Search

Firewalls are crucial elements that enhance network security by examining the field values of every packet and deciding whether to accept or discard a packet according to the firewall policies. With the development of networks, the number of rules in firewalls has rapidly increased, consequently degrading network performance. In addition, because most real-life firewalls have been plagued with policy conflicts, malicious traffics can be allowed or legitimate traffics can be blocked. Moreover, because of the complexity of the firewall policies, it is very important to reduce the number of rules in a firewall while keeping the rule semantics unchanged and the target firewall rules conflict-free. In this study, we make three major contributions. First, we present a new approach in which a geometric model, multidimensional rectilinear polygon, is constructed for the firewall rules compression problem. Second, we propose a new scheme, Firewall Policies Compression (FPC), to compress the multidimensional firewall rules based on this geometric model. Third, we conducted extensive experiments to evaluate the performance of the proposed method. The experimental results demonstrate that the FPC method outperforms the existing approaches, in terms of compression ratio and efficiency while maintaining conflict-free firewall rules.

In this paper we propose a cluster-based platoon handoff protocol (CPHP), in which the platoon is divided into clusters to minimize its handoff delay between two adjacent cells. Via the vehicle-to-vehicle (V2V) communications, multiple clusters are constructed within one platoon and only the cluster head (CH) communicates with the base station (BS) via the vehicle-to-infrastructure (V2I) communications. In this way, the number of V2I links can be greatly saved and the signaling overhead is reduced, thereby shortening the handoff delay. Specifically, we formulate a delay minimization problem based on a discrete-time Markov chain and then optimize the number of clusters and spectrum resource allocation. Simulation results demonstrate a significant decrease in the handoff delay of the platoon. The optimal expected delay under a platoon with 50 vehicles by utilizing the proposed CPHP is 15% smaller than that of the traditional handoff scheme.

Optimizing the virtual machine (VM) migration is an important issue of server consolidation in the cloud data center. By leveraging the content similarity among the memory of VMs, the time and the amount of transferred data in VM migration, as well as the pressure of network traffic, can be reduced. There are two problems in server consolidation: (1) determining which VMs should be migrated from the overloaded hosts (VM selection problem) and (2) how to place these VMs to the destination hosts (VM placement problem). By exploiting the content similarity, we redefine the above two problems into one problem to minimize the transferred memory data in VM migration. Given a fixed host overloaded threshold, an approximation algorithm is proposed to solve the problem with one overloaded host and one destination host. For the case of multiple overloaded hosts and destination hosts, two heuristic algorithms are presented with fixed and dynamic overloaded threshold respectively. We conduct a real workload trace based simulation to evaluate the performance of our algorithms. The result shows that our algorithms can produce fewer transferred VM memory data and consume less energy than existing policies.

Multipath TCP (MPTCP) has been an emerging transport protocol that provides network resilience to failures and improves throughput by splitting a data stream into multiple subflows across all the available multiple paths. While MPTCP is generally beneficial for throughput-sensitive large flows with large number of subflows, it may be harmful for latency-sensitive small flows. MPTCP assigns each subflow a congestion window, making short flows susceptible to timeout when a flow only contains a few packets. This condition becomes even worse when the paths have heterogeneous characteristics as packet reordering occurs and the slow paths can be used with MPTCP, causing the increased end-to-end delay and the lower application Goodput. Thus, it is important to choose the appropriate subflows for each MPTCP connection to achieve the good performance. However, the subflows in MPTCP are determined before a connection is established, and they usually remain unchanged during the lifetime of that connection. To address this issue, we propose DMPTCP, which dynamically adjusts the subflows according to application workloads. Specifically, DMPTCP first utilizes the idea of TCP modeling to estimate the latency on the path under scheduling and the data amount sent on the other paths simultaneously, and then decides the set of subflows to be used for certain application periodically with the goal of reducing completion time for short flows and achieving a higher throughput for long flows. We implement DMPTCP in a Linux server and conduct extensive experiments both in NS3 and in Linux testbed to validate its effectiveness. Our evaluation shows that DMPTCP decreases the completion time by over 46.55% compared to conventional MPTCP for short flows while increases the Goodput up to 21.3% for long-lived flows.

Multipath transmission control protocol (MPTCP) allows a TCP connection to operate across multiple paths simultaneously and becomes highly attractive to support the emerging mobile devices with various radio interfaces and to improve resource utilization as well as connection robustness. The existing multipath congestion control algorithms, however, are mainly loss-based and prefer the paths with lower drop rates, leading to severe performance degradation in wireless communication systems, where random packet losses occur frequently. To address this challenge and improve the performance of MPTCP in wireless networks, this paper proposes a new mVeno algorithm, which makes full use of the congestion information of all the subflows belonging to a TCP connection in order to adaptively adjust the transmission rate of each subflow. Specifically, mVeno modifies the additive increase phase of Veno so as to effectively couple all subflows by dynamically varying the congestion window increment based on the receiving ACKs. The weighted parameter of each subflow for tuning the congestion window is determined by distinguishing packet losses caused by random error of wireless links or by network congestion. We implement mVeno in a Linux server and conduct extensive experiments both in test bed and in real WAN to validate its effectiveness. The performance results demonstrate that compared with the existing schemes, mVeno increases the throughput significantly, achieves load balancing, and can keep the fairness with regular TCP.

The contention based medium access method of 802.11 standards is a fundamental cause of poor downlink goodput and high latency over wireless networks, which makes it impossible to provide QoS guarantees. The intensive channel contention leads to the performance degradation. The problem exacerbates when the traffic asymmetry between the uplink and the downlink is present. While prior research works proposed various mechanisms to alleviate the issue, little was done to specifically address the appropriate parameter setting in a real world network. This study presents a way to obtain the appropriate access parameters that improves the performance of QoS applications over wireless networks. In particular, we propose AQEDCA, a traffic-aware minimum contention window adjustment algorithm. We validate our scheme by the extensive real world network tests and the results show that our scheme improves the downlink goodput up to 199.13%, decreases the latency up to 54.77%, and can achieve tight QoS guarantees as compared to the existing schemes.

Cognitive radio (CR) networks have an ample but dynamic amount of spectrum for communications. Communication rendezvous in CR networks is the process of establishing a control channel between radios before they can communicate. Designing a communication rendezvous protocol that can take advantage of all the available spectrum at the same time is of great importance, because it alleviates load on control channels, and thus further reduces probability of collisions. In this paper, we present ETCH, efficient channel-hopping-based MAC-layer protocols for communication rendezvous in CR networks. Compared to the existing solutions, ETCH fully exploits spectrum diversity in communication rendezvous by allowing all the rendezvous channels to be utilized at the same time. We propose two protocols, SYNC-ETCH, which is a synchronous protocol assuming CR nodes can synchronize their channel hopping processes, and ASYNC-ETCH, which is an asynchronous protocol not relying on global clock synchronization. Our theoretical analysis and ns-2-based evaluation show that ETCH achieves better performances of time-to-rendezvous and throughput than the existing work.

User access control in sensor networks defines a process of granting user an access right to the stored information. It is essential for future real sensor network deployment in which sensors may provide users with different services in terms of data and resource accesses. A centralized access control mechanism requires the base station to be involved whenever a user requests to get authenticated and access the information stored in the sensor node, which is inefficient, not scalable, and is exposed to many potential attacks along long communication paths. In this paper, we propose a distributed user access control under a realistic adversary model in which sensors can be compromised and user may collude. We split the access control into local authentication conducted by a group of sensors physically close to a user, and a light remote authentication based on the endorsement of the local sensors. We implement the access control protocols on a testbed of TelosB motes. Our analysis and experimental results show that our schemes are feasible for real access control requirements.

Symmetric cryptography has been mostly used in security schemes in sensor networks due to the concern that public key cryptography (PKC) is too expensive for sensor devices. While these schemes are efficient in processing time, they generally require complicated key management, which may introduce high memory and communication overhead. On the contrary, PKC-based schemes have simple and clean key management, but cost more computational time. The recent progress in PKC implementation, specially elliptic curve cryptography (ECC), on sensors motivates us to design a PKC-based security scheme and compare its performance with the symmetric-key counterparts. This paper proposes a practical PKC-based access control for sensor networks, which consists of pairwise key establishment, local access control, and remote access control. We have implemented both cryptographic primitives on commercial off-the-shelf sensor devices. Building the user access control as a case study, we show that PKC-based protocol is more advantageous than those built on symmetric cryptography in terms of the memory usage, message complexity, and security resilience. Meanwhile, our work also provides insights in integrating and designing PKC-based security protocols for sensor networks.

A body sensor network (BSN) is a network of sensors deployed on a person's body for health care monitoring. Since the sensors collect personal medical data, security and privacy are important components in a BSN. In this paper, we developed IBE-Lite, a lightweight identity-based encryption suitable for sensors in a BSN. We present protocols based on IBE-Lite that balance security and privacy with accessibility and perform evaluation using experiments conducted on commercially available sensors.

A typical sensor network application is to monitor objects, including wildlife, vehicles and events, in which information about an object is periodically sent back to the sink. Many times, the object needs to be protected for security reasons. However, an adversary can detect message flows and trace the message back to its source by moving in the reverse direction of the flows. This paper aims to maximize source location privacy, which is evaluated by the adversary's traceback time, by designing routing protocols that distribute message flows to different routes. First, we give the performance bound for any routing scheme. Then, we present our routing schemes, which maximize the adversary's average traceback time and achieve max-min traceback time given certain energy constraints. We then propose WRS, a suboptimal but practical privacy-aware routing scheme, and provide simulation results. Finally, we extend the discussion to an extreme adversary model, which allows the adversary to deploy an adversary sensor network to monitor the message routing activities. Accordingly, we propose a random schedule scheme to confuse the adversary. To reduce the message delivery time, we give an approximation algorithm for message routing.

Given the extremely limited hardware resources on sensor nodes and the inclement deploying environment, the adversary Denial-of-Service (DoS) attack becomes a serious security threat toward wireless sensor networks. Without adequate defense mechanism, the adversary can simply inundate the network by flooding the bogus data packets, and paralyze the partial or whole sensor network by depleting node battery power. Prior work on false packet filtering in sensor networks are mostly based on symmetric key schemes, with the concern that the public key operations are too expensive for the resource constrained sensors. Recent progress in public key implementations on sensors, however, has shown that public key is already feasible for sensors. In this paper, we present PDF, a Public-key based false Data Filtering scheme that leverages Shamir's threshold cryptography and Elliptic Curve Cryptography (ECC), and effectively rejects 100% of false data packets. We evaluate PDF by real world implementation on MICAz motes. Our experiment results support the conclusion that PDF is practical for real world sensor deployment.

Flooding is a fundamental file search operation in unstructured peer-to-peer (P2P) file sharing systems, in which a peer starts the file search procedure by broadcasting a query to its neighbors, who continue to propagate it to their neighbors. This procedure repeats until a time-to-live (TTL) counter is decremented to 0. Flooding can seriously limit system scalability, because the number of redundant query messages grows exponentially during the message propagation. Our study shows that more than 70 percent of the generated messages are redundant in a flooding with a TTL of 7 in a moderately connected Gnutella network. Existing efforts to address this issue have been focused on limiting the use of the flooding operation. We propose a new flooding scheme, called LightFlood, with the objective of minimizing the number of redundant messages and retaining a similar message-propagating scope as that of the standard flooding. In the scheme, each peer keeps track of the connectivities of every immediate and next indirect neighbor peers, which can be acquired locally. LightFlood identifies the neighbor with the highest connectivity and uses the link to that neighbor to form a suboverlay within the existing P2P overlay. In LightFlood, flooding is divided into two stages. The first stage is a standard flooding with a limited number of TTL hops, where a message can spread to a sufficiently large scope with a small number of redundant messages. In the second stage, message propagating is only conducted along the suboverlay, significantly reducing the number of redundant messages. Our analysis and simulation experiments show that the LightFlood scheme provides a low-overhead broadcast facility that can be effectively used in P2P search. For example, compared with standard flooding with seven TTL hops, we show that LightFlood with an additional two to three hops can reduce up to 69 percent of the flooding messages and retain the same flooding scope. We believe that LightFlood can be widely used as a core mechanism for efficient message broadcasting in P2P systems due to its near-optimal performance.

A distributed access control module in wireless sensor networks (WSNs) allows the network to authorize and grant user access privileges for in-network data access. Prior research mainly focuses on designing such access control modules for WSNs, but little attention has been paid to protect user's identity privacy when a user is verified by the network for data accesses. Often, a user does not want the WSN to associate his identity to the data he requests, particularly in a single-owner multi-user WSN. In this paper, we present the design, implementation, and evaluation of a novel approach, Priccess, to ensure privacy-preserving access control. In addition to the theoretical analysis that demonstrates the security properties of Priccess, this paper also reports the experimental results of Priccess in a network of Imote2 motes, which show the efficiency of Priccess in practice.

In this paper, we show through a simple secure symmetric key based protocol design and experiments the feasibility of secure data collection in a vehicular sensor networks. This protocol exhibits high speed data routing for sensor data collection through vehicles. The large communictaion and storage capacities of a vehicle and its mobility facilitates this high speed routing scheme compared with routing through hop-by-hop communication among sensors. We demonstrate that the protocol works in a realistic setting by collecting the real trace data through real implementation.

In this paper, we show through a simple secure symmetric key based protocol design and its implementation the feasibility of secure data collection in a vehicular sensor networks. We demonstrate that the protocol works in a realistic setting by collecting the real trace data through real implementation. Some of the key considerations are efficiency, deployability and security. The protocol does not safeguard against some of the techniques an adversary could deploy, such as jamming and deliberate battery-draining.

While symmetric-key schemes are efficient in processing time for sensor networks, they generally require complicated key management, which may introduce large memory and communication overhead. On the contrary, public-key based schemes have simple and clean key management, but cost more computational time. The recent progress of elliptic curve cryptography (ECC) implementation on sensors motivates us to design a public-key scheme and compare its performance with the symmetric-key counterparts. This paper builds the user access control on commercial off-the-shelf sensor devices as a case study to show that the public-key scheme can be more advantageous in terms of the memory usage, message complexity, and security resilience. Meanwhile, our work also provides insights in integrating and designing public-key based security protocols for sensor networks.

Hardware advances will allow us to embed small devices into everyday objects such as toasters and coffee mugs, thus naturally form a wireless object network that connects the object with each other. This paper presents Snoogle, a search engine for such a network. Snoogle uses information retrieval techniques to index information and process user queries, and compression schemes such as Bloom filters to reduce communication overhead. Snoogle also considers security and privacy protections for sensitive data. We have implemented the system prototype on off-the-shelf sensor motes, and conducted extensive experiments to evaluate the system performance.

A body sensor network (BSN), is a network of sensors deployed on a person's body, usually for health care monitoring. Since the sensors collect personal medical data, security and privacy are important components in a body sensor network. At the same time, the collected data has to readily available in the event of an emergency. In this paper, we present IBE-Lite, a lightweight identity-based encryption suitable for sensors, and developed protocols based on IBE-Lite for a BSN.

This paper considers the performance problem of VoIP over 802.11e WLANs caused by the unfairness between uplink and downlink as well as the inefficient EDCA. A novel medium access control scheme named BEDCA (Balanced EDCA) is presented, which provides service differentiation between the access point (AP) and the mobile stations (STAs) to enhance VoIP capacity. In BEDCA, the expression of AP's contention window is obtained which is a relative constant value independent of the participating STAs. The minimum contention window of the STAs is traffic-aware based on the proposed algorithm. The performance improvement of BEDCA is verified through intensive simulations and the results show the capacity improvement of 82.1% compared to EDCA.

Access control in sensor networks is used to authorise and grant users the right to access the network and data collected by sensors. Different users have different access right due to the access restriction implicated by the data security and confidentiality. Even though symmetric-key scheme, which has been investigated extensively for sensor networks, can fulfil the requirement, public-key cryptography is more flexible and simple rendering a clean interface for the security component. Against the popular belief that a public key scheme is not practical for sensor networks, this paper describes a public-key implementation of access control in a sensor network. We detail the implementation of Elliptic Curve Cryptography (ECC) over primary field, a public-key cryptography scheme, on TelosB, which is the latest sensor network platform. We evaluate the performance of our implementation and compare with other implementations we have ported to TelosB.