The continued explosion of new virus/worm and other security attacks in the Internet and the tremendous propagation speed of self-propagating attacks has led to network security being considered as a design criterion rather than an afterthought. Attack prevention, detection, and mitigation mechanisms can be broadly classified as network based or host based. Network based security mechanisms have been shown to be much more effective than host based mechanisms, primarily because of the former's ability in identifying attack traffic that is further upstream from the victim and closer to the attack source. In the context of network based mechanisms, we consider a flexible overlay network of security systems running on top of programmable (active) routers. In such an architecture, security services can be dynamically distributed across the network, which provides flexibility for load-balancing of services across nodes and addition of new services over time. Such network based mechanisms inevitably decrease network performance as all packets are analyzed for malicious content before being forwarded. In this paper, we consider traffic routing, placement of active router nodes, and distribution of security services across such nodes so as to optimize certain objectives, including (i) minimize the total number of active router deployed nodes, and (ii) minimize the maximum utilization of any router node in the network. Based on an emulation in the Deter testbed we show the benefit of the presented approach.

A novel concept in available bit rate (ABR) service model as defined by the ATM Forum is the minimum cell rate (MCR) bandwidth guarantee for each connection. In this paper, we present a network bandwidth allocation policy to support each ABR connection's MCR requirement, as well as its peak cell rate (PCR) constraint. Furthermore, we develop two explicit-rate (ER) based ABR algorithms consistent with the ATM Forum ABR traffic management framework to achieve this rate allocation policy. The first ABR implementation is a simple heuristic algorithm which does not require per-VC accounting. It requires minimal implementation complexity and offers satisfactory performance in a LAN environment. The second ABR implementation employs per-VC accounting and is proven to converge to our rate allocation policy for any network topology and any set of link distances.

In this paper, we present a scalable dynamic multicast routing algorithm based on a dynamic Steiner tree approach. First, we analyze a hierarchical multicast routing algorithm which introduced the use of core nodes in each peer-group to support multicasting under the private network-network interface (PNNI) framework. Based on this analysis, we conclude that finding near-optimal multicast trees in each peer-group is important. Our proposed algorithm produces improved results by computing better multicast trees within each peer-group. This scheme also eliminates the dependency of core node selection, on the quality of overall multicast tree generated. We compare the two schemes based on simulations on several randomly generated graphs of size ranging from 115 to 170 nodes. Based on these simulations, we show that our algorithm performs 35% better than the hierarchical algorithm. Our algorithm is scalable, allows incorporation of fault-tolerance and can easily be extended to incorporate a QoS criterion in routing.

Several algorithms have been proposed for the switch behavior for congestion control of available bit rate (ABR) services. Schemes such as the enhanced proportional rate control algorithm (EPRCA) and the dynamic max rate control algorithm (DMRCA), which use the queue length as the congestion indicator to make a simple approximation of the fair share converge to the actual fair share, have become popular, because they offer a good performance and are simple to implement. In particular, with no VBR traffic in the network, DMRCA has been shown to achieve fairness in all situations, good buffer control, and robust performance. First we show that the performance of these schemes may degrade when ABR traffic interacts with highly-bursty VBR traffic. If VBR traffic induces congestion in the network, the length of the ABR queue cannot serve as a reliable indicator of congestion caused by ABR traffic, and the schemes perform poorly, introducing considerable unfairness. Then, we propose a simple technique to solve these problems. The switch constructs the length of a virtual queue which is not affected by the instantaneous behavior of VBR traffic, and does not depend on how the two types of traffic are served in order to share the common link capacity; thus, it can serve as a reliable indicator of congestion. We use this technique in DMRCA with virtual queueing (DMRCA-VQ), and show that the new scheme achieves fair rate allocation to the ABR connections also in the presence of highly-bursty VBR traffic. The DMRCA-VQ maintains the low hardware complexity of DMRCA. The virtual queueing technique is a solution for the more general problem of separating rate allocation based on the queue length from scheduling of multiple queues for sharing a common resource.

We study shared-memory switches under multicast bursty traffic and characterize the relation between their performance and the multicast distribution that defines the mix of multicast traffic arriving at the switches. We consider two schemes that have been used in practical realizations of these switches to replicate multicast cells: (1) replication-at-receiving (RAR), where multiple copies of a multicast cell are stored in the buffer and served independently, and (2) replication-at-sending (RAS), where a single instance of a multicast cell is stored in the buffer, and the cell is replicated as it is transmitted to the output ports. For each scheme, we study two configurations: (1) the shared-memory-only (SMO) configuration, where the bandwidth of the replication mechanism is sufficient to accommodate even the worst-case replication requirements, and (2) the shared-memory-with-replication-first-in-first-out (SM+RFIFO) configuration, where the bandwidth of the replication mechanism is lower than that required by the worst case, and thus an additional buffer is used in front of the shared memory to temporarily store cells while they are replicated. For all cases, using simulation, we find upper bounds for the buffer requirements to achieve a desired cell-loss rate. We show that these upper bounds are significantly larger than the buffer requirements under unicast traffic and are approached even for very small volumes of multicast traffic; thus, these upper bounds should be used in practice to size the buffers to achieve the desired performance under traffic with general multicast distributions. We also study shared-memory switches with output demultiplexers and characterize and compare the different multicasting schemes that are used in these switches.

We study a shared-memory center-stage switch with input multiplexers and output demultiplexers, where backpressure is applied from the demultiplexers to the center stage, and from the center stage to the multiplexers. We consider three backpressure schemes: (i) non-selective backpressure (NSB), where a congested center stage or a congested demultiplexer applies backpressure indiscriminately to all the traffic destined to it, regardless of the destination; (ii) per-port selective backpressure (PPSB), where the center stage applies backpressure selectively only to the traffic destined to the center-stage port(s) experiencing congestion, but a demultiplexer applies backpressure indiscriminately to all the traffic destined to it; and (iii) per-subport selective backpressure (PSSB), where both center-stage switch and demultiplexers apply backpressure selectively only to the traffic destined to the output link(s) experiencing congestion. We show that NSB introduces heavy HOL blocking which limits the throughput of the system and causes heavy losses. On the contrary, PPSB and PSSB achieve high throughputs, and allow one to increase buffer utilization in the system while keeping the majority of the buffers physically separate in the input multiplexers. Both these schemes perform very well in the case where only limited sharing of the buffers in the center stage is allowed, as required to guarantee fairness in the switch. With PSSB, small buffer sizes in the demultiplexers can be used. If the buffers in the demultiplexers are large, PPSB and PSSB offer comparable performance.

The authors present a queuing analysis and a simulation study of banyan switch fabrics based on 2*2 switching elements with crosspoint buffering. In particular, the results apply to the PHOENIX switching element based banyan fabrics. The results indicate that crosspoint buffering provides throughput approaching the offered load under uniform traffic conditions. The effect of bursty traffic on the performance of the switch is studied. It is shown that a speedup factor of three or more is required to achieve acceptable delay and packet loss probability. It is also shown that the amount of buffer space required per port increases linearly with the burst size for a desired packet loss performance. For a given burst size the packet loss rate decreases exponentially as the buffer size is increased. The impact of crosspoint buffering and shared buffering in the switching elements on the performance of the banyan fabric is analyzed.>

The authors propose a new approach to building large asynchronous transfer mode (ATM) switches based on shared memory modules. Shared memory modules are proposed to be placed in parallel, with every input and output port having access to every one of the switch models. This approach permits global sharing of the total buffer space. Some basic issues in such an arrangement are studied, such as the necessary and sufficient conditions for optimal performance and the minimum number of modules required for the switch to have optimal performance while permitting sharing of the entire buffer space among all the input and output ports and while preserving packet sequencing for any virtual channel. A centralized control algorithm which yields optimal performance is also proposed.>

An approach to the design of reconfigurable programmable logic arrays (RPLAs) is proposed in which diagnosis of faults and reconfiguration are performed simultaneously. The approach also takes advantage of a laser programmable interconnect to simplify the test circuitry and area overhead. The RPLA design presented makes it possible to diagnose and repair faults on bit lines, product lines, and output lines. The unrepairable area in the RPLA is kept to a minimum. Only one extra input is required for testability. A mapping process for masking out missing crosspoint faults is employed to further enhance the yield of PLAs. Experimental results on the area overhead and the yield of the proposed RPLAs are presented. The field of the proposed RPLAs is higher than that of the original PLAs.>

Programmable gate arrays (PGAs) offer a convenient means of prototyping complex logic. An approach is presented for enhancing the yield of PGAs through defect tolerance. This serves two purposes: to make the product economical, as well as to help reduce the turnaround time. The approach is based on using programmable interconnect to test the logic in the PGA and to use adaptive customization to avoid the defective portions. The ideas are illustrated through the use of a novel PGA architecture. Heuristics for adaptive customization of the PGAs are given and their effectiveness is studied through yield analysis. The results of the study for a sample circuit are included.>

To provide fault tolerance and improve system reliability and performance, a class of fault-tolerant multistage interconnection networks, called augmented shuffle-exchange networks (ASENs) has been proposed. ASENs are gracefully degradable; although an individual component failure reduces ASEN performance, it does not cause a total network failure. The purpose of this work is to analyze how these component failures affect ASEN performance. A key step in performance and reliability modeling is the choice of an appropriate metric for analysis. Because network bandwidth can be an inadequate performance measure when fault are present. The authors consider other network performance measures, including the interreference time distribution for individual outputs (memories).>

A class of multipath multistage interconnection networks (MINs) is proposed in this paper.These MINs have single fault-tolerance and dynamic reroutability at reduced link complexity.In addition they tolerate several multiple faults.The proposed MINs feature links between switches of the same stage, unlike other MINs, and the nmnber of links between adjacent stages is the same as in unique path networks.The paths available between a given source-destination pair have val3"ing lengths.Reliability analysis, including the mean time to failure, steady state availability, and terminal reliability is given for the networks.The reliability figures are found comparable to thee of other, more complex multipath MINs.°The performance analysis of the MINs in circuit switched, random access environment shows that the acceptance probability is considerably increased and the average path length is close to that in the unique path MINs.