Seamless handover is one of the most attractive research fields in B3G systems. Many mechanisms are proposed to provide certain QoS guarantees in handovers of mobile systems, which would also introduce new threats, such as DoS and DDOS attacks. In this paper, we extend a cookie-based scheme to protect systems from DoS and DDoS attacks. We also adopt a novel queuing network model to analyze our scheme by estimating two essential metrics, i.e. the mean total response time and the mean queue length of MAP. Numerical results indicate that our mechanism works better than the traditional cookie-based scheme and it could effectively help networks defend against abnormal attacks in the handover process.

An emerging problem facing future high performance multi-core processors is transient faults caused by radiation, noise and other factors. These faults will likely make future multi-core processors less reliable as chip features shrink and the number of cores increase. To address this problem, we propose a new and practical systems approach of managing and allocating reliability according to software process requirements. The asymmetric multi-core architecture is based on cores with differing reliabilities. Critical and non-critical software components are identified and matched with the higher reliability cores. We show that by using asymmetrically reliable cores the overall system failure rate can be reduced by several times when critical processes can be isolated and executed by higher reliability cores, while offering the same or better overall performance, power utilization and chip area as symmetric cores.

Future network systems and embedded infrastructure devices in ubiquitous environments will need to consume low power and process large amounts of network packet traffic. In order to meet necessary high processing efficiency requirements, future processors will have many heterogeneous cores with reduced reliability due to low voltage, small transistor sizes, semiconductor wearout, and environmental factors such as noise and interference. It will be necessary for multi-core network infrastructure software to mitigate transient hardware faults to maintain acceptable system reliability. Applications such as packet processing can benefit from the reliability versus performance tradeoff. We propose a model based on stochastic reward nets to evaluate the performance vs. reliability tradeoff of unreliable embedded multi-core network processors, and apply this model to a multi-core packet processing application.

The virtual infrastructure has become more and more popular in the grid and cloud computing. With the aggrandizement scale, the management of the resources in virtual infrastructure faces a great technical challenge. To support the upper services effectively, it raises higher requirements for the performance, fault-tolerance and scalability of virtual infrastructure management systems. In this paper, we study the performance, fault-tolerance and scalability of virtual infrastructure management systems with the three typical structures, including centralized, hierarchical and peer-to-peer structures. We give the mathematical definition of the evaluation metrics and give detailed quantitative analysis, and then get several useful conclusions for enhancing the performance, fault-tolerance and scalability, based on the quantitative analysis. We believe that the results of this work will help system architects make informed choices for building virtual infrastructure.

The traditional TCP congestion control is inefficient for high speed networks and it is a challenge to design a high speed replacement for TCP. By simulating some existing high speed protocols, we find that these high speed protocols have limitations in convergence and stability. To address these problems, we apply a population ecology model to design a novel congestion control algorithm-Coupling Logistic TCP(CLTCP). It is based on bandwidth pre-assignment that is similar to XCP and MaxNet. The pre-assignment rate factor is computed in the routers based on the information of the router capacity, the aggregate incoming traffic and the queue length. Then the senders adjust the sending rate according to the pre-assignment rate factor which carries by the packet to strengthen the convergence and stability of transport protocol. The theoretical analysis and simulation results show that CLTCP provides not only fast convergence and strong stability, but also high utilization and fair bandwidth allocation regardless of round trip time.

Deep Packet Inspection (DPI) is a critical function in network security applications such as Firewalls and Intrusion Detection Systems (IDS). Signature based scanners used in DPI apply multi-pattern matching algorithms to check whether the packet payload or flow content contains a specified signature in a signature set. Existing multi-pattern matching algorithms sacrifice memory space to achieve better performance. In this paper a novel fast multi-pattern matching algorithm, the Hash Boyer-Moore (HBM) Algorithm, is presented, which reduces the memory footprint of the heuristic table using a hash function and adds another heuristic table to reduce the false-positive ratio. Analyses and simulations show HBM offers higher speed and lower memory cost than some existing algorithms. The HBM algorithm was implemented on the Intel IXP 2400 Network Processor (NP) platform and experiments show suitable performance results in a Gigabit Ethernet LAN environment.

In this paper, based on the Trusted Network Connect architecture, we designed a novel TNC-compatible Network Access Control System which ensures that network administrators enforce security policies on endpoint connection and communication with corporate network depending on the endpoint integrity and security status. The platform framework is built on the Intel IXP2400 network processor and a set of network access control mechanisms is implemented. The paper introduces the system design and implementation based on hardware characteristic of the IXP2400 Architecture, presents emulation performance results of the system, and then proposes systemic performance optimizations, especially cryptographic performances, according to IXP2400 shared memory hierarchy and access latency, which averagely boost the throughput more than 25%. The novelty of system design is the utilization of IXP2400 multi-core and multi-thread network processor's software and hardware platform to implement the NAC system framework through secure and reliable communication to ensure endpoint integrity and platform-authentication, which is compatible with Trusted Network Connect.

In this paper, an AntiWorm system based on the Intel IXP Network Processor was implemented using the Parallel Bloom filters technique. The AntiWorm system consists of two components: Bloom filters and Exact Matching engines. The Parallel Bloom filters can identify the suspicious traffic quickly and effectively, and then dispatch them to Exact Matching engines for further investigation. Both the principles and the implementation of the AntiWorm system are introduced in detail. With the consideration of the system performance parameters, two feasible implementation solutions are investigated and the advantages and disadvantages are also compared. The selections of configuration parameters of the AntiWorm system are also discussed. A hash scheme based on MD5's function is proposed for implementing fast hash functions. To test the performance of the AntiWorm system, such as throughput and delay, some experiments are carried out with different simulated traffic condition. The internal statistics of IXP network processor are also collected and analyzed for optimizing the system performance. To demonstrate the operation of the AntiWorm system, assaults by Worm Blaster are used in the test bed, and the experimental results prove the effectiveness of the AntiWorm system. The Software Package WormDetector1.0 is also provided as a software release from the research.