Search

The current mechanism to secure Border Gateway Protocol relies on the resource public key infrastructure (RPKI) for route origin authorization. The RPKI implements a hierarchical model that intrinsically makes lower layers in the hierarchy susceptible to errors and abuses from entities placed in higher layers. In this article, we present InBlock, a distributed autonomous organization that provides decentralized management of IP addresses based on blockchain, embedding an alternative trust model to the hierarchical one currently implemented by the RPKI. By leveraging on blockchain technology, InBlock requires consensus among the involved parties to change existent prefix allocation information. InBlock also fulfills the same objectives as the current IP address allocation system, i.e., uniqueness, fairness, conservation, aggregation, registration, and minimized overhead. InBlock is implemented as a set of blockchain smart contracts in Ethereum, performing all the functions needed for the management of a global pool of addresses without human intervention. Any entity may request an allocation of addresses to the InBlock registry by solely performing a (crypto) currency transfer to the InBlock. We describe our InBlock implementation and we perform several experiments to show that it enables fast address registering and incurs in very low management costs. Publicado

The current system to manage the global pool of IP addresses is centralized in five transnational organizations, known as regional internet registries (RIRs). Each of them manages the address pool for many countries. In this paper, we present InBlock, a distributed autonomous organization that provides the decentralized management of IP addresses. The InBlock also fulfills the same objectives as those fulfilled by the current IP address allocation organizations, i.e., uniqueness, fairness, conservation, aggregation, registration, and minimized overhead. The InBlock is implemented as a set of blockchain's smart contracts in Ethereum, and it implements all the functions needed for the management of a global pool of addresses without any human intervention. Any entity may request an allocation of addresses to the InBlock registry by performing a (crypto)currency transfer to the InBlock. The fee required, along with the annual renewal fee, serves as a mechanism to deter stockpiling and other wasteful practices. As with any novel technology, there are many open questions about the usage of blockchains to build an IP address registry. For this reason, we believe that practical experimentation is required in order to have hands-on experience, so we propose to conduct an experiment on the InBlock as a starting point to inform about the future directions in this space. This work was supported by Huawei through the InBlock HIRP prize and by the Spanish Ministry of Economy and Competitiveness through the 5G-City project (TEC2016-76795-C6-3-R).

In this paper, we present InBlock4, a blockchain-based alternative to RPKI for the provision of Route Origin validation for BGP. InBlock4 embeds an alternative trust model to protect entities obtaining a resource allocations from errors and abuses from other entities in the allocation hierarchy. InBlock4 is compatible with BGPsec. Moreover, InBlock4 can be bootstrapped using the information in the RPKI and it can coexists with RPKI-based route origin validation. In the paper, we also present a working implementation of InBlock4 for Ethereum and we quantify its performance.

BGP reconvergence events involving a large number of prefixes may result in the loss of large amounts of traffic. Based on the observation that a very small number of prefixes carries the vast majority of traffic, we propose Power Prefixes Prioritization (PPP) to ensure the routes of these popular BGP prefixes converge first. By doing so, we significantly reduce the amount of traffic lost during reconvergence events. To achieve this, PPP obtains an ordered list of popular prefixes through traffic inspection, and configures the resulting prefix rank in the BGP routers to prioritize the processing and advertisement of BGP routes. We model the benefits of PPP over traditional BGP processing in terms of traffic loss for both generic and a Zipf traffic distribution, and we consider the impact of sampling in the process of obtaining the prefix rank. Applying the mechanism to real traffic traces obtained from WIDE, we show that PPP reduces the amount of traffic lost by an order of magnitude, even when we configure it to use conservative sampling rates. We prototype our proposal in Quagga to show the feasibility of its implementation, and we observe similar traffic loss reduction. PPP can be deployed incrementally, as it is implemented purely as a change in the router-internal BGP processing behavior.

Bartolomeu is a solution to enable stub networks to perform adaptive egress traffic load balancing across multiple interdomain routes by spreading the traffic across available paths according to a passive measurement of their performance. It defines a BGP-SDN architecture that increases the number of BGP routes that can be used by stub networks. Bartolomeu measures the available capacity of each path to any destination prefix, and allocates to each path a number of large flows that is proportional to its capacity. This strategy reduces the mean sojourn time, i.e., mean time to flow completion, compared to state-of-the-art traffic balancing techniques as ECMP. We develop a mathematical model to compute this time and compare with ECMP and single path (fast path) selection. An analysis of the traffic traces of two content providers was performed to ensure that our solution is deployable. An experiment with traffic exchange over the Internet is used to show that Bartolomeu can provide gains with real interfering traffic. A discrete-event simulator fed with the traces captured is used to asses Bartolomeu's gains with prefixes with different number of flows, and flows with different sizes and arrival time. We observe in this experiment that Bartolomeu can reduce the sojourn time, compared to ECMP, by half when path rates differ in a factor of 3, or to a sixth when path rates differ in a factor of 10. We compute the maximum number of per-flow entries and the maximum entry change request rate to show that the resources required fit in with the specifications of the current generation of SDN switches. The work of Pedro Rodrigues Torres-Jr. was partially supported by the Fundación Carolina, program Mobilidad SEGIB 2019. The work of Alberto García-Martínez was supported by the 5G-TRANSFORMER project, H2020-761536. The work of and Marcelo Bagnulo was supported in part by the 5G-TRANSFORMER project, and by the Spanish Ministry of Economy and Competitiveness under 5GCity project, TEC2016-76795-C6-3-R.

We present a methodology to measure the propagation time of BGP routes with BGP route collectors and beacons which accounts for the clock offset error between route source and destinations. We apply it to the RIPE RIS data set comparing 2012 and 2018, showing that the IPv4 route prefix reachability interval and the time to receive the preferred route have not changed much, but the time to remove an IPv4 route has increased and it is high (a mean of 121s to remove a route). In 2018, IPv6 route propagation times are shorter than IPv4 ones. The work of Alberto García-Martínez was supported by 5G-Coral project, H2020-ICT-2016-2. The work of Marcelo Bagnulo was supported in part by the Spanish Ministry of Economy and Competitiveness under 5GCity project, TEC2016-76795-C6-3-R, and in part by the European Commission, Marie Curie ITN, METRICS project.

Evaluate if eslicarbazepine acetate (ESL) in combination with other non-inducer antiepileptic drugs (AEDs) in the treatment of epilepsy may represent a positive impact in the cardiovascular risk profile.multicentre, retrospective, observational, non-interventional, real-life study comparing patients treated with cytochrome P450 (CYP) inducer vs. ESL plus non-inducer AEDs. Primary endpoint: Carotid intima-media thickness (CIMT) measured following the Manheim Consensus criteria.Patients included: 163. The main demographic, clinical and vascular risk parameters were comparable between the two groups except for duration of the disease, prevalence of dyslipidemia and use of lipid-lowering drugs (significantly higher in the inducers group) and number of previous antiepileptic drugs (significantly higher in the non-inducers group). Bivariate analysis of the main endpoint showed almost significant differences (p=0.05) in CIMT measures favourable to non-inducers (average 0.617mm+SD=0.148) vs. inducers (average 0.663mm+SD=0.147). Other variables reaching statistical significance were: age 50 years (p0.001), high blood pressure (p0.01) and dyslipidemia (p0.05). A multivariate analysis including these variables and biochemical vascular risk factors showed a predictor model including two variables: inducers group (p=0.031; Coefficient β=0.234) and age50 years (p=0.001; Coefficient β=0.387). Regarding gender, the mean CIMT in males was significantly higher in the inducers (0.693mm; SD=0.139) than in the non- inducers groups (0.628mm; SD=0.151; p0.05). In females the differences were not significant.The use of CYP inducer AEDs is associated with a significant increase in CIMT as compared with ESL and other non-inducer AEDs. The study shows a decrease in the vascular risk measured by ultrasound criteria in male patients treated with ESL compared with patients treated with inducer AEDs.

Multipath interdomain routing has been proposed to enable flexible traffic engineering for transit Autonomos Systems (ASes). Yet, there is a lack of solutions providing maximal path diversity and backwards compatibility at the same time. The BGP-XM (Border Gateway Protocol-eXtended Multipath) extension presented in this paper is a complete and flexible approach to solve many of the limitations of previous BGP multipath solutions. ASes can benefit from multipath capabilities starting with a single upgraded router, and without any coordination with other ASes. BGP-XM defines an algorithm to merge into regular BGP updates information from paths which may even traverse different ASes. This algorithm can be combined with different multipath selection algorithms, such as the K-BESTRO (K-Best Route Optimizer) tunable selection algorithm proposed in this paper. A stability analysis and stable policy guidelines are provided. The performance evaluation of BGP-XM, running over an Internet-like topology, shows that high path diversity can be achieved even for limited deployments of the multipath mechanism. Further results for large-scale deployments reveal that the extension is suitable for large deployment since it shows a low impact in the AS path length and in the routing table size.

The impact of the ICT sector in worldwide power consumption is an increasing concern, motivating the research community to devote an important effort to define novel energy efficient networking solutions. Despite file distribution is responsible for a major portion of the current Internet traffic, little effort has been dedicated to address the issue of its energy efficiency so far. Most of the previous literature focuses on optimizing the download time of file distribution schemes (e.g. centralized server-based or distributed peer-to-peer solutions) while it is yet unclear how to optimize file distribution schemes from the point of view of energy consumed. In this paper, we present a general modelling framework to analyze the energy consumption of file distribution systems. First, we show that the general problem of minimizing energy consumption in file distribution is NP-hard. Then, for restricted versions of the problem, we establish theoretical bounds to minimal energy consumption. Furthermore, we define a set of optimal algorithms for a variety of system settings, which exploit the service capabilities of hosts in a P2P fashion. We show that our schemes are capable of reducing at least 50 % of the energy consumed by traditional (yet largely used) centralized distribution schemes even when considering effects such as network congestion and heterogeneous access speed across nodes. Supported in part by Ministerio de Economia y Competitividad grant TEC2014- 55713-R, the DRONEXT project (TEC2014-58964-C2-1-R), Regional Government of Madrid (CM) grant Cloud4BigData (S2013/ICE-2894, co- funded by FSE & FEDER), and BRADE Project (P2013/ICE-2958), NSF of China grant 61520106005, and European Commission H2020 grants ReCred and NOTRE.

Energy efficient networking has gained momentum in past one decade due to the Internet's ever increasing share in world's total energy consumption. It is crucial to study and reduce the energy consumption of tasks that are very heavily used in the Internet. In this paper, we focus on one such task, file distribution, and study its energy efficiency. We prove lower bounds on energy consumption for different scenarios that are relevant in today's Internet and design schemes that achieve the lower bounds when all the hosts have equal upload and equal download capacities. We evaluate our theoretical results numerically to generalized scenarios as well. We show that our schemes of file distribution can save as much as 50% energy compared to other energy efficient P2P methods proposed in the literature.

Internet is growing rapidly in the developing world now. Stringent budget constraints give rise to networks with tree topology, leaving lesser room to apply energy savings methods proposed in the last decade as there are no redundant links or nodes in the network. In this paper, we propose SLEEPWELL, design of energy efficient network topology using energy aware networking devices. We divide users according to their profile of network usage and users with similar profile are all connected to one switch to allow the switch to sleep. We evaluate our framework using real data collected from the Local Area Network of IIT Kanpur (an Indian university) having more than ten thousand network users. Results show that even in a tree topology, SLEEPWELL achieves substantial energy gains, up to 22% using energy-efficient hardware, without compromising performance. We also show that dividing users in just two profiles accounts for more than 90% of the total energy saved using SLEEPWELL. We also evaluate the overheads occurred and show that the extra cost incurred can be recovered within two years for most of the practical scenarios.

It is clear that there is not enough time to upgrade existing Internet hosts to dual stack before the IPv4 address pool depletes. This implies that the IPv6 transition and co-existence must support interaction between IPv4 nodes and IPv6 nodes. In this article we describe NAT64 and DNS64, a tool suite that provides a way forward in the IPv4-to-IPv6 transition by allowing communication among unmodified IPv6 and IPv4 nodes. The research of Marcelo Bagnulo leading to these results has received funding from the Ministry of Science and Innovation of Spain, under the QUARTET project (TIN2009-13992-C02- 01) and the MEDIANET project (S2009-TIC1468). The work of Alberto García-Martínez is partially supported by BONE (Building the Future Optical Network in Europe), a Network of Excellence funded by the European Commission through the 7th ICT-Framework Program, and by the MEDIANET project (S2009-TIC1468). Publicado

Ethernet switched networks do not scale appropriately due to limitations inherent to the spanning tree protocol. Ethernet architectures based on routing over a virtual topology in which turns are prohibited offer improved performance over spanning tree, although in some cases suffer from excessive computational complexity. Up/Down routing is a turn prohibition algorithm with low computational complexity. In this paper we propose HURBA, a new layer-two architecture that improves Up/Down routing performance due to an optimization based on the use of hierarchical addressing, while preserving the computational complexity of Up/Down. The resulting architecture requires zero-configuration, uses the same frame format as Ethernet, allows upgrades by software update, and is compatible with 802.1D bridges by means of encapsulation. HURP protocol builds automatically a core with the interconnected HURP routing bridges and the standard bridges get connected to the edges in standard spanning trees. Simulations show that the performance of HURP, evaluated over various combinations of network topology and size, is close to the one of shortest path, is consistently better than that of Up/Down, and is equal or better than Turn Prohibition, with the advantage of having a lower complexity., Ministerio de Educación y Ciencia, Comunidad de Madrid, Junta de Comunidades de Castilla-La Mancha

Multihoming is currently widely used to provide fault tolerance and traffic engineering capabilities. It is expected that, as telecommunication costs decrease, its adoption will become more and more prevalent. Current multihoming support is not designed to scale up to the expected number of multihomed sites, so alternative solutions are required, especially for IPv6. In order to preserve interdomain routing scalability, the new multihoming solution has to be compatible with Provider Aggregatable addressing. However, such addressing scheme imposes the configuration of multiple prefixes in multihomed sites, which in turn causes several operational difficulties within those sites that may even result in communication failures when all the ISPs are working properly. In this paper we propose the adoption of Source Address Dependent routing within the multihomed site to overcome the identified difficulties.

Today, link-state routing protocols that compute multiple shortest paths predominate in data center and campus networks, where routing is performed either in layer three or in layer two using link-state routing protocols. But current proposals based on link-state routing do not adapt well to real time traffic variations and become very complex when attempting to balance the traffic load. We propose All-Path bridging, an evolution of the classical transparent bridging that forwards frames over shortest paths using the complete network topology, which overcomes the limitations of the spanning tree protocol. All-Path is a new frame routing paradigm based on the simultaneous exploration of all paths of the real network by a broadcast probe frame, instead of computing routes on the network graph. This paper presents All- Path switches and their differences with standard switches and describes ARP-Path protocol in detail, its path recovery mechanisms and compatibility with IEEE 802.1 standard bridges. ARP-Path is the first protocol variant of the All-Path protocol family. ARP-Path reuses the standard ARP Request and Reply packets to explore reactively the network and find the fastest path between two hosts. We compare its performance in terms of latency and load distribution with link-state shortest-path routing bridges, showing that ARP-Path distributes the load more evenly and provides lower latencies. Implementations on different platforms prove the robustness of the protocol. The conclusion is that All-Path bridging offer a simple, resilient and scalable alternative to path computation protocols., Comunidad de Madrid

In this article we describe Source Address Validation Implementation (SAVI), a security architecture being standardized by the IETF to prevent source address spoofing within a link. SAVI devices, usually layer 2 switches, create bindings between the IP address of a node and a property of the host¿s network attachment, such as the port through which the packet is received. Bindings are created by monitoring the packet exchange associated with IP address configuration mechanisms such as DHCP, SLAAC, or SEND. SAVI devices filter out packets whose source IP address does not match with an existing binding. This article has received funding from Comunidad de Madrid, Spain, under the MEDIANET project (S2009/TIC-1468).

Although there are many reasons for the adoption of a multi-path routing paradigm in the Internet, nowadays the required multi-path support is far from universal. It is mostly limited to some domains that rely on IGP features to improve load distribution in their internal infrastructure or some multi-homed parties that base their load balance on traffic engineering. This chapter explains the motivations for a multi-path routing Internet scheme, commenting on the existing alternatives, and detailing two new proposals. Part of this work has been done within the framework of the Trilogy research and development project, whose main objectives are also commented on in the chapter. Introduction Multi-path routing techniques enable routers to be aware of the different possible paths towards a particular destination so that they can make use of them according to certain restrictions. Since several next hops for the same destination prefix will be installed in the forwarding table, all of them can be used at the same time. Although multi-path routing has a lot of interesting properties that will be reviewed in Section 12.3, it is important to remark that in the current Internet the required multi-path routing support is far from universal. It is mostly limited to some domains that deploy multi-path routing capabilities relying on Intra-domain Gateway Protocol (IGP) features to improve the load distribution in their internal infrastructure and normally only allowing the usage of multiple paths if they all have the same cost.

We propose an integrated approach to protect from address spoofing for both IPv6 and Layer-2 addresses, and from address resolution attacks. The proposed approach is an extension to the FCFS SAVI specification, and relies on the inspection and generation of standard Neighbor Solicitation messages. It does not require host modification and manual configuration is only needed to indicate the ports to which routers connect. CCG10-UC3M-TIC-5624 project funded by Comunidad de Madrid. Ministry of Science and Innovation of Spain, QUARTET project (TIN2009-13992-C02-01) Publicado

The Shim6 architecture enables IPv6 multihoming without compromising the scalability of the global routing system by using provider aggregatable addresses. To do so, hosts use different addresses as locators for data packet transmission, but present the same source and destination identifier pair to transport and upper layers. The components of this architecture are the Shim6 entity, which maps and translates upper-layer identifiers and locators for remote hosts; the Shim6 protocol, which exchanges mapping information between two hosts that communicate; and the REAP protocol, which monitors the existing unidirectional paths and finds new valid locator combinations in case of failure. To protect against new vulnerabilities this architecture may introduce compared to IPv6, Shim6 hosts use either cryptographically generated addresses or hash-based addresses. European Community's Seventh Framework Program The work of Alberto García-Martínez is supported by the T2C2 project (TIN2008-06739- C04-01), funded by the Spanish Ministerio de Ciencia e Innovación. This research was supported by Trilogy (http://www.trilogy-project.org), a research project (ICT-216372) partially funded by the European Community under its Seventh Framework Programme. European Community's Seventh Framework Program This work was partly funded by POSDRU/89/1.5/S/62557 Publicado

This work is at: The 17th IEEE International Workshop on Local and Metropolitan Area Networks, took place May 5 - 7, 2010 in Long Branch, New Jersey, USA In this paper we propose Fast Path Ethernet, an evolution of the transparent bridges learning mechanisms to increase infrastructure utilization for campus and datacenter networks in a simple way. Fast Path Ethernet Switches reuse standard ARP Request and Reply packets to set up fast ondemand paths between hosts. This architecture uses the standard Ethernet frame format, so it is fully transparent to hosts and compatible with 802.1D bridging in core-island mode. A proof of concept has been implemented in Linux. Preliminary simulations in metropolitan and campus network topologies show superior performance to spanning tree and even to shortest path forwarding, at a fraction of the their complexity. This work was supported in part by grants from Comunidad de Madrid through Project MEDIANET-CM (S-2009/TIC- 1468) and from Comunidad de Castilla la Mancha through Project EMARECE (PII1I09-0204-4319). Publicado

This paper characterizes analytically the performance of REAchability Protocol (REAP), a network layer end-to-end recovery protocol for IPv6. REAP was developed by the IETF SHIM6 Working Group as part of its multihoming solution. The behavior of REAP is governed by a small number of parameters: three timers, a simple characterization of the application traffic, and the communication delay. The key figure of merit of REAP performance is the time to recover from a path failure as seen by the upper layers, figure that cannot be trivially obtained, despite the apparent simplicity of this reachability protocol. In this paper we provide upper bounds for the recovery time of REAP for different deployment scenarios, applying these analytical results to two interesting case studies, TCP and VoIP traffic. European Community´s Seventh Framework Program Publicado

Tree-based routing Ethernet (TRE) is a recent Ethernet architecture that enables shortcut links to improve performance compared to spanning tree protocols. However, TRE can only use shortcuts that arrive directly at bridges located in the branch of the destination. TRE+ extends the topology knowledge of a bridge to 2 hops away, thus unveiling new shortcuts to the destination branch. Simulations show a major performance improvement of TRE+ compared to TRE, with results close to shortest paths in some topologies., Junta de Comunidades de Castilla La Mancha

We claim that the slow deployment of IPv6 seen so far is related with the complete decoupling with IPv4 regarding to routing and addressing. In this paper we propose Integrated Routing and Addressing (InRA), a new solution to allow IPv6 to integrate with IPv4 routing and addressing in order to decrease management cost during the coexistence period, and speed up IPv6 deployment. Addressing and routing integration are achieved by the use of a new address format derived from IPv4 address assignment, and the use of a new type of encapsulation allowing packets to be forwarded according to the most detailed information known by a router (InRA or IPv4). TRUE pub

Tree-based Routing (TRE) revisits Tree-based Routing Architecture for Irregular Networks (TRAIN)¿a forwarding scheme based on a spanning tree that was extended to use some shortcut links.We propose its adaptation to Ethernet, using a new type of hierarchical Ethernet addresses and a procedure to assign them to bridges. We show that compared to RSTP, TRE offers improved throughput. The impact of transient loops in TRE is lower compared to the application of the classical shortest path routing protocols to Ethernet. Finally, TRE is self-configuring and its forwarding process is simpler and more efficient than in standard Ethernet and shortest path routing proposals., Ministerio de Ciencia e Innovación

This article describes a scalable, self-configuring architecture for campus networks, the ABridges architecture. It is a two-tiered hierarchy of layer two switches in which network islands running independent rapid spanning tree protocols communicate through a core formed by island root bridges (ABridges). ABridges use AMSTP, a simplified and self configuring version of MSTP protocol, to establish shortest paths in the core using multiple spanning tree instances, one instance rooted at each core edge ABridge. The architecture is very efficient in terms of network usage and path length due to the ability of AMSTP to provide optimum paths in the core mesh, while RSTP is used to aggregate efficiently the traffic at islands networks, where sparsely connected, tree-like topologies are frequent and recommended. Convergence speed is as fast as existing Rapid Spanning Tree and Multiple Spanning Tree Protocols. Publicado

The P-SHIM6 architecture provides ISP independence to IPv6 sites without compromising scalability. This architecture is based on a middle-box, the P-SHIM6, which manages the SHIM6 protocol exchange on behalf of the nodes of a site, which are configured with provider independent addresses. Incoming and outgoing packets are processed by the P-SHIM6 box, which can assign different locators to a given communication, either when it is started, or dynamically after the communication has been established. As a consequence, changes required for provider portability are minimized, and fine-grained Traffic Engineering can be enforced at the P-SHIM6 box, in addition to the fault tolerance support provided by SHIM6.

We present an architecture for the provision of network layer privacy based on the SHIM6 multihoming protocol. In its basic form, the architecture prevents on-path eavesdroppers from using SHIM6 network layer information to correlate packets that belong to the same communication but use different locators. To achieve this, several extensions to the SHIM6 protocol and to the HBA (Hash Based Addresses) addressing model are defined. On its full-featured mode of operation, hosts can vary dynamically the addresses of the packets of on-going communications. Single-homed hosts can adopt the SHIM6 protocol with the privacy enhancements to benefit from this protection against information collectors. IEEE Communications Society Publicado

There is ongoing work on the IETF aimed to provide support for different flavors of multihoming configurations, such as SHIM6 for multihomed sites, multiple CoAs support in MIP for multihomed mobile nodes and HIP for multihomed nodes and sites. A critical aspect for all the resulting multihoming protocols is to detect failures and gain information related with the paths available between two hosts. The Failure Detection and Locator Path Exploration Protocol (in short REAchability Protocol, REAP) being defined in the SHIM6 WG of the IETF is a good candidate to be included as a reachability detection component on protocols requiring this functionality. Performance study is performed by combining analytical estimations and simulations to evaluate its behavior and tune its main parameters.

This paper proposes an API for Multihoming in IPv6. This API is based on the Hash Based Addresses and Cryptographically Generated Addresses approaches, which are being developed by the IETF multi6 Working Group. The support of Multihoming implies several actions such as failure detection procedures, reach-ability tests, re-homing procedures and exchange of locators. Applications can benefit from transparent access to Multihoming services only if per host Multihoming parameters are defined. However, more benefits could be obtained by applications if they will be able to configure these parameters. The proposed Multihoming API provides different functions to applications which can modify some parameters and invoke some functions related with the Multihoming Layer.

In this paper we present a comprehensive set of mechanisms that restore to the site administrator the capacity of enforcing Traffic Engineering (TE) policies in a multiaddressed IPv6 scenario. The mechanisms rely on the ability of SHIM6 to securely perform locator changes in a transparent fashion to transport and application layers. Once an outgoing path has been selected for a communication by proper routing configuration in the site, the source prefix of SHIM6 data packets is rewritten by the site routers to avoid packet discarding due to ingress filtering. The SHIM6 locator preferences exchanged in the context establishment phase are modified by the site routers to influence in the path used for receiving traffic. Scalable deployment is ensured by the stateless nature of these mechanisms TRUE pub

This paper proposes a scalable solution for the support for globally moving networks. It is basically oriented to airborne mobile networks built in commercial aircrafts in order to provide Internet access to the passengers. As opposed to currently used solutions, the proposed solution has no impact in the global routing tables while it provides optimized paths between the mobile network and the rest of the Internet The proposed solution is an extension to the IETF standard network mobility support protocol and relies on the communication through multiple geographically distributed Home Agents in order to avoid panoramic routing imposed by single anchor points as in the case of a single Home Agent. The proposed solution includes a mechanism to select the best Home Agent to route new communications through. This project has been supported by Optinet project TIC-2003-09042-C03-01 and IMPROVISA project. Publicado

It is expected that IPv6 multihomed sites will obtain as many global prefixes as direct providers they have, so traffic engineering techniques currently used in IPv4 multihomed sites is no longer suitable. However, traffic engineering is required for several reasons, and in particular, for being able to properly support multimedia communications. In this paper we present a framework for traffic engineering in IPv6 multihomed sites with multiple global prefixes. Within this framework, we have included several tools such as DNS record manipulation and proper configuration of the policy table defined in RFC 3484. To provide automation in the management of traffic engineering, we analyzed the usage of two mechanisms to configure the policy table. This work has been partly supported by the European Union under the E-Next Project FP6-506869 and by the OPTINET6 project TIC-2003-09042-C03-01. Publicado

In this note, we propose a security mechanism for protecting IPv6 networks from possible abuses caused by the malicious usage of a multihoming protocol. In the presented approach, each multihomed node is assigned multiple prefixes from its upstream providers, and it creates the interface identifier part of its addresses by incorporating a cryptographic one-way hash of the available prefix set. The result is that the addresses of each multihomed node form an unalterable set of intrinsically bound IPv6 addresses. This allows any node that is communicating with the multihomed node to securely verify that all the alternative addresses proposed through the multihoming protocol are associated to the address used for establishing the communication. The verification process is extremely efficient because it only involves hash operations Publicado

Multihoming is currently widely adopted to provide fault tolerance and traffic engineering capabilities. It is expected that, as telecommunication costs decrease, its adoption will become more and more prevailing. Current multihoming support is not designed to scale up to the expected number of multihomed sites, so alternative solutions are required, especially for IPv6. In order to preserve interdomain routing scalability, the new multihoming solution has to be compatible with Provider Aggregatable addressing. However, such addressing scheme imposes the configuration of multiple prefixes in multihomed sites, which in turn causes several operational difficulties within those sites that may even result in communication failures when all the ISPs are working properly. In this note we propose the adoption of Source Address Dependent routing within the multihomed site to overcome the identified difficulties.

A proper support for multimedia communications transport has to provide fault tolerance capabilities such as the preservation of established connections in case of failures. While multi-homing addresses this issue, the currently available solution based in massive BGP route injection presents serious scalability limitations, since it contributes to the exponential growth of the BGP table size. Alternative solutions proposed for IPv6 fail to provide equivalent facilities to the current BGP based solution. In this paper we present MEX (Muti-homing through EXtension header) a novel proposal for the provision of IPv6 multi-homing capabilities. MEX preserves overall scalability by storing alternative route information in end-hosts while at the same time reduces packet loss by allowing routers to re-route in-course packets. This behavior is enabled by conveying alternative route information within packets inside a newly defined Extension Header. The resulting system provides fault tolerance capabilities and preserves scalability, while the incurred costs, namely deployment and packet overhead, are only imposed to those that benefit from it. An implementation of the MEX host and router components is also presented.

Real-Time Technology and Applications Symposium. Brookline, MA, USA, 10-12 Oct. 1996 In real-time data-intensive applications, the simultaneous achievement of the required performance and determinism is a difficult issue to address, mainly due to the time needed to perform I/O operations, which is more significant than the CPU processing time. Additional features need to be considered if these applications are intended to perform in hostile environments. In this paper, we address the implementation of a hardware/software platform designed to acquire, transfer, process and store massive amounts of information at sustained rates of several MBytes/sec, capable of supporting real-time applications with stringent throughput requirements under hazardous environmental conditions. A real-world system devoted to the inspection of nuclear power plants is presented as an illustrative example Publicado

Some FPGA’s are designed to compute division and multiplication on Galois fields. FPGA’s are quite cheap programmable logic devices used in digital circuits with the important characteristic of being reprogrammable. Any FPGA can be specified within VHDL which at present is a standard language in the design of digital systems. We describe in VHDL the divider and multiplier basic cells and their whole integration. The structures have scalable systolic architectures. The circuits operate by pipelining; the divider in GF (2 m ) requires 5m − 1 clock cycles while the multiplier 3m − 1. The divider proceeds by the Gaussian triangulation algorithm and is uniform with respect to the irreducible polynomial generating the field. The codes, some simulations and performance measurements are provided.

Third COST 263 International Workshop on Quality of Future Internet Services, QofIS 2002 and Second International Workshop on Internet Charging and QoS Technologies, ICQT 2002 Zurich, Switzerland, October 16–18, 2002 Proceedings In this paper we describe MIRA, a distributed and scalable architecture for flow-based monitoring and traffic analysis. MIRA relies on data inspection to provide advanced monitoring services such as Acceptable User Policy auditing. It is based on a low cost hardware platform that can be deployed in both LAN and WAN environments. The distributed architecture of the measurement platform is designed to provide real-time global results from a complex network. Processing rate can be seamlessly increased by the addition of new hardware elements. The MIRA architecture has been thoroughly tested in a field trial on RedIRIS, the Spanish National Research Network. This research was supported by the MIRA (Methods for IP traffic Analysis) project, funded by the Spanish National R&D Programme under contract CICYT 2fd-97-2234-c03-01

A global solution for the provision of QoS in IPng sites must include ISP selection based on per-application requirements. In this article we present a new site-local architecture for QoS-driven ISP selection in multihomed domains, performed in a per application basis. This architecture proposes the novel use of existent network services, a new type of routing header, and the modification of address selection mechanisms to take into account QoS requirements. This proposal is an evolution of current technology, and therefore precludes the addition of new protocols, enabling fast deployment. The sitelocal scope of the proposed solution results in ISP transparency and thus in ISP independency.

In this article we present, analyse and evaluate a new memory management technique for video-on-demand servers. Our proposal, Memory Reservation Per Storage Device (MRPSD), relies on the allocation of a fixed, small number of memory buffers per storage device. Selecting adequate scheduling algorithms, information storage strategies and admission control mechanisms, we demonstrate that MRPSD is suited for the deterministic service of variable bit rate streams to intolerant clients. MRPSD allows large memory savings compared to traditional memory management techniques, based on the allocation of a certain amount of memory per client served, without a significant performance penalty Publicado

We present a buffering technique that reduces video-on-demand server memory requirements in more than one order of magnitude. This technique, Per-Storage-Device Buffering (PSDB), is based on the allocation of a fixed number of buffers per storage device, as opposed to existing solutions based on per-stream buffering allocation. The combination of this technique with disk array servers is studied in detail, as well as the influence of Variable Bit Streams. We also present an interleaved data placement strategy, Constant Time Length Declustering, that results in optimal performance in the service of VBR streams. PSDB is evaluated by extensive simulation of a disk array server model that incorporates a simulation based admission test. This research was supported in part by the National R&D Program of Spain, Project Number TIC97-0438. Publicado

23rd Euromicro Conference EUROMICRO 97: 'New Frontiers of Information Technology', Budapest, Hungary, 1-4 Sept 1997 Memory management is a key issue when designing cost effective video on demand servers. State of the art techniques, like double buffering, allocate buffers in a per stream basis and require huge amounts of memory. We propose a buffering policy, namely Single Pair of Buffers, that dramatically reduces server memory requirements by reserving a pair of buffers per storage device. By considering in detail disk and network interaction, we have also identified the particular conditions under which this policy can be successfully applied to engineer video on demand servers. Reduction factors of two orders of magnitude compared to the double buffering approach can be obtained. Current disk and network parameters make this technique feasible. Publicado

There is a strong consensus about the need for IPsec, although its use is not widespread for end-to-end communications One of the main reasons for this is the difficulty for authenticating two end-hosts that do not share a secret or do not rely on a common Certification Authority In this paper we propose a modification to IKE to use reverse DNS and DNSSEC (named DNSSEC-to-IKE) to provide end-to-end authentication to Internet hosts that do not share any secret, without requiring the deployment of a new infrastructure We perform a comparative analysis in terms of requirements, provided security and performance with state-of-the-art IKE authentication methods and with a recent proposal for IPv6 based on CGA We conclude that DNSSEC-to-IKE enables the use of IPsec in a broad range of scenarios in which it was not applicable, at the price of offering slightly less security and incurring in higher performance costs.