Securing multi-domain network performance monitoring (NPM) systems that are being widely deployed as `Measurement Infrastructure-as-a-Service' (MIaaS) in high-performance computing is becoming increasingly critical. It presents an emerging set of research challenges in cloud security given that security mechanisms such as policy-driven access to federated NPM services across multiple domains need to be designed carefully to protect MIaaS resources and data. In this paper, we advocate the design of a security middleground between default open/closed access settings and present policy-driven access controls of measurement functions for a multi-domain federation using a MIaaS. Our approach involves an analytical investigation based on a set of custom metrics to compare and contrast the legacy, role-based and more fine-grained, attribute-based access control schemes to design a security middleground. We implement the chosen middleground with a secured middleware, viz., “OnTimeSecure”. Our middleware enables `user-to-service' and `service-to-service' authentication, and enforces federated authorization entitlement policies for timely orchestration of MIaaS services. Lastly, we evaluate OnTimeSecure in a real multi-domain MIaaS testbed by performing threat modeling and security risk assessments to validate the analysis outcomes and demonstrate its effectiveness for easy integration and sustainable adoption.

Multi-domain network monitoring systems based on active measurements are being widely deployed in high-performance computing and other communities that support large-scale data transfers. Security mechanisms such as policy-driven access to related federated Network Performance Monitoring (NPM) services are important to protect measurement resources and data. In this paper, we present a novel, secure middleware framework viz., “OnTimeSecure” that enables `user-to-service' and `service-to-service' authentication, and enforces federated authorization entitlement policies for timely orchestration of NPM services. OnTimeSecure is built using RESTful APIs and features a hierarchical policy-engine that interfaces with a meta-scheduler for prioritization of measurement requests when there is contention of users concurrently attempting to utilize measurement resources. We validate OnTimeSecure in a federated multi-domain NPM infrastructure by performing threat modeling and security risk assessments based on overall attack likelihood and impact factors.

Distributed observation and control of mobile objects via static wireless sensors demands timely information in a distance-sensitive manner: Information about closer objects is required more often and more quickly than that of farther objects. In this article, we present a wireless sensor network protocol, Trail, that supports distance-sensitive tracking of mobile objects for in-network subscribers upon demand. Trail achieves a find time that is linear in the distance from a subscriber to an object, via a distributed data structure that is updated only locally when the object moves. Notably, Trail does not partition the network into a hierarchy of clusters and clusterheads, and as a result Trail has lower maintenance costs, is more locally fault tolerant, and it better utilizes the network in terms of load balancing and minimizing the size of the data structure needed for tracking. Moreover, Trail is reliable and energy efficient, despite the network dynamics that are typical of wireless sensor networks. Trail can be refined by tuning certain parameters, thereby yielding a family of protocols that are suited for different application settings such as rate of queries, rate of updates, and network size. We evaluate the performance of Trail by analysis, simulations in a 90 × 90 sensor network, and experiments on 105 Mica2 nodes in the context of a pursuer-evader control application.

Surveillance systems based on sensor network technology have been shown to successfully detect, classify and track targets of interest over a large area. State information collected via the sensor network also enables these systems to actuate mobile agents so as to achieve surveillance goals such as target capture and asset protection. But satisfying these goals is complicated by the fact that track information in a sensor network is routed to mobile agents through multi-hop communication links and is thus subject to delays and losses. In addition, as the sensor network is scaled in size, high throughput rates for all pursuers cannot be sustained at all times, which necessitates a network communication strategy that adapts to pursuer information requirements.In this paper, we concentrate on the formulation of optimal pursuit control strategies in the presence of network effects, assuming that target track information has been established locally in the sensor network. We adapt ideas from the theory of differential games to networked games --including ones involving non-periodic track updates, message losses and message delays-- to derive optimal strategies, bounds on the information requirements, and scaling properties of these bounds. Moreover, we present a specific network communication protocol which has the required scalable information characteristics and conclude with the results of experimental studies.

The Kansei testbed at the Ohio State University is designed to facilitate research on networked sensing applications at scale. Kansei embodies a unique combination of characteristics as a result of its design focus on sensing and scaling: (i) Heterogeneous hardware infrastructure with dedicated node resources for local computation, storage, data exfiltration and back-channel communication, to support complex experimentation, (ii) Time accurate hybrid simulation engine for simulating substantially larger arrays using testbed hardware resources, (iii) High fidelity sensor data generation and real-time data and event injection, (iv) Software components and associated job control language to support complex multi-tier experiments utilizing real hardware resources and data generation and simulation engines. In this paper, we present the elements of Kansei testbed architecture, including its hardware and software platforms as well as its hybrid simulation and sensor data generation engines.

Research in sensor networks has begun to address the use of mobility to improve the reachability of the network, but a number of network principles and application patterns remain to be explored in this context. We propose here a network architecture that uses energy constrained devices for enabling new campus wide applications. Specifically, our demonstration illustrates a new network stack and application framework for a class of locality specific applications. The locality specific nature favors exploiting the limited, slow and regional mobility pattern present in large campuses, as opposed to exclusively exploiting the Internet or the cellular network.

It has become a common practice for Internet service providers (ISPs) to instrument their networks with network measurement infrastructures (NMIs). These NMIs support network-wide "active" and "passive" measurement data collection and analysis to: 1) identify end-to-end performance bottlenecks in network paths and 2) broadly understand Internet traffic characteristics, on an ongoing basis. In this paper, we present our analysis of the active and passive measurement data collected along network backbone paths within typical campus, regional and national networks which carry traffic of cutting-edge Internet applications such as high-quality voice and video conferencing, multimedia streaming and distributed file sharing. The active measurement data has been obtained by using "ActiveMon" software, which we have developed and deployed along the above network backbone paths. The passive measurement data has been obtained using SNMP, Syslog and NetFlow data available at the intermediate routers located at strategic points along the same network backbone paths. Our analysis of the measurement data includes studying notable trends, network events and relative performance issues of the network backbone paths which are reflected in the active and passive measurement data collected regularly over several months. Our results thus provide valuable insights regarding traffic dynamics in the different academic network backbones and can be used for better design and control of networks and also to develop traffic source models based on empirical data from real-networks.

Project ExScal (for extreme scale) fielded a 1000+ node wireless sensor network and a 200+ node peer-to-peer ad hoc network of 802.11 devices in a 13km by 300m remote area in Florida, USA during December 2004. In comparison with previous deployments, the ExScal application is relatively complex and its networks are the largest ones of either type fielded to date. In this paper, we overview the key requirements of ExScal, the corresponding design of the hardware/software platform and application, and some results of our experiments.

Exponential growth of Internet traffic and the proliferation of new user applications warrant the development of a new Internet infrastructure. Due to the fundamental satellite system characteristics such as global coverage, broadcast nature and bandwidth on demand, satellite systems are excellent candidates for providing high data rate Internet access and global connectivity accommodating multimedia applications. However, to meet this goal, provisioning of quality-of-service (QoS) within the advanced satellite network systems is the critical requirement. Congestion remains the main obstacle to QoS on the Internet. In today's TCP networks, explicit congestion notification (ECN) is the only explicit mechanism which delivers congestion signals to the source. We present a new traffic management scheme based on an enhanced ECN mechanism. In particular, we used multilevel ECN, which conveys more accurate feedback information about the network congestion status than the current ECN scheme. We have designed a TCP source reaction that takes advantage of the extra feedback information and tunes better its response to the congestion than the current schemes. Our analysis and simulations results show that our scheme performed better than the current ECN, having fewer losses, better network utilization, fewer delays, and the solution is scalable.