Service Function Chains allow the dynamic generation of basic virtual network services in order to build more complex services. They constitute the basis of the flexibility support for 5G and Beyond 5G networks. In order to totally exploit their benefits, the Service Function Chains should adapt to specific user requirements and current network status. The existing mechanisms to compose and embed Service Function Chains mostly disregard energy metrics to guide their decisions, thus resulting in a lack of energy optimisation by network operators. This paper presents a revision of existing Service Function Chain composition and embedding approaches and a discussion of current and future research directions, focused on energy optimisation for adaptive Service Function Chains. Furthermore, an architecture to empower the green orchestration of adaptive Service Function Chains is also drafted.

The widespread use of Machine Type Communication (MTC) has sparked a surge in Machine to Machine traffic, creating a need for efficient wireless network management strategies. The conventional Random Access approach struggles to accommodate the substantial influx of devices that characterize MTC deployment, leading to congestion, delays, and resource wastage. To address these challenges, this study introduces Dynamic Switching Access (DSA), a novel multiple access technique that intelligently alternates between Grant Free and Grant Based protocols based on device intensity. By dynamically adjusting thresholds, DSA capitalizes on the strengths of both protocols, effectively enhancing overall system performance even in scenarios with fluctuating traffic loads. Simulation results conclusively demonstrate that the proposed DSA approach outperforms individual protocols in various multiple access scenarios.

In the domain of Industrial Automation and Control Systems (IACS), security was traditionally downplayed to a certain extent, as it was originally deemed an exclusive concern of Information and Communications Technology (ICT) systems. The myth of the air-gap, as well as other preconceived notions about implicit IACS security, constituted dangerous fallacies that were debunked once successful attacks become known. Ultimately, the industry started shifting away from this dangerous mindset, discussing how to properly secure those systems. In many ways, IACS security should not be treated differently from modern ICT security. For sure, IACS have distinct characteristics, assets, protocols and even priorities that should be considered – but security should never be an optional concern.In this publication, we present the main results of a PhD dissertation that proposes a holistic and data-driven framework capable of leveraging distinct techniques to increase situational awareness and provide continuous and near real-time monitoring of IACS. For such purposes, it proposes an evolution of the Security Information and Event Management (SIEM) concept, geared towards providing a unified security data monitoring solution by leveraging recent advances in the field of real-time Big Data analytics. In the same way, the most recent machine-learning-based anomaly-detection techniques (which are becoming increasingly prominent in the cybersecurity field) are also analyzed and studied to understand their benefits for developing and advancing IACS cyber-intrusion detection processes.

5G networks have strict constraints regarding the services in terms of latency, reliability, and availability, which pose additional challenges to the traditional orchestration solutions, and 6G networks will increment the number of slices and services deployed over different technological domains, adding more difficulties for the orchestrator. Distributed and automated solutions will be essential for this context. This article identifies the main challenges in 5G/6G orchestration and then describes the utility of Artificial Intelligence-driven solutions, outlining an orchestrator architecture for 5G networks. The architecture is then explored as an orchestration solution for two ongoing research projects focused on the deployment of critical services over 5G networks.

Internet of Things (IoT) protocols provide the fundamental mechanisms to collect data from low power devices and lossy networks. IoT protocols collect data blocks from the devices in messages that have one header and a single payload, regardless the size of the payload. This paper presents a solution to collect small size data blocks from low power devices in an efficient way, carrying these data blocks in the payload of a single message. Current solutions do not offer manners to gather many small blocks of data and reduce the overhead of the communication. The proposed solution is a light-weight layer designed to operate with the standard IoT protocol stack aiming to reduce the energy consumption of the energy constrained devices without lowering the data accuracy. The proposed solution was developed in Contiki devices and the measurements conducted on a testbed showed up to 14% energy savings.

It is our great pleasure to welcome you to the 15th IFIP/IEEE International Symposium on Integrated Network Management (IM 2017), sponsored by the IEEE Communications Society and IFIP Working Group 6.6. Held in odd-numbered years since 1989, IM 2017 will follow the 28-year tradition of IM as the primary IEEE Communications Society's forum for technical exchange on management of information and communication technology focusing on research, development, integration, standards, services, and user communities. IM 2017 focuses on the theme “Integrated Management in the Cloud and 5G Era”, that aims at capturing the emerging approaches and technical solutions for dealing with 5G and cloud infrastructures, as well as associated services and applications.

As Supervisory Control and Data Acquisition (SCADA) and Industrial and Automation Control System (IACS) architectures became more open and interconnected, some of their remotely controlled processes also became more exposed to cyber threats. Aspects such as the use of mature technologies and legacy equipment or even the unforeseen consequences of bridging IACS with external networks have contributed to this situation. This situation prompted the involvement of governmental, industrial and research organizations, as well as standardization entities, in order to create and promote a series of recommendations and standards for IACS cyber-security. Despite those efforts, which are mostly focused on prevention and mitigation, existing literature still lacks attack descriptions that can be reused to reproduce and further research specific use cases and scenarios of security incidents, useful for improving and developing new security detection strategies. In this paper, we describe the implementation of a set of attacks targeting a SCADA hybrid testbed that reproduces an electrical grid for energy distribution (medium and high voltage). This environment makes use of real SCADA equipment to faithfully reproduce a real operational deployment, providing a better insight into less evident SCADA- and device-specificities.

With the recent emergence of energy-harvesting technologies in wireless devices, new challenges have to be addressed by Machine-to-Machine (M2M) communication protocols. The Neutral Operation problem is a relevant problem that seeks to maintain the energy reserve of a node in a level that minimizes energy depletion and maximizes the usage of the harvested-energy. However, neutral operation in a multihop network is a more complex issue, since the nodes lack full knowledge of the network and the nodes have diverse harvesting and consumption profiles. A simplification of the Neutral Operation problem is proposed, named Neutral Operation of the Minimum Energy Node, in which the node with the lowest amount of energy determines the operation of the whole network. This paper proposes a battery-aware solution, called Routing and Aggregation for Minimum Energy (RAME), that performs data-aggregation on the traffic load according to the minimum energy reserve on the path. As part the proposed solution, a kinetic battery model has been developed to provide non-linear battery level estimation. Besides, the Routing Protocol for Low-Power and Lossy Networks (RPL) was enhanced to use the kinetic battery estimation as metric for parent node selection and to find periodically the minimum energy reserve on the available paths. The performance evaluation of the proposed mechanism using Contiki shows the benefits of RAME in comparison to the M2M standard protocols.

With the increasing usage of mobile devices for traffic-heavy applications, mobile operators struggle for delivering good performance while, at the same time, optimizing resource consumption. By resorting to Information-Centric Networking and mobile cloud computing paradigms, mobile operators are able to tackle this challenge, simultaneously supporting more users and reducing operational costs. In this paper we propose a Mobile Follow-Me Cloud (M-FMC) model for enhancing the migration of content caches located at the edge of cloudified mobile networks, leveraging the benefits of such paradigms. This is achieved by accounting for content popularity and user mobility, optimizing systems' caches according to user interests and improving resource management. Evaluation results demonstrate that M-FMC model achieves more than 90% accuracy in real-time selection of content objects to be migrated between caches. This performance is reflected in higher cache-hit rates, therefore representing an improvement in content-access latency and overall bandwidth savings.

The specific capabilities of Wireless Sensor Networks (WSNs), such as fast deployment and flexibility, together with the low cost solutions that can be achieved, bring new opportunities for an all-new range of applications, far from the typical scenarios of low requirements and high redundancy. Some of these new scenarios involve the assurance of predefined performance goals. To guarantee that these goals are achieved, a careful constant monitoring must exist. However, this monitoring depletes nodes energy (especially in middle nodes that have to retransmit the information to the sink), increases interference between nodes and causes an overhead in the used bandwidth, a foreseeable result if measuring performance of a large multilevel WSN. In the protocol to be presented, data fusion is used to enhance the benefits of continuous monitoring while minimizing its implied overhead, using the specific characteristics of WSNs in its favor.

Abstract Currently, there are several ongoing efforts for the definition of new regulation policies, paradigms, and technologies aiming a more efficient usage of the radio spectrum. In this context, cognitive radio (CR) emerges as one of the most promising players by enabling the dynamic access to vacant frequency bands on a non-interference basis. However, the intrinsic characteristic of CR opens new ways for attackers, namely in the context of the effective detection of incumbent or primary users (PUs), the most fundamental and challenging requirement for the successful operation of CR networks. In this article, we provide a global and integrated vision of the main threats affecting CR environments in the context of the detection of primary users, with a particular focus on spectrum sensing data falsification and primary user emulation attacks. We also address solutions and research challenges still required to address such threats. Our discussion aims at being complete and self-contained, while also targeting readers with no specific background on this important topic of CR environments. It is, as far as our knowledge goes, the first work providing a global and clear vision of security threats and countermeasures in the context of primary user detection in CR.

Abstract From an internet service provider's (ISP) perspective, modern broadband access networks pose significant and ever increasing challenges in terms of security management. The growing number of permanently connected home networks, with a myriad of poorly managed devices, imposes significant security risks not only to the domestic customers, unable to defend themselves from security attacks, but also to the ISP and third‐parties potentially targeted by large‐scale distributed botnet attacks fed by swarms of zombie domestic personal computers. In this context, the traditional delimitation of customer and ISP perimeters is no longer effective. Home networks became too complex and vulnerable to be autonomously managed by the average customer, and the scale and sophistication of distributed security attacks make it more and more difficult for the ISP to properly manage security without intervening outside the boundaries of its own network. Considering this state of affairs, we propose an alternative architecture for security management. This architecture increases the level of integration and cooperation between the domains of the ISP infrastructure and the home network. At the same time, it potentially improves the scalability and granularity of traditional intrusion detection and prevention mechanisms. Copyright © 2015 John Wiley & Sons, Ltd.

Machine-to-Machine technology supports several application scenarios, such as smart metering, automotive, healthcare and city monitoring. Smart metering applications have attracted the interest of companies and governments since these applications bring many benefits (e.g. costs reduction and increased reliability) for production, monitoring and distribution of utilities, such as gas, water and electricity. Multi-hop wireless communication is a cost-effective technology for smart metering applications because it extends the wireless range and enables fast deployment. Smart metering data communicated via wireless multi-hop approaches needs mechanisms that makes the communication less vulnerable to security threats and saves the device resources. Data encryption and data aggregation mechanisms emerge as potential solutions to fulfill these requirements. However, the simultaneous execution of data encryption and data aggregation mechanisms is not a trivial task. This is because the data encryption prevents the data aggregation mechanism to summarize the data along the path. Another challenge is to manage both mechanisms according to the concurrent Machine-to-Machine (M2M) applications interests. In this context, we present sMeter, which is a framework that deals with multiple applications interests, avoiding interest conflicts of concurrent users and supporting the management of data aggregation and data encryption. sMeter is implemented using low-cost hardware in an indoor environment. The communication is performed via a wireless multi-hop technology, and the performance of this communication is evaluated in terms of delay, data reception ratio and received signal strength indication.

Together with the developments in terms of broadband connectivity and IP-based service consolidation, the introduction of cloud technologies is opening a whole new window of opportunity for service and telecommunications operators alike, to improve and expand their service portfolio. In this line of thought, this paper presents an innovative proposal to improve the delivery of IPTV services for residential users. It departs from the existing model, based on fat Set-Top Box (STB) appliances designed for specific IPTV frameworks, going instead for a solution that turns STBs into stateless devices, with the whole service interface being moved to the provider infrastructure. This thin-client STB-based service delivery model for IPTV, also includes the necessary management mechanisms to provision and configure the involved components. Overall, this approach is designed to enable providers to improve and simplify their IPTV delivery infrastructure, while maintaining backwards-compatibility with their existing Operations Support Systems.

Wireless Mesh Networks (WMNs) provide ubiquitous Internet access for mobile users by integrating wired and wireless networks and are a valuable component of new generation communication systems. As gateways towards wired networks are potential bottlenecks, load balancing between multiple gateways plays a central role in the performance of the WMNs. This is especially important for demanding interactive applications such as Voice over IP in the multi-hop WMNs environment. In this paper a Routing Algorithm for Inter-cluster Load Balancing (RAILoB) in WMNs is set out to improve traffic performance. A simulation study has been carried out to assess the performance of RAILoB with a different number of gateways. The results showed that when RAILoB is used as a load balancing mechanism, the traffic performance in multiple gateway WMNs is improved, while keeping the overhead within acceptable bounds.

The Universal Plug and Play (UPnP) protocol framework was conceived to allow seamless device discovery, control and configuration on domestic LANs, with minimum user intervention. It supports a wide range of devices, from printers to network equipment, having become an important mechanism for automatic configuration of devices within domestic LANs.

The availability of inexpensive sensing devices capable of wireless communications enables the design of exciting and new distributed sensing applications. The integration of such applications with the Internet will contribute to materialize a vision of a future Web that we nowadays describe as the Web of Things (WoT). Many security-related aspects are still open on how to address security for communications on the WoT, and that must be targeted before such applications can realistically be considered ready for deployment. We discuss the experimental evaluation of mechanisms proposed to secure end-to-end web communications with IPv6-capable sensing applications and devices, as such mechanisms may provide an important contribution towards the WoT. Our experimental evaluation study considers the impact of security on real sensing devices and requirements from sensing applications, allowing the identification of the limitations of current sensing platforms in supporting the proposed mechanisms.

Wireless Mesh Networks (WMNs) are being called upon to improve their management policies to support a wide range of multimedia applications. As gateways towards wired networks are potential bottlenecks, cluster load balancing routing methods between multiple gateways play a central role in the routing management of the WMNs. This is especially important for demanding interactive applications, for instance triple play services which include traditional applications such as data applications, voice, and video over IP. However, the current performance assessment of these methods does not take into consideration triple play services in their traffic model and this paper seeks to fill this gap. This entails providing a detailed description of each method and carrying out a comparative evaluation by simulating a traffic model for triple play services. This performance assessment compares these cluster load balancing methods by assessing the traditional traffic performance parameters, while varying the traffic load which is the main variable factor that affects the load balancing methods. The results support that the cluster load balancing routing methods as well as the traffic load have a significant impact on each application performance when the applications are evaluated separately and moreover, they still have impact on the triple play services but it is lesser significant than when a single application is evaluated. Furthermore, the most agile and flexible method results in more scalable triple play service.

Cognitive radio (CR) users (i.e., secondary users) are wireless nodes which are allowed to select and access licensed frequency bands, provided that they do not cause any harmful interference to the respective incumbent users (i.e., primary users). One of the possible approaches consists in having the secondary users locating and accessing vacant frequencies dynamically. However, in scenarios with hidden primary users (i.e., a secondary user cannot sense a primary user on its respective channel, but the two coverage areas overlap each other), it is unfeasible to address the protection of primary users with solutions which are exclusively based on local and non-cooperative sensing schemes. In this work, we propose a cooperative approach which enables an effective protection of primary users in fully distributed CR scenarios, even when the hidden node problem is a concern. Our proposal is based on a key concept we designate as “filtering based on suspect channels” and takes full advantage of any underlying learning scheme based on observation and past experience. It was also successfully integrated with an existing CR medium access control (MAC) protocol. Simulation results show the proposal is effectively capable of delivering high levels of protection concerning the primary users, while preserving the secondary users' communication performance.

A new generation of Wireless Sensor Networks (WSNs) is expanding to performance critical environments. In these new scenarios, performance must be monitored and effectively measured, in order to guarantee that the network fulfills initial expectations. However, measuring performance in WSN has not the same requirements as measuring performance in traditional networks. While new specific WSN metrics have been proposed to cope with the new specific needs of these networks, a global performance framework for evaluating WSN does not yet exist. In this paper, WSN specific communication performance needs are analyzed and, to measure them, an initial approach to a global framework of WSN performance metrics is proposed. These metrics are intended to evaluate the real-time performance of a WSN, providing the necessary measurements to indicate if the QoS expectations are being met.

Critical infrastructure (CI) services are constantly consumed by the society and are expected to be available 24 hours a day. A common definition states that CIs are so vital to our society that a disruption or destruction would have a severe impact on the social well-being and the economy nationally and internationally. CI sectors include, amongst others, the electricity, telecommunication, air traffic and transport sectors. CIs can be mutually dependent on each other and a failure in one CI can cascade to another dependent or interdependent CI to cause service disruptions. Methods to better assess and monitor CIs and their dependencies in order to predict possible risks have to be developed. Information about the current risk in a service provided by a CI can contribute not only to increase CI security, but also to increase the confidence of consumers and CIs that depend on this service. In this paper, a previous work on CI security modelling is extended. A trust based component is added to the security model as a means to improve its accuracy and its resilience to inconsistent information provided by dependent CIs allowing to evaluate the correctness of information received from those dependencies.

QoS adaptation is an important process in inter-domain service management, since it can guarantee the correct service provisioning when unexpected events occur. However, in inter-domain environments, the human interference and the manual-based operations hamper the deployment of expeditious mechanisms to adapt the QoS of the services. This paper presents an approach based on SOA principles to perform QoS adaptation in these environments. This approach allows providers to determine the new QoS parameters, renegotiate these parameters with other providers along the provisioning path, update their contracts and enforce the changes in the equipment configuration in an automatic and on-demand fashion. The QoS adaptation process can be caused by technical (QoS violations, infrastructure malfunctions) or business (financial problems) issues. In addition, if a provider configuration in the provisioning path already supports the new requirements, this provider is not affected by the adaptation, thus decreasing the processing time.

Integrated services delivered over broadband connections are becoming the norm in domestic households, as it is the case with triple-play bundles which offer combined Voice, Television and Data services delivered using IP-based technologies and protocols. As a result, the usage of SIP-based (Session Initiation Protocol) VoIP devices has known a significant growth in domestic environments, either in the form of standalone (e.g. SIP telephones) or embedded devices (as it happens with some domestic gateways, which embed analog-to-SIP adaptors). For Internet Service Providers (ISPs), the provisioning and management of those devices is a challenge — especially standalone SIP phones, since most of them were exclusively designed for corporate LAN usage, not supporting adequate mechanisms for remote management over broadband access networks. In this paper we propose a framework which allows the integration of off-the-shelf SIP phones with the CWMP protocol suite, the prevailing standard for remote management of Customer Premises Devices (CPEs) in broadband access networks. This integration framework supports the vast majority of commercially available SIP phones whilst maintaining full compatibility with the original CWMP specification — thus allowing ISPs to reuse their CWMP management infrastructure to configure and provision off-the-shelf SIP telephones.

Presently there is a lack of remote desktop management solutions for domestic and SOHO users connected to broadband access networks. This contrasts with the enterprise LAN environment, where there are several standards, resources and frameworks for PC or thin-client management. Among these, one specific remote boot technology the Preboot execution Environment (PXE) is now the basis for a wide array of LAN-wide desktop management applications. In this context, integrating PXE-based solutions into broadband access networks would allow novel management paradigms, targeting not just domestic end-users but also telecommuters working from their homes and small businesses which are too small for local deployment of full-fledged enterprise desktop management platforms. In this paper we propose a solution that brings the benefits of managed desktop computing to home users, telecommuters and small businesses by integrating PXE technologies into broadband access network environments. In addition, we also propose a desktop services delivery model capable of efficiently providing a secure and quality managed desktop experience to domestic and SOHO end-users, using a PXE-based thin-client platform for broadband environments that can replace a full-fledged PC whilst maintaining most of its benefits.

Inter-domain QoS-aware service provisioning is still a complex task due to the Internet heterogeneity. It is necessary to overcome several obstacles in order to achieve a scenario where providers fully interact to satisfy all customer service requirements. Some of these obstacles are service class specification and service composition. This paper presents an integrated approach for service class specification and service composition that supports the provisioning of QoS-aware services in inter-domain environments. This approach makes use of QoS performance parameters, service-specific parameters and business parameters to compose services that fulfill customer requirements and comply with providers' business expectations.

Security plays a vital role in enabling future integration of Wireless Sensor Networks (WSNs) with the Internet. Although security in WSNs is a mature field of research and many proposals currently exist that can address particular security threats, how to guarantee end-to-end security at the network layer for IPv6-enabled WSNs remains an open research issue. Security should be addressed at the network layer, as sensor nodes will evolve to become IPv6 aware and new applications are adapted or designed that depend on IPv6 connectivity to sensor nodes. We propose and evaluate new compressed AH and ESP 6lowpan security headers that allow the protection of IPv6 communications on IEEE 802.15.4 WSNs. As the security headers are designed to work side-by-side with other extension headers of the 6lowpan adaptation layer, they allow also the establishment of end-to-end secure communications between Internet hosts and wireless sensor nodes. The usage of IPv6 on WSNs has the potential of enabling the integration of sensing applications with the Internet and, if end to end security is properly addressed, can represent a major contribution towards the "internet of things".

Wireless Mesh Networks (WMNs) are a potentially valuable type of new generation communication systems, that allow wired and wireless networks to be easily integrated. Routing plays a central role in WMNs, due to their multi-hop structure and the need to identify the best routes to the gateways that can provide an acceptable performance for demanding applications such as in triple play services, including traditional data applications, voice, and video over IP. A scheme for scalable routing in Multi-Channel Multi-Radio WMNs has been developed to improve the traffic performance in this callenging scenario, named Cross-layer Routing schEme for scAlable Triple play sErvices (CREATE) in WMNs. CREATE employs a clustering routing scheme which relies on a cross-layer routing metric and on an inter-cluster routing procedure for load balancing. A simulation study to assess the impact of the routing metrics on the different applications that form triple play services was carried out, and provided important insigth to support the choice of the metric to be used on the proposed routing scheme. By combining clustering, inter-cluster load balancing and an interference and load aware routing metric, CREATE has the potential for scalable multi-hop WMNs in the presence of challenging traffic patterns, such as Triple Play Services.

Broadband Forum's CPE Wan Management Protocol (CWMP/TR-069) became, in the last few years, a key industry standard for the management of devices that, despite located in the local network of domestic broadband users, still need to be directly managed by operators due to their relevance to added value services such as VoIP, IPTV, VoD or femtocell applications. Despite its relevance, the adoption of CWMP is still slow, in part because current CWMP applications do not cope well (yet) with the dynamic environment of domestic LANs, where the nature of topologies and services to be managed quickly evolves. In this paper we propose an extensible CWMP agent framework that, whilst keeping full compatibility with the original specification, allows it to better adapt to the home network environment, by incorporating the notion of extensible CWMP agents and proxying mechanisms.

In this paper we study the stability of the Open Box Transport Protocol (OBP), an explicit congestion control protocol that provides information to the end systems about the current state of the network path. To support the study we deduced the OBP transfer function, which modulates the OBP behavior at equilibrium. In the stability evaluation we use Bode and Nyquist diagrams. The OBP stability characteristics, discussed in this work, are only related with the equilibrium phase, in other words when all the network capacity is in use. The results show that the OBP is stable for the tested scenarios and the transfer function does not have unstable poles. We also present an evaluation process that helps to identify the OBP performance. We show that the OBP reaches high utilization of the bottleneck channel and has fairness skills.

Real-time multimedia sessions are now present in our daily live experience, and will be among the most important applications in future generation networks. The distribution of those sessions, towards fixed and mobile users, with Quality of Experience (QoE) assurance is important to attract and keep customers, while increasing the profits of providers. This paper proposes the Quality Level Control for Multi-user Session (QUALITIS) approach to assure the quality level of sessions shared by multiple users (multi-users) in future generation networks. QUALITIS aims to keep sessions with an acceptable quality level and to avoid session blocking. The QUALITIS control is achieved by coordinating Quality of Service (QoS) mapping, QoS adaptation, resource allocation and mobility mechanisms. Performance evaluation was carried out based on simulation experiments and verified the QUALITIS impact on the user's expectation and on the performance of the network.

In a multi-domain Internet that offers quality of service guaranties, there is the need of signaling among the domain entities that are responsible for the management of quality of service. Because different domains have different network protocols and topologies, there is no solution that is able to signal these entities using an off-path approach and, in particular, that is able to interwork with the on-path signaling mechanisms. The HyPath approach extends the NSIS framework and its interactions with the local routing protocols to achieve off- path signaling in these hybrid environments. This document presents HyPath and its evaluation on a test-bed, showing that the mechanisms proposed have the potential to perform off-path signaling without introducing an excessive overhead in the network.

In this paper we propose Open Box Transport Protocol (OBP), a mechanism that provides information to the end systems about the current state of the network path. With this information (essentially the available bandwidth and the most restricted link capacity) the end systems can efficiently use the network resources. OBP is easy to implement because the intermediate nodes only have to provide information about the current network state to the end systems, and don't have to estimate the transmission rate of the flows. The coexistence of flows from OBP and other transport protocols in the same link does not introduce additional problems because the transmission rate of OBP flows is estimated at the sender end system. In this paper we present the new algorithm to estimate the transmission rate of each flow at the end systems. Moreover, we present the evaluation results in fat networks based on NS2 simulations. The results show that OBP can outperform current transport protocols and achieve results as good as XCP (Explicit Congestion Notification Protocol), using a simpler model.

The great demand for real-time multimedia sessions encompassing groups of users (multi-user), associated with the limitations of the current Internet in providing quality assurance, has raised challenges for defining the best mechanisms to deploy the next generation of networks (NGN). There is a consensus that an efficient and scalable provisioning of network resources is crucial for the success of the NGN, mainly in what concerns access networks. Previous solutions for the control of multi-user sessions rely mostly on uncoordinated actions to allocate per-flow bandwidth and multicast trees. This paper introduces a multiuser aggregated resource allocation mechanism (MARA) that coordinates the control of class-based bandwidth and multicast resources in a scalable manner. In comparison with previous work, MARA significantly reduces signaling, state and processing overhead. The performance benefits of MARA are analyzed though simulations, which successfully demonstrated the significant optimization in the network performance.

We present an admission control (AC) algorithm for the specific case of pre-provisioned IEEE 802.16 d links for VoIP aggregates. The algorithm approaches AC from a new perspective as admission criterion is speech quality, the sole true quality metric for voice services. As we found the E-Model can be used to reliably estimate speech quality and the resulting R-Score as admission criterion. Moreover, we show that speech quality can be evaluated on aggregate level without compromising individual call's speech quality. The algorithm is simple, fast, and precise and its behaviour is consistent over a range of different deployments.

Many issues still remain to be addressed in order to achieve acceptable security in wireless sensor networks (WSNs). This necessity, together with the adoption of IPv6 on WSNs being defined at the 6lowpan working group of the IETF, motivates our investigation on the feasibility of the application of IPSec on sensor nodes. IPSec is already part of IPv6, which makes it a natural candidate to be directly employed or adapted for WSNs. We discuss results obtained from practical experiments on the usage of cryptographic algorithms typically employed within IPSec in real sensor nodes. We analyze the security and performance tradeoffs involved when employing cryptography measures in WSNs, also in the context of their usage side-by-side with IPv6. The results obtained show that the adoption of a security architecture such as IPSec is viable, and also point towards the successful design and deployment of a security architecture for WSNs.

Virtual private networks (VPNs) are a popular and cost-effective means to build wide-area corporate networks, since they provide bandwidth, privacy and security for a fraction of the cost of private networks. However, establishing VPNs across different domains (inter-domain VPNs) is still a cumbersome task, requiring human- based negotiation between involved carriers, manual configuration of network equipment and inefficient exploitation procedures during the whole VPN life cycle. For these reasons, inter-domain VPNs are usually contracted in a long-term basis and thus appropriate only for a limited set of usage scenarios. In this paper we propose a framework for efficient provisioning of inter-domain VPNs, comprising a business layer for inter-carrier negotiation and orchestration, policy-based mechanisms for intra-domain resource management, and RFC 4364-based mechanisms for configuration of VPNs. This framework will allow ISPs to provide much more elastic VPN services, able to support not only traditional VPNs (contracted for long periods, for interconnection of corporate networks) but also a new class of more granular, on-demand VPNs for support of shorter-term services such as videoconference sessions or internet banking transaction.

In this paper we present a framework for autonomic QoS provisioning for VoIP services. The central role is held by a Measurement Based Admission Control algorithm which incorporates three innovations. First, the mathematical underpin- ing obeys a non-parametric approach, removing the dependency on a priori assumed characteristics of the underlying stochastic process, i.e. those of the work arrival process. Thus, we tackle a major issue of common parametric MBAC. The second and the third enhancement is embodied in the combination of a closed-loop control based on perceived QoS. Typically, MBAC algorithms do not validate there decision and thats why many algorithms miss QoS targets due to non- stationaries in work arrival processes. As a metric for perfor- mance evaluation we devised a new approach based on the Emodel, an ITU-T standard for quantifying QoS assessment based on human perception. The contribution is the mathematical framework for both, the non-parametric MBAC and its closed-loop control but also an analysis based on simulations.

Multihoming smart routing plays a significant role in improving the performance of Internet access of IP network customers through dynamic path switching. On the other hand, inter-domain traffic engineering becomes indispensable for IP network providers, in order for them to meet their traffic objectives. Unfortunately, this ability of both parties to choose their own routing policies does not necessary lead to the best routing in the Internet. A major challenge of the research on traffic engineering and Internet routing architectures is to accommodate this tussle. However, little is known about the interactions between Inter-domain smart routing and traffic engineering. In this paper, we analyse such interactions through intuitive descriptions and a simulation model. In our evaluations, we observed that the overall stability can benefit from combining Inter-domain adaptive smart routing and traffic engineering. However, we also observed that the effectiveness of Inter-domain traffic engineering can be negatively affected by interdomain routing changes performed by smart routing.

Multicast routing is again gaining popularity with the development of new group services, like real-time multimedia streaming. The aim is to reach big groups of users with the quality level they expect, while using network resources in an efficient way. This is a challenge to be fulfilled as current multicast protocols still have difficulties in dealing with basic issues like asymmetric routing. In this work we describe and evaluate an overlay that allows the use of the source-specific multicast standard in environments with asymmetric routing. A set of tests is made in the data and control plane, to expose the pros and cons of this new proposal.

The occurrence of a traffic anomaly is always responsible for a degradation of performance. The anomaly can be observable, at some scale, in different ways: an increase in the number of packets, an increase in the number of bytes, a concentration of packets around a port number, etc. In this paper we propose an anomaly independent methodology for detecting such traffic anomalies and to classify them. To accomplish that, we integrate previous work in a multi-criteria tomographic analysis process, criteria being bytes, packets or flow rate, port number or address distribution, etc. As a demarcation from this inspiring work, this new methodology is based on a multi-scale analysis, which always permits the exhibition of anomalies on at least one parameter at one time scale. The motivation for using simple parameters deals with making the interpretation of anomalies simpler, and mitigation mechanisms obvious. In addition, this methodology associates to each anomaly a set of parameters that is able to characterize the anomaly and will serve as a signature for it. This paper presents this methodology, the related algorithm for anomaly detection, and its application on several real traffic traces captured on several networks: Auckland university, GEANT and Renater.

The substantial advancement and proliferation of wireless technologies leads to the need to efficiently manage user mobility. Furthermore, the simultaneously emerging of services like video-conference, radio and TV has emphasized the importance to deliver content to several simultaneous receivers. This way, one of the key challenges to deploy multi-user services in the next generation wireless systems is the support of seamless mobility of multi-user services. In this paper the functioning of the seamless mobility of users for media distribution services (SEMUD) proposal is presented. This mobility management technique possesses two operation modes. To provide seamless mobility the standard mode resorts on the collaboration between caches (located in the base stations) and buffers (located in the mobile nodes). The enhanced mode introduces mobility prediction and messages for context transfer between access routers. A performance analysis is given to corroborate the merits of the proposal.

It is expected that next generation of networks will handle new types of services which are destined to large audiences and have different QoS requirements. From the transport point of view, multicast is the most suitable technology for the required group communication services, since it avoids packets duplication and saves network resources. However, QoS-aware multicast content deliver raises several problems, such as the control of QoS trees in environments with asymmetric routing. This paper presents Multi-service Resource Allocation (MIRA), a multicast-aware resource reservation protocol for class-based networks that consider routing asymmetries. MIRA controls the resources of network classes associated to multicast sessions considering the QoS characteristics of the latter and network conditions of the available classes in the source-to-receivers path. A detailed description of the functionalities of MIRA and a conceptual analysis against RSVP and RMD-QoSM are presented. Finally, the session setup time, and the signalling and state overheard in comparison with RSVP are analyzed based on simulations.

Multicast mobility management is a challenging and unsolved task for the successful deployment of multi-user real-time multimedia services in next generation mobile networks. Therefore, a solution that constrains losses during handover and limits the service degradation perceived by users is needed. Moreover, the losses should be constrained taking in consideration the impact that different packets have in the quality of the multimedia session. In this paper, the seamless mobility of users for media distribution services (SEMUD) proposal takes in account this fact when constraining packet losses that result from the handover process. This leads to an augmented capability to provide seamless mobility for multi-user services. This ability is evaluated by comparing the quality of a received video sequence with and without taking into consideration the different importance that packets have in the quality of the sequence. The results attest for the quality improvement of the video sequence when the packets are handled taking in consideration their importance.

Next generation IP networks are envisioned to be heterogeneous, to provide a wide variety of services, and to support mobility of users with distinct requirements. Moreover, mobile communications are expected to expand from telephony to publish-subscribe services, such as real-time multimedia. With this goal, the University of Coimbra is working with DoCoMo Euro-Labs on a unifying control architecture for multimedia publish-subscribe services over an IP-based mobile system, where our proposal aims to control the quality of service and mobility across heterogeneous networks with no perceived service degradation to the users. This article highlights the requirements of a control architecture for publish-subscribe services, and presents our proposal, called QoS Architecture for Multi-user Mobile Multimedia (Q3M). The main components and functionality of the Q3M architecture are analysed from the user and network perspectives, and some simulation results concerning the analysis of the session setup times are presented.

Smart route control is being increasingly used as a way to dynamically improve the end-to-end performance of the outbound traffic of multihomed stub domains. However, all the solutions available at present have in common two drawbacks which are key motivations for this work. First, all solutions are standalone, so no routing control interactions exist between the domains sourcing and sinking the traffic. The consequences of this lack of interactions are quite coarse route control over the outbound traffic from the domains, and the inability to smartly control how traffic flows into the domains. The second drawback is that all available solutions behave in a fully selfish way, that is, they operate without considering the effects of their decisions in the performance of the network. Given these limitations, we propose to extend the existing route control model from standalone and selfish to a cooperative and social route control model. Our main contribution in this paper is to show that when several route controllers compete for the same network resources, the conventional ones are outperformed by those using a cooperative and social approach and this becomes especially noticeable as the network utilization increases. Our results reveal that it is possible to reduce the frequency of traffic relocations by more than a 50% on average and still obtain slightly better end-to-end traffic performance for delay-sensitive applications. A key advantage is that our extension can be installed and used today by simply performing software upgrades to any of the existing route control solutions.

In this paper we present a methodology for detecting traffic anomalies. To accomplish that, and as a demarcation from similar works, we combine multi-scale with a multi-criteria tomography process analysis. With a complete knowledge of traffic anomalies, we intend to define anomalies signatures that could be used in a large range of scopes as traffic engineering, routing and intrusion detection systems, and much more.

Although the single source multicast model is quite mature, the implementation of its protocols became available only very recently and experimental results to evaluate this model are still missing, specially in mobile environments. Hence, our goal is to experimentally evaluate the single source multicast model against the two multicast mobility proposals of the IETF: remote subscription and bi-directional tunneling techniques. We experimentally confirm that the group management query, in remote subscription, and the router advertisement interval, in bi-directional tunneling are unacceptably high and not adjusted for mobile environments. The handover latency of both techniques is closely related with those intervals. Other results show that both techniques have similar throughput and packet loss in home network, having the remote subscription higher throughput in remote access networks. This throughput decrease in remote access networks reveals one of the drawbacks of the bidirectional tunneling technique: the non-optimal routing. Its was also concluded that RFC 3810 is not prepared to deal with mobile environments

Long-Range-Dependency (LRD) and Self-Similarity (SS) effects are synthetically generated by multiplexing ON/OFF sources with Pareto distributed ON and OFF times. Dependent on a myriad of parameters, however, it can be questioned if resulting traffic actually exhibits SS and LRD effects. In this paper we evaluate the robustness of these effects in simulator generated traffic to parameter settings. Using a typical simulation for performance evaluation, we measure the degree of SS and LRD.

At the Communications and Telematics Laboratory of the University of Coimbra is being developed a router prototype with the aim to provide QoS to different traffic classes. One of the most important mechanisms of this router is the IP packet scheduler. It is well known that the common scheduling discipline of current routers (first come first serve) makes them useless when QoS is needed-a different type of scheduler must be used. Our first idea to overcome this problem was to use a simple, open, and available scheduler, easy to adapt to the system we wanted to implement. We thought of the WFQ discipline, and, as we are using a testbed of Intel machines running FreeBSD OS, we admitted that the WFQ/ALTQ implementation would be an interesting choice. Nevertheless, a broad set of tests carried out at our laboratory proved the contrary. Most important, these tests guided us to a deep knowledge of the problems, and causes, that can weaken the effectiveness of IP schedulers. Given the importance of that surplus information, we decided to implement our own scheduler. The idea was to take advantage of a pragmatic view of scheduling activities to construct a scheduler with the best possible characteristics (but also very simple) able to reach very good performance levels. This paper presents the scheduler that resulted from our attempts. The proposed scheduler was subject to a set of tests that proved its ability to effectively differentiate traffic classes. The results of these tests are also presented and analyzed.

This paper presents a study carried out on a weighted fair queuing implementation for Unix routers-the WFQ implementation of the ALTQ project. It shows the WFQ/ALTQ weaknesses and explains why we cannot expect an interesting behavior from a system using such a scheduler. The conclusions here presented are supported by a set of tests using UDP traffic only. With a tool developed in our laboratory, we were able to show that changing the classes' weights does not necessarily result on a different quality of service for each of the existing classes. To achieve this differentiation, the lengths of the queues which serve the scheduler (one for each class) must be increased beyond reasonable values. We found that the low-level dynamics of FreeBSD systems practically turns WFQ schedulers useless. The same is applicable to any other work-conserving discipline. Thus, an important conclusion of this paper, is that one must design very carefully the platforms that support work conserving disciplines in order to expect adequate behaviors from those systems, in terms of QoS provision.