Spontaneous and robust mobile device location authentication can be realized by supplementing existing 802.11x access points (AP) with small cells. We show that by transferring network traffic to a mobile computing device associated with a femtocell while remotely monitoring its ingress traffic activity, any internet-connected sender can verify the cooperating receiver's location. We describe a prototype non-cryptographic location authentication system we constructed, and explain how to design both voice and data transmissions with distinct, discernible traffic signatures. Using both analytical modeling and empirical results from our implementation, we demonstrate that these signatures can be reliably detected even in the presence of heavy cross-traffic introduced by other femtocell users.

Providers of location-based services seek new methods to authenticate the location of their clients. We propose a novel infrastructure-based solution that provides spontaneous and transaction-oriented mobile device location authentication via an integrated 802.11× wireless access point and 3G femtocell access system. By simply making a voice call while remotely monitoring femtocell activity, a calling party can verify a (co-operating) called party's location even when the participants have no pre-existing relationship. We show how such a traffic signature can be reliably detected even in the presence of heavy cross-traffic introduced by other femtocell users. We describe how the verification proceeds without revealing details of the authentication - or even the parties involved - to the location provider.

The growing use of virtualization technologies in settings such as multi-tenant compute and storage clouds challenges us to both specify and enforce the isolation of clients sharing network and compute resources. In this paper we propose a novel analytical measure of performance isolation for shared resource systems serving multiple traffic flows or computing workloads. By basing our measure on well-known results from network calculus, we demonstrate how isolation metrics can be calculated for individual flows - or groups of flows - traversing both individual system elements and networks of those elements. Finally, we show how isolation-aware resource allocators in multi-tenant network testbeds and compute clouds can select network and compute resources to match a client's resource needs while maintaining a desired quality-of-isolation.

Location-based applications (e.g., foursquare, Groupon) rely on each client's assertion of his or her location (e.g., uploaded GPS coordinates). Yet these service providers seek methods to authenticate the location of clients to enhance targeted service delivery and support their advertisers. We propose an intelligent infrastructure-based solution that provides spontaneous, transaction-oriented, collusion-resistant mobile device location authentication to a remote party via an integrated 802.11× wireless access point and 3G femtocell access system.

Network device vendors have recently opened up the processing capabilities on their hardware platform to support third-party applications. In this paper, we explore the requirements and overheads associated with co-locating middlebox functionality on such computing resources on networking hardware. In particular, we use an example of TCP acceleration proxy (CHART) that improves throughput over networks with delay and loss. The CHART system, developed by HP and its partners provides enhanced TCP/IP performance and service quality guarantees by deploying performance accelerating proxies, which enables legacy clients to benefit by high-performance network service. Use of the TCP proxy, however, requires manual configuration on the clients changing http proxy and/or routing table settings. Can we remove the need to configure end-hosts by inserting a transparent TCP proxy in the path, without losing performance? To address this question, we implement the accelerator on HP's x86-based processing blade designed to integrate network applications within switch architecture as well as on low-end home routers with OpenWRT. We describe the implementation detail such as flow redirection for transparency and new mechanisms required for easy insertion of proxies in the network path. We also evaluate its performance on HP's experimental testbed in terms of throughput and additional processing overhead.

The Internet was designed as a packet-switched network in the 1960's and 1970's, with the explicit intent of sacrificing quality-of-service guarantees for an individual application in order to optimize channel usage and provide optimal median service for all applications. This approach was successful, since the application mix of the Internet heretofore has been dominated by applications with low quality-of-service needs: primarily bulk data transfer and low-bandwidth text- based interactive applications. As the Internet absorbs other networks and applications with strong quality-of-service requirements (television, voice over IP) , this tradeoff changes. We are faced with the problem of introducing the quality- of-service guarantees of circuit-switching into packet-switched networks. Fundamental change to the lower layers of the Internet stack have proven infeasible; even strongly-motivated, well-designed modifications which made transition a first-class design consideration have had difficult introductions. ATM and IPv6 are two recent examples. One effective transition strategy for new networking techniques has been the use of overlays. In this paper, we introduce the concept of a service overlay network, to offer circuit-switched behavior on legacy IP networks, and establish the requirements on the underlying IP network to make this strategy effective.

To improve the performance of VPN connections we investigate how the bandwidth of multiple access links can be aggregated with inverse multiplexing to create a single, higher capacity logical communication link. But achieving the maximum possible aggregated TCP throughput becomes extremely challenging if the underlying links either use different technologies (e.g., DSL, cable modem) or suffer different or time-varying communication characteristics (e.g., available bandwidth, packet loss rate). To maximize VPN throughput we have constructed a system that combines two distinct innovations. First, we continuously measure the communication characteristics of the underlying component links in our aggregate and dynamically assign packets to each link in proportion to its available capacity. Second, we modify TCP congestion control across the inverse-multiplexed access hop to avoid rate decreases normally initiated by the delayed acknowledgments often triggered when using legacy TCP on multiple heterogeneous paths. We describe the systempsilas implementation, the test environment we built on Emulab, and show that when access links form the communication bottleneck in the end-to-end connection we can significantly increase VPN performance over conventional approaches.

The bandwidth of multiple physical communication links can be aggregated with inverse multiplexing to create a single, higher capacity logical communication link. However, achieving the maximum possible aggregated bandwidth becomes challenging as the communication characteristics of the underlying links (e.g., available bandwidth, packet loss rate) change with time. In this paper we introduce NATALIE, a Network-aware traffic equalizer. NATALIE combines an arbitrary set of network interfaces and schedules IP packet transmissions over those interfaces in a weighted round-robin fashion. To achieve the maximum possible throughput, NATALIE measures the communication characteristics of the underlying links and dynamically adjusts its scheduler to assign packets to each link in proportion to its available capacity. We describe NATALIE'S implementation, the test environment we built on the Emulab Network Testbed, and the results of experiments demonstrating NATALIE'S throughput performance for TCP connections over diverse underlying links with cross-traffic.

Multihomed, mobile wireless computing and communication devices can spontaneously form communities to logically combine and share the bandwidth of each other's wide-area communication links using inverse multiplexing. But, membership in such a community can be highly dynamic, as devices and their associated WWAN links randomly join and leave the community. We identify the issues and trade-offs faced in designing a decentralized inverse multiplexing system in this challenging setting and determine precisely how heterogeneous WWAN links should be characterized and when they should be added to, or deleted from, the shared pool. We then propose methods of choosing the appropriate channels on which to assign newly arriving application flows. Using video traffic as a motivating example, we demonstrate how significant performance gains can be realized by adapting allocation of the shared WWAN channels to specific application requirements. Our simulation and experimentation results show that collaborative bandwidth aggregation systems are, indeed, a practical and compelling means of achieving high-speed Internet access for groups of wireless computing devices beyond the reach of public or private access points

We present a multipath routing scheme that is designed to increase throughput and alleviate congestion in networks employing shortest path routing. The multipath routing scheme consists of an algorithm to determine a set of multiple disjoint or partially disjoint paths and a mechanism for distributing traffic over a multipath route to reduce the traffic load on a congested link. The algorithm for finding multipath routes is based on shortest path routing and does not require pre-establishment of paths or support for source routing. The mechanism for multipath traffic distribution is triggered at a node when the average load on an outgoing link exceeds a threshold. Our simulation results demonstrate that the proposed congestion-triggered multipath routing scheme can effectively improve network performance by exploiting routing redundancies inherent in the network topology.

Aggregating the bandwidth of multiple low-cost physical communication links to form a single, higher capacity logical link is a common and inexpensive approach to increasing network performance. Aggregating or bonding links has traditionally been used in relatively static settings such as LAN-WAN interconnection, where the component links to be aggregated were typically identical (e.g., multiple T1 links) with very similar communication characteristics. However the emergence of multi-homed hosts and diverse access technologies (e.g., cable modem, wireless DSL) compel us to study the performance of aggregating the bandwidth of increasingly heterogeneous links.In this paper we examine the end-to-end performance of a single TCP connection with packets transmitted over multiple heterogeneous links. We describe a testbed we constructed, present empirical results, and introduce a new Linux-based traffic scheduler called wTEQL that we have developed to optimize the performance of TCP over multiple heterogeneous communication links. Finally, we present a novel analytical approach based on linear systems theory to characterize the performance of TCP over an inverse multiplexed channel with WRR scheduling over heterogeneous links. We believe that our model is the first to demonstrate analytically how TCP throughput on two links with a poorly matched packet scheduling policy can fall below the achievable throughput of the slower of the two links when that link is used alone.1

Distributed computing has been widely embraced as a cost-effective means of performing compute-intensive tasks by pooling the computational resources of collaborating systems. We envision the emergence of an analogous approach to communication resource sharing which we call distributed communication. Distributed communication enables sharing a set of relatively low-speed WAN channels emanating from communities of multi-homed devices interconnected with a highspeed wireless LAN. We envisage opportunities to aggregate cellular links from spontaneously formed ad hoc groups of mobile devices, as well as broadband access links (e.g., DSL) from neighboring residences. But, will individuals be willing to share bandwidth as easily as they share bits? A prototype system that we have constructed convinces us that the technical challenges of distributed communication can be overcome. And there appears to be no other means of satisfying the growing demand for access bandwidth as quickly and as cheaply.

Bonding multiple low-cost physical communication links to form a single, higher capacity logical link is a common and inexpensive approach to increasing WAN access bandwidth. Though bonded links have traditionally been homogeneous, the emergence of multi-homed hosts and diverse access technologies (e.g., cable modem, DSL, connection sharing via 802.11x) compel us to study the performance of bonding increasingly heterogeneous links. We examine the end-to-end performance of a single TCP connection with packets transmitted over multiple links. We describe a testbed we constructed, and present throughput results for bonded links with heterogeneous component links

Multi-homed, mobile wireless computing and communication devices can spontaneously form communities to logically combine and share the bandwidth of each other's wide-area communication links using inverse multiplexing. But membership in such a community can be highly dynamic, as devices and their associated WAN links randomly join and leave the community. We identify the issues and tradeoffs faced in designing a decentralized inverse multiplexing system in this challenging setting, and determine precisely how heterogeneous WAN links should be characterized, and when they should be added to, or deleted from, the shared pool. We then propose methods of choosing the appropriate channels on which to assign newly-arriving application flows. Using video traffic as a motivating example, we demonstrate how significant performance gains can be realized by adapting allocation of the shared WAN channels to specific application requirements. Our simulation and experimentation results show that collaborative bandwidth aggregation systems are, indeed, a practical and compelling means of achieving high-speed Internet access for groups of wireless computing devices beyond the reach of public or private access points.

We introduce an overlay network architecture and signaling mechanism that permit program insertions in live, high quality video streams transmitted over IP networks. We describe the implementation of an application proxy that dynamically inserts pre-recorded video programs into NTSC D1 quality Motion-JPEG streams with no visible artifacts. As increases in computing power further enable the modification of video during transport, new services such as personalized commercial advertisement insertions promise to make IP distribution an attractive alternative to conventional broadcast network distribution.

We propose a new, media-independent protocol for including program timing, structure and identity information in Internet media streams. The protocol uses signaling messages called cues to indicate events whose timing is significant to receivers, such as the start or stop time of a media program. We describe the implementation and operation of a prototype Internet radio station which transmits program cues in audio broadcasts using a real-time transport protocol (RTP). A collection of simple yet powerful stream processing applications we implemented demonstrate how application creation is greatly eased when media streams are enriched with program cues.

We propose a new, media-independent protocol for including program timing, structure and identity information in Internet media streams. The protocol uses signaling messages called cues to indicate events whose timing is significant to receivers, such as the start or stop time of a media program. We describe the implementation and operation of a prototype Internet radio station which transmits program cues in audio broadcasts using the Real-Time Transport Protocol. A collection of simple yet powerful stream processing applications we implemented demonstrate how application creation is greatly eased when media streams are enriched with program cues.

We introduce a new two-phase technique to solve highly asymmetric assignment problems. In the first phase, the assignment problem is decomposed into subproblems which are solved in parallel. The first phase is used to exclude certain suboptimal assignments from consideration in the second phase. In the second phase, the optimal assignment is finalized. We show that the two-phase algorithm can reduce the theoretical time bound for solving an n/spl times/k assignment problem (n

Each copy of a text document can be made different in a nearly invisible way by repositioning or modifying the appearance of different elements of text, i.e., lines, words, or characters. A unique copy can be registered with its recipient, so that subsequent unauthorized copies that are retrieved can be traced back to the original owner. In this paper we describe and compare several mechanisms for marking documents and several other mechanisms for decoding the marks after documents have been subjected to common types of distortion. The marks are intended to protect documents of limited value that are owned by individuals who would rather possess a legal than an illegal copy if they can be distinguished. We describe attacks that remove the marks and countermeasures to those attacks. An architecture is described for distributing a large number of copies without burdening the publisher with creating and transmitting the unique documents. The architecture also allows the publisher to determine the identity of a recipient who has illegally redistributed the document, without compromising the privacy of individuals who are not operating illegally. Two experimental systems are described. One was used to distribute an issue of the IEEE Journal on Selected Areas in Communications, and the second was used to mark copies of company private memoranda.

Modern computer networks make it possible to distribute documents quickly and economically by electronic means rather than by conventional paper means. However, the widespread adoption of electronic distribution of copyrighted material is currently impeded by the ease of unauthorized copying and dissemination. In this paper we propose techniques that discourage unauthorized distribution by embedding each document with a unique codeword. Our encoding techniques are indiscernible by readers, yet enable us to identify the sanctioned recipient of a document by examination of a recovered document. We propose three coding methods, describe one in detail, and present experimental results showing that our identification techniques are highly reliable, even after documents have been photocopied.>

We consider the problem of finding the worst case packet transit delay in networks using deflection routing. Several classes of networks are studied, including many topologies for which deflection routing has been proposed or implemented (e.g., hypercube, Manhattan Street Network, shuffle-exchange network). We derive new upper bounds on the evacuation time of batch admissions, and present simple proofs for several existing bounds. Also derived are bounds on worst case transit delay for certain networks admitting packets continuously. To demonstrate the practical utility of our results, we compare a new delay bound to the maximum delay observed in simulations. The results have application in both protocol design and the determination of the required capacity of packet resequencing buffers.>

A major impediment to the widespread adoption of services for electronic distribution of copyrighted material is the ease with which illicit copies can be made and disseminated. In this paper, we describe feature coding techniques to mark document images with codes that are indiscernible by readers but can be decoded by document feature analysis techniques. These codes can be used to trace the source of errant documents. We propose three coding methods: line-shift coding, word-shift coding, and character coding. We describe how the coding features are found, inserted, and decoded. Finally, we show preliminary experimental results indicating robustness of the line-shift coding method where decoding can be performed even from images of up to ten generations of photocopying.

Cell delay variations can cause a cell stream traversing an ATM LAN to occasionally exceed a connection's negotiated peak cell rate at the entry point to an ATM WAN, resulting in undesired cell discard. The article shows through analysis and simulation that peak rate regulation enables a traffic source to maintain a desired service quality despite changes in LAN usage. This approach promises to lower an ATM WAN user's communications costs by allowing the user to pay only for actual delay variations, rather than worst case delay variations.>

Modern computer networks make it possible to distribute documents quickly and economically by electronic means rather than by conventional paper means. However, the widespread adoption of electronic distribution of copyrighted material is currently impeded by the ease of illicit copying and dissemination. The authors propose techniques that discourage illicit distribution by embedding each document with a unique codeword. The encoding techniques are indiscernible by readers, yet enable one to identify the sanctioned recipient of a document by examination of a recovered document. The authors propose three coding methods, describe one in detail, and present experimental results showing that their identification techniques are highly reliable, even after documents have been photocopied.>