With its significant security potential, the quantum internet is poised to revolutionize technologies like cryptography and communications. Although it boasts enhanced security over traditional networks, the quantum internet still encounters unique security challenges essential for safeguarding its Confidentiality, Integrity, and Availability (CIA). This study explores these challenges by analyzing the vulnerabilities and the corresponding mitigation strategies across different layers of the quantum internet, including physical, link, network, and application layers. We assess the severity of potential attacks, evaluate the expected effectiveness of mitigation strategies, and identify vulnerabilities within diverse network configurations, integrating both classical and quantum approaches. Our research highlights the dynamic nature of these security issues and emphasizes the necessity for adaptive security measures. The findings underline the need for ongoing research into the security dimension of the quantum internet to ensure its robustness, encourage its adoption, and maximize its impact on society.

Intrusion detection systems (IDS) for the Internet of Things (IoT) systems can use AI-based models to ensure secure communications. IoT systems tend to have many connected devices producing massive amounts of data with high dimensionality, which requires complex models. Complex models have notorious problems such as overfitting, low interpretability, and high computational complexity. Adding model complexity penalty (i.e., regularization) can ease overfitting, but it barely helps interpretability and computational efficiency. Feature engineering can solve these issues; hence, it has become critical for IDS in large-scale IoT systems to reduce the size and dimensionality of data, resulting in less complex models with excellent performance, smaller data storage, and fast detection. This paper proposes a new feature engineering method called LEMDA (Light feature Engineering based on the Mean Decrease in Accuracy). LEMDA applies exponential decay and an optional sensitivity factor to select and create the most informative features. The proposed method has been evaluated and compared to other feature engineering methods using three IoT datasets and four AI/ML models. The results show that LEMDA improves the F1 score performance of all the IDS models by an average of 34% and reduces the average training and detection times in most cases.

Crowdsourcing applications, such as Uber for ride-sharing, enable distributed problem-solving. A subset of these applications is intelligent crowd-forecasting applications, e.g., Virustotal, for malware detection. In crowd-forecasting applications, multiple agents respond with predictions about potential future event outcome(s). These responses are then combined to assess the events collaboratively and act accordingly. Unlike conventional crowdsourcing applications that only communicate information, crowd-forecasting applications need to additionally process information to achieve a collaborative assessment. Hence, they require knowledge-based systems instead of simple storage-based ones for crowdsourcing applications. Most existing crowd-forecasting systems are centralized, leading to the inherent single point of failure and inefficient collaborative assessment. This paper presents CrowdFAB,CrowdsourcedForecastingApplications usingBlockchains. We deploy a knowledge-based blockchain paradigm that transforms blockchains from simple storage to knowledge-based systems, thereby achieving crowd-forecasting requirements without centralization. In addition, we formulate a novel reputation scheme that assigns reputations to agents based on their performance. We then use this scheme when making assessments. We implement and analyze CrowdFAB in terms of overhead and security features. Further, we evaluate CrowdFAB for a collaborative malware detection use case, where multiple detectors are involved for crowd forecasting. Results demonstrate CrowdFAB's superior accuracy and other metrics performance compared to other works with the same settings.

Despite artificial intelligence (AI)’s significant growth, its “black box” nature creates challenges in generating adequate trust. Thus, it is seldom utilized as a standalone unit in IoT high-risk applications, such as critical industrial infrastructures, medical systems, financial applications, etc. Explainable AI (XAI) has emerged to help with this problem. However, designing appropriately fast and accurate XAI is still challenging, especially in numerical applications. Here, we propose a universal XAI model, named the transparency relying upon statistical theory (TRUST), which is model-agnostic, high performing, and suitable for numerical applications. Simply put, TRUST XAI models the statistical behavior of the AI’s outputs in an AI-based system. Factor analysis is used to transform the input features into a new set of latent variables. We use mutual information (MI) to rank these variables and pick only the most influential ones on the AI’s outputs and call them “representatives” of the classes. Then, we use multimodal Gaussian (MMG) distributions to determine the likelihood of any new sample belonging to each class. We demonstrate the effectiveness of TRUST in a case study on cybersecurity of the Industrial Internet of Things (IIoT) using three different cybersecurity data sets. As IIoT is a prominent application that deals with numerical data. The results show that TRUST XAI provides explanations for new random samples with an average success rate of 98%. Compared with local interpretable model-agnostic explanations (LIME), a popular XAI model, TRUST is shown to be superior in the context of performance, speed, and the method of explainability. In the end, we also show how TRUST is explained to the user.

The rapid evolutions in microcomputing, mini-hardware manufacturing, and machine-to-machine (M2M) communications have enabled novel Internet-of-Things (IoT) solutions to reshape many networking applications. Healthcare systems are among these applications that have been revolutionized with IoT, introducing an IoT branch known as the Internet-of-Medical Things (IoMT) systems. IoMT systems allow remote monitoring of patients with chronic diseases. Thus, it can provide timely patients' diagnostic that can save their life in case of emergencies. However, security in these critical systems is a major challenge facing their wide utilization. In this article, we present state-of-the-art techniques to secure IoMT systems' data during collection, transmission, and storage. We comprehensively overview IoMT systems' potential attacks, including physical and network attacks. Our findings reveal that most security techniques do not consider various types of attacks. Hence, we propose a security framework that combines several security techniques. The framework covers IoMT security requirements and can mitigate most of its known attacks.

Internet of Things (IoT) devices frequently utilize wireless networks operating in the Industrial, Scientific, and Medical (ISM) Sub‐1 GHz spectrum bands. Compared with higher frequency bands, the Sub‐1 GHz band provides broader coverage and lower power consumption, which are desirable properties for low‐cost IoT applications. However, low‐power and low‐cost IoT modules cause high variability in network performance. The varying influence from real‐world environments additionally undermines wireless propagation and aggravates this variability. We explore these influences and provide a checklist of potential factors affecting wireless network performance in real‐world environments. Using multiple low‐cost IoT modules, we conduct multiple experiments in five real‐world scenarios: indoor, street, open field, ground‐to‐drone (G2D), and drone‐to‐drone (D2D). Specifically, the tests are conducted inside a building, on a straight street with wooded sidewalks and aligned houses, on an open field golf course, and high up in the air between drones. To understand the difficulty of reproducibility in IoT deployments, we studied the effect of factors in four categories. This includes the effect of path (line of sight, distance, and obstruction), configuration (transmit power level), weather (precipitation, temperature, and humidity), and installation (IoT module mobility and position). We find that some of the factors in the path and weather categories have the most influence among all the factors, while the rest have moderate to low impacts. In the end, we provide a complete checklist of all the tested factors, which we believe would be constructive not only to academics but also to industrial practitioners working on wireless IoT systems.

Carriers’ network services are distributed, dynamic, and investment intensive. Deploying them as virtual network services (VNS) brings the promise of low-cost agile deployments, which reduce time to market new services. If these virtual services are hosted dynamically over multiple clouds, greater flexibility in optimizing performance and cost can be achieved. On the flip side, when orchestrated over multiple clouds, the stringent performance norms for carrier services become difficult to meet, necessitating novel and innovative placement strategies. In selecting the appropriate combination of clouds for placement, it is important to look ahead and visualize the environment that will exist at the time a virtual network service is actually activated. This serves multiple purposes — clouds can be selected to optimize the cost, the chosen performance parameters can be kept within the defined limits, and the speed of placement can be increased. In this paper, we propose the P-ART (Predictive-Adaptive Real Time) framework that relies on predictive-deductive features to achieve these objectives. With so much riding on predictions, we include in our framework a novel concept-drift compensation technique to make the predictions closer to reality by taking care of long-term traffic variations. At the same time, near real-time update of the prediction models takes care of sudden short-term variations. These predictions are then used by a new randomized placement heuristic that carries out a fast cloud selection using a least-cost latency-constrained policy. An empirical analysis carried out using datasets from a queuing-theoretic model and also through implementation on CloudLab, proves the effectiveness of the P-ART framework. The placement system works fast, placing thousands of functions in a sub-minute time frame with a high acceptance ratio, making it suitable for dynamic placement. We expect the framework to be an important step in making the deployment of carrier-grade VNS on multi-cloud systems, using network function virtualization (NFV), a reality.

It is critical to secure the Industrial Internet of Things (IIoT) devices because of potentially devastating consequences in case of an attack. Machine learning (ML) and big data analytics are the two powerful leverages for analyzing and securing the Internet of Things (IoT) technology. By extension, these techniques can help improve the security of the IIoT systems as well. In this paper, we first present common IIoT protocols and their associated vulnerabilities. Then, we run a cyber-vulnerability assessment and discuss the utilization of ML in countering these susceptibilities. Following that, a literature review of the available intrusion detection solutions using ML models is presented. Finally, we discuss our case study, which includes details of a real-world testbed that we have built to conduct cyber-attacks and to design an intrusion detection system (IDS). We deploy backdoor, command injection, and Structured Query Language (SQL) injection attacks against the system and demonstrate how a ML-based anomaly detection system can perform well in detecting these attacks. We have evaluated the performance through representative metrics to have a fair point of view on the effectiveness of the methods.

Federal Aviation Administration (FAA) of the United States is considering Remote ID systems for unmanned aerial vehicles (UAVs). These systems act as license plates used on automobiles, but they transmit information using radio waves. To be useful, the transmissions in such systems need to reach long distances to minimize the number of ground stations to capture these transmissions. LoRaWAN is designed as a cheap long-range technology to be used for long-range communication for the Internet of Things. Several manufacturers make LoRaWAN modules, which are readily available on the market and are, therefore, ideal for the UAVs Remote IDs at a low cost. In this paper, we present our experiences in using LoRaWAN technology as a communication technology. Our experiments to identify and locate the UAV systems uncovered several issues of using LoRaWAN in such systems that are documented in this paper. Using several ground stations, we can determine the location of a UAV equipped with a LoRaWAN module that transmits the UAV Remote ID. Hence, it can help identify UAVs that unintentionally, or intentionally, fly into restricted zones.

Machine learning algorithms have been shown to be suitable for securing platforms for IT systems. However, due to the fundamental differences between the industrial internet of things (IIoT) and regular IT networks, a special performance review needs to be considered. The vulnerabilities and security requirements of IIoT systems demand different considerations. In this paper, we study the reasons why machine learning must be integrated into the security mechanisms of the IIoT, and where it currently falls short in having a satisfactory performance. The challenges and real-world considerations associated with this matter are studied in our experimental design. We use an IIoT testbed resembling a real industrial plant to show our proof of concept.

Cloud computing has been widely adopted by application service providers (ASPs) and enterprises to reduce both capital expenditures (CAPEX) and operational expenditures (OPEX). Applications and services previously running on private data centers are now being migrated to private or public clouds. Since most of the ASPs and enterprises have globally distributed user bases, their services need to be distributed across multiple clouds, spread across the globe which can achieve better performance in terms of latency, scalability and load balancing. The shift has eventually led the research community to study multi-cloud environments. However, the widespread acceptance of such environments has been hampered by major security concerns. Firewalls and traditional rule-based security protection techniques are not sufficient to protect user-data in multi-cloud scenarios. Recently, advances in machine learning techniques have attracted the attention of the research community to build intrusion detection systems (IDS) that can detect anomalies in the network traffic. Most of the research works, however, do not differentiate among different types of attacks. This is, in fact, necessary for appropriate countermeasures and defense against attacks. In this paper, we investigate both detecting and categorizing anomalies rather than just detecting, which is a common trend in the contemporary research works. We have used a popular publicly available dataset to build and test learning models for both detection and categorization of different attacks. To be precise, we have used two supervised machine learning techniques, namely linear regression (LR) and random forest (RF). We show that even if detection is perfect, categorization can be less accurate due to similarities between attacks. Our results demonstrate more than 99% detection accuracy and categorization accuracy of 93.6%, with the inability to categorize some attacks. Further, we argue that such categorization can be applied to multi-cloud environments using the same machine learning techniques.

Lately application service providers (ASPs) and Internet service providers (ISPs) are being confronted with the unprecedented challenge of accommodating increasing service and traffic demands from their geographically distributed users. Many ASPs and ISPs, such as Facebook, Netflix, AT&T and others have adopted micro-service architecture to tackle this problem. Instead of building a single, monolithic application, the idea is to split the application into a set of smaller, interconnected services, called micro-services (or simply services). Such services are lightweight and perform distinct tasks independent of each other. Hence, they can be deployed quickly and independently as user demands vary. Nevertheless, scheduling of micro-services is a complex task and is currently under-researched. In this work, we address the problem of scheduling micro-services across multiple clouds, including micro-clouds. We consider different user-level SLAs, such as latency and cost, while scheduling such services. Our aim is to reduce overall turnaround time for the complete end-to-end service in service function chains and reduce the total traffic generated. In this work we present a novel fair weighted affinity-based scheduling heuristic to solve this problem. We also compare the results of proposed solution with standard biased greedy scheduling algorithms presented in the literature and observe significant improvements.

Deployment of Network Function Virtualization (NFV) over multiple clouds accentuates its advantages like flexibility of virtualization, proximity to customers and lower total cost of operation. However, NFV over multiple clouds has not yet attained the level of performance to be a viable replacement for traditional networks. One of the reasons is the absence of a standard based Fault, Configuration, Accounting, Performance and Security (FCAPS) framework for the virtual network services. In NFV, faults and performance issues can have complex geneses within virtual resources as well as virtual networks and cannot be effectively handled by traditional rule-based systems. To tackle the above problem, we propose a fault detection and localization model based on a combination of shallow and deep learning structures. Relatively simpler detection has been effectively shown to be handled by shallow machine learning structures like Support Vector Machine (SVM). Deeper structure, i.e., the stacked autoencoder has been found to be useful for a more complex localization function where a large amount of information needs to be worked through to get to the root cause of the problem. We provide evaluation results using a dataset adapted from fault datasets available on Kaggle and another based on multivariate kernel density estimation and Markov sampling.

Network Function Virtualization (NFV) and Service Chaining (SC) are novel service deployment approaches in the contemporary cloud environments for increased flexibility and cost efficiency to the Application Service Providers and Network Providers. However, NFV and SC are still new and evolving topics. Optimized placement of these virtual functions is necessary for acceptable latency to the end-users. In this work we consider the problem of optimal Virtual Function (VF) placement in a multi-cloud environment to satisfy the client demands so that the total response time is minimized. In addition we consider the problem of dynamic service deployment for OpenADN, a novel multi-cloud application delivery platform.

Application Service Providers (ASPs) may obtain resources from a number of cloud service providers (CSPs) in an attempt to improve latency and minimize operational expenses (OpEx). The CSPs may use management and control platforms, such as Open Stack and EC2 and the network service providers (NSPs) may use network management platforms, such as, Open Daylight. However, today the ASPs do not have a common management and control platform that would present to them a converged view of all the cloud and network resources. OpenADN being developed at Washington University in Saint Louis aims to allow the ASPs dynamic and real time control of virtual resources across multiple clouds and networks to provide efficient application delivery. The OpenADN platform itself is a complex distributed and multi-threaded system. Performance evaluation and assessment of need for optimization of such a complex platform requires precise and fine-grained behavioral data. In this paper we establish the need for profiling OpenADN like platforms so that the ASPs can optimize its behavior and control their cost, performance (latency) and energy consumption.

Smart energy in buildings is an important research area of Internet of Things (IoT). As important parts of the smart grids, the energy efficiency of buildings is vital for the environment and global sustainability. Using a LEED-gold-certificated green office building, we built a unique IoT experimental testbed for our energy efficiency and building intelligence research. We first monitor and collect 1-year-long building energy usage data and then systematically evaluate and analyze them. The results show that due to the centralized and static building controls, the actual running of green buildings may not be energy efficient even though they may be “green” by design. Inspired by “energy proportional computing” in modern computers, we propose an IoT framework with smart location-based automated and networked energy control, which uses smartphone platform and cloud-computing technologies to enable multiscale energy proportionality including building-, user-, and organizational-level energy proportionality. We further build a proof-of-concept IoT network and control system prototype and carried out real-world experiments, which demonstrate the effectiveness of the proposed solution. We envision that the broad application of the proposed solution has not only led to significant economic benefits in term of energy saving, improving home/office network intelligence, but also bought in a huge social implication in terms of global sustainability.

Ensuring end-to-end quality of service for video applications requires the network to choose the most feasible path in terms of bandwidth, delay and jitter. Quality of service can only be ensured if the paths are reliable - perform to specification per request. This paper makes four contributions to research. First, it presents Reliable Video over Software-Defined Networking (RVSDN) which builds upon previous work of Video over Software-Defined Networking (VSDN) to address the issue of finding the most reliable path(s) through the network for video applications. Second, it presents the design and implementation of RVSDN. Third, it presents the experience of integrating RVSDN into ns-3 which is a network simulator used by the research community to simulate and model computer networks. Finally, it presents the results of RVSDN in terms of the number of requests serviced by the network architecture. RVSDN is able to service 31 times more requests than VSDN and MPLS explicit routing when the reliability constraint is 0.995 or greater using aggregation of reliability across network paths.

The Internet is becoming increasingly mobile. Although several mobility solutions are proposed, none of them has been largely deployed. We propose a new system that can facilitate and support mobility on the Internet. The new mobility support service will be offered as a value-added service by mobility service providers to paying mobile customers. Therefore, the proposed solution is economically viable. We propose to design our mobility management system on cloud computing. Furthermore, we explore the architectural tradeoffs among QoS, economic viability, security and privacy of various cloud aided designs. Our simulation results show how various system architectures could be used to satisfy different requirements.

There are two key issues that prevent Application Service Providers (ASPs) from fully leveraging the cloud "advantage." First, in modern enterprise and Internet-based application environments, a separate middlebox infrastructure for providing application delivery services such as security (e.g., firewalls, intrusion detection), performance (e.g., SSL off loaders), and scaling (e.g., load balancers) is deployed. In a cloud datacenter, the ASP does not have any control over the network infrastructure, thus making it hard for them to deploy middleboxes for their cloud-based application deployments. Second, modern services virtualize the application endpoint. A service can no longer be statically mapped to a single end host. Instead, the service is partitioned and replicated across multiple end hosts for better performance and scaling. In enterprise datacenters, service requests are intercepted by an application-level routing service (APR) in the data plane and dynamically mapped to the correct service partition and the best (e.g. least loaded) instance of that partition. However, although multi-cloud (or Inter-cloud) environments allow ASPs to globally distributed their applications over multiple cloud datacenters leased from multiple cloud providers, ASPs need support of a globally distributed APR infrastructure to intelligently route application traffic to the right service instance. But, since such an infrastructure would be extremely hard to own and mange, it is best to design a shared solution where APR could be provided as a service by a third party provider having a globally distributed presence, such as an ISP. Although these requirements seem separate, they can be converged into a single abstraction for supporting application delivery in the cloud context. A sample design of this abstraction is OpenADN, presented here.

Multihoming practice in the current Internet is limited to hosts and autonomous systems (ASs). It is “connectivity-oriented” without support for user or data multihoming. However, the swift migration of Internet from “connectivity-oriented” to “content-oriented” pattern urges to incorporate user and data level multihoming support in architecture designs instead of just through ad-hoc patches. In this paper, based on our previous research experience, we expand the multihoming concepts to both user and data levels based on the “multiple points of attachment” in a way similar to host multihoming. We propose a new incrementally-deployable multihoming framework by introducing a “realm” concept. The high-level user and data multihoming support can be built on top of the host and AS level multihoming in an incrementally-deployable and flexibly-assembled manner. Realms form a hierarchy of functionally dependable blocks. We define a new dimension of building block-slice which is an incrementally implementable functional unit for multihoming. Besides the long-term support for user and data multihoming, the first step deployment of the new framework is also able to address the short-term routing scalability challenge by reducing the total inter-domain routing table size gradually.

Two key challenges in the design of datalinks for unmanned aircraft (UAS) systems compared to other wireless links are the long range of distances and speeds that need to be covered. The 960 - 1164 MHz part of the IEEE L band has been identified as a candidate spectrum for future manned and unmanned aircraft datalinks. The amount of spectrum available in the L-Band is not sufficient to support video applications common in UASs and so dual-band designs using both L-Band and C-Band are being considered. For L-Band, two projects funded by EUROCONTROL L-Band Digital Aeronautical Communications Systems 1 and 2 (L-DACS1 and L-DACS2) are often mentioned for use in UAS also. We briefly discuss issues with their use for UAS. We compare the two proposals in terms of their scalability, spectral efficiency, and interference resistance. Then we discuss several issues in UAS datalink design including availability, networking, preemption, and chaining. We also propose ways to mitigate interference with other systems in the L-Band.

The support for mobility is a major requirement for the future Internet. Although several mobility solutions have been proposed, none of them has been largely deployed, mostly because they are not economically viable. We propose a business oriented mobility framework - Mobility Support Service (MSS) to be offered as a value-added service to paying mobile customers. MSS uses Identifiers (IDs) to locate the nodes and network addresses as points of attachment for the nodes. MSS is a scalable distributed service. MSS does not require changes in existing network architecture nor services. We present two MSS distributing algorithms that enable tradeoffs among costs and QoS. We show by simulations the advantages of MSS compared to existing mobility solutions, especially regarding scalability and service delay. However the main advantage of MSS is that it can be realistically offered, because it is economically viable.

Cellular networking standards organizations such as the 3rdGeneration Partnership Project (3GPP) are currently developing System Architecture Evolution (SAE) as their core network architecture. SAE is all-IP based. However, IP-based networks face several known issues, such as mobility, multi-homing, location privacy, path preference, etc. Mobile IP (MIP) and its variants, such as Mobile IPv6 (MIPv6), Hierarchical MIP, and Proxy MIP, have been developed primarily to alleviate the mobility problem. These variation and extensions, however, still do not provide many of the features required in Next Generation Wireless Networks (NGWN). The limitations are especially due to the overloading of IP addresses as both node identity and locator. In this paper, we propose an extension to MIPv6 called Virtual ID. This concept applies the ID/Locator split idea into a Mobile IPv6 environment. Virtual ID and its extensions provide many features that would be desired in the NGWN. Since our proposed scheme is based on the standard MIPv6 and Proxy MIPv6, the scheme is fully compatible with the legacy MIPv6.

We present a new Internet architecture based on de-conflated identities (ADI) that explicitly establishes the separation of ownership of hosts from the underlying infrastructure connectivity. A direct impact of this de-conflated Internet architecture is the ability to express organizational policies separately and thus more naturally, from the underlying infrastructure routing policies. Host or organizational accountability is separated from the infrastructure accountability, laying the foundations of a cleaner security and policy enforcement framework. Also, it addresses the present Internet routing problems of mobility, multihoming, and traffic engineering more naturally by making a clear distinction of host and infrastructure responsibilities and thus defining these functions as a set of primitives governed by individual policies. In this paper, we instantiate the primitive mechanisms related to the issues of end-to-end policy enforcements, mobility, multihoming, traffic engineering, etc., within the context of our architecture to emphasize the relevance of a de-conflated Internet architecture on these functions.

In this paper, we take a fresh look at stub-site multihoming within the paradigms of an identifier/locator split architecture. More specifically, we investigate the possibility of enabling multi-homed stub network sites to improve the performance of their end-to-end TCP flows by leveraging the path diversity of the underlying network. We design a host-network co-operative mechanism for end-to-end flow path switching based on reliable transport layer protocol "hints" indicating probable path problems. Our evaluations of actual Internet routing/topology data strongly suggest significant degree of path diversity across path switches available to multihomed stub networks, even within the restricted precincts of inter-domain policy routing. Additionally, we also address the problems of global routing scalability and inbound traffic engineering control as pertaining to stub-site multi-homing.

High definition video streams are gaining larger shares of the Internet usage for typical users on daily basis. This is an expected result of the current boom in the online standard and high definition (HD) video streaming services such as YouTube and Hulu. Because of these video streams' unique statistical characteristics and their high bandwidth requirements, they are considered to be a continuous challenge in both network scheduling and resource allocation fields. In this paper we provide a statistical analysis of over 50 high definition video traces that resembles wide varieties of high definition video traffic workloads. We performed both factor and cluster analysis on our collection of video traces to support a better understanding of video stream workload characteristics and their impact on network traffic. Additionally, we compare and evaluate different modeling approaches for high definition videos traces.

We propose a simple model that is capable of capturing the statistical characteristics of mobile video traces encoded using MPEG4-Part2, AVC and SVC-TS encoding standards. The model can be adjusted to adapt to diverse workload configurations, which gives fellow researchers a great flexibility to evaluate different network traffic scenarios. We also discuss the model-based trace generator and the challenges of its implementation. Moreover, we present the simulation results validating the model using different encoding settings. In addition to that, we provide several insights about our video modeling approach. This will help in testing, simulating and validating mobile video transmission and resource scheduling strategies over broadband wireless networks such as WiMAX and LTE.

Many challenges to the Internet including global routing scalability have drawn significant attention from both industry and academia, and have generated several new ideas for the next generation. MILSA (Mobility and Multihoming supporting Identifier Locator Split Architecture) and related enhancements are designed to address the naming, addressing, and routing scalability challenges, provide mobility and multihoming support, and easy transition from the current Internet. In this paper, we synthesize our research into a multiple-tier realm-based framework and present the fundamental principles behind the architecture. Through detailed presentation of these principles and different aspects of our architecture, the underlying design rationale is justified. We also discuss how our proposal can meet the IRTF RRG design goals. As an evolutionary architecture, MILSA balances the high-level long-run architecture design with ease of transition considerations. Additionally, detailed evaluation of the current inter-domain routing system and the achievable improvements deploying our architecture is presented that reveals the roots of the current difficulties and helps to shape our deployment strategy.

The key to proper resource allocation for mobile video on wireless networks is to have a good model for the resource demands. In this paper, we present the results of analysis of a number of mobile video streams and show that a simple seasonal ARIMA model (SAM) can provide a very good representation for both MPEG4-Part2 and MPEG4-Part10 videos, the formats that are commonly used for mobile videos. The model has been implemented to provide both video frame and RTP packet generators. The model can be used to represent different movies and can be easily adjusted to produce different workloads for simulation studies. We use the SAM generator to compare the performance of three different scheduling methods for video over WiMAX networks: Earliest Deadline First (EDF), Deficit Round Robin (DRR) and a combination of the two. The results show that under overload, EDF introduces unfairness. DRR with deadline is fair and gives the best performance.

MILSA (Mobility and Multihoming supporting Identifier Locator Split Architecture) has been proposed to address the naming and addressing challenges for NGI (next generation Internet), we present several design enhancements for MILSA which include a hybrid architectural design that combines "core-edge separation approach" and "split approach", a security-enabled and logically oriented hierarchical identifier system, a three-level identifier resolution system, a new hierarchical code based design for locator structure, cooperative mechanisms among the three planes in MILSA model to assist mapping and routing, and an integrated MILSA service model. The underlying design rationale is also discussed along with the design descriptions. Further analysis addressing the IRTF (Internet Research Task Force) RRG (Routing Research Group) design goals shows that the enhanced MILSA provides comprehensive benefits in routing scalability, traffic engineering, mobility and multihoming, renumbering, security, and deployability.

Interest in broadband wireless access (BWA) has been growing due to increased user mobility and the need for data access at all times. IEEE 802.16e based WiMAX networks promise the best available quality of experience for mobile data service users. Unlike wireless LANs, WiMAX networks incorporate several quality of service (QoS) mechanisms at the Media Access Control (MAC) level for guaranteed services for data, voice and video. The problem of assuring QoS is basically that of how to allocate available resources among users in order to meet the QoS criteria such as delay, delay jitter and throughput requirements. IEEE standard does not include a standard scheduling mechanism and leaves it for implementer differentiation. Scheduling is, therefore, of special interest to all WiMAX equipment makers and service providers. This paper discusses the key issues and design factors to be considered for scheduler designers. In addition, we present an extensive survey of recent scheduling research. We classify the proposed mechanisms based on the use of channel conditions. The goals of scheduling are to achieve the optimal usage of resources, to assure the QoS guarantees, to maximize goodput and to minimize power consumption while ensuring feasible algorithm complexity and system scalability.

Naming and addressing are important issues for next generation Internet (NGI). In this paper, we discuss a new mobility and multihoming supporting identifier locator split architecture (MILSA). There are three main contributions of our solution. First, we separate trust relationships (realms) from connectivity (zones). A hierarchical identifier system for the realms and a Realm Zone Bridging Server (RZBS) infrastructure that performs the bridging function is introduced. Second, we separate the signaling and data plane functions to improve the performance and support mobility. Third, to provide transparency to the upper layer applications, identifier locator split happens in network layer. A Hierarchical URI-like Identifier (HUI) is used by the upper layers and is mapped to a locators set by HUI Mapping Sublayer (HMS) through interaction with RZBS infrastructure. Further scenarios description and analysis show the benefits of this scheme for routing scalability, mobility and multihoming.

In this paper, an explicit rate control framework for Ethernet applications, especially data centers, is described. The framework guarantees zero packet drops at the congested switch and fast convergence to fair and stable state. In order to manage the congestion, design choices on 2-point and 3- point structures, the reactive and proactive signaling, explicit and implicit rate controls are compared. Then the core component of the framework, queue control, is carefully studied. Furthermore, we show that this framework can seamlessly cooperate with IEEE 802.3x PAUSE mechanism to recover from severe congestion scenarios. Numerical results are provided to support the claims.

Wireless broadband technologies like WiMAX2are spreading especially in areas where wired broadband is not expected to reach. Video streaming is continuously acquiring a larger share of Internetpsilas traffic resulting in a need to have a reliable video traffic model. In this paper, we analyze several video streams compressed for mobile streaming and develop their optimal Seasonal ARIMA models. Although these optimal models are very different, we find that a simple model, which we call Simplified Seasonal ARIMA Model (SAM), represents all of the streams very well. This model is ideally suitable for video generation in mobile video simulation studies. We also present the parameter values suitable for such studies.

Distributed denial-of-service attacks (DDoS) pose an immense threat to the Internet. The most studied solution is to let routers probabilistically mark packets with partial path information during packet forwarding, which is referred as Probabilistic Packet Marking (PPM). In this paper, we study the effect of simple attacker strategies to spoof the markings to impede victim's capacity to traceback. We show that random marking is sufficient to impede the victim from tracing the attackers. A simple enhancement based on IP path length distribution makes it harder for the victim. We hope that this analysis would help researchers to adapt the current PPM techniques accordingly to thwart the DDoS attacks.

IEEE 802.1 standards committee is working on a new specification for congestion notification in Ethernet networks. The goal of this work is to enable application of Ethernet in backend datacenter applications. Such applications typically use fiber channel and infiniband due to their loss-free characteristics. A backward congestion notification (BCN) scheme is one of the candidate schemes proposed to avoid long delays and minimize loss in Ethernet networks. This paper presents an analysis of this scheme. We develop an analytical model to analyze the stability and the rate of convergence of the scheme. It is shown that BCN achieves proportional fairness and not max-min fairness under certain circumstances. Simulation results are presented that validate the analytical results.

Key predistribution is a popular technique for key distribution in sensor networks. The existing predistribution schemes are designed for nodes with no or limited mobility. The existing schemes make use of only one key pool to establish links between the stationary and the mobile nodes. This restricts the mobility of nodes to one specific network. If the same key pool is used in multiple networks, the compromise of keys in one network would lead to compromise of keys in all the networks. We present two different solutions to this problem. The first approach uses a separate disjoint key pool to establish links between the stationary and mobile nodes of the network. In the second approach we take a large key pool and segment it into smaller key pools. Each of these segments acts as the key pool for different stationary sensor networks. The mobile nodes get keys from the aggregate of all these segments. The aggregate key pool can have some segments which can be used for future deployments. We compare the two schemes and analyze their performance. It is assumed that the stationary nodes of the sensor networks are securely connected.

Summary form only given. The author highlights current important topics in networking with particular emphasis on optical and wireless networking.

IP over optical is being envisioned as one of the most attractive architectures for the new Internet. There have been various proposals in IETF and other international standards organizations regarding the interaction of IP routers and optical core networks. This paper describes the architectural alternatives for the integration of IP and DWDM networks using Multiprotocol Lambda Switching (MPLambdaS). The paper also addresses the issues of routing, signaling, control and survivability in an all-optical network.

Exponential growth of Internet traffic and the proliferation of new user applications warrant the development of a new Internet infrastructure. Due to the fundamental satellite system characteristics such as global coverage, broadcast nature and bandwidth on demand, satellite systems are excellent candidates for providing high data rate Internet access and global connectivity accommodating multimedia applications. However, to meet this goal, provisioning of quality-of-service (QoS) within the advanced satellite network systems is the critical requirement. Congestion remains the main obstacle to QoS on the Internet. In today's TCP networks, explicit congestion notification (ECN) is the only explicit mechanism which delivers congestion signals to the source. We present a new traffic management scheme based on an enhanced ECN mechanism. In particular, we used multilevel ECN, which conveys more accurate feedback information about the network congestion status than the current ECN scheme. We have designed a TCP source reaction that takes advantage of the extra feedback information and tunes better its response to the congestion than the current schemes. Our analysis and simulations results show that our scheme performed better than the current ECN, having fewer losses, better network utilization, fewer delays, and the solution is scalable.

In this paper, we document our design of a MAC protocol, called OSU-MAC, subject to the physical layer characteristics and constraints of a narrow-band wireless modem testbed currently being built at the Ohio State University. The narrow-band wireless modem testbed is expected to support both real-time (bus location tracking) and non-real-time (regular) data applications. A number of techniques are proposed to support QoS imposed by the real-time applications, to deal with the asymmetry on the forward and reverse channels and the half-duplex transmission constraint imposed by the physical layer, and to enhance the error control capability of OSU-MAC. We also present simulation results to demonstrate the key functional characteristics of OSU-MAC.

Challenges presented by the exponential growth of the Internet have resulted in the intense demand for broadband services. Providing bandwidth and connectivity on demand has risen to be an important goal for service providers. To realize this, signaling in the optical network seems to be a critical component. Provisioning involves establishing a circuit from one client end system to another, through the optical backbone. With this general notion, this paper discusses in brief the role of signaling in all-optical networks, which employ DWDM for lower layer transport. The architectural choices pertaining to lightpath services are outlined. Signaling procedures for ensuring dynamic end-to-end lightpath setup have also been presented. Path provisioning comprises a string of operations like service and neighbor discovery, route computation, signaling requests, and path setup. This paper tries to summarize the various strategies, designed for each step, for use in the all-optical networks.

This paper proposes an algorithm for aggregating virtual channel connections (VCCs) onto virtual path connections (VPSs) in asynchronous transfer mode (ATM) networks. We focus on the interesting problem of multiplexing onto an available bit rate (ABR) VPC. ABR VPCs are particularly useful for connecting enterprise sites over the Internet, providing a virtual private network (VPN). The VPC/VCC hierarchy is also important for supporting Internet differentiated services over ATM. The coupling between the flow control mechanisms for VCCs and VPCs is not standardized. We propose fairness definitions for VPC bandwidth allocation, and describe an algorithm for allocating the VPC capacity to the multiplexed VCCs. Preliminary simulation results indicate that the algorithm achieves the required fair allocations, while controlling queue sizes.

ATM frame latency is one of the main QoS parameters and consequently an important target in performance testing. We compare MIMO (message in message out), a new metric for measuring frame latency, versus other metrics and in particular versus LCD (last cell delay). Analysis of examples as well as measurement results demonstrate that MIMO is less affected by test workload and is a better indicator of the switch performance, in particular for out-of-service testing. We show how to aggregate MIMO for a network of switches. The expression of MIMO aggregation clearly indicates the contribution of each network element and their interconnections to the total frame latency.

Frame latency, as one of the main QoS parameters, quantifies also the level of quality of network devices. We proposed a new metric for ATM frame latency called MIMO (message-in message-out) latency that improves upon other latency metrics commonly used for continuous frame technologies. Analysis of examples and measurement results showed that MIMO is less workload dependent and a better indicator of switch performance. MIMO can be used to measure the frame latency of a single switch or of a network of switches. We showed that the formulation of MIMO aggregation is very useful in understanding the contribution of each network element and their interconnections to the total frame latency.

We compare the service received by TCP and UDP flows when they share either a link or a Multiprotocol Label Switching (MPLS) traffic trunk. Since MPLS traffic trunks allow non-shortest path links also to be used, the total network throughput goes up with proper traffic engineering. We found that if UDP and TCP flows are mixed in a trunk, TCP flows receive a reduced service as the UDP flows increase their rates. Also, we found that in order to benefit from traffic engineering, MPLS trunks should be implemented end-to-end (first router to last router). If some part of the network is MPLS trunk-unaware, the benefits are reduced or eliminated.

This paper describes the "explicit rate indication for congestion avoidance" (ERICA) scheme for rate-based feedback from asynchronous transfer mode (ATM) switches. In ERICA, the switches monitor their load on each link and determine a load factor, the available capacity, and the number of currently active virtual channels. This information is used to advise the sources about the rates at which they should transmit. The algorithm is designed to achieve high link utilization with low delays and fast transient response. It is also fair and robust to measurement errors caused by the variations in ABR demand and capacity. We present performance analysis of the scheme using both analytical arguments and simulation results. The scheme is being considered for implementation by several ATM switch manufacturers.

In performance testing of ATM switches and networks of switches a variety of connection configurations is needed. In most of the cases, these configurations require one traffic generator and/or analyzer for each switch port. Since this equipment is rather expensive, it is desirable to define scalable configurations that can be used with a limited number of generators. In this paper we present a methodology for the implementation of scalable connection configurations. The methodology is simple and offers a general solution to generate scalable connection configurations. Several examples of scalable configurations illustrate the methodology. The application of this methodology helps users to repeat easily performance tests under the same traffic load conditions.

An explicit rate switch scheme monitors the load at each link and gives feedback to the sources. We define the overload factor as the ratio of the input rate to the available capacity. In this paper, we present three overload-based switch schemes which provide MCR (minimum cell rate) guarantees for the ATM (asynchronous transfer mode) ABR (available bit rate) service. The switch schemes proposed use the overload factor and other terms including current source rate and target utilization to calculate feedback rates. A dynamic queue control mechanism is used to achieve efficient usage of the link, control queues and, achieve constant queuing delay at steady state. The proposed algorithms are studied and compared using several configurations. The configurations were chosen to test the performance of the algorithms in the presence of link bottlenecks, source bottlenecks and transient sources. Finally, a comparison of the proposed algorithms based on the simulation results is given.

In a wireless environment, due to topology changes and characteristics of media (interference in radio signals) the bandwidth of a link is unpredictable and possibly very low, the error rates are variable and extremely high. Provisioning and guaranteeing quality of service (QoS) in such an environment is a very challenging problem. In this paper we propose an adaptive and QoS framework to support multimedia applications in a wireless networking environment. The proposed framework is hierarchical in nature with cluster of mobile end hosts connected to a base station, base stations are connected to a supervisory node, which in turn is connected to the wired infrastructure. The changing conditions in wireless due to interference and possibly mobility, entitle that the real-time applications needing stringent QoS should be adaptable. The framework uses a generic feedback mechanism to support adaptability at all layers of the wireless network. An overview of existing wireless architectures which support QoS is given. The architectures discussed are WAMIS (wireless adaptive multimedia information system), SWAN (seamless wireless ATM network), MMWN (multimedia support for mobile wireless networks), and QGMC (QoS guarantees in mobile computing). The proposed approach is compared with these existing methods.

The available bit rate (ABR) service is designed to fairly allocate the bandwidth unused by higher priority services. The network indicates to the ABR sources the rates at which they should transmit to minimize their cell loss. Switches must constantly measure the demand and available capacity, and divide the capacity fairly among the contending connections. In order to compute the fair and efficient allocation for each connection, a switch needs to determine the effective number of active connections. We propose a method for determining the number of active connections and the fair bandwidth share for each. We prove the efficiency and fairness of the proposed method analytically, and simulate it for a number of configurations.

The ABR rate allocation schemes can achieve high link utilizations by maintaining non-zero (small) queues in the steady state, and draining queues when the sources do not have data to send. The queue length (and queuing delays) can be controlled if part of the available bandwidth is used for draining queues in the event of queue build up. A simple threshold function can allocate such bandwidth to drain queues. Better control of the queues, and hence delay, can be achieved using more sophisticated queue control functions. We study the design and analysis of several such queue control functions: the step, linear, hyperbolic and inverse hyperbolic functions. Analytical explanation and simulation results consistent with analysis are presented. From the study, we conclude that the inverse hyperbolic is the best queue control function. To reduce complexity, the linear function can be used since it performs satisfactorily in most cases.

We give a general definition of weighted fairness and discuss how a pricing policy can be mapped to general weighted (GW) fairness. The GW fairness can be achieved by calculating the excess fairshare (weighted fairshare of the left over bandwidth) for each VC. We show how a switch algorithm can be modified to support the GW fairness by using the excess fairshare term. We use ERICA+ as an example switch algorithm and show how it can be modified to achieve the general fairness. Simulations results are presented to demonstrate that, the modified switch algorithm achieves GW fairness. An analytical proof for convergence of the modified ERICA+ algorithm is given in the appendix.

ABR traffic management for point-to-multipoint connections controls the source rate to be the minimum rate supported by all the branches of the multicast tree. A number of algorithms have been developed for extending ABR congestion avoidance algorithms to perform feedback consolidation at the branch points. This paper discusses various design options and implementation alternatives for the consolidation algorithms, and proposes a number of new algorithms. The performance of the proposed algorithms and the previous algorithms is compared under a variety of conditions. Results indicate that the algorithms we propose eliminate the consolidation noise (caused if the feedback is returned before all branches respond), while exhibiting a fast transient response.

The ATM guaranteed frame rate (GFR) service is intended for best effort traffic that can benefit from minimum throughput guarantees. Edge devices connecting LANs to an ATM network can use GFR to transport multiple TCP/IP connections over a single GFR VC. These devices would typically multiplex VCs into a single FIFO queue. It has been shown that in general, FIFO queuing is not sufficient to provide rate guarantees, and per-VC queuing with scheduling is needed. We show that under conditions of low buffer allocation, it is possible to control TCP rates with FIFO queuing and buffer management. We present analysis and simulation results on controlling TCP rates by buffer management. We present a buffer management policy that provides loose rate guarantees to SACK TCP sources when the total buffer allocation is low. We study the performance of this buffer management scheme by simulation.

Compressed video is well known to be self-similar in nature. We model VBR carrying long-range dependent, multiplexed MPEG-2 video sources traffic. The actual traffic for the model is generated using fast-Fourier transform of the fractional Gaussian noise sequence. Our model of compressed video sources bears similarity to an MPEG-2 transport stream carrying video, i.e., it is long-range dependent and generates traffic in a piecewise constant bit rate manner. We study, the effect of such VBR traffic on ABR carrying TCP traffic. The effect of such VBR traffic is that the ABR capacity is highly variant. We find that a switch algorithm like ERICA+ can tolerate this variance in ABR capacity while maintaining high throughput and low delay. We present simulation results for terrestrial and satellite configurations.

ATM-UBR service responds to congestion by dropping cells when switch buffers become full. TCP connections running over UBR experience low throughput and high unfairness. For 100% TCP throughput, each switch needs buffers equal to the sum of the window sizes of all the TCP connections. Intelligent drop policies can improve the performance of TCP over UBR with limited buffers. The UBR+ service proposes enhancements to UBR for intelligent drop. The early packet discard scheme improves throughput but does not attempt to improve fairness. The selective packet drop scheme based on per-connection buffer occupancy improves fairness. The fair buffer allocation scheme further improves both throughput and fairness.

We extend our earlier studies of buffer requirements of TCP over ABR in two directions. First, we study the performance of TCP over ABR in an ATM backbone. We find that the TCP queues are at the edge router and not inside the ATM network. The edge router requires buffering equal to the sum of the receiver window sizes of the participating TCP connections. Second, we study the performance when ABR capacity is variable due to the effect of various patterns of VBR background traffic. The key factors in this study are the VBR traffic pattern, ABR feedback delays and the sensitivity of the ABR switch scheme to variance. We present our experiences in refining the ERICA+ switch scheme to handle these conditions.

We study the performance of selective acknowledgements (SACK) with TCP over the ATM-UBR service category. We examine various unspecified bit rate (UBR) drop policies, TCP mechanisms and network configurations to recommend optimal parameters for TCP over UBR. We discuss various TCP congestion control mechanisms compare their performance for LANs and WANs. We describe the effect of satellite delays on TCP performance over UBR and present simulation results for LANs, WANs and satellite networks. SACK TCP improves the performance of TCP over UBR, especially for large delay networks. Intelligent drop policies at the switches are an important factor for good performance in local area networks.

Using a trace of address references, the author compares the efficiency of several different hashing functions such as cyclic redundancy checking polynomials, Fletcher checksum, folding of address octets using the exclusive-OR operation, and bit extraction from the address. Guidelines are provided for determining the size of hash masks required to achieve a specified level of performance.>

Fiber-Distributed Data Interface (FDDI) is a 100-Mbps Local Area Network (LAN) standard being developed by the American National Standards Institute (ANSI). It uses a timed-token access method and allows up to 500 stations to be connected with a total fiber length of 200 km.We analyze the performance of FDDI using a simple analytical model and a simulation model. The performance metrics of response time, efficiency, and maximum access delay are considered. The efficiency is defined as the ratio of maximum obtainable throughput to the nominal bandwidth of the network. The access delay is defined as the time it takes to receive a usable token.The performance of FDDI depends upon several workload parameters; for example; the arrival pattern, frame size, and configuration parameters, such as the number of stations on the ring, extent of the ring, and number of stations that are waiting to transmit. In addition, the performance is affected by a parameter called the Target Token Rotation Time (TTRT), which can be controlled by the network manager. We considered the effect of TTRT on various performance metrics for different ring configurations, and concluded that a TTRT value of 8 ms provides a good performance over a wide range of configurations and workloads.

An analysis is made of the impact of various design decisions on the error detection capability of the fiber distributed data interface (FDDI), a 100-Mb/s fiber-optic LAN standard being developed by the American National Standards Institute (ANSI). In particular, the frame error rate, token loss rate, and undetected error rate are quantified. Several characteristics of the 32-b frame check sequence (FCS) polynomial, which is also used in IEEE 802 LAN protocols, are discussed. The standard uses a nonreturn to zero invert on ones (NRZI) signal encoding and a 4-b to 5-b (4b/5b) symbol encoding in the physical layer. Due to the combination of NRZI and 4b/5b encoding, many noise events are detected by code (or symbol) violations. A large percentage of errors are detected by FCS violations. The errors that escape these three violations remain undetected. The probability of undetected errors due to creation of false starting delimiters, false ending delimiters, or merging of two frames is analyzed. It is shown that every noise event results in two code bit errors, which in turn may result in up to four data bit errors. The FCS can detect up to two noise events. Creation of a false starting delimiter or ending delimiter on a symbol boundary also requires two noise events. This assumes enhanced frame validity criteria. The author justifies the enhancements by quantifying their effect.>

We propose a scheme for congestion avoidance in networks using a connectionless protocol at the network layer. The scheme uses a minimal amount of feedback from the network to the users, who adjust the amount of traffic allowed into the network. The routers in the network detect congestion and set a congestion-indication bit on packets flowing in the forward direction. The congestion indication is communicated back to the users through the transport-level acknowledgment. The scheme is distributed, adapts to the dynamic state of the network, converges to the optimal operating point, is quite simple to implement, and has low overhead. The scheme maintains fairness in service provided to multiple sources. This paper presents the scheme and the analysis that went into the choice of the various decision mechanisms. We also address the performance of the scheme under transient changes in the network and pathological overload conditions.

We propose a scheme for congestion avoidance in networks using a connectionless protocol at the network layer. The scheme uses feedback from the network to the users of the network. The interesting challenge for the scheme is to use a minimal amount of feedback (one bit in each packet) from the network to adjust the amount of traffic allowed into the network. The servers in the network detect congestion and set a congestion indication bit on packets flowing in the forward direction. The congestion indication is communicated back to the users through the transport level acknowledgement.

During overload, most networks drop packets due to buffer unavailability. The resulting timeouts at the source provide an implicit mechanism to convey congestion signals from the network to the source. On a timeout, a source should not only retransmit the lost packet, but it should also reduce its load on the network. Basedon this realization, we have developed a simple congestion control scheme using the acknowledgment timeouts as indications of packet loss and congestion. This scheme does not require any new message formats, therefore, it can be used in any network with window flow control, e.g., ARPAnet or ISO.

Traffic measurements on a ring local area computer network at the Massachusetts Institute of Technology are presented. The analysis of the arrival pattern shows that the arrival processes are neither Poisson nor compound Poisson. An alternative model called "packet train" is proposed. In the train model, the traffic on the network consists of a number of packet streams between various pairs of nodes on the network. Each node-pair stream (or node-pair process, as we call them) consists of a number of trains. Each train consists of a number of packets (or cars) going in either direction (from node A to B or from node B to A). The intercar gap is large (compared to packet transmission time) and random. The intertrain time is even larger. The Poisson and the compound Poisson arrivals are shown to be special cases of the train arrival model. Another important observation is that the packet arrivals exhibit a "source locality." If a packet is seen on the network going from A to B, the probability of the next packet going from A to B or from B to A is very high. Implications of the train arrivals and of source locality on the design of bridges, gateways, and reservation protocols are discussed. A numbet of open problems requiring development of analysis techniques for systems with train arrival processes are also described.