid paradigm, inspired by selected design principles of the Internet. The EP grid breaks up the grid into self-organizing, decentralized EP cells wherein EP devices exchange energy packets. Power synchronicity is independently solved within EP cells, leading to a higher robustness of the overall EP grid. We focus on the interplay between the energy plane and the communication plane, i.e., how power electronics and the ability to exchange messages enable an EP grid. In this context, we introduce SEPT, an EP transfer protocol that allows two neighboring EP devices to exchange energy packets. SEPT takes care of the interplay between the energy plane and the communication plane, adding a new interdisciplinary perspective to the field.

Link capacities increase at an enormous pace, with 100 Gbit/s becoming standard in data centers, campus networks, and the Internet. These ever increasing data rates are challenging since end-system performance (esp. CPU performance) cannot keep up with the growth rates.Still, the TCP protocol and today's hardware are capable of transferring 100 Gbit/s with a single sender/receiver pair. However, extensive tuning is necessary down to manual interrupt configuration and corresponding CPU core pinning for the applications. A major issue is packet loss within the receiving end-system that cannot be prevented by TCP's flow control. This, in turn, affects TCP's default congestion control that interprets the losses as congestion signal. In this paper we show how to tune end-systems that are driven at their performance limits, what data rates are feasible, where the limitations are, and discuss the impact on and by TCP's congestion control.

Simultaneously achieving high throughput, a low and bounded queuing delay, and providing fairness among competing flows is very challenging for end-to-end congestion controls. Table 1 shows the properties of a reasonable selection of wellknown and recently proposed congestion controls. Except from TCP LoLa [1], none of them achieve all three goals at once.

BBR is a recently proposed congestion control. Instead of using packet loss as congestion signal, like many currently used congestion controls, it uses an estimate of the available bottleneck link bandwidth to determine its sending rate. BBR tries to provide high link utilization while avoiding to create queues in bottleneck buffers. The original publication of BBR shows that it can deliver superior performance compared to Cubic TCP in some environments. This paper provides an independent and extensive experimental evaluation of BBR at higher speeds. The experimental setup uses BBR's Linux kernel 4.9 implementation and typical data rates of 10Gbit/s and 1 Gbit/s at the bottleneck link. The experiments vary the flows' round-trip times, the number of flows, and buffer sizes at the bottleneck. The evaluation considers throughput, queuing delay, packet loss, and fairness. On the one hand, the intended behavior of BBR could be observed with our experiments. On the other hand, some severe inherent issues such as increased queuing delays, unfairness, and massive packet loss were also detected. The paper provides an in-depth discussion of BBR's behavior in different experiment setups.

TCP LoLa is a new delay-based congestion control that supports both, low queuing delay and high network utilization in high speed wide-area networks. This is particularly useful for traffic mixes consisting of bandwidth demanding and delay sensitive flows (e.g., long file transfer and interactive "web 2.0" traffic). TCP LoLa keeps the queuing delay at the bottleneck link low around a fixed target threshold value. This target value is independent from the number of flows sharing the bottleneck. TCP LoLa achieves high link utilization and attains convergence to fairness even among flows with different round-trip times, due to its novel mechanism called "fair flow balancing".

Designing and developing cloud services is a challenging task that includes requirements engineering, secure service deployment, maintenance, assurance that proper actions have been taken to support security and, in addition, considering legal aspects. This is unfortunately not possible by taking current methods and techniques into consideration. Therefore, we require a systematic and comprehensive approach for building such services that starts the integration of security concerns from early stages of design and development, and continuous to refines and integrate them in the deployment phase. In this paper we therefore propose a solution that integrates security requirements engineering and continuous refinement in a comprehensive security development and deployment life-cycle for cloud services and applications. Our approach is focused on iterative refinement of the security-based requirements during both software engineering (development phase) and software maintenance (deployment phase).

Interactive and delay-sensitive applications constitute an important and growing part of the Internet. Today, low delays can only be achieved if there are no congested links along the path. At a bottleneck, the commonly used congestion control mechanisms induce high queuing delay and packet loss. Specialized congestion control mechanisms achieving a low queuing delay in an otherwise congested network exist. However, if their flows share a bottleneck with traditionally congestion controlled flows, they get suppressed or loose their low-delay property. This paper presents three approaches - Separate Paths, Separate Queues and Limited Queue - that enable coexistence of congestion control mechanisms that are optimized for different goals, e.g., interactive applications and bulk transfers. The measurement results show that concurrent operation of different congestion control mechanisms can be successfully implemented this way.

The Cloud Computing operational model is a major recent trend in the IT industry, which has gained tremendous momentum. This trend will likely also reach the IT services that support Critical Infrastructures (CI), because of the potential cost savings and benefits of increased resilience due to elastic cloud behaviour. However, realizing CI services in the cloud introduces security and resilience requirements that existing offerings do not address well. For example, due to the opacity of cloud environments, the risks of deploying cloud-based CI services are difficult to assess, especially at the technical level, but also from legal or business perspectives. This paper discusses challenges and objectives related to bringing CI services into cloud environments, and presents an architectural model as a basis for the development of technical solutions with respect to those challenges.

The Session Initiation Protocol (SIP) is nowadays widely used as the primary standard application layer signaling protocol for multimedia sessions in the Internet. Furthermore, it is considered as the core protocol for the IP Multimedia Subsystem (IMS) of Next Generation Network architectures. Resources in the Internet are, however, still committed only on a best-effort basis, which proves to be especially problematic for real-time interactive applications, such as Voice-over-IP (VoIP) telephony. In order to reserve the correct amount of resources for multimedia sessions from end-to-end Quality-of-Service signaling protocols are necessary. This paper shows how a SIP-based setup of a multimedia session can be coupled with an advanced Quality-of-Service signaling solution. We present an analysis of the required SIP protocol mechanisms, show how the resource reservation request interacts with the SIP signaling request, and evaluate the duration of the overall signaling process using a prototypical implementation.

While virtual networks have been subjected to detailed analysis, prototypes are usually constructed and instantiated manually or by means of control protocols that mostly neglect security considerations. In this work, we present our proposal for a Virtual Link Setup Protocol (VLSP) that is designed as a modular extension to a standardized and extensible state-of-the-art signaling protocol suite. We use these signaling protocols to combine an authenticated and on-demand setup of virtual links with the establishment of Quality-of-Service guarantees in the underlying substrate. The solution presented in this paper is not limited to a specific set of virtualization techniques or tunneling mechanisms. We describe the design and implementation of VLSP and evaluate its signaling performance, as well as the overhead that is associated with the instantiation of the virtual links.

Supporting Quality-of-Service resource reservations for IP multicast flows is especially advantageous for distributed multimedia applications like video conferencing, 3D tele-immersion, or multi-player online gaming. In response to various limitations of RSVP the IETF developed more flexible signaling protocols within the Next Steps in Signaling (NSIS) framework. But unlike RSVP, the NSIS protocols were designed to consider unicast flows only in order to reduce protocol complexity. This paper presents an extension of the NSIS signaling protocols that allow for QoS resource reservations of IP multicast data flows. We describe the main challenges and discuss the resulting design decisions in detail. Enhancements of an existing NSIS implementation show that the required changes are minimal and do neither affect the unicast protocol operation, nor increase the protocol's complexity significantly. Instead, all of the advanced features introduced by NSIS, like reliable signaling message transport or support for sender- and receiver-initiated reservations can also be used with IP multicast flows. Evaluation results confirm that the overhead introduced by supporting IP multicast in NSIS compared to unicast reservations is negligible and that the presented solutions also offers scalable sender initiated reservations.

This paper presents a platform for virtual network (VN) provisioning across multiple domains. The platform decomposes VN provisioning into multiple steps to address the implications of limited information disclosure on resource discovery and allocation. A new VN embedding algorithm with simultaneous node and link mapping allows to assign resources within each domain. For inter-domain virtual link setup, we design and realize a signaling protocol that also integrates resource reservations for providing virtual links with Quality-of-Service guarantees. Experimental results show that small VNs can be provisioned within a few seconds.

The IETF's Next Steps in Signaling (NSIS) framework provides an up-to-date signaling protocol suite that can be used to dynamically install, maintain, and manipulate state in network nodes. In its two-layered architecture, the General Internet Signaling Transport (GIST) protocol is responsible for the transport and routing of signaling messages. The strong presence of Network Address Translation (NAT) gateways in today's Internet infrastructure causes some major challenges to signaling protocols like NSIS. The address translation mechanisms performed by common NAT gateways are primarily concerned with address information contained in the IP and transport layer headers. Messaging associations between two signaling peers do, however, rely on address information contained in GIST data units. If a non GIST-aware NAT gateway merely adapts addresses in the IP and transport headers, inconsistent state will finally be installed at the signaling nodes. In this paper we present the design, implementation, and evaluation of an application level gateway for the GIST protocol, that translates GIST messages in a way that allows for the establishment of messaging associations between any two GIST nodes across a NAT gateway.

Future telecommunication networks are likely designed along the Next Generation Network (NGN) framework of the ITU-T. End-to-end Quality-of-Service support-independent from underlying transport-related technologies-is one of the fundamental requirements of NGNs. This paper presents an overarching QoS control architecture that is based on the IETF's Next Steps in Signaling framework. It provides a detailed discussion of how the NSIS approach fits into the NGN architectures, its coupling to the IP Multimedia Subsystem, and possible migration paths from centralized to more distributed approaches. Advantages of using NSIS as part of an NGN-based QoS architecture are pointed out and implementation results for parts of a proposed NGN architecture are presented.

The IETF working group next steps in signaling (NSIS) develops signaling protocols for quality-of-service (QoS) reservations or dynamic NAT and firewall (NAT/FW) configuration. QoS signaling allows for on-demand resource reservations in order to provide guaranteed quality-of-service for real-time oriented services in IP-based next generation networks whereas NAT/FW signaling allows for establishing pinholes in firewalls or bindings in NAT devices. QoS signaling must be secured to allow for a reliable accounting and NAT/FW configuration is a sensitive operation per se. This paper presents an approach that provides an integrity protection of NSLP signaling messages by extending an NSLP session authorization object. A worked example for secure QoS signaling in a Kerberos-secured domain is given.

Efficient support for multimedia communication is essential for next generation mobile wireless networks. In order to provide the necessary quality-of-service (QoS) in mobile wireless networks, appropriate signaling has to be defined. Our QoS signaling architecture integrates resource management with mobility management. It is based on a domain resource manager concept and nicely supports different handover types. In particular, our approach supports anticipated handover with pre-reservation of resources before the mobile node is attached to the new access point. The article discusses the protocol design and implementation, in particular integration with mobile IP, and shows the benefit of anticipated handover by measurement results.

The long latency associated with mobile IPv6 home-address and care-of-address tests can significantly impact delay-sensitive applications. This paper presents an optimization of mobile IPv6 correspondent registrations that evades the latency of both address tests. An optimized correspondent registration eliminates 50%, or more, of the additional delay that a standard correspondent registration adds to the network stack's overall latency. The optimization is realized as an optional, and fully backward-compatible, extension to mobile IPv6.

The Differentiated Services architecture provides basic building blocks for quality of service (QoS) support within the Internet. Definition of scalable QoS mechanisms in the data path was a main objective. However, in order to provide guaranteed end-to-end reservations on demand the management of highly dynamic resource reservations by control entities (e.g., those performing admission control) must be scalable as well. This paper presents the DARIS architecture that provides a scalable management for QoS-based end-to-end services in the Internet. It defines a novel concept of dynamic and hierarchical aggregation of reservations, which operates on the network level of autonomous systems (AS). The aggregation concept reduces the managed reservation states as well as the number of signaling messages that have to be processed by management entities in intermediate AS. The aggregation concept was evaluated in detail using simulations including real Internet topologies.

The Differentiated Services (DiffServ) approach will also bring benefits for multicast applications which need quality of service support. For instance, a highly reliable multicast service can be provided based on the proposed expedited forwarding behavior. Such a service may also be used advantageously in a global computing cluster infrastructure, e.g., for distribution of synchronization messages. However, DiffServ multicast services have not been addressed in a very detailed manner yet. This paper illustrates some of the problems which will arise when IP Multicast is used in DiffServ networks without taking special precautions into account for providing it. Those problems mainly lead to situations in which other service users are affected adversely. In order to retain the benefits of the DiffServ approach, a quite simple and scalable solution for those problems is needed, not resulting in additional complexity or costs in a DiffServ domain. The proposed architecture in this paper requires only an additional entry for the DiffServ Codepoint in multicast routing tables and some support by management mechanisms. The discussion of the related problems and presentation of the solution is illustrated and confirmed by some measurements performed with a Linux implementation of DiffServ, and an adapted Linux multicast router.