Security and privacy have become a great concern in cloud computing platforms in which users risk the leakage of their private data. The leakage can happen while the data is at rest (in storage), in processing, or on moving within a cloud or between different cloud infrastructures, e.g., from private to public clouds. This paper focuses on protecting data “in processing”. For big data applications, the MapReduce framework has been proven as an efficient solution and has been widely deployed, e.g., in healthcare and business data analysis. In this article, we propose a trust-based framework for MapReduce in big data processing tasks. Specifically, we first quantify and propose to assign the sensitive values for data and trust values for map and reduce slots. We then compute the trust value of each resource employed in the big data processing tasks. Depending on the data's sensitivity level of a task, the task requires a given level of trust (i.e., higher sensitive data requires servers/slots with higher trust level). The MapReduce scheduling problem is then formulated as the maximum weighted matching problem of a bipartite graph that aims to maximize the total trust value over all possible assignments subject to various trust requirement of different tasks. The problem is known to be NP-hard. To tackle it, we observe that within a computing node (VM), slots share the same trust value granted from the secured transformation phase. This helps reduce the number of slot nodes of a weight bipartite graph. Leveraging this fact, we propose an efficient heuristic algorithm that achieves 94.7 percent of the optimal solution obtained via exhaustive search. Extensive simulations show that the trust-based scheduling scheme provides much higher protection for data sensitivity while ensuring good performance for big data applications.

Network virtualization is an inherent component of future internet architectures. Network resources are virtualized from the underlying substrate and elastically provisioned and offered to customers on-demand. Optimal allocation of network resources in terms of utilization, quality of service, and energy consumption has been a challenge. Existing solutions consider congestion control in a single-objective virtual network embedding (VNE) problem. This paper defines a multiple-objective VNE problem called the congestion-aware, energy-aware VNE (CEVNE). The aim is to seek a solution that saves cost, saves energy and avoids network congestion simultaneously. CEVNE modelling techniques and solution approaches apply both the weighting method and the constraint method to search for pareto-optimal solutions that produce the best compromised solutions for all three objectives. Solving VNE problem is, however, NP-hard. A heuristic solution is proposed involving a two-stage coordinated CEVNE. The node-mapping algorithm searches for the sub-optimal solutions for three objectives. The link mapping process is an SDN-based heuristic algorithm that deploys a path service and a resource monitoring application on an SDN controller. The solution is realized using SDN, Segment Routing, and open network operating system platform (ONOS) technologies. The energy minimization is implemented with a registry that keeps track of active nodes and sets inactive nodes to sleep mode. The evaluation results showed that the multiple-objective CEVNE approach is feasible and achieves its goals of optimizing the resource allocation, improving the runtime, saving the energy consumption and controlling the network congestion.

Request route flooding attack is one of the main challenges in the security of Mobile Ad Hoc Networks (MANETs) as it is easy to initiate and difficult to prevent. A malicious node can launch an attack simply by sending an excessively high number of route request (RREQ) packets or useless data packets to nonexistent destinations. As a result, the network is rendered useless as all its resources are used up to serve this storm of RREQ packets and hence unable to perform its normal routing duty. Most existing research efforts on detecting such a flooding attack use the number of RREQs originated by a node per unit time as the threshold to classify an attacker. These algorithms work to some extent; however, they suffer high misdetection rate and reduce network performance. This paper proposes a new flooding attacks detection algorithm (FADA) for MANETs based on a machine learning approach. The algorithm relies on the route discovery history information of each node to capture similar characteristics and behaviors of nodes belonging to the same class to decide if a node is malicious. The paper also proposes a new flooding attacks prevention routing protocol (FAPRP) by extending the original AODV protocol and integrating FADA algorithm. The performance of the proposed solution is evaluated in terms of successful attack detection ratio, packet delivery ratio, and routing load both in normal and under RREQ attack scenarios using NS2 simulation. The simulation results show that the proposed FAPRP can detect over 99% of RREQ flooding attacks for all scenarios using route discovery frequency vector of sizes larger than 35 and performs better in terms of packet delivery ratio and routing load compared to existing solutions for RREQ flooding attacks.

Trust has played a crucial role in enhancing the security of IoT systems over their lifecycles from creation to retirement. Particularly, in a personal space IoT system where devices join and leave the system dynamically, it is important to evaluate the device's behavior in the form of trust on its admission to the system to reduce the risk and uncertainty of the overall system. Currently, proposed trust evaluation models primarily rely on the historical knowledge or trusted recommendations. However, in many situations, such information is not available at the first encounter between the system and the device. The challenge tackled by this paper is how to establish whether a device can be trusted to a level that merits further evaluation for admission into an IoT system when it encounters the system for the first time. We propose a Dirichlet-based trust assessment model to establish the initial trust that the system places on a device in a mobile and dynamic environment called personal space IoT. The proposed scheme can also be used to affirm the trust of a device during its operation or when it is being re-admitted to the system after an interruption. We describe and evaluate our proposed model theoretically and by simulation.

Most countries around the globe are facing the same issue - an aging population. As an individual move from their working life to a retirement life, multiple socio-economic issues can occur as their social life has also significantly changed. This shift often affects an individual's mental health and well-being. As a result, the aging population requires a solution that does reduce not only its impact on the government but also harvests its contribution to the society. Existing solutions are based on utilizing online platforms such as social network or service network as a medium to reduce social isolation and improve the mental health of elderly people. However, these solutions fail on two accounts: 1) they fail to see older people as active contributors and 2) older people do not see the needs or benefits of using them. This paper proposes a solution that addresses those two issues by engaging people actively and collaboratively as contributors of services and/or receivers of social benefits through an assistive platform that integrates a service network with a social network. This model combines the advantages of both platforms, offers many opportunities for seniors to not only utilize their skills and knowledge to exchange benefits with other users but also expand their social life. The proposed model can be used as a mean to engage older adults to the community, making them become more active, improve their mental well-being and subsequently reduce the cost of health services to the society.

Software-Defined Infrastructure (SDI) is a resource sharing infrastructure that embraces the concept of separation of the network control plane from its data plane, and software realization of network functions from the underlying hardware appliances through the virtualization technology in emerging infrastructures such as Cloud, Network Function Virtualization (NFV), and Software-Defined Networking (SDN). Virtualization and virtualized infrastructures bring with them new challenges regarding security and virtual resources protection. Traditional security measures and endpoint security are no longer adequate due to invisible boundaries created among shared logical and virtual entities among numerous users. This paper introduces a software-defined security service (SDS2) for protecting cloud infrastructures. SDS2focuses on defining security concerns regarding physical and virtual boundaries of data, resources, tenants and detecting security breaches through violations of boundaries. Boundaries are defined by security policies and security violations by attackers are predicted, monitored, and detected when boundaries are crossed. This paper describes SDS2and presents its initial implementation. The paper provides examples of policy-defined boundaries and shows the effectiveness and feasibility of our design in detecting invisible security boundaries through simulation of a security control structure and agile, dynamic, and intelligent VSFs.

Currently, the Software Defined Networking (SDN) paradigm has attracted significant interests from industry and academia as a future network architecture. SDN brings many benefits to network operations and management including programmability, agility, elasticity, and flexibility. With SDN and OpenFlow, one of the promising SDN protocols, software defined Network Virtualization (NV) techniques can be designed and implemented via flow table segmentation to provision independent virtual networks (VNs). In this paper, we propose an intent based virtual network management platform based on software defined NV. The objective of the proposed NV platform is to automate the management and configuration of virtual networks based on high level tenant requirement specifications, called intents. The design and implementation of the platform is based on ONOS, an open-source SDN controller, and OpenVirteX, a network hypervisor. The platform is designed to provide multiple VNs over the same physical infrastructure to multiple tenants.

We are living in a cyber space with an unprecedented rapid expansion of the space and its elements. All interactive information is processed and exchanged via this space. Clearly a well-built cyber security is vital to ensure the security of the cyber space. However the definitions and scopes of both cyber space and cyber security are still not well-defined and this makes it difficult to establish sound security models and mechanisms for protecting this space. Out of existing models, maturity models offer a manageable approach for assessing the security level of a system or organization. The paper first provides a review of various definitions of cyber space and cyber security in order to ascertain a common understanding of the space and its security. The paper investigates existing security maturity models, focusing on their defining characteristics and identifying their strengths and weaknesses. Finally, the paper discusses and suggests measures for a sound and applicable cyber security model.

With high data rate and mobility support wireless networks are becoming an integral part of the ubiquitous broadband access. Appropriate dimensioning of the wireless access networks is essential to satisfy users' Quality of Service (QoS) requirements. Once the network is dimensioned, dynamic variations in traffic or population distribution can affect the capability of the network to deliver the agreed QoS of connections. Consequently, re-dimension the network may be necessary. Current researches do not discuss the effects of QoS schemes on the capacity of the network. In this paper, we investigate the impact of QoS schemes on the capacity of the network. The objective is to determine the capability of the network to deal with the variations in the demography of the covered area and the user's traffic profile with the proposed QoS schemes including Congestion Control (CC) and Radio Admission Control (RAC). Different scenarios are presented to evaluate the effects of QoS schemes on the capacity of the network. This investigation will assist network operators to determine the point after which the network needs to be re-dimensioned.

Cloud computing is a cost-effective solution to the current expensive IT infrastructure for healthcare but it has not been adopted due to the due to the concerns that current Cloud technologies are inadequate to protect sensitive information contents of health records in the outsourced environment. This paper focuses on how electronic health records can be protected in the Cloud environments deploying our proposed trust-oriented data protection framework. In particular, it introduces a technique for transforming raw electronic health records to active data cubes and for encoding data for storage and fast access. Implementation of the framework is also presented.

Radio Admission Control (RAC) is a key function of the Radio Resource Management (RRM) at layer 3 of an eNodeB; however, the 3GPP standard does not specify the RAC and is left as an eNodeB vendor specific. Most admission control schemes proposed to date do not ensure differentiation among the users at different priority levels. Also, they do not provide fairness among the users with the same priority. This paper proposes a novel RAC scheme for Long Term Evolution (LTE-Advanced) networks based on the combined idea of complete sharing and virtual partitioning. It introduces a step wise degradation scheme, to prioritize the high priority traffic in state of resource limitations. A detailed and comprehensive simulation is performed in Opnet to show the efficiency of the proposed RAC scheme. The simulation results demonstrate that the proposed RAC scheme minimizes the call blocking probability and adheres extremely well to the bandwidth constraints of different traffic types.

Recently cloud computing has been increasingly gaining attention and spreading in various industries. This novel paradigm also has received significant research focus on the data security and privacy issues due to its outsourced nature. However, few of the research efforts have been focused on data mobility issues which existed intrinsically in highly complex and dynamic cloud services. To address this challenge, this paper discusses full mobility management of cloud data from two aspects: data mobility management and user mobility management. The work is based on our previously proposed active data-centric framework. Taking advantage of this framework, the active data can establish an active binding relationship with its user. Any data mobility-related behavior could inform to its bundled user instantly and safely. The paper also discusses user mobility management via the self-adaptable heterogeneous network handoff mechanism to ensure the ubiquitous informing service in the mobile cloud environment. The experimental outcomes demonstrate the feasibility, proactivity, and efficiency by the full mobility management scheme.

In next generation wireless networks like WiMAX, a dynamic Call Admission Control (CAC) plays an important role to ensure Quality of Service (QoS) of existing users and to efficiently utilize network resources. We propose a predictive CAC namely Wireless Fair Intelligent Admission Control (WFIAC) that admits or rejects a new incoming connection base on resource availability and load in the network. The proposed CAC works in conjunction to a load control module namely WiMAX Fair Intelligent Congestion Control (WFICC) to determine load in network. The proposed CAC is based on bandwidth borrowing and degradation of over provisioned connections in order to minimize blocking probability and to maximize resource utilization in the network. Once the network load reduces, WFICC upgrades the bandwidth allocated to connections that have data to send. So, WFIAC along with WFICC ensures the network operates around a target operating point to guarantee QoS to end users. A detailed and comprehensive simulation is performed in ns-2 to show the efficiency of the proposed CAC scheme in terms of blocking probability of different service classes and QoS provisioning to existing connections when the network is in congested and non congested state.

In WiMAX architecture the base station lacks the mechanisms to avoid it from being overloaded, which can lead to degradation in the Quality of service (QoS) experienced by the users in the cell, as the large queue at buffer risk high delays and buffer overflow. Congestion avoidance is rarely considered in ensuring the QoS of wireless connections. Efforts are mainly aimed at reducing the overload once it has occurred or to ensure the provision of QoS under load conditions. In this paper we propose a mechanism namely WiMAX Fair Intelligent Congestion Control (WFICC) to avoid congestion at the base station. WFICC ensures that the traffic is scheduled in such a way that the base station output buffer operates at a target operating point, without violating the QoS requirements of connections. A detailed simulation study is performed in ns-2 to evaluate the effectiveness of proposed algorithm to meet the QoS requirements of different Class of Services (CoSs). The results have shown that the proposed WFICC algorithm enables the base station to avoid congestion and ensures the provision of QoS of different Class of Services (CoSs) in terms of throughput, fairness and packet delay.

We present an approach to analyze the applicability and secrecy properties of the selected security mechanisms when implemented with UDT. This approach extends applicability refinement methodology with symbolic model in UDT implementations. In our approach, we carry out a formal proof of correctness, therefore, determining applicability, using formal composition logic. This approach is modular, comprising a separate proof of each protocol section and providing insight into the network environment in which each section can be reliably employed. Moreover, the proof holds for a variety of failure recovery strategies and other implementation and configuration options. We derive our technique from the protocol composite logic on TLS and Kerberos in the literature. We, maintain, however, the novelty of our work for UDT specifically our newly developed mechanisms such as UDT-AO, UDT-DTLS, UDT-Kerberos(GSS-API) specifically for UDT.

In WiMAX architecture to avoid congestion at the base station, a mechanism namely WiMAX Fair Intelligent Congestion Control (WFICC) was proposed in [11]. WFICC ensures that the traffic is scheduled in such a way that the base station output buffer operates around a target operating point, without violating the Quality of Service (QoS) requirements of connections. However, only preliminary results were presented in [11]. The aim of this paper is to investigate WFICC thoroughly and evaluate its performance in terms of throughput, delay and jitter for various Class of Services (CoSs) under various parameter settings of the algorithm. A detailed and comprehensive simulation study on various settings of parameters is performed in ns-2. The results show that WFICC performs extremely well in allocating resources fairly among Class of Services (CoSs), yet preserving their QoS requirements. Furthermore, WFICC is robust and easily adapted to various traffic conditions.

Most wireless sensor networks operate with very limited energy sources-their batteries, and hence their usefulness in real life applications is severely constrained. The challenging issues are how to optimize the use of their energy or to harvest their own energy in order to lengthen their lives for wider classes of application. Tackling these important issues requires a robust architecture that takes into account the energy consumption level of functional constituents and their interdependency. Without such architecture, it would be difficult to formulate and optimize the overall energy consumption of a wireless sensor network. Unlike most current researches that focus on a single energy constituent of WSNs independent from and regardless of other constituents, this paper presents an Energy Driven Architecture (EDA) as a new architecture and indicates a novel approach for minimising the total energy consumption of a WSN.

In this paper, we use statistical tools to analysis dependency between Wireless Sensor Network (WSN) parameters and overall Energy Consumption (EC). Our approach has two key steps: profiling, and effective parameter extraction. In former step, a sensor network simulator is re-run 800 times with different values of the WSN parameters to profile the average residual energy in nodes. In latter step, three statistical analyses (p-value, linear and non-linear correlation) are applied to the outcome of profiled experiments to extract the most effective parameters on WSN residual energy.

Deploying state-of-the-art technologies is vital and inevitable in healthcare industry to cope with emerging services such as healthcare resource sharing and integration, collaborative consultation, and electronic health record. Cloud computing allows simple and easy user access, coping with users' dynamic and elastic demands, providing metered usage for its resources and hence is increasingly being adopted by individual users as well as enterprise users. The Cloud is being considered as appropriate technology for future healthcare infrastructure. However, in order to use of Cloud services effectively, users' data and/or resource have to be transferred to the cloud side and this inevitably raises several serious issues concerning losing control of users' resource, data privacy protection, data ownership and security. This paper addresses security and privacy challenges in healthcare cloud by deploying a novel framework with CPRBAC (Cloud-based Privacy-aware Role Based Access Control) model for controllability, traceability of data and authorized access to system resources. Furthermore, the work seeks to develop a unique active auditing service that is capable of tracing, tracking, and triggering an alarm on any operation, data or policy violations in the Cloud environment.

In-house healthcare monitoring applications are continuous time-critical applications often built upon Body Area Wireless Sensor Networks (BAWSNs). Our Assistive Care Loop Framework (ACLF) is an in-house healthcare application capable of monitoring the health conditions of aged/patients over a dedicated period of time by deploying the BAWSN as the monitoring component. However, the wireless medium used in the BAWSN for communications is prone to vulnerabilities that could open a door to attackers tampering with or compromising the user's data privacy. Hence, it is imperative to maintain the privacy and integrity of the data to gain the confidence and hence, the acceptance of the users of the healthcare applications. Furthermore, in time-critical applications, the vital health conditions must be monitored at regular intervals within their specified critical time. Therefore, the security model proposed for the BAWSN must not incur undue overheads when meeting the critical time requirements of the application. In this paper, we propose and implement a secure adaptive triple-key scheme (aTKS) for the BAWSN to achieve the privacy and integrity of the monitored data with minimal overheads. We then present the performance results of our scheme for the BAWSN, using real-time test-bed implementations and simulations.

With high data rate and mobility support wireless networks are becoming an essential access component and an integral part of the ubiquitous Internet. As the provision of wireless networks is cost effective, they are being adopted for broadband access in rural areas (e.g., the Australian National Broadband Network). In this paper we present a comprehensive study of the parameters that effect both the capacity and coverage of IEEE 802.16e WiMAX which will serve as a basis for designing an effective access network including network dimensioning and provisioning QoS for dynamic and mixed distribution of services. In particular, the effect of physical and MAC layer overhead is considered for capacity evaluation with a simple scheduler. The paper also discusses the usage of compressed MAPs with SUB-DL-UL-MAP to reduce overheads and increase network capacity. Different scenarios are presented to evaluate the effect of standard and compressed overhead on capacity and coverage.

Sensors have limited resources so it is important to manage the resources efficiently to maximize their use. A sensor's battery is a crucial resource as it singly determines the lifetime of sensor network applications. Since these devices are useful only when they are able to communicate with the world, radio transceiver of a sensor as an I/O and a costly unit plays a key role in its lifetime. This resource often consumes a big portion of the sensor's energy as it must be active most of the time to announce the existence of the sensor in the network. As such the radio component has to deal with its embedded sensor network whose parameters and operations have significant effects on the sensor's lifetime. In existing energy models, hardware is considered, but the environment and the network's parameters did not receive adequate attention. Energy consumption components of traditional network architecture are often considered individually and separately, and their influences on each other have not been considered in these approaches. In this paper we consider all possible tasks of a sensor in its embedded network and propose an energy management model. We categorize these tasks in five energy consuming constituents. The sensor's Energy Consumption (EC) is modeled on its energy consuming constituents and their input parameters and tasks. The sensor's EC can thus be reduced by managing and executing efficiently the tasks of its constituents. The proposed approach can be effective for power management, and it also can be used to guide the design of energy efficient wireless sensor networks through network parameterization and optimization.

Despite cloud computing has been widely adopted by most industries, the healthcare industry still reveals a slow development in cloud-based solution due to the raising of user fear that their confidential health data or privacy would leak out in the cloud. To allay users' concern of data control, data ownership, security and privacy, we propose a robust data protection framework which is surrounded by a chain of protection schemes from access control, monitoring, to active auditing. The framework includes three key components which are Cloud-based Privacy-aware Role Based Access Control (CPRBAC) model, Triggerable Data File Structure (TDFS), and Active Auditing Scheme (AAS) respectively. Our schemes address controllability, traceability of data and authorize access to healthcare system resource. Data violation against access control policies can be proactively triggered to perform corresponding defense mechanisms. Our goal is to bring benefits of cloud computing to healthcare industries to assist them improve quality of service and reduce the cost of overall healthcare.

Deploying state-of-the-art technologies is vital and inevitable in assistive healthcare to cope with emerging services such as remote monitoring, collaborative consultation, and electronic health record. Grid computing has succeeded somewhat in enabling the sharing of resources across organizations but has not been deployed widely due to its complex implementation and interface. Cloud computing overcomes this aspect by allowing simple and easy user access, coping with users' dynamic and elastic demands, providing metered usage for its resources and hence is increasingly being adopted by individual users as well as enterprise users. The Cloud may just be the right technology for healthcare infrastructure. However, several serious issues concerning security, data protection and ownership, quality of services, and mobility need to be resolved before Cloud computing can be widely adopted. This paper proposes Mobile Cloud for Assistive Healthcare (MoCAsH) as an infrastructure for assistive healthcare. Besides inheriting the advantages of Cloud computing, MoCAsH embraces important concepts of mobile sensing, active sensor records, and collaborative planning by deploying intelligent mobile agents, context-aware middleware, and collaborative protocol for efficient resource sharing and planning. MoCAsH addresses security and privacy issues by deploying selective and federated P2P Cloud to protect data, preserve data ownership and strengthen aspects of security. It also addresses various quality-of-service issues concerning critical responses and energy consumption.

The increasing ageing population around the world presents an unprecedented challenge in developing economically viable healthcare systems for our societies. To overcome this challenge and maintain a decent level of healthcare, further innovation and deployment of information technologies in the field of healthcare are the keys. Our earlier work puts forward "An Active Grid Infrastructure for Elderly Care" solution whereby elderly people are monitored non-intrusively to provide essential health information about them; the information concerning their condition is kept in an "active" health record; and resources involved in the system can be shared by multiple caregivers or organizations allowing them to collaborate in developing relevant care programs for these elderly persons. This paper focuses on the design of the collaborative component of the solution. A framework is proposed for an integrated Grid system that supports collaborative task planning and workflow development. The system will enable healthcare professionals to access the necessary resources, collaborate with each other to develop and execute treatment workflows in a user-friendly and intuitive manner. The paper will discuss the requirements and design principles for key components of the system and present its preliminary implementation.

The cochannel overlapping basic service sets (OBSS) wireless interference is unavoidable in a high-density overlapping BSS environment. In order to provide interference-free environment and, at the same time, Quality of Services, centralized resources coordination functionalities particularly in Medium Access Control (MAC) layer are required. The proposed scheme, based on the context of 802.11 WiFi, separates the uplink and downlink transmission into two periods governed by contention scheme and polling scheme respectively. The possible collisions during the synchronized uplink period are avoided because of the natures of contention scheme used. During the downlink period, the grouping assignments, using coloring theory, are carried out based on the topology to divide BSSs into groups and then time spans to avoid collision. The constraint of grouping is that no two overlapping BSSs could be assigned to the same group/time span, so interferences are minimized using time division technique. A complete performance analysis in a number of simulation scenarios is finally presented.

Various wireless technologies have been used in health monitoring systems; however, it is not always clear why one technology is chosen over another and how it fits into the overall architecture of an application. This paper explores many limiting characteristics of relevant wireless technologies and attempts to provide a basis for making an appropriate selection. The paper also suggests an architecture that supports collaboration among multiple caregivers over a particular health monitoring application.

Peer-to-peer (P2P) technologies developed rapidly in different directions with various applications and routing mechanisms. However, the lack of standardization in functional architectures of the P2P systems makes their performances far from optimal. This trend also restricts the interoperability amongst the systems, and limits the exploitation of the edge-Internet resources and tangible benefits for Internet users. Inspired by the TCP/IP model, this paper introduces PARM: a physically-aware reference model for overlay internetworking. PARM is a layered model that enables a more modular communications approach to solve P2P problems and to optimize systems more efficiently. Simulation results indicate that PARM helps to produce better performance overlays with desirable features such as decentralization, self-organization, and minimal delay penalty.

The Internet is composed of many separate administrative domains called autonomous systems (ASs). To enable the end-to-end quality of service (QoS) for Internet applications, the inter-autonomous system QoS routing plays an important role in advertising the available network resources between domains. In this paper, border gateway protocol (BGP) is extended to provide end-to-end QoS. The choice of using BGP is due to 2 reasons: (1) BGP is currently the only inter-domain routing protocol activated on the Internet. (2) The use of attributes attached to routes makes BGP powerful and scalable inter-domain routing protocol. This paper introduces an extension to BGP to support multi-domain feature for our new FICC-Diffserv architecture, which was introduced in an earlier work. Via simulation results, we demonstrate the performance of the BGP-extended architecture, including route selection policy and overhead reduction issues. The paper concludes by highlighting some directions for future research.

Hospitals around the world are taking advantage of wireless LAN-based computing technologies in view of their mobility, flexibility, and speed to improve the quality and reduce the cost of patient care. The handheld computers have evolved into a viable platform for these organizations to access and manage the patients' information wirelessly from any point of care. However, the deployment of the handheld technology is hindered by the lack of automation of workflows in the present hospital system architecture. In this paper, thin client architecture with workflow decision making is presented by considering the outpatient workflow. The prototype is not intended to replace the workflows in the healthcare but to facilitate the health care professionals to receive useful and relevant information on time with greater flexibility than before. The prototype focuses on exchanging information with existing legacy systems, updating data in real time, and making them available to healthcare professionals by organizing daily routines in the ward.

One of the major weaknesses of existing peer-to-peer (P2P) networks is that their overlay structures do not correlate to the physical underlying network topology. As a result, the overlays waste network resources and introduce excessive end-to-end latency for P2P applications. In this paper, we present a new model for topology-aware overlay formation. Firstly, it clusters nodes that are close to each other in terms of network latency and network membership. Secondly, it discovers the underlying topology between clusters to form an efficient overlay. The model is self-organising and distributed without the need of global knowledge.

Programmable network architectures facilitate dynamically updatable functionality to enable selective and trusted third parties on-demand service deployment. Resource and security management of such architectures on shared infrastructure have proven as challenging tasks. This is due to the extent of functionality provided to users and the heterogenous nature of service resource requirements and resource availability. In this paper we present a new programmable network platform that enables safe sharing by providing each trusted user (e.g., an Internet service provider) with a secure, separate, and resource assured partition, representing a 'virtual router', to accommodate their services. To allocate router internal resources among these partitions and among competing services within a partition, this paper uses a new scalable and adaptive mechanism called control plane-quality of service (C-QoS).

This paper analyses the behaviour and evaluates the performance of a new QoS DiffServ model, called FICC-DiffServ, as implemented in [I]. The implementation proposed a comprehensive framework for DiffServ networks. In the model, the fair intelligent congestion control (FICC) algorithm is applied to provide fairness among traffic aggregates and control congestion inside the networks. Simulation results show that the FICC-DiffServ is robust and simple to implement. It provides excellent fairness and minimizes the packet delay and jitter under a wide range of variations of both internal and external network conditions. In addition, the paper investigates the dynamicity of the overall system by studying the impact of its target operating point on the overall system performance and suggesting a scheme to adjust the operating point adaptively.

The multi-hop ad hoc network is promising to extend the reach of the current mobile Internet, and support ubiquitous computing. However, it is hindered by the lack of a flexible network structure to bridge the gap between MANETs and heterogeneous IP networks. The paper introduces a novel mobile peer-to-peer overlay as an enabling structure for uniting connectivity, mobility and services. Our proposed service architecture allows mobile users to build networks on-the-fly, and capitalize relevant resources in their vicinity for universal communications. A practical implementation of the system prototype demonstrates that our proposed framework lays a solid foundation for developing an integrated mobile Internet and ubiquitous computing.

A dynamically extensible control plane is a key enabling feature of next generation intelligent self-configuring networks. This extensibility can be achieved by enabling service deployment into the control plane of a network. These services consume unpredictable amounts of resources at nodes with unknown resource availability. The paper presents an autonomic resource management model, called C-QoS, for extensible control planes. Under the C-QoS model, services are classified into classes according to their importance or QoS requirements. Resources are allocated among classes according to a differentiated per-class resource allocation scheme, while services within a class receive fair treatment. Due to the difficulty of determining resource availability in a heterogenous infrastructure or service resource requirements, this scheme is dynamically adaptive to each resource according to its demand patterns.

Advances in Grid technology enable the deployment of data-intensive distributed applications, which require moving terabytes or even petabytes of data between data banks. The current underlying networks cannot provide dedicated links with adequate end-to-end sustained bandwidth to support the requirements of these Grid applications. DWDM-RAM is a novel service-oriented architecture, which harnesses the enormous bandwidth potential of optical networks and demonstrates their on-demand usage on the OMNInet. Preliminary experiments suggest that dynamic optical networks, such as the OMNInet, are the ideal option for transferring such massive amounts of data. DWDM-RAM incorporates an OGSI/OGSA compliant service interface and promotes greater convergence between dynamic optical networks and data intensive Grid computing.

Next generation applications and architectures (for example, Grids) are driving radical changes in the nature of traffic, service models, technology, and cost, creating opportunities for an advanced communications infrastructure to tackle next generation data services. To take advantage of these trends and opportunities, research communities are creating new architectures, such as the Open Grid Service Architecture (OGSA), which are being implemented in new prototype advanced infrastructures. The DWDM-RAM project, funded by DARPA, is actively addressing the challenges of next generation applications. DWDM-RAM is an architecture for data-intensive services enabled by next generation dynamic optical networks. It develops and demonstrates a novel architecture for new data communication services, within the OGSA context, that allows for managing extremely large sets of distributed data. Novel features move network services beyond notions of the network as a managed resource, for example, by including capabilities for dynamic on-demand provisioning and advance scheduling. DWDM-RAM encapsulates optical network resources (Lambdas, lightpaths) into a Grid service and integrates their management within the Open Grid Service Architecture. Migration to emerging standards such as WS-Resource Framework (WS-RF) should be straightforward. In initial applications, DWDM-RAM targets specific data-intensive services such as rapid, massive data transfers used by large scale eScience applications, including: high-energy physics, geophysics, life science, bioinformatics, genomics, medical morphometry, tomography, microscopy imaging, astronomical and astrophysical imaging, complex modeling, and visualization.

Differentiated service network (DiffServ) provides an architecture that is scalable and capable of differentiating applications' quality of service (QoS). However, it could not control its loads under heavy traffic conditions, and it could not achieve assured service for TCP and UDP traffic-mixes if these flows are aggregated into a DiffServ class. This paper investigates these problems across multiple DiffServ domains. The paper suggests a solution that involves an edge-aware resource discovery (RD) feedback loop and fair intelligent admission control (FIAC) scheme for each DiffServ domain. The scheme is characterized by two fundamental features. First, the RD loop infers the availability of network resources, yet for scalability, it does not involve core routers. Second, the admission control module understands incoming traffic's requirements, reconciles with available resources via the RD loop, and admits traffic intelligently according to the FIAC algorithm. Multiple-domain control is obtained by concatenation of the RD loop and FIAC admission for each domain along the path from a source to a destination. Simulation results demonstrate that the enhanced DiffServ solution can admit traffic appropriately in terms of fairness and efficiency.

In this paper, we examine algorithmic issues related to the delayed multicast technique for video-on-demand delivery. We introduce the minimum total memory (MTM), minimum total traffic (MTT) and the minimum maximum memory per node (MMMN) delayed-multicast allocation problems. We examine these problems on two networks of practical interest, namely, the chandelier and the broom networks. We provide polynomial time algorithms for solving the MTM and the MTT problems on the chandelier network and the MTM problem on the broom network. We also show that a version of the decision-MMMN problem on a general graph is NP-complete. Finally, we present a heuristic method for obtaining a solution for the MTM problem on tree networks.

With their increasingly sophisticated applications, users promote the notion that there is more to a network (be it an intranet, or the Internet) than mere L1-3 connectivity. In what shapes a next generation service contract between users and the network, users want the network to offer services that are as ubiquitous and dependable as dial tones. Typical services include application-aware firewalls, directories, nomadic support, virtualization, load balancing, alternate site failover, etc. To fulfill this vision, a service architecture is needed. That is, an architecture wherein end-to-end services compose, on-demand, across network domains, technologies, and administration boundaries. Such an architecture requires programmable mechanisms and programmable network devices for service enabling, service negotiation, and service management. The bedrock foundation of the architecture, and also the key focus of the paper, is an open-source programmable service platform that is explicitly designed to best exploit commercial-grade network devices. The platform predicates a full separation of concerns, in that control-intensive operations are executed in software, whereas, data-intensive operations are delegated to hardware. This way, the platform is capable of performing wire-speed content filtering, and activating network services according to the state of data and control flows. The paper describes the platform and some distinguishing services realized on the platform.

"Delayed-multicast" is a novel transmission technique which uses internal nodes in the transmission paths from the server to the clients to buffer data streams. The buffers are used to service later requests without having to start new streams from the server, thus bringing the benefits of traditional multicast without the constraint that all requests must be serviced at the same time. We describe our new scalable "delayed-multicast" framework and present an optimal resource allocation algorithm that minimizes the total bandwidth required to service a set of requests.

Numerous studies have indicated that ATM available bit rate (ABR) service can provide low-delay, fairness, and high throughput, and can handle congestion effectively inside the ATM network. However, network congestion is not really eliminated but rather it is pushed out to the edge of the ATM network, packets from TCP sources competing for the available ATM bandwidth are buffered in the routers or switches at the network edges, causing severe congestion, degraded throughput, and unfairness. This poor performance is mainly due to the uncoordinated interaction between the congestion control mechanism of TCP and ATM. It is well accepted that some form of cooperation at edge device would help to control TCP traffic flow over ATM more effectively. We have previously proposed the fair intelligent explicit window adaptation (FIEWA) scheme and fair intelligent ACK bucket control (FIABC) scheme. The key idea is to combine the feedback information from the receiver, from the underlying ATM network, and from the local information at the edge device intelligently to explicitly/implicitly control the TCP rate. We present a comparative simulation study on our schemes with other established schemes; to identify the characteristics of each different scheme; and to indicate the requirement for a fairer, simpler and more robust coherent approach at the edge device.

This paper proposes a novel application layer quality of service (QoS) feedback control scheme for supporting compressed video. In this proposal, a QoS packet is sent by the source after each video frame to transfer QoS information. The source employs a simple additive-increase and explicit-decrease bandwidth algorithm to adjust its rate based on the QoS feedback parameters sent from the destination. The simulation results show that the proposed scheme is able to control the jitter, delay and loss very efficiently.

This paper presents a global optimal solution technique for the joint optimization of link capacity and flow assignment (CFA) in a packet-switched communications network,m-M/M/1queueing systems to model existing networks are considered. A continuous lower bound of the average packet delay is used in the formulation of the cost objective function for the capacity and flow assignment. The cost objective function thus formulated is shown to be convex with respect to the network multicommodity flow. This convexity ensures the global optimal solution to the CFA problem via the flow deviation (FD) method. Refinement of the CFA optimization techhique to allow optimal discretization of the continuous solutions to discrete solutions is presented based on dynamic programming and iterations of Flow Optimization and Capacity Optimization. Application examples of these optimization procedures are illustrated.

A closed-form optimal nonlinear smoothing algorithm is derived for estimation of signal that is indirectly observed through a discrete time point process (DTPP). A finite-state Markov signal influences the rate of the point process. The smoothers obtained are simple, recursive, and finite dimensional. An illustrative example of the derived estimation scheme is presented.