Advances in wireless networking, such as 5G, continue to enable the vision of the Internet of Things (IoT), where everything is connected, and much data is collected by IoT devices and made available to interested parties (i.e., application servers). However, events such as botnet attacks (e.g., [1]) demonstrate that there are important challenges in this evolution.In this paper we consider the problem of scalable and secure data publication from IoT devices, with included mechanisms that help towards device attacks prevention and detection. We propose SEDIMENT, a system and methodology which look more specifically at problems that arise in a network with a broad variety of devices, some of which have limited resources and some of which were designed for a less hostile environment. SEDIMENT uses a combination of software root of trust, remote attestation and resource-efficient cryptography, to build a system that scales across heterogeneous computing platforms. It allows for devices that range from battery-powered devices that are intended to operate for long periods up to server-class machines without power constraints. SEDIMENT provides a secure application layer that can be used for common communication paradigms such as publish-subscribe while following zero-trust principles in both protecting the end hosts from the network and other end hosts, as well as protecting the network from the end hosts.

Opportunistic operations are functions carried out by leveraging spare capacity on existing devices. We investigate the performance of implementing distributed RF functions, such as spectrum monitoring, as opportunistic operations on groups of radios and RF sensors. We assume that the primary activities of the devices cannot be fully predicted, and that opportunistic operations on a device may be preempted by its primary functions. Therefore there is uncertainty regarding the ability of RF devices to complete assigned opportunistic operations. Moreover, we assume the communications network is intermittent, lossy and low bandwidth. The network limitations create command and control uncertainty. The primary research challenge addressed in this work is to overcome these sources of uncertainty in order to carry out distributed RF operations with high probability of success, while minimizing resource consumption. The approach we have developed is implemented in a middleware layer called Management of RF Network and Tasking Infrastructure (MARTI). We use an analytic model and experiments with MARTI in a wireless testbed to quantify the impact of various strategies for mitigating uncertainty, the tradeoffs between improved communication reliability and its latency and bandwidth costs, and strategies for trading off between result fidelity and network resource consumption.

As both end-to-end network reliability and performance becomes a growing concern for large distributed organizations, carriers face an increasing pressure to offer enhanced network services with higher quality of service (QoS). Such premier services are exemplified by wide-area virtual private networks (VPN) with QoS guarantees, or QVPNs, for which users can specify bandwidth, latency, and reliability requirements. From a carrier's standpoint, the primary challenge is to set up fault-tolerant routes for each QVPN request across its network with user-specified reliability and performance guarantees and, at the same time, maximize the total number of QVPNs that its network can support at any instant. We propose a fault tolerant load balancing routing (FTLBR) algorithm to select fault-tolerant routes for QVPNs. FTLBR maintains network-wide load balance while selecting primary and backup routes for QVPNs and performs resource sharing along backup routes to achieve an overall high network resource utilization efficiency. FTLBR is able to avoid formation of bottleneck links during primary-backup route selection by employing a simple quantitative metric that effectively captures network-wide load balance. Simulation results show that FTLBR can support significantly higher number of QVPNs when compared with existing traffic engineering algorithms.

As wide-area network connectivity becomes commoditized, network service providers are offering premium services that generate higher revenues by supporting performance sensitive traffic (such as voice, multimedia, and online trading). An emerging example is a virtual private network path with quality of service (QoS) guarantees, or QVPN. The main technical challenge in offering the QVPN service is how to allocate a physical route for each QVPN so as to maximize the total number of QVPNs that a given physical network infrastructure can support simultaneously. We make the case that the key to addressing this challenge is to maintain network-wide load balance when selecting QVPN routes. By ensuring that different parts of the network are evenly loaded, no single critical link will tend to become a bottleneck resource. This paper describes a Link Criticality Based Routing (LCBR) algorithm, which achieves high network resource utilization efficiency while supporting QVPNs with end-to-end delay and bandwidth guarantees. In addition, LCBR can select primary and backup routes for each QVPN simultaneously to support fast recovery from node or link failures. Using a simple yet effective metric that accurately quantifies network-wide load balance, LCBR significantly improves the total number of supported QVPNs when compared to state-of-the-art traffic engineering approaches.

Growth of performance sensitive applications, such as voice and multimedia, has led to widespread adoption of resource virtualization by a variety of service providers (xSPs). For instance, Internet Service Providers (ISPs) increasingly differentiate their offerings by means of customized services, such as virtual private networks (VPN) with Quality of Service (QoS) guarantees or QVPNs. Similarly Storage Service Providers (SSPs) use storage area networks (SAN)/network attached storage (NAS) technology to provision virtual disks with QoS guarantees or QVDs. The key challenge faced by these xSPs is to maximize the number of virtual resource units they can support by exploiting the statistical multiplexing nature of the customers' input request load.While a number of measurement-based admission control algorithms utilize statistical multiplexing along the bandwidth dimension, they do not satisfactorily exploit statistical multiplexing along the delay dimension to guarantee distinct per-virtual-unit delay bounds. This article presents Delay Distribution Measurement (DDM) based admission control algorithm, the first measurement-based approach that effectively exploits statistical multiplexing along the delay dimension. In other words, DDM exploits the well-known fact that the actual delay experienced by most service requests (packets or disk I/O requests) for a virtual unit is usually far smaller than its worst-case delay bound requirement because multiple virtual units rarely send request bursts at the same time. Additionally, DDM supports virtual units with distinct probabilistic delay guarantees---virtual units that can tolerate more delay violations can reserve fewer resources than those that tolerate less, even though they require the same delay bound. Comprehensive trace-driven performance evaluation of QVPNs (using Voice over IP traces) and QVDs (using video stream, TPC-C, and Web search I/O traces) shows that, when compared to deterministic admission control, DDM can potentially increase the number of admitted virtual units (and resource utilization) by up to a factor of 3.

Rerouting has been used in traffic management to perform dynamic load balancing. The aim of rerouting is to reassign the path/bandwidth allocations of current traffic trunks in a network in order to minimize the probability of blocking future resource requests. We investigate how the effectiveness of rerouting can be affected by the characteristic of the underlying network topology. We established baseline measures through two resource allocation algorithms: a shortest distance path algorithm (SDP), that represents the best common practice without rerouting, and a global rerouting algorithm that is based on a provably /spl epsiv/-optimal algorithm for the multi-commodity flow problem. We propose two rerouting algorithms based on the basic SDP algorithm that selects for rerouting either from traffic trunks with the same source-destination pairs (local rerouting) or from all traffic trunks (global rerouting). The effectiveness of rerouting is highly related to the average node degree. As the connectivity of a graph increases, rerouting tends to be more effective. However, rerouting does not always perform better when connectivity is increased. Significant performance improvement only occurs within a relatively small range of connectivities when a rerouting algorithm is able to find alternative paths and SDP cannot. Furthermore, local rerouting is sufficient to exploit most of the benefits of rerouting and it is not necessary to utilize much more computationally intensive global rerouting algorithms. Finally, we investigate the rerouting frequency vs. blocking trade-off and show that for local rerouting, the best performance can be achieved by a rerouting frequency of only 30%.

Provisioning techniques for network flows with end-to-end QoS guarantees need to address the interpath and intrapath load balancing problems to maximize the resource utilization efficiency. This paper focuses on the intrapath load balancing problem: How to partition the end-to-end QoS requirement of a network flow along the links of a given path such that the deviation in the loads on these links is as small as possible? We propose a new algorithm to solve the end-to-end QoS partitioning problem for unicast and multicast flows that takes into account the loads on the constituent links of the chosen flow path. This algorithm can simultaneously partition multiple end-to-end QoS requirements such as the end-to-end delay and delay violation probability bound. The key concept in our proposal is the notion of slack, which quantifies the extent of flexibility available in partitioning the end-to-end delay requirement across the links of a selected path (or a multicast tree). We show that one can improve network resource usage efficiency by carefully selecting a slack partition that explicitly balances the loads on the underlying links. A detailed simulation study demonstrates that, compared with previous approaches, the proposed delay budget partitioning algorithm can increase the total number of long-term flows that can be provisioned along a network path by up to 1.2 times for deterministic and 2.8 times for statistical delay guarantees

Carriers increasingly differentiate their wide-area connectivity offerings by means of customized services, such as virtual private networks (VPN) with Quality of Service (QoS) guarantees, or QVPNs. The key challenge faced by carriers is to maximize the number of QVPNs admitted by exploiting the statistical multiplexing nature of input traffic. While existing measurement-based admission control algorithms utilize statistical multiplexing along the bandwidth dimension, they do not satisfactorily exploit statistical multiplexing along the delay dimension to guarantee distinct per-QVPN delay bounds. This paper presents Delay Distribution Measurement (DDM) based admission control algorithm, the first measurement-based approach that effectively exploits statistical multiplexing along the delay dimension. In other words, DDM exploits the well known fact that the actual delay experienced by most packets of a QVPN is usually far smaller than its worst-case delay bound requirement since multiple QVPNs rarely send traffic bursts at the same time. Additionally, DDM supports QVPNs with distinct probabilistic delay guarantees -- QVPNs that can tolerate more delay violations can reserve fewer resource than those that tolerate less, even though they require the same delay bound. A comprehensive performance evaluation using Voice over IP traces shows that, when compared to deterministic admission control, DDM can potentially increase the number of admitted QVPNs (and link utilization) by up to a factor of 3.0 even when the delay violation probability is as small as 10-5.

This paper studies the effect of rerouting for augmenting aggregate based resource allocation in the trade-off between overhead and utilization. Aggregation is a common approach to address the scalability issue in resource allocation. However, resources committed in bulk may be under utilized while other resource requests are being turned down for lack of resources in some shared links. The aim of rerouting is to free up committed resources for better utilization by reusing resources vacated by terminated flows and by moving existing flows to alternative paths. Our results show that rerouting improves performance over a wide range of network loads on two different network topologies. In particular, we show that depending on the network load and topology, it is possible to reduce both blocking rate and routing cost.

Real-time online multi-player games are becoming increasingly popular due to advances in game design and the proliferation of broadband Internet access. However, fairness remains a major challenge when players over large geographic areas participate in a client-server based game together. The paper proposes a game-independent, network-based service, called Sync-MS, that balances the trade-off between response time and fairness. Sync-MS uses two mechanisms, sync-out and sync-in, to address state update fairness and player action fairness, respectively. Two metrics, ahead and behind, measured against the fair order, are defined to-evaluate Sync-MS's fairness performance. Simulation results show that Sync-MS dramatically improves player action fairness for all players while it slightly increases the average response time for players with shorter network delay to the game server.

Network monitoring is an integral part of any network management system. In order to ensure end-to-end service quality stated in service level agreements (SLAs), managers of a service provider network need to gather quality-of-service (QoS) measurements from multiple nodes in the network. For a large network with over thousands of flows with end-to-end SLAs, the information exchanged between network nodes and a central network management system (NMS) could be substantial. We propose a mechanism called aggregation and refinement based monitoring (ARM) to reduce the amount of information exchange. ARM is a generic mechanism that can be configured to run with different objectives, including threshold-based, rank-based and percentile-based. The mechanism enables the NMS to collect data from network nodes using a dynamic QoS data aggregation/refinement technique, and to process these information differently depending on its measurement objective. Our simulation results show that for these various objectives, the selective refinement process is able to validate SLAs quickly, is an order of magnitude more efficient than a simple polling scheme, and performs well across a wide range of traffic loads.

This paper presents an intelligent gateway architecture, IP-CLIX, that shields device and interface heterogeneity from network provisioning tools. A salient feature of IP-CLIX is its meta-data-driven approach, which facilitates incremental support of various interfaces and services, and enables rapid deployment of mediation modules for additional CLI types.

In order to detect violations of end-to-end service level agreements (SLA) and to isolate trouble links and nodes based on a unified framework, managers of a service provider network need to gather quality of service (QoS) measurements from multiple nodes in the network. For a network carrying over thousands of flows with end-to-end SLAs, the information exchanged between network nodes and a central network management system (NMS) could be substantial. Moreover in situations where only, a small number of flows violate their respective SLAs, simple polling mechanisms can lead to huge unnecessary overhead in identifying these ill-behaved flows. We propose an algorithm called (ARM) (Aggregation and Refinement based Monitoring) to reduce the amount of information exchange. (ARM) uses a histogram-based dynamic QoS data aggregation/refinement technique at each network node and a reasoning engine at the NMS to minimized the amount of data exchange between network nodes and NMS. (ARM) not only reduces unnecessary reporting through selective refinement, it also performs well across a wide range of traffic loads. Our simulation results show that (ARM) is at least an order of magnitude more efficient than a simple polling scheme. It also outperforms two centralized highly optimized schemes that cannot be implemented in practice.

In this paper, we present the design and implementation of a software system that performs the control functions of current mobile switching centers (MSCs) and visitor location registers (VLRs), and provides support for third generation services. The novelty of the system design is in its software architecture. To allow flexible deployment of the system as the migration from second generation to third generation systems occurs, the software is modular. To provide scalability in terms of capacity, distributed processing is used. We show that a deployment of this system using three Sun Ultra workstations achieves a call throughput of 300,000 calls/hour with a latency of below 300 milliseconds. This meets the latency requirements of third generation systems.