Search

The Internet of Things (IoT) is of continuously growing interest for research and industry [...]

The Java Programming Language revolutionized the world of software development in the last decades. Thanks to its portability, Java makes it possible to develop software that can run everywhere, in a truly cross-platform computing environment. Although running the same Java code anywhere works smoothly on major desktop and server platforms, this becomes much more complicated when different devices and platforms, such as smartphones or embedded systems, are taken into account. Furthermore, even if we consider devices that natively support the Java programming language, the same application may not run without re-writing part or the entire source code. This is mainly due to the existence of platform specific libraries for accessing input/output peripherals or system-specific features. In particular, the main limitation is usually associated to the different APIs that must be used for programming the Graphical User Interface (GUIs). In this paper, we present a novel framework that can be used by developers to write Java applications with portable GUIs that are truly platform-independent and thus can run on different systems such as PCs, Workstations, Android devices or mobile phones and embedded systems with Java MicroEdition (Java ME).

Evaluating novel applications and protocols in realistic scenarios has always been a very important task for all stakeholders working in the networking field. Network emulation, being a trade-off between actual deployment and simulations, represents a very powerful solution to this issue, providing a working network platform without requiring the actual deployment of all network components. We present NEMO, a flexible and scalable Java-based network emulator, which can be used to emulate either only a single link, a portion of a network, or an entire network. NEMO is able to work in both real and virtual time, depending on the tested scenarios and goals, and it can be run as either a stand-alone instance on a single machine, or distributed among different network-connected machines, leading to distributed and highly scalable emulation infrastructures. Among different features, NEMO is also capable of virtualizing the execution of third-party Java applications by running them on top of virtual nodes, possibly attached to an emulated or external network. Keywords: Network emulation, Protocol stack, Java

The giant information exchange enabled by the Internet of Things (IoT) paradigm, i.e. by a “network of networks” of smart and connected devices, will likely exploit electrical lines as a ready-to-use infrastructure. Power Line Communications (PLC) have received a significant attention in the last decade, as electrical lines are not used as simple energy supply media, but as information carriers. Among the different aspects of PLC-based architectures, an interesting and important analysis have to be reserved to security aspects that should be adopted in similar infrastructures, having that they are crucial to deliver trustworthy and reliable systems and, hence, to support users relying on available services, especially in case in which they should be inherently secure at the physical level (e.g. against unauthorised signal removal/interruption and eavesdropping, since they are difficult and dangerous). Motivated by the relevant impact of PLC on IoT, in this chapter we investigate experimentally the performance of IoT systems on PLC in indoor environments, considering a vendor-provided application tool and a self-developed Java library. The experimental tests are carried out on both cold and hot electrical lines, evaluating both fixed-size and variable-length power lines. Our results show that IoT-oriented PLC can reach a throughput of 8 kbps on a 300-m cold line and of 6 kbps on a 300-m hot line. Further experimental efforts will be oriented to performance analyses in presence of the adoption of security measures.

Security in the Internet of Things is a current hot topic and it may comprise different aspects such as confidentiality and integrity of personal data, as well as the authentication and the authorization to access smart objects that are spreading more and more in our every-day lives. In this work we focus on MQTT (Message Queue Telemetry Transport), a message-based communication protocol explicitly designed for low-power machine-to-machine communications and based on the publish-subscribe paradigm. First of all, we provide an accurate analysis of some of the most recent security solutions and improvements of MQTT found in the literature. Secondly, we describe in detail a novel secure solution, called MQTT-Auth, to protect specific topics in MQTT. This solution is based on the AugPAKE security algorithm for guaranteeing confidentiality, and onto two tokens which permit to authenticate the usage of a topic and to guarantee authorization in accessing a topic respectively. MQTT-Auth can also be easily extended to a hierarchical structure of topics and entities. Finally, we compare MQTT-Auth with some solutions for securing MQTT being present in the relevant literature, and we provide some details on how MQTT-Auth has been implemented and successfully tested.

Open authorization (OAuth) is an open protocol, which allows secure authorization in a simple and standardized way from third-party applications accessing online services, based on the representational state transfer (REST) web architecture. OAuth has been designed to provide an authorization layer, typically on top of a secure transport layer such as HTTPS. The Internet of Things (IoTs) refers to the interconnection of billions of resource-constrained devices, denoted as smart objects, in an Internet-like structure. Smart objects have limited processing/memory capabilities and operate in challenging environments, such as low-power and lossy networks. IP has been foreseen as the standard communication protocol for smart object interoperability. The Internet engineering task force constrained RESTful environments working group has defined the constrained application protocol (CoAP) as a generic web protocol for RESTful-constrained environments, targeting machine-to-machine applications, which maps to HTTP for integration with the existing web. In this paper, we propose an architecture targeting HTTP/CoAP services to provide an authorization framework, which can be integrated by invoking an external oauth-based authorization service (OAS). The overall architecture is denoted as IoT-OAS. We also present an overview of significant IoT application scenarios. The IoT-OAS architecture is meant to be flexible, highly configurable, and easy to integrate with existing services. Among the advantages achieved by delegating the authorization functionality, IoT scenarios benefit by: 1) lower processing load with respect to solutions, where access control is implemented on the smart object; 2) fine-grained (remote) customization of access policies; and 3) scalability, without the need to operate directly on the device.

The current specification of the Segment Routing (SR) architecture requires enhancements to the intra-domain routing protocols (e.g. OSPF and IS-IS) so that the nodes can advertise the Segment Identifiers (SIDs). We propose a simpler solution called PMSR (Poor Man's Segment Routing), that does not require any enhancement to routing protocol. We compare the procedures of PMSR with traditional SR, showing that PMSR can reduce the operation and management complexity. We analyze the set of use cases in the current SR drafts and we claim that PMSR can support the large majority of them. Thanks to the drastic simplification of the Control Plane, we have been able to develop an Open Source prototype of PMSR. In the second part of the paper, we consider a Traffic Engineering use case, starting from a traditional flow assignment optimization problem which allocates hop-by-hop paths to flows. We propose a SR path assignment algorithm and prove that it is optimal with respect to the number of segments allocated to a flow., September 2015 - Paper accepted to the Mini-conference track of NOMS 2016

The Internet of Things (IoT) is expected to pervasively interconnect more than 50 billion devices, denoted as “smart objects”, by 2020 in an Internet-like structure, which will extend the current Internet, enabling new forms of interaction between physical objects and people. The IoT will be made up of heterogeneous devices, featuring extremely diverse capabilities, in terms of computational power, connectivity, availability, and mobility. In such a scenario, characterized by the heterogeneity and large number of involved devices, in order to effectively allow and foster the growth of new applications and services, it is necessary to provide appropriate standards that can guarantee full interoperability among existing hosts and IoT nodes. Standardization organizations, such as the Internet Engineering Task Force (IETF), and research projects are chartered to bring IP to smart objects and to define suitable application-layer and security protocols for IoT scenarios. In order to cope with the limitations of smart objects, the IETF CoRE Working Group has defined the Constrained Application Protocol (CoAP), a standard application-layer protocol for use with constrained nodes and constrained networks. In this work, we present mjCoAP, an open source lightweight Java-based implementation of CoAP, which aims at simplifying the development of CoAP-based IoT applications. The mjCoAP library is fully RFC-compliant and integrates several IETF CoRE WG specifications, such as blockwise transfers, resource observing, and HTTP/CoAP mapping. We also present some application scenarios and we describe how they can be easily implemented based on mjCoAP.

Traffic Engineering (TE) in IP carrier networks is one of the functions that can benefit from the Software Defined Networking paradigm. By logically centralizing the control of the network, it is possible to "program" per-flow routing based on TE goals. Traditional per-flow routing requires a direct interaction between the SDN controller and each node that is involved in the traffic paths. Depending on the granularity and on the temporal properties of the flows, this can lead to scalability issues for the amount of routing state that needs to be maintained in core network nodes and for the required configuration traffic. On the other hand, Segment Routing (SR) is an emerging approach to routing that may simplify the route enforcement delegating all the configuration and per-flow state at the border of the network. In this work we propose an architecture that integrates the SDN paradigm with SR-based TE, for which we have provided an open source reference implementation. We have designed and implemented a simple TE/SR heuristic for flow allocation and we show and discuss experimental results., Comment: Extended version of poster paper accepted for EWSDN 2015 (version v4 - December 2015)

In order to make cloud services attractive for several IT organizations, it is necessary to provide access control and to implement safe and reliable mechanisms of Identity and Access Management (IAM). In this work, we focus on security issues and challenges in the design and implementation of cloud architectures and, in particular, for the management of Big Stream applications in Internet of Things (IoT) scenarios. The proposed work introduces a new set of modules allowing a federated access control policy for cloud users. An analysis of possible threats and attacks against the proposed Big Stream platform is presented, investigating the system performance in terms of detection and elimination of malicious nodes. In particular, we propose a new module, denoted as Traffic Handler Orchestrator & Rapid Intervention (THORIN), which is very efficient in counteracting botnet-based threats.

The Information-Centric Networking (ICN) paradigm is expected to be one of the major innovation of the Future Internet An ICN can be characterized by some key components like: (i) the content-centric request/reply paradigm for data distribution, (ii) route-by-name operations, and (iii) in-network caching. In this paper we focus on a framework for ICN called CONET (COntent NETwork) and in particular on a solution devised under this framework called coCONET. coCONET characteristics make it suitable for deployment in accordance to the Software Defined Networks (SDN) philosophy. In this paper, we will describe how coCONET can be implemented over an OpenFlow (the most popular SDN instantiation, to date) network and how OpenFlow should be modified to better suit the operations of coCONET and, more in general, of ICN solutions.

Vehicular Ad-hoc NETworks (VANETs) are witnessing an ever increasing interest. Security is a key aspect to pave the road to commercial deployments, as malicious attacks may increase the risk of accidents. Key management in VANETs poses further problems, as connectivity is limited and communication with a central certification authority might be problematic. In this paper, we propose a novel approach to key management for securing VANET communications. In particular, a general framework for key group multicast is proposed, with specific application to a VANET communication scenario.

Voice over IP (VoIP) and multimedia real-time communications between two or more parties are widely used over the Internet. The Session Initiation Protocol (SIP) is the current signaling standard for such applications and allows users to establish and negotiate any end-to-end multimedia session. Unfortunately current SIP-based platforms use a centralized architecture where calls between User Agents (UAs) are routed based on static public-reachable proxy servers, suffering of well-known scalability and availability problems. Moreover, security is currently poorly implemented and, when supported, it usually relies on a third-party trust relationship or on a Public Key Infrastructure (PKI). In this work we propose a completely distributed P2P VoIP architecture where calls are routed relying on a Location Service implemented through a Distributed Hash Table (DHT). End-to-end security is also provided without the use of any centralized server or PKI. Secure media sessions are established and authenticated on the basis of previously established sessions or by simple peer’s voice recognition. The proposed architecture has been also implemented and publicly released.

This article addresses a problem of integration of reputation management mechanisms and lookup processes in (distributed hash table) DHT-based peer-to-peer (P2P) networks with collaborative nature. We present a possible scenario of application of some reputation techniques to lookup and data retrieval processes in a P2P network based on the popular Kademlia algorithm. Unlike most of existing reputation management systems for DHT-based P2P environments, we don't use a number of successful downloads as the main instrument to evaluate a trustworthiness of peers, but we propose to consider any type of interactions between nodes. This choice is motivated by the fact that file sharing is not a unique service supported by DHT-based P2P systems. There are other application areas for P2P (e.g. collaborative and distributed computing) where it is important to consider such aspects as a risk factor, a "stay on-line" time or a number of requests without reply.

The SIP protocol provides authentication and authorization of SIP requests through a challenge-response authentication scheme inherited by the HTTP protocol and named HTTP Digest Authentication. The current specification defines a particular algorithm for calculating the challenge response that uses the MD5 hash of a combination of user name, realm, and password. Unfortunately, a lot of authentication systems maintain the user credentials protected with a one-way function (usually a hash) in a way that is incompatible with the information required by the current HTTP Digest Authentication. Some examples are given by the mechanisms used for storing passwords by the Unix OS, LDAP servers, or other applications. In this paper, we propose to extends the original HTTP Digest Authentication by adding a new and flexible scheme that uses an arbitrary hash function and an arbitrary combination of various information such as user name, realm, password, salt, and/or other data. The proposed authentication scheme has been implemented within two testbeds in which a SIP UA authenticates itself with a remote proxy server (acting as authenticator) that uses respectively a LDAP server or a userspsila password file of a Joomla Content Management System.

This paper describes a Session Initiation Protocol (SIP) based solution for mobility management that provides seamless mobile multimedia services in a heterogeneous scenario where different radio access technologies are used (802.11/ WiFi, Bluetooth, 2.5G/3G networks). The solution relies on the so called "Session Border Controllers" which are now widely used in many commercial SIP telephony solutions, mainly to deal with NAT traversal. Session Border Controller functionality has been extended to support seamless mobility for multimedia applications. A prototype of the proposed solution focused on VoIP services has been implemented in a test bed which is able to perform seamless handovers (and NAT traversal) using the 802.11, Bluetooth and 3G (UMTS) access networks. Measurements results are reported which analyze the performance of the solution in a real world environment, using commercial WiFi and 3G services.

The success of modern VoIP-based applications has demonstrated how VoIP technologies are rather mature for replacing current telephony systems and for creating new and flexible modes of communication. There are several applications and services that can benefit from such technologies: among them the e- learning is one important candidate. Future and present scenarios of mobile learning applications and the design of new collaboration models in teachers/students interactions are possible fields of application of VoIP technologies. For example, students may be enabled to join a lecture via cell phone wherever the IP network allows linking to video and audio conferencing servers. In this paper the integration of audio and video conferencing tools in a distance education environment is considered and a prototyping implementation is described. Particular attention is paid to currently available open-source projects and tools: the EifFE-L (Environment for freedom in E-Learning) Learning Management System in conjunction with the MjSIP project for VoIP functionalities have been used.

The success of modern VoIP-based applications has demonstrated how VoIP technologies are rather mature for replacing current telephony systems and for creating new and flexible modes of communication. Currently there are many open-source libraries, tools, and applications available. Starting from some of them, we have designed and built a complete IP telephony platform including several functionalities such registration, call proxying, authentication, PSTN interworking, conferencing, voice mail and other centrex functions. The core of our platform is based on our java-based SIP proxy implementation named mj Proxy that is also described in the paper.

In this paper we propose a p2p framework in order to organize the cooperation and the set-up phase of interconnected laboratories for didactical purposes through the Internet. Even if the application of standard p2p algorithms to distributed cooperative laboratories is a quite new methodology, we will base our approach on a solid foundation, such as the one provided by the Session Initiation Protocol (SIP). The proposed architecture solves some general problems such as the discovering of entities, and also provides, a general framework for devices accounting. In addition, our framework offers mechanisms in order to provide an abstract namespace for adding — removing facilities on the fly and invoking them.

Voice, video and multimedia applications are sensitive to the QoS provided by the underlying IP network. The DiffServ architecture offers a set of QoS mechanisms for IP networks. The "binding" of the application, QoS needs with the QoS features offered by the DiffServ networks is still an open problem. The simplest approach is to have a static configuration of QoS and therefore no direct interaction in the control plane between applications and QoS. We consider the advanced scenario, where the QoS mechanisms can be dynamically configured to follow the applications' need. For this scenario, a set of control plane interfaces needed for a whole end-to-end QoS architecture is defined. At the lower level, an internal interface ("Application Programming Interface"--API) in the QoS router is considered. This interface provides access to the DiffServ QoS mechanism available in a router and is used by the control logic running in the router itself. Then a QoS signaling protocol is considered, that allows external QoS clients to dynamically access the QoS services provided by the network. Finally the interaction of a session level signaling protocol (i.e., the SIP for IP telephony) with the QoS protocol is defined. A testbed implementation of the proposed architecture and a set of performance tests on the internal QoS API are reported.