The Internet undergoes a fundamental transformation as billions of connected ”things” surround us and embed themselves into the fabric of our everyday lives. However, this is only the beginning of true convergence between the realm of humans and that of machines, which materializes with the advent of connected machines worn by humans, or wearables. The resulting shift from the Internet of Things to the Internet of Wearable Things (IoWT) brings along a truly personalized user experience by capitalizing on the rich contextual information, which wearables produce more than any other today’s technology. The abundance of personally identifiable information handled by wearables creates an unprecedented risk of its unauthorized exposure by the IoWT devices, which fuels novel privacy challenges. In this paper1, after reviewing the relevant contemporary background, we propose efficient means for the delegation of use applicable to a wide variety of constrained wearable devices, so that to guarantee privacy and integrity of their data. Our efficient solutions facilitate contexts when one would like to offer their personal device for temporary use (delegate it) to another person in a secure and reliable manner. In connection to the proposed protocol suite for the delegation of use, we also review the possible attack surfaces related to advanced wearables.

Users want to enjoy online services without sacrificing their security. Although there is a trade-off between the security of a service and its usability, the level of security required will differ depending on the user and the situation. To optimize the balance between security and usability, it can be customized for each user and each online transaction. Yet in order to do that, both users and service providers need to stipulate their security requirements. We have been working on a framework that provides security requirement classifications in multiple dimensions to help users identify and select their security requirements, and then apply these requirements to different dimensions. This paper shows how we implemented this framework and then evaluated it by conducting a user study along with our implementation. The study verifies that ordinary users without any particular technical knowledge prefer to clarify their security requirements using a taxonomy-based selection scheme (our scheme) as opposed to a free-form input scheme. It also discusses the coverage of pre-defined taxonomies and users' requirements. Through this study, we clarify the future direction of our research.

This paper proposes a mechanism that realizes accountable security using a security service level agreement (SSLA), which defines the security level of a service agreed to between a user and service provider. The mechanism consists of three major components: security expression, translation, and negotiation techniques. The security expression technique provides a means to describe security requirements and capabilities of a user and service provider, as well as the SSLA between them, in different levels of detail. The translation technique provides a means to translate such information among different levels of detail, and the negotiation technique provides a means to negotiate and agree upon the SSLA between the user and service provider. Both the user and service provider need to be accountable and non-repudiable against the agreed to SSLA in order to empower it. The mechanism uses cryptographic identities and digital signatures for this purpose. This paper demonstrates the feasibility and usability of the mechanism by describing its usage scenario and implementing its prototype, and analyzes this mechanism.

During the past few years a new trend, user generated content, has gained more and more popularity. Current website-based sharing services provide already means to share content to a group of other users, but it is not possible to share content with other mobile users at a competitive cost. The increasing use of mobile devices in our daily life will create demand for the new types of services in the usergenerated content field. This paper presents a personal mobile broadcasting system as an extension to the currently existing 3GPP MBMS system. A new user-level interface between the BM-SC and the personal mobile broadcaster is proposed. Also some new functionality, to be able to restrict the delivery only to a subset of user population, are presented in the paper.

The rise in device mobility, interactions for service discovery as well as IPv6 networking, necessitate a means by which a clear and consistent approach towards supporting rapid, dynamic service discovery and service provision must be undertaken. This paper describes ways to provide movement detection, automatic and dynamic discovery of network services as well as network characteristics at the point of attachment for mobile devices moving in IPv6 network spaces. It employs a service discovery mechanism based on using the service location protocol (SLP), one of the most extensively researched and standardised discovery protocols in existence today. We show why traditional means of service discovery have shortcomings when used in advanced mobile networking environments, and describe new extensions to overcome these issues without losing compatibility to existing work in SLP. Prototypes developed and tested from the work described provided empirical verification over several of our production and research IPv6 networks.

This paper presents an analytical model of steady state throughput of the Slow-but-Steady variant of TCP NewReno as a function of loss event rate, average number of segments lost per loss event, average round trip time, and retransmission timeout value. The presented model is based on the approach proposed by Padhyeetal.for TCP Reno throughput modeling and extends it by capturing the effect of fast recovery algorithm of the Slow-but-Steady variant of TCP NewReno on throughput and taking into consideration slow start phase after timeout expiration. Validation by ns-2 simulations shows good agreement and accuracy of the proposed model.

One of the main issues of mobile IPv6 is handover latency that causes service disruption time. Although plenty of proposals significantly reduce the service disruption time, they suffer from redundant routing that causes packet misordering and bandwidth consumption during the process of inter-domain handover. In this paper, we propose R-MIP, a routing-aware handover scheme for mobile IP, that minimizes the redundant routing during the process of inter-domain handover by utilizing forwarding routers. R-MIP consists of forwarding router discovery and proactive handover. We evaluate R-MIP in the view of packet misordering and bandwidth consumption, and clarify its efficiency. We also evaluate the impact of the forwarding router's capacity since routers have limited resources. By strategically locating forwarding routers, e.g. next to the router that has peering to another domain, the redundant routing caused by inter-domain handover will be efficiently suppressed.

One of the main issues of mobile IPv6 is handover latency that causes service disruption time. Although plenty of proposals significantly reduce the service disruption time, they suffer from redundant routing that causes packet misordering and excess bandwidth consumption. In this paper, we propose a new scheme that minimizes the redundant routing during the process of inter-domain handover by utilizing forwarding routers. Our proposed scheme consists of forwarding router discovery and proactive handover. Furthermore, we evaluate the proposed scheme in the view of packet misordering and bandwidth consumption, and clarify the effectiveness of the proposed scheme.

A large diversity of services based on packet switching in the third generation (3G) wireless system leads to dramatic changes in the characteristics and parameters of the data traffic. It is expected that the traffic in the 3G systems undergo both quantitative and qualitative changes. In particular, there is a considerable increase of a rate of transactions and an amount of information transferred during the transactions. Besides, it is necessary to take into account the notion of self-similarity that take place in the 3G systems due to the high variability of burstiness of the multiservice traffic. For these reasons, the prediction problem of data traffic characteristics becomes more complex when planning the 3G wireless systems. In this paper the estimation method for the main parameters of the data traffic in the 3G mobile networks taking into account the above-mentioned 3G features is considered. It is based on a probabilistic model of events initiated by calls of 3G services. It is proposed to make both a decomposition of 3G services into some subsets in accordance with an average amount of transferred data during transactions and a distribution of 3G prospective users into some subgroups in accordance with the Pareto law.

Multicast control protocol has been proposed to control multicast traffic transparently from the sources and the receivers. We have been developing and implementing this protocol, and this paper introduces the framework of our implementation in the Linux environment and proposes some performance enhancements brought by implementation specific features. This paper also shows the performance evaluation of our implementation. Finally, we clarify the effectiveness and the scalability of this protocol.

Based on the differentiated services (DiffServ, [S. Blake, et al., December 1998]) model we develop implementation-ready transmission service for video-on-demand (VoD) traffic. In order to satisfy the demands of real-time nature of VoD traffic we propose to use assured forwarding (AF, [B. Davie, et al., March 2002]) per-hop behavior (PHB) group. We provide specific traffic profile parameters which adequately fit to VoD traffic requirements. Using these parameters and AF PHB class we show how to construct a well-defined transmission service that is suitable for VoD traffic delivery. Our service is analytically tractable. It means that using the quality of service (QoS) parameters which should be provided to VoD traffic we can evaluate the required capacity not only within the DiffServ ingress node, but within the interior nodes too. Our transmission service is designed in such way that it is fully characterized by the parameters of DiffServ ingress node, bounds the losses and delay along the path of behavior aggregate and allows us to predict the QoS degradation which can be experienced by both behavior aggregate and single microflows.

Assuring guaranteed services and providing fair bandwidth sharing are much sought characteristics in the current network architecture research. The IntServ approaches achieve those characteristics but only at the expense of using per-flow states and signaling, which are not scalable and difficult to implement. Alternatively, the stateless approaches proposed up to now are focused either on providing guaranteed services similar to those offered by IntServ or on ensuring a reasonably fair bandwidth allocation. In this paper we propose a stateless architecture - the fair bandwidth allocation control (Fair-BAC) - that ensures both the adherence to the given throughput guarantees and a fair allocation of the remaining bandwidth between the flows that do not have any reservation and the out-of-profile fraction of the flows with reservation. The capabilities of Fair-BAC are demonstrated in a set of simulations performed for various degrees of congestion and using sources with different conformance levels.

This paper presents results from performance measurements in a test network that can be operated as an ordinary best effort or as a Differentiated Services (DiffServ) capable network. The target of the measurements was to analyse the effects that the DS mechanism has on the behaviour of the TCP flow control mechanism. The network implements service differentiation by using eight drop precedence levels and separate classes for real time and non-real time traffic. Performed tests verified that our QoS (quality of service) implementation allows QoS-controlled TCP senders to recover faster from congestion than what is possible for TCP sessions in a purely best-effort network. When QoS is enabled, the access node helps smooth traffic bursts flowing into the DiffServ core network. As a consequence, the congestion window oscillates moderately and keeps TCP operating in the congestion avoidance phase, making the rate adjustment scheme more controllable.

The IP multicast has not been widely used by current Internet service operators, and part of this relates to the nature of multicast, which is designed to allow any host to receive or send multicast traffic to the network. Internet service operators do not want to risk their network operation without sufficient control of the multicast sources and receivers and protection against denial of service (DoS) attacks. In this paper we propose a scheme, which allows operators to add this control part to the existing networks. The solution is lightweight, independent of multicast routing protocols and it does not need modifications to the host interface, namely IGMP or MLD.

This paper presents results from delay measurements in a test network that can be operated as an ordinary best-effort or as a differentiated services capable network. The differentiated services features were implemented according to the simple integrated media access (SIMA) model in the network nodes. Delays of several constant and variable bit rate UDP flows were measured with and without generated background load. The aim was to find out what kind of QoS the implemented SIMA model and DiffServ architecture in general can provide for real-time streams. The results of these measurements clearly show the power of this mechanism, especially under the overload situation.

This paper provides an overview of an implementation of differentiated services interior and boundary nodes as described in the SIMA model. The operation of the network nodes was verified with a series of measurements in a simple networking environment. These measurements also give some idea about the level of quality of service this kind of mechanism is able to provide.

MPOA builds on many existing protocols and combines them to a scalable ATM based layer 3 switched routing solution. This paper starts by describing the implementation of an MPOA client for the Linux operating system and then proceeds to compare the performance and delay characteristics of an MPOA based solution against a "traditional" router based network where MPOA shortcuts are not used.

IETF has developed two architectures for the Internet, Integrated Services (IntServ) and Differentiated Services (DiffServ), which should enable QoS based handling of data flows in IP networks. This paper presents a number of measurements which were carried out in order to determine some performance differences between these QoS mechanisms, as well as some characteristics about their joint use. The results show that in some cases the flow aggregation model, i.e. DiffServ, can provide the same or even better QoS than the reservation based model, i.e. IntServ.

This paper presents results from performance measurements carried out in a differentiated services WAN connecting three major cities in southern Finland. The target of the measurements was to collect precise information about the level of service experienced by a user transmitting files with FTP in a network that implements service differentiation by using drop precedence levels and separate classes for real time and non-real time traffic. Special attention was paid to the behaviour of competing TCP flows produced by users with different service level specifications. Background traffic from ISPs network was injected into our test network in order to create traffic profiles which are typical in a core network. The results show clearly that the SIMA model used for the implementation of the DS mechanisms in the network nodes can provide service differentiation in a useful and fair manner in traffic conditions varying from light load to severe overload.

This paper describes a series of measurements about the characteristics of a reserved controlled-load flow in a simple router network at the presence of excessive background traffic, which was forwarded on a best-effort basis via a common link between two routers. Results concerning the delays and packet loss of the controlled-load flow are discussed and compared to those of the best-effort flow. The tests were carried out according to the simple evaluation criteria given in the RFC specifying the controlled-load service. A quite reasonable performance was measured, roughly satisfying the goals of the controlled-load service. Yet, the presence of background traffic introduced a clear increase in the average level of the network delay of the reserved flow, and also resulted in a larger jitter, which could be intolerable to inelastic traffic.

This article describes a congestion control protocol, based on the use of fuzzy controllers, for efficient utilisation of the capacity of the network. The basic control mechanism uses rate-based control, closely resembling the one specified by the ATM Forum for the Available Bit Rate (ABR) service category. Fuzzy logic is utilised in the network elements to enhance the required control decisions with the general aim of fair and optimal utilisation of the available bandwidth. The control protocol adapts to the changes of the load produced by CBR and VBR connections, and shares the available capacity of the network fairly between ABR connections. Simulations have been carried out to test the performance of the control system in the presence of several VBR and ABR connections with statistical traffic distributions and with varying buffer sizes of the network elements. Results of the tests show the adaptability and efficiency of the control system.

We describe the results obtained when using a desktop videoconferencing system for distance learning and, at the same time, doing measurements about its performance. The system hardware is based on a PC with a LAN network controller, and a compression card implementing the CCITT H.261 algorithm. Our network environment consists of a campus network (Ethernets connected with routers and bridges) and a wide area network connection (0.5 Mbit/s frame relay) to another university 150 miles away. In this environment TCP/IP is used as the transport and network protocol suite. The quality of the videoconferencing application is first analysed on a subjective perceptual basis in four different subnetworks. Then, the transmission rate of the application and the number of TCP retransmissions is measured in those subnetworks under varying background traffic load. As one may assume, severe problems with audio appear when the networking environment gets more demanding. With video, the problems are not so evident. Yet, slight degradation of perceptual quality can be observed and related to the increase of load and number of packet switches (routers and frame relay nodes) in the network connection.>

A parallel data bus based on the slotted ring idea with destination release policy is proposed and analyzed. Analytical results are compared to simulations and actual measurements carried out in a test network with a 200-Mb/s data rate. Transfer delays are calculated by mathematical analysis and computer simulation for networks with five and eight nodes with Poisson distributed load. Two different destination address distributions are used, i.e., uniform and geometric. The results indicate good performance for a large range of load. Potential applications include a back-plane bus for multiprocessor systems, and a local fiber optic network for real-time traffic, e.g., multimedia applications.