Search

Balanced Hash Tree (BHT) is a mechanism for service function (SF) chaining, service routing, and traffic steering that enables switches to select SF instances for load balancing without involving the controller. In an experimental evaluation, BHT decreased packet-in message-processing time by 92.5 percent and achieved near-perfect load-balancing performance.

Attack trees provide a model to describe the security of a system based on the possibility of various attacks. In this paper, we propose the concept of “attack graphs” as an extension of attack trees, wherein directed acyclic graphs are used to depict possible attacks on a system. By deploying this model, system managers can discern all possible threats to the system and thus are more likely to design efficient countermeasures to thwart those attacks. Within this model, we also propose the concept of the most dangerous path in the attack graph, and finally propose an algorithm to expose it.

A distributed denial-of-service (DDoS) attack could cause the incoming connections per second exceeding the capacity of the firewall device and the network system might be paralyzed. By analyzing the syslog of firewall, we design an effective mechanism to block malicious source IPs automatically from the router. We have undergone a field trial on campus for two years. The collected data shows that our approach significantly reduces suspicious traffic and improve the stability of overall network service.

Information technology (IT) services are diverse and complex. Numerous service design methods have been developed for designing and developing products. However, owing to the limited availability of useful tools in IT service design, these methods are ineffective. This study proposes an innovative three-dimensional method for designing IT services. The proposed method considers user requirements, an organization's business requirements, service providers' management requirements as well as the decision-making criteria of management representatives to ensure a smooth implementation of a designed IT service. Using this method, a prototype system to improve campus wireless local area network services was developed and tested at a university in Taiwan. The prototype system reduced the need for repetitive authentication and the time required to solve service problems and address user complaints. In addition, the service design team observed an approximately 70% reduction in project cycle time. The proposed method provided a systematic means to organize the design and implementation of IT services.

We consider the security issues associated with bring your own device (BYOD) services on campus. More than 70% of the cyber users at the studied university access wireless campus networks through BYOD. Although wireless access is convenient for users, its network management remains a problem. We analyze existing BYOD solutions that are applicable only to particular wireless network architectures, that require users to register their devices to a management platform, or that install client software. Moreover, commercial software is often prohibitively expensive for educational institutes. We found that most users enter their usernames and passwords multiple times a day, resulting in inconvenient user authentications. Thus, we propose an EZ-Net BYOD service management system that imposes a fail-through authentication function to an existing wireless local area network mobility controller via multiple externally established authentication servers. This solution requires no client-side configuration and is not limited to any particular brand of wireless network equipment. The solution is evaluated and deployed on campus. The proposed EZ-Net BYOD system saves an average of 60 min of authentication time per month for each user and allows the studied university to save tens of thousands of US dollars on licensing fees for BYOD service management software.