The proposed MSN architecture is intended to directly address the challenge of mobility, which refers to the motion of users as well as the dynamics of the satellite constellation. A virtual access point layer consisting of fixed virtual satellite network attachment points is superimposed over the physical topology in order to hide the mobility of satellites from the mobile endpoints. Then the MSN enhances endpoint mobility by a clean separation of identity and logical network location through an identity-to-location resolution service, and taking full advantage of the user's geographical location information. Moreover, a SDN based implementation is presented to further illustrate the proposal.

In this paper, we propose a rollback traffic avoidance method for the snapshot routing in cyclic mobile networks. Since the snapshot routing tables are switched simultaneously, part of the traffic may be sent back on some links if the new routing path contains the same links but with reversed forwarding direction against the old one. Since the selection of routing paths to avoid the rollback traffic is NP-hard, we propose an approximate algorithm called Inter-Snapshot Rollback Traffic Avoidance (ISRTA), to pursuit the approximate optimal solutions. Evaluation is performed based on the typical cyclic mobile network -- Iridium satellite system, and the simulation results show that our method can efficiently eliminate the rollback paths and traffic in the Iridium system.

In this paper, we propose an offline rollback traffic avoidance method for the snapshot routing in cyclic mobile networks. Since the snapshot routing tables are switched simultaneously, part of the traffic may be sent back on some links if the new routing path contains the same links but with reversed forwarding direction against the old one. To avoid the rollback traffic, we first formulate the rollback traffic avoidance problem as an integer programming problem which is NP-hard, and then we propose an approximate algorithm called Inter-Snapshot Rollback Traffic Avoidance (ISRTA), to pursuit the approximate optimal solutions. Simulation results show that our method can efficiently eliminate the rollback paths and traffic in the Iridium system. Although the global average network delay is increased slightly, the extra end to end delay caused by rollback traffic is eliminated and the packet loss rate is reduced.

In recent years, with the rapid development of satellite technology including On Board Processing (OBP) and Inter Satellite Link (ISL), satellite network devices such as space IP routers have been experimentally carried in space. However, there are many difficulties to build a future satellite network with current terrestrial Internet technologies due to the distinguished space features, such as the severely limited resources, remote hardware/software upgrade in space. In this paper, we propose OpenSAN, a novel architecture of software-defined satellite network. By decoupling the data plane and control plane, OpenSAN provides satellite network with high efficiency, fine-grained control, as well as flexibility to support future advanced network technology. Moreover, we also discuss some practical challenges in the deployment of OpenSAN.

Transport Control Protocol (TCP) incast congestion happens in high-bandwidth and low-latency networks when multiple synchronized servers send data to the same receiver in parallel. For many important data-center applications such as MapReduce and Search, this many-to-one traffic pattern is common. Hence TCP incast congestion may severely degrade their performances, e.g., by increasing response time. In this paper, we study TCP incast in detail by focusing on the relationships between TCP throughput, round-trip time (RTT), and receive window. Unlike previous approaches, which mitigate the impact of TCP incast congestion by using a fine-grained timeout value, our idea is to design an Incast congestion Control for TCP (ICTCP) scheme on the receiver side. In particular, our method adjusts the TCP receive window proactively before packet loss occurs. The implementation and experiments in our testbed demonstrate that we achieve almost zero timeouts and high goodput for TCP incast.

ABSTRACT Group signature is one of the well‐known cryptographic primitives for anonymous authentication which is the fundamental requirement for securing vehicular ad hoc networks (VANETs), but it is prone to cause huge revocation overhead in VANETs with millions of nodes and serious security risk. To solve this problem, we develop an efficient distributed key management scheme (DKM) where the whole domain of VANET is divided into several sub‐regions, and any vehicle has to update its group secret key periodically from the regional group manager who manages the region where the vehicle stays. Unlike the previously reported works, DKM prevents vehicles from leaking the value of the updated group secret key to the regional group manager during the group key updating process. Subsequently, it is capable of identifying either the compromised regional authorities or the malicious vehicles. Moreover, performance analysis demonstrates that DKM can reduce the revocation cost significantly while the communication cost for key updating is small. Copyright © 2011 John Wiley & Sons, Ltd.

Data center networks encode locality and topology information into their server and switch addresses for performance and routing purposes. For this reason, the traditional address configuration protocols such as DHCP require a huge amount of manual input, leaving them error-prone. In this paper, we present DAC, a generic and automatic Data center Address Configuration system. With an automatically generated blueprint that defines the connections of servers and switches labeled by logical IDs, e.g., IP addresses, DAC first learns the physical topology labeled by device IDs, e.g., MAC addresses. Then, at the core of DAC is its device-to-logical ID mapping and malfunction detection. DAC makes an innovation in abstracting the device-to-logical ID mapping to the graph isomorphism problem and solves it with low time complexity by leveraging the attributes of data center network topologies. Its malfunction detection scheme detects errors such as device and link failures and miswirings, including the most difficult case where miswirings do not cause any node degree change. We have evaluated DAC via simulation, implementation, and experiments. Our simulation results show that DAC can accurately find all the hardest-to-detect malfunctions and can autoconfigure a large data center with 3.8 million devices in 46 s. In our implementation, we successfully autoconfigure a small 64-server BCube network within 300 ms and show that DAC is a viable solution for data center autoconfiguration.

Routing is a challenge problem in Delay-tolerant networks (DTNs) due to the intermittent connectivity environment. To cope with it, both single-copy and multi-copy routing protocols have been proposed. The difference between them is how to handle with the messages that have been forwarded to the next hop. These messages will be removed from buffer immediately in the single-copy protocols, while be kept and forwarded to other relays in the multi-copy cases. However, there is a gap between the two protocols. In our previous work, we have indicated it and proposed a Snail Crawling(SC) method to fill the gap. In this paper, we indicate that the SC method is just an enhanced method but not a routing protocol. By adopting heuristic strategies in messages distribution of SC, we get a new routing protocol One Leader at One Time(OLOT), in which only one node can forward message to another relay at the same time. Simulation results show that both the delivery rate and the overhead of OLOT are better than the SC method.

Multi-tenancy and lack of network performance isolation among tenants together make the public cloud vulnerable to attacks. This paper studies one of the potential attacks, namely, low-rate denial-of-service (DoS) attack (or \textit{Shrew} attack for short), in cloud data center networks (DCNs). To explore the feasibility of launching Shrew attack from the perspective of a normal external tenant, we first leverage a loss-based probe to identify the locations and capabilities of the underlying bottlenecks, and then make use of the low-latency feature of DCNs to synchronize the participating attack flows. Moreover, we quantitatively analyze the necessary and sufficient traffic for an effective attack. Using a combination of analytical modeling and extensive experiments, we demonstrate that a tenant could initiate an efficient Shrew attack with extremely little traffic, e.g., milliseconds-long burst traffic, which imposes significant difficulty for the switching boxes and counter-DoS mechanisms to detect. We identify that both the conventional protocol assumption and new features of DCNs enable such Shrew attack, and new techniques are required to thwart it in the DCNs.

TCP incast congestion happens in high-bandwidth and low-latency networks, when multiple synchronized servers send data to a same receiver in parallel [15]. For many important data center applications such as MapReduce[5] and Search, this many-to-one traffic pattern is common. Hence TCP in-cast congestion may severely degrade their performances, e.g., by increasing response time.

Data center networks encode locality and topology information into their server and switch addresses for performance and routing purposes. For this reason, the traditional address configuration protocols such as DHCP require huge amount of manual input, leaving them error-prone.In this paper, we present DAC, a generic and automatic Data center Address Configuration system. With an automatically generated blueprint which defines the connections of servers and switches labeled by logical IDs, e.g., IP addresses, DAC first learns the physical topology labeled by device IDs, e.g., MAC addresses. Then at the core of DAC is its device-to-logical ID mapping and malfunction detection. DAC makes an innovation in abstracting the device-to-logical ID mapping to the graph isomorphism problem, and solves it with low time-complexity by leveraging the attributes of data center network topologies. Its malfunction detection scheme detects errors such as device and link failures and miswirings, including the most difficult case where miswirings do not cause any node degree change.We have evaluated DAC via simulation, implementation and experiments. Our simulation results show that DAC can accurately find all the hardest-to-detect malfunctions and can autoconfigure a large data center with 3.8 million devices in 46 seconds. In our implementation, we successfully autoconfigure a small 64-server BCube network within 300 milliseconds and show that DAC is a viable solution for data center autoconfiguration.