The Internet provides no support for privacy or authentication of multicast packets. However, an increasing number of applications require secure multicast services in order to restrict group membership and enforce accountability of group members. A major problem associated with the deployment of secure multicast delivery services is the scalability of the key distribution protocol. This is particularly true with regard to the handling of group membership changes, such as member departures and/or expulsions, which necessitate the distribution of a new session key to all the remaining group members. As the frequency of group membership changes increases, it becomes necessary to reduce the cost of key distribution operations. This paper explores the use of batching of group membership changes to reduce the frequency, and hence the cost, of key re-distribution operations. It focuses explicitly on the problem of cumulative member removal and presents an algorithm that minimizes the number of messages required to distribute new keys to the remaining group members. The algorithm is used in conjunction with a new multicast key management scheme which uses a set of auxiliary keys in order to improve scalability. In contrast to previous schemes which generate a fixed hierarchy of keys, the proposed scheme dynamically generates the most suitable key hierarchy by composing different keys. Our cumulative member removal algorithm uses Boolean function minimization techniques, and outperforms all other schemes known to us in terms of message complexity.

We present a novel formulation for B-spline snakes that can be used as a tool for fast and intuitive contour outlining. The theory is implemented in a platform independent JAVA interface, which allows real time computation of the snake curve. In this paper, our main focus is on two points. First, we propose a novel B-spline snake formulation, where the intrinsic scale of the spline model is adjusted a priori. It leads to a reduction of the number of parameters to be optimized and eliminates the need for internal energies. The approach solves the two main drawbacks of traditional snakes (slow convergence speed and difficult to adjust weighting factors for internal energy terms). Second, we comment on our experience using JAVA for the implementation of the snake and for the design of the graphical user interface. Our technique provides a very intuitive, user-friendly, and platform independent tool for contour outlining, generally applicable to a vast range of images. Several biomedical examples of applications are included to illustrate the versatility of the method.

This paper explores the performance impact of supporting QoS guarantees on communication in TCP/IP protocol stacks at Unix-like end hosts. We first demonstrate the efficacy of our RSVP-based QoS architecture in providing the desired QoS to individual connections via application-level experiments using UDP sessions and TCP connections on an ATM network. We then identify and measure, via detailed profiling, the overheads imposed by the individual components of the QoS architecture, such as traffic policing, traffic shaping, and buffer management. Our measurements reveal that traffic policing overheads are largely offset by savings due to per-session buffer pre-allocation, and, for ATM networks, a faster path through the network interface layer. In the latter case the data path latency for compliant packets can even be slightly smaller than the default best-effort data path latency. Traffic shaping presents more challenges, primarily because of interactions with the operating system CPU scheduler. We discuss the performance implications of traffic shaping and suggest techniques to reduce or mask some of the associated overheads.

This paper develops a practical method for connection admission control in ATM networks. The method is based on a virtual cell loss probability criterion, is designed to handle heterogeneous traffic types and allows each traffic source to be described by an individual finite-state model with as many states as are needed to describe the source traffic. To make connection admission decisions with respect to individual links, an aggregate finite state model is computed from the individual models and used to estimate the virtual cell loss probabilities. To reduce the computational requirements for maintaining the aggregate traffic model, the aggregate model uses quantized data rates and is maintained incrementally using direct numerical convolution. The approximations required by the quantization process can be done in a strictly conservative way.

Writing software to control networks is important and difficult. It must be efficient, reliable, and flexible. Conduits+ is a framework for network software that has been used to implement the signalling system of a mullti-protocol ATM access switch. An earlier version was used to implement TCP/IP. It reduces the complexity of network software, makes it easier to extend or modify network protocols, and is sufficiently efficient. Conduits+ shows the power of a componentized object-oriented framework and of common object-oriented design patterns.