Question: Anonymized post-quantum crypt-cash? (Complete Edition)

In the realm of digital currencies, particularly focusing on Bitcoin, a decentralized payment system underpinned by Proof-of-Work, we delve into the security implications of utilizing Bitcoin for expedited transactions. As Bitcoin's acceptance widens, encompassing various sectors including quick-service restaurants, the need for swift, secure payments becomes paramount. This study scrutinizes the vulnerabilities of Bitcoin in the context of rapid exchanges, where the transaction-to-delivery interval is exceedingly brief, potentially in the span of mere seconds. Our analysis zeroes in on double-spending assaults on these accelerated payments, illustrating that such attacks can be executed with minimal expenditure on contemporary Bitcoin versions. Moreover, we critique the countermeasures suggested by Bitcoin's developers for safeguarding fast transactions, revealing their ineffectiveness in thwarting double-spending. We posit that even with the incorporation of these recommendations into future Bitcoin iterations, the threat of double-spending remains. Building upon our discoveries, we propose a lightweight defense mechanism designed to identify double-spending attempts in the context of fast transactions, thereby enhancing Bitcoin's security profile for rapid exchanges.

Encryption is a well established technology for protecting sensitive data. However, once encrypted, data can no longer be easily queried aside from exact matches. We present an order-preserving encryption scheme for numeric data that allows any comparison operation to be directly applied on encrypted data. Query results produced are sound (no false hits) and complete (no false drops). Our scheme handles updates gracefully and new values can be added without requiring changes in the encryption of other values. It allows standard databse indexes to be built over encrypted tables and can easily be integrated with existing database systems. The proposed scheme has been designed to be deployed in application environments in which the intruder can get access to the encrypted database, but does not have prior domain information such as the distribution of values and annot encrypt or decrypt arbitrary values of his choice. The encryption is robust against estimation of the true value in such environments.

1. Beijing University of Posts and Telecommunications, Beijing, 100876, China deepblue.lb@gmail.com 2. School of Computer, National University of Defense Technology, Changsha, 410073, China kelele.xu@gmail.com 3. School of Information Communication, National University of Defense Technology, Wuhan, 430015, China 4. The University of Melbourne, Parkville, 3010, Australia yihengw1@student.unimelb.edu.au 5. China Minsheng Bank, Beijing 100031, China wangyanbo@cmbc.com.cn

It is desirable to store data on data storage servers such as mail servers and file servers in encrypted form to reduce security and privacy risks. But this usually implies that on e has to sacrifice functionality for security. For example, if a client wishes to retrieve only documents containing certai n words, it was not previously known how to let the data storage server perform the search and answer the query without loss of data confidentiality. In this paper, we describe our cryptographic schemes for the problem of searching on encrypted data and provide proofs of security for the resulting crypto systems. Ou r techniques have a number of crucial advantages. They are provably secure : they provideprovable secrecy for encryption, in the sense that the untrusted server cannot learn anything about the plaintext when only given the ciphertext; they providequery isolationfor searches, meaning that the untrusted server cannot learn anything more about the plaintext than the search result; they provide controlled searching, so that the untrusted server cannot search for an arbitrary word without the user’s authorization; they also supporthidden queries , so that the user may ask the untrusted server to search for a secret word without revealing the word to the server. The algorithms we present are simple, fast (for a document of length n, the encryption and search algorithms only need O(n) stream cipher and block cipher operations), and introduce almost no space and communication overhead, and hence are practical to use today. We gratefully acknowledge support for this research from se veral US government agencies. This research was suported in part by t he Defense Advanced Research Projects Agency under DARPA contract N66 01-9928913 (under supervision of the Space and Naval Warfare Syst ems Center San Diego), by the National Science foundation under grant F D99-79852, and by the United States Postal Service under grant USPS 1025 90-98-C3513. Views and conclusions contained in this document are t hose of the authors and do not necessarily represent the official opinio n or policies, either expressed or implied of the US government or any of its agencies, DARPA, NSF, USPS.

In modern societies, the number of mobile users has dramatically risen in recent years. In this paper, an efficient authentication scheme for distributed mobile cloud computing services is proposed. The proposed scheme provides security and convenience for mobile users to access multiple mobile cloud computing services from multiple service providers using only a single private key. The security strength of the proposed scheme is based on bilinear pairing cryptosystem and dynamic nonce generation. In addition, the scheme supports mutual authentication, key exchange, user anonymity, and user untraceability. From system implementation point of view, verification tables are not required for the trusted smart card generator (SCG) service and cloud computing service providers when adopting the proposed scheme. In consequence, this scheme reduces the usage of memory spaces on these corresponding service providers. In one mobile user authentication session, only the targeted cloud service provider needs to interact with the service requestor (user). The trusted SCG serves as the secure key distributor for distributed cloud service providers and mobile clients. In the proposed scheme, the trusted SCG service is not involved in individual user authentication process. With this design, our scheme reduces authentication processing time required by communication and computation between cloud service providers and traditional trusted third party service. Formal security proof and performance analyses are conducted to show that the scheme is both secure and efficient.

Online social networks routinely publish data of interest to third parties, but in so doing often reveal relationships, such as a friendship or contractual association, that an attacker can exploit. This systematic look at existing privacy-preservation techniques highlights the vulnerabilities of users even in networks that completely anonymize identities. Through a taxonomy that categorizes techniques according to the degree of user identity exposure, the authors examine the ways that existing approaches compromise relation privacy and offer more secure alternatives.

We propose a general multiparty computation protocol secure against an active adversary corrupting up to n−1 of the n players. The protocol may be used to compute securely arithmetic circuits over any finite field Fpk . Our protocol consists of a preprocessing phase that is both independent of the function to be computed and of the inputs, and a much more efficient online phase where the actual computation takes place. The online phase is unconditionally secure and has total computational (and communication) complexity linear in n, the number of players, where earlier work was quadratic in n. Moreover, the work done by each player is only a small constant factor larger than what one would need to compute the circuit in the clear. We show this is optimal for computation in large fields. In practice, for 3 players, a secure 64-bit multiplication can be done in 0.05 ms. Our preprocessing is based on a somewhat homomorphic cryptosystem. We extend a scheme by Brakerski et al., so that we can perform distributed decryption and handle many values in parallel in one ciphertext. The computational complexity of our preprocessing phase is dominated by the public-key operations, we need O(n/s) operations per secure multiplication where s is a parameter that increases with the security parameter of the cryptosystem. Earlier work in this model needed Ω(n) operations. In practice, the preprocessing prepares a secure 64-bit multiplication for 3 players in about 13 ms.

Bitcoin utilizes Nakamoto Consensus to achieve agreement on a consistent set of transactions, in the permissionless setting, where anyone can participate in the protocol anonymously. Since its rise, many other permissionless consensus protocols have been proposed. We present SPECTRE, a new protocol for the consensus core of cryptocurrencies that remains secure even under high throughput and fast confirmation times. At any throughput, SPECTRE is resilient to attackers with up to 50% of the computational power (reaching the limit defined by network congestion and bandwidth constraints). SPECTRE can operate at arbitrarily high block creation rates, which implies that its transactions confirm in mere seconds (limited mostly by the round-trip-time in the network). SPECTRE’s underlying model falls into the category of partial synchronous networks: its security depends on the existence of some bound on the delivery time of messages between honest participants, but the protocol itself does not contain any parameter that depends on this bound. Hence, while other protocols that do encode such parameters must operate with extreme safety margins, SPECTRE converges according to the actual network delay. Key to SPECTRE’s achievements is the fact that it satisfies weaker properties than classic consensus requires. In the conventional paradigm, the order between any two transactions must be decided and agreed upon by all non-corrupt nodes. In contrast, SPECTRE only satisfies this with respect to transactions performed by honest users. We observe that in the context of money, two conflicting payments that are published concurrently could only have been created by a dishonest user, hence we can afford to delay the acceptance of such transactions without harming the usability of the system. Our framework formalizes this weaker set of requirements for a cryptocurrency’s distributed ledger. We then provide a formal proof that SPECTRE satisfies these requirements.

Blockchain protocols such as Bitcoin are gaining traction for exchanging payments in a secure and decentralized manner. Their need to achieve consensus across a large number of participants, however, fundamentally limits their performance. We describe Teechain, a new off-chain payment protocol that utilizes trusted execution environments (TEEs) to perform secure, efficient and scalable fund transfers on top of a blockchain, with asynchronous blockchain access. Teechain introduces secure payment chains to route payments across multiple payment channels. Teechain mitigates failures of TEEs with two strategies: (i) backups to persistent storage and (ii) a novel variant of chain-replication. We evaluate an implementation of Teechain using Intel SGX as the TEE and the operational Bitcoin blockchain. Our prototype achieves orders of magnitude improvement in most metrics compared to existing implementations of payment channels: with replicated Teechain nodes in a trans-atlantic deployment, we measure a throughput of over 33, 000 transactions per second with 0.1 second latency.

We introduce a new cryptographic primitive: Proofs of SpaceTime (PoSTs) and construct a practical protocol for implementing these proofs. A PoST allows a prover to convince a verifier that she spent a “spacetime” resource (storing data—space—over a period of time). Formally, we define the PoST resource as a linear tradeoff between CPU work and space-time (under reasonable cost assumptions, a rational user will prefer to use the lower-cost space-time resource over CPU work). Compared to a proof-of-work, a PoST requires less energy use, as the “difficulty” can be increased by extending the time period over which data is stored without increasing computation costs. Our definition is very similar to “Proofs of Space” [ePrint 2013/796, 2013/805] but, unlike the previous definitions, takes into account amortization attacks and storage duration. Moreover, our protocol uses a very different (and simpler) technique, making use of the fact that we explicitly allow a space-time tradeoff.

We present a distributed efficiently amortizable CPU cost-function with no trap–door. The absence of a trap–door allows us to avoid needing to trust any party. Applications for such cost-functions are in distributed document popularity estimation, and metering of web advertising. None of the servers involved have any advantage over users in computing the cost function. The amortized token has a small fixed sized representation independent of the amortized value. The valuation function is efficient. Limits can be placed on the resources which can be expended in computing the cost-function to prevent the user inflating the value of his contribution by using more CPU time than the expected token value. The amortized part of the cost result can be blinded so that clients can not obtain service but avoid contributing to the amortization by expending more resources than the expected token value. Interactive and non-interactive variants of the cost-function can be constructed which can be used in situations where the server can issue a challenge (connection oriented interactive protocol), and where it can't (where the communication is store–and–forward, or packet oriented) respectively.


Question: SDN Docker: Facilitating automatic application docking/undocking in edge switches.

This paper introduces OpenFlow, a groundbreaking technology designed to facilitate innovation in campus networks by enabling researchers to test experimental protocols within the networks they frequently utilize. OpenFlow is built upon an Ethernet switch equipped with an internal flow-table and a standardized interface for the addition and removal of flow entries. Our primary objective is to motivate networking vendors to incorporate OpenFlow into their switch products, specifically targeting college campus backbones and wiring closets. We assert that OpenFlow strikes a crucial balance: it provides researchers with the capability to execute experiments on a diverse array of switches in a standardized manner, achieving line-rate performance and high port-density. Simultaneously, it does not require vendors to disclose the intricate details of their switch operations. OpenFlow's potential extends beyond research, as it could serve as an integral campus component in large-scale testbeds such as GENI, facilitating the evaluation of ideas in real-world traffic scenarios. As a testament to its viability, two buildings at Stanford University are poised to implement OpenFlow networks, utilizing commercially available Ethernet switches and routers. We are committed to promoting its deployment across other educational institutions and encourage you to explore the integration of OpenFlow into your university's network infrastructure.

StackMap leverages the best aspects of kernel-bypass networking into a new low-latency Linux network service based on the full-featured TCP kernel implementation, by dedicating network interfaces to applications and offering an extended version of the netmap API as a zero-copy, lowoverhead data path while retaining the socket API for the control path. For small-message, transactional workloads, StackMap outperforms baseline Linux by 4 to 80 % in latency and 4 to 391 % in throughput. It also achieves comparable performance with Seastar, a highly-optimized user-level TCP/IP stack for DPDK.

Network Functions Virtualization (NFV) has recently emerged as one of the major technological driving forces that significantly accelerate the evolution of today's computer and communication networks. Despite the advantages of NFV, e.g., saving investment cost, optimizing resource consumption, improving operational efficiency, simplifying network service lifecycle management, lots of novel security threats and vulnerabilities will be introduced, thereby impeding its further development and deployment in practice. In this paper, we briefly report our threat analysis in the context of NFV, and identify the corresponding security requirements. The purpose is to establish a comprehensive threat taxonomy and provide a guideline to develop effective security countermeasures. Furthermore, a conceptual design framework for NFV based security management and service orchestration is presented, with an objective to dynamically and adaptively deploy and manage security functions on the demands of users and customers. A use case about NFV based access control is also developed, illustrating the feasibility and advantages of implementing NFV based security management and orchestration.

The development of Unmanned Aerial Vehicles (UAV) and wireless sensor network (WSN) applications depends on the availability of resources in UAVs and sensor nodes. In traditional applications, UAVs obtain the required data from specific sensors. However, this tightly coupled architecture restricts the usage of the infrastructure for specific applications. This paper proposes a softwarization architecture for UAVs and WSNs. In addition, the higher layers are proposed to be part of the cloud to benefit from the various cloud opportunities. The proposed architecture is based on the network softwarization concept and the Software Defined Networks (SDN) concept along with the Network Functional Virtualization (NFV) technologies. These concepts are associated with decoupling the hardware infrastructure from the control layer that virtualizes the infrastructure resources for the higher layers. The architecture is illustrated with an agricultural example for a cooperative system of a WSN and UAVs. We implement a prototype system that consists of a sensing node, UAV, WSN controller, UAV controller, and orchestration layer to provide a proof of concept for the proposed architecture.

This paper provides an overview of software-defined “hardware” infrastructures (SDHI). SDHI builds upon the concept of hardware (HW) resource disaggregation. HW resource disaggregation breaks today’s physical server-oriented model where the use of a physical resource (e.g., processor or memory) is constrained to a physical server’s chassis. SDHI extends the definition of of software-defined infrastructures (SDI) and brings greater modularity, flexibility, and extensibility to cloud infrastructures, thus allowing cloud operators to employ resources more efficiently and allowing applications not to be bounded by the physical infrastructure’s layout. This paper aims to be an initial introduction to SDHI and its associated technological advancements. This paper starts with an overview of the cloud domain and puts into perspective some of the most prominent efforts in the area. Then, it presents a set of differentiating use-cases that SDHI enables. Next, we state the fundamentals behind SDI and SDHI, and elaborate why SDHI is of great interest today. Moreover, it provides an overview of the functional architecture of a cloud built on SDHI, exploring how the impact of this transformation goes far beyond the cloud infrastructure level in its impact on platforms, execution environments, and applications. Finally, an in-depth assessment is made of the technologies behind SDHI, the impact of these technologies, and the associated challenges and potential future directions of SDHI.

Network Virtualization (NV) and Software-Defined Networking (SDN) are both expected to increase the flexibility and programmability of today's communication networks. Combining both approaches may even be a further step towards increasing the efficiency of network resource utilization. Multiple solutions for virtualizing SDN networks have already been proposed, however, they are either implemented in software or they require special network hardware. We propose HyperFlex, an SDN hypervisor architecture that relies on the decomposition of the hypervisor into functions that are essential for virtualizing SDN networks. The hypervisor functions can be flexibly executed in software or hosted on SDN network elements. Furthermore, existing hypervisor solutions focus on data-plane virtualization mechanisms and neglect the virtualization of the control-plane of SDN networks. HyperFlex provides control-plane virtualization by adding a control-plane isolation function, either in software or on network elements. The isolation function ensures that the resources of the control-plane are shared correctly between each virtual SDN network while it also protects the hypervisor resources from resource exhaustion.

Creating context-aware ad hoc collaborative systems remains to be one of the primary hurdles hampering the ubiquitous deployment of IT and communication services. Especially under mission-critical scenarios, these services must often adhere to strict timing deadlines. We believe empowering such realtime collaboration systems requires context-aware application platforms working in conjunction with ultra-low latency data transmissions. In this paper, we make a strong case that this could be accomplished by combining the novel communication architectures being proposed for 5G with the principles of Mobile Edge Computing (MEC). We show that combining 5G with MEC would enable inter- and intra-domain use cases that are otherwise not feasible.

New scientific instruments that are being designed and deployed in the coming years will dramatically increase the need for large, real-time data transfers among scientists throughout the world. One such instrument is the Large Synoptic Survey Telescope being built in Chile that will produce 6.4 GB images every 17 seconds. This paper describes an ongoing effort to meet the demands of these large data scientific instruments through the development of an international software defined exchange point (SDX) that will meet the provisioning needs for the scientific users. The specific planned and ongoing work in SDX architecture is described with specific consideration for policy specification and security. Keywords—Software Defined Exchange; Science Data

SDN and NFV are two significant innovations in networking. The evolution of both SDN and NFV has shown strong synergy between these two paradigms. Recent research efforts have been made toward combining SDN and NFV to fully exploit the advantages of both technologies. However, integrating SDN and NFV is challenging due to the variety of intertwined network elements involved and the complex interaction among them. In this article, we attempt to tackle this challenging problem by presenting an architectural framework called SDNV. This framework offers a clear holistic vision of integrating key principles of both SDN and NFV into unified network architecture, and provides guidelines for synthesizing research efforts toward combining SDN and NFV in future networks. Based on this framework, we also discuss key technical challenges to realizing SDN-NFV integration and identify some important topics for future research, with a hope to arouse the research community's interest in this emerging area.

This paper presents Swift, a packet filter for high-performance packet capture on commercial off-the-shelf hardware. The key features of the Swift include: 1) extremely lowfilter update latency for dynamic packet filtering, and 2) gigabits-per-second high-speed packet processing. Based on complex instruction set computer (CISC) instruction set architecture (ISA), Swift achieves the former with an instruction set design that avoids the need for compilation and security checking, and the latter by mainly utilizing single instruction, multiple data (SIMD). We implement Swift in the Linux 2.6 kernel for both i386 and ×86-64 architectures and extensively evaluate its dynamic and static filtering performance on multiple machines with different hardware setups. We compare Swift to BPF (the BSD packet filter)--the de facto standard for packet filtering in modern operating systems--and hand-coded optimized C filters that are used for demonstrating possible performance gains. For dynamic filtering tasks, Swift is at least three orders of magnitude faster than BPF in terms of filter update latency. For static filtering tasks, Swift outperforms BPF up to three times in terms of packet processing speed and achieves much closer performance to the optimized C filters. We also show that Swift can harness the processing power of hardware SIMD instructions by virtue of its SIMD-capable instruction set.

The Internet of Things (IoT) has connected an incredible diversity of devices in novel ways, which has enabled exciting new services and opportunities. Unfortunately, IoT systems also present several important challenges to developers. This paper proposes a vision for how we may build IoT systems in the future by reconceiving IoT's fundamental unit of construction not as a "thing", but rather as a widely and finely distributed "microservice" already familiar to web service engineering circles. Since IoT systems are quite different from more established uses of microservice architectures, success of the approach depends on adaptations that enable them to met the key challenges that IoT systems present. We argue that a microservice approach to building IoT systems can combine in a mutually enforcing way with patterns for microservices, API gateways, distribution of services, uniform service discovery, containers, and access control. The approach is illustrated using two case studies of IoT systems in personal health management and connected autonomous vehicles. Our hope is that the vision of a microservices approach will help focus research that can fill in current gaps preventing more effective, interoperable, and secure IoT services and solutions in a wide variety of contexts.


Question: SDN Docker: Facilitating automatic application docking/undocking in the edge switch environment.

This paper delves into the convergence of Software-Defined Networking (SDN) and Internet-of-Things (IoT), exploring the opportunities and challenges this integration presents for wireless networking. The complexity of managing IoT networks, which involves data acquisition, analysis, decision-making, and action, has prompted researchers to investigate how SDN can simplify and streamline these processes. SDN, as a transformative concept, holds the potential to create a programmable, robust, and easily manageable wireless network infrastructure to support a multitude of physical devices and applications. The paper begins by tracing the evolution of SDN, then focuses on the significant advancements in integrating SDN with IoT in both wireless and optical domains. It also addresses the critical challenges faced in this integration, including issues related to security and scalability, which are essential considerations for the successful deployment of SDN in IoT environments.

**Question**: Analysis of the performance of a hybrid method for solving the economic dispatch problem

**Documents**: A hybrid algorithm for the two-machine flow shop problem with limited machine-dependent buffer
A hybrid algorithm is presented for solving the two-machine flow shop problem with limited machine-dependent buffer. The algorithm combines two heuristic rules: Johnson's rule for sequencing the jobs and a priority rule for assigning the jobs to the machines. The hybrid algorithm is compared with three existing heuristic algorithms: the LPT (longest processing time) rule, the SPT (shortest processing time) rule, and the FCFS (first come first served) rule. The results of the computational experiments show that the hybrid algorithm outperforms the other three heuristics in terms of the solution quality. The hybrid algorithm is also compared with an exact algorithm, which is based on branch-and-bound. The results show that the hybrid algorithm is able to find solutions that are very close to the optimal solutions, even for large problem instances.

**Similar Documents**: This paper introduces a hybrid algorithm designed to tackle the two-machine flow shop problem, characterized by a restricted machine-dependent buffer. The algorithm integrates two key heuristic strategies: Johnson's rule for job sequencing and a priority rule for job allocation to machines. To assess its effectiveness, the hybrid algorithm is benchmarked against three established heuristic methods: the Longest Processing Time (LPT) rule, the Shortest Processing Time (SPT) rule, and the First Come First Served (FCFS) rule. Computational experiments demonstrate that the hybrid algorithm surpasses these heuristics in solution quality. Additionally, the algorithm is evaluated against an exact method based on branch-and-bound. The outcomes reveal that

Recently, several researches concerning with smart and connected communities have been studied. Soon the 4G / 5G technology becomes popular, and cellular base stations will be located densely in the urban space. They may offer intelligent services for autonomous driving, urban environment improvement, disaster mitigation, elderly/disabled people support and so on. Such infrastructure might function as edge servers for disaster support base. In this paper, we enumerate several research issues to be developed in the ICDCS community in the next decade in order for building safe, smart cities resistant to disasters. In particular, we focus on (A) up-to-date urban crowd mobility prediction and (B) resilient disaster information gathering mechanisms based on the edge computing paradigm. We investigate recent related works and projects, and introduce our on-going research work and insight for disaster mitigation.

5G Network Slice Broker concept aims to enable mobile virtual network operators, over-the-top providers, and industry vertical market players to request and lease resources from infrastructure providers dynamically according to needs. In the future digital factory, the leasing of resources could also happen autonomously by manufacturing equipment. This paper presents Blockchain Slice Leasing Ledger Concept and analysis of its applicability in the Factory of the Future. The novel concept utilizes 5G Network Slice Broker in a Blockchain to reduce service creation time and enable manufacturing equipment autonomously and dynamically acquire the slice needed for more efficient operations.

The prosperity of Internet of Things (IoT) and the success of rich Cloud services have expedited the emergence of a new computing paradigm called Fog computing, which promotes the processing of data at the proximity of their sources. Complementary to the Cloud, Fog promises to offer many appealing features, such as low latency, low cost, high multitenancy, high scalability, and to consolidate the IoT ecosystem. Although the Fog concept has been widely adopted in many areas, a comprehensive realization has yet been adequately researched. To address all these issues, in this paper, object virtualization is investigated to overcome obstacles resulting from resource constraints on sensory-level nodes while service virtualization is explored to easily create tailored applications for end users. Moreover, network function virtualization is studied to perform the flexibility of network service provisioning. Grounded on object virtualization, network function virtualization and service virtualization, a layered framework that encompasses smart objects, Fog and Cloud is presented to illustrate the realization of virtual Fog along IoT continuum. This proposed virtual Fog framework is applied to a smart living case for verification, then quantitative analysis is conducted to demonstrate the low latency, low operating expense, high multitenancy and scalability, followed by an experimental evaluation to further confirm that delay and jitter can be decreased through virtualization.

Creating context-aware ad hoc collaborative systems remains to be one of the primary hurdles hampering the ubiquitous deployment of IT and communication services. Especially under mission-critical scenarios, these services must often adhere to strict timing deadlines. We believe empowering such realtime collaboration systems requires context-aware application platforms working in conjunction with ultra-low latency data transmissions. In this paper, we make a strong case that this could be accomplished by combining the novel communication architectures being proposed for 5G with the principles of Mobile Edge Computing (MEC). We show that combining 5G with MEC would enable inter- and intra-domain use cases that are otherwise not feasible.

Wireless sensor networks (WSNs) are becoming increasingly popular with the advent of the Internet of things (IoT). Various real-world applications of WSNs such as in smart grids, smart farming and smart health would require a potential deployment of thousands or maybe hundreds of thousands of sensor nodes/actuators. To ensure proper working order and network efficiency of such a network of sensor nodes, an effective WSN management system has to be integrated. However, the inherent challenges of WSNs such as sensor/actuator heterogeneity, application dependency and resource constraints have led to challenges in implementing effective traditional WSN management. This difficulty in management increases as the WSN becomes larger. Software Defined Networking (SDN) provides a promising solution in flexible management WSNs by allowing the separation of the control logic from the sensor nodes/actuators. The advantage with this SDN-based management in WSNs is that it enables centralized control of the entire WSN making it simpler to deploy network-wide management protocols and applications on demand. This paper highlights some of the recent work on traditional WSN management in brief and reviews SDN-based management techniques for WSNs in greater detail while drawing attention to the advantages that SDN brings to traditional WSN management. This paper also investigates open research challenges in coming up with mechanisms for flexible and easier SDN-based WSN configuration and management.

Nowadays, IoT services are typically delivered as physically isolated vertical solutions, in which all system components ranging from sensory devices to applications are customized and tightly coupled for the requirements of each specific project. The efficiency and scalability of such service delivery model are intrinsically limited, posing significant challenges to IoT solution providers. Therefore, we propose a novel PaaS framework that provides essential platform services for IoT solution providers to efficiently deliver and continuously extend their services. This paper first introduces the IoT PaaS architecture, on which IoT solutions can be delivered as virtual verticals by leveraging computing resources and middleware services on cloud. Then we present the detailed mechanism and implementation of domain mediation, which helps solution providers to efficiently provide domain-specific control applications. The proposed approaches are demonstrated through the implementation of a domain mediator for building management and two use cases using the mediator.

Emerging software defined network SDN stacks have introduced an entirely new attack surface that is exploitable from a wide range of launch points. Through an analysis of the various attack strategies reported in prior work, and through our own efforts to enumerate new and variant attack strategies, we have gained two insights. First, we observe that different SDN controller implementations, developed independently by different groups, seem to manifest common sets of pitfalls and design weakness that enable the extensive set of attacks compiled in this paper. Second, through a principled exploration of the underlying design and implementation weaknesses that enables these attacks, we introduce a taxonomy to offer insight into the common pitfalls that enable SDN stacks to be broken or destabilized when fielded within hostile computing environments. This paper first captures our understanding of the SDN attack surface through a comprehensive survey of existing SDN attack studies, which we extend by enumerating 12 new vectors for SDN abuse. We then organize these vulnerabilities within the well-known confidentiality, integrity, and availability model, assess the severity of these attacks by replicating them in a physical SDN testbed, and evaluate them against three popular SDN controllers. We also evaluate the impact of these attacks against published SDN defense solutions. Finally, we abstract our findings to offer the research and development communities with a deeper understanding of the common design and implementation pitfalls that are enabling the abuse of SDN networks.

In this paper, a cabin door detection framework based on deep learning and mathematical morphology is proposed. It is applied to an automated docking system for airplane cabin door. This system needs to work under any weather condition like rain, shine, day and night. Limited by the number of videos, just a small dataset based on actual airport operation is established for aerobridge docking process. As the training dataset is small, the trained detector cannot identify all the cabin doors in this dataset. Some of the cabin doors, which are not detected, can be identified with the combination of deep learning and mathematical morphology. Experimental results show that the integration of deep learning and mathematical morphology performs better than the simple deep learning method.

A recent trend in communication networks --- sometimes referred to as fog computing --- offers to execute computational tasks close to the access points of the networks. This enables real-time applications, like mobile Complex Event Processing (CEP), to significantly reduce end-to-end latencies and bandwidth usage. Most work studying the placement of operators in such an environment completely disregards the migration costs. However, the mobility of users requires frequent migration of operators, together with possibly large state information, to meet latency restrictions and save bandwidth in the infrastructure.
 This paper presents a placement and migration method for providers of infrastructures that incorporate cloud and fog resources. It ensures application-defined end-to-end latency restrictions and reduces the network utilization by planning the migration ahead of time. Furthermore, we present how the application knowledge of the CEP system can be used to improve current live migration techniques for Virtual Machines to reduce the required bandwidth during the migration. Our evaluations show that we safe up to 49% of the network utilization with perfect knowledge about a users mobility pattern and up to 27% of the network utilization when considering the uncertainty of those patterns.

Mininet is a system for rapidly prototyping large networks on the constrained resources of a single laptop. The lightweight approach of using OS-level virtualization features, including processes and network namespaces, allows it to scale to hundreds of nodes. Experiences with our initial implementation suggest that the ability to run, poke, and debug in real time represents a qualitative change in workflow. We share supporting case studies culled from over 100 users, at 18 institutions, who have developed Software-Defined Networks (SDN). Ultimately, we think the greatest value of Mininet will be supporting collaborative network research, by enabling self-contained SDN prototypes which anyone with a PC can download, run, evaluate, explore, tweak, and build upon.


Question: SDN Docker: Facilitating automatic application docking/undocking in the edge switch environment.

This paper explores the integration of publish/subscribe capabilities into software defined networking (SDN) frameworks to optimize and scale IoT communications effectively. The Internet of Things (IoT) amalgamates diverse enabling technologies, encompassing embedded systems, wireless sensor networks, cloud computing, and big data, all geared towards data collection, processing, inference, and transmission. The confluence of these technologies necessitates comprehensive research to tackle the multifaceted challenges they present, particularly concerning the sensing and transmission of data from the physical realm to cloud-based services. This article delves into critical aspects such as standardization initiatives, object mobility, network access via gateways, and the provision of Quality of Service (QoS). Specifically, the paper outlines a pioneering IoT network architecture that merges SDN with data distribution service (DDS) middleware. This novel architecture is poised to enhance the service delivery of IoT systems, introducing a new level of network flexibility and efficiency. By enabling publish/subscribe functionality within SDN, the proposed architecture aims to streamline IoT communications, ensuring scalability and efficiency in data dissemination across the network. This innovative approach not only facilitates better data management but also positions SDN as a versatile solution for managing the complexities of IoT environments, particularly in handling the high volumes of data generated by interconnected devices. The integration of DDS into SDN architectures further empowers IoT systems to dynamically adjust to changing network conditions, thereby improving overall performance and reliability.

Software Defined Networks (SDNs) based on the OpenFlow (OF) protocol export controlplane programmability of switched substrates. As a result, rich functionality in traffic management, load balancing, routing, firewall configuration, etc. that may pertain to specific flows they control, may be easily developed. In this paper we extend these functionalities with an efficient and scalable mechanism for performing anomaly detection and mitigation in SDN architectures. Flow statistics may reveal anomalies triggered by large scale malicious events (typically massive Distributed Denial of Service attacks) and subsequently assist networked resource owners/operators to raise mitigation policies against these threats. First, we demonstrate that OF statistics collection and processing overloads the centralized control plane, introducing scalability issues. Second, we propose a modular architecture for the separation of the data collection process from the SDN control plane with the employment of sFlow monitoring data. We then report experimental results that compare its performance against native OF approaches that use standard flow table statistics. Both alternatives are evaluated using an entropy-based method on high volume real network traffic data collected from a university campus network. The packet traces were fed to hardware and software OF devices in order to assess flow-based datagathering and related anomaly detection options. We subsequently present experimental results that demonstrate the effectiveness of the proposed sFlow-based mechanism compared to the native OF approach, in terms of overhead imposed on usage of system resources. Finally, we conclude by demonstrating that once a network anomaly is detected and identified, the OF protocol can effectively mitigate it via flow table modifications. 2013 Elsevier B.V. All rights reserved.

Network operators are actively pushing towards the new 5G era and a crucial part to accomplish this is the Network Functions Virtualization (NFV). FPGAs and their hardware accelerators are a promising solution for NFV and 5G cloud environments because of their fast turnaround time and great speedup potential through application parallelism mapping on the reconfigurable fabric. Recently, consolidation reached a plateau in this field with lightweight virtualization techniques, that require a high overcommitment of FPGA accelerator resources to cope with numerous demands of guests. Although FPGAs can play an important role for the future 5G networks their capability to manage and control them from the upper layers of the software stack is inadequate. The lack of such support coupled with cloud integration and programmability issues can repel potential providers from utilizing FPGAs at their data centers. This paper presents the communication mechanism of the vFPGAmanager, an FPGA virtualization framework which can be orchestrated, monitored and enables accelerators overcommitment with direct guest access. These are key features to allow potential adopters of FPGA technology to include them in the next generation of NFV systems. The communication mechanism architecture is detailed and then benchmarked to show that even under heavy load on the system it demonstrates a minimal overhead to orchestrate and monitor the FPGA as a resource.

Mission-critical applications that use computer networks require guaranteed communication with bounds on the time needed to deliver packets, even if hardware along a path fails or congestion occurs. Current networking technologies follow a reactive approach in which retransmission mechanisms and routing update protocols respond once packet loss occurs. We present a proactive approach that pre-builds and monitors redundant paths to ensure timely delivery with no recovery latency, even in the case of a single-link failure. The paper outlines the approach, describes a new mechanism we call a redundancy controller, and explains the use of SDN to establish and change paths. The paper also reports on a prototype system and gives experimental measurements.

Software-Defined Networking (SDN) approaches were introduced as early as the mid-1990s, but just recently became a well-established industry standard. Many network architectures and systems adopted SDN, and vendors are choosing SDN as an alternative to the fixed, predefined, and inflexible protocol stack. SDN offers flexible, dynamic, and programmable functionality of network systems, as well as many other advantages such as centralized control, reduced complexity, better user experience, and a dramatic decrease in network systems and equipment costs. However, SDN characterization and capabilities, as well as workload of the network traffic that the SDN-based systems handle, determine the level of these advantages. Moreover, the enabled flexibility of SDN-based systems comes with a performance penalty. The design and capabilities of the underlying SDN infrastructure influence the performance of common network tasks, compared to a dedicated solution. In this paper we analyze two issues: a) the impact of SDN on raw performance (in terms of throughput and latency) under various workloads, and b) whether there is an inherent performance penalty for a complex, more functional, SDN infrastructure. Our results indicate that SDN does have a performance penalty, however, it is not necessarily related to the complexity level of the underlying SDN infrastructure.

Traffic application classification is an essential step in the network management process to provide high availability of network services. However, network management has seen limited use of traffic classification because of the significant overheads of existing techniques. In this context we explore the feasibility and performance of lightweight traffic classification based on NetFlow records. In our experiments, the NetFlow records are created from packet-trace data and pre-tagged based upon packet content. This provides us with NetFlow records that are tagged with a high accuracy for ground-truth. Our experiments show that NetFlow records can be usefully employed for application classification. We demonstrate that our machine learning technique is able to provide an identification accuracy (≈ 91%) that, while a little lower than that based upon previous packet-based machine learning work (> 95%), is significantly higher than the commonly used port-based approach (50--70%). Trade-offs such as the complexity of feature selection and packet sampling are also studied. We conclude that a lightweight mechanism of classification can provide application information with a considerably high accuracy, and can be a useful practice towards more effective network management.

In this paper, we propose an optimization framework of offloading from a single mobile device (MD) to multiple edge devices. We aim to minimize both total tasks’ execution latency and the MD’s energy consumption by jointly optimizing the task allocation decision and the MD’s central process unit (CPU) frequency. This paper considers two cases for the MD, i.e., fixed CPU frequency and elastic CPU frequency. Since these problems are NP-hard, we propose a linear relaxation-based approach and a semidefinite relaxation (SDR)-based approach for the fixed CPU frequency case, and an exhaustive search-based approach and an SDR-based approach for the elastic CPU frequency case. Our simulation results show that the SDR-based algorithms achieve near optimal performance. Performance improvement can be obtained with the proposed scheme in terms of energy consumption and tasks’ execution latency when multiple edge devices and elastic CPU frequency are considered. Finally, we show that the MD’s flexible CPU range can have an impact on the task allocation.

Fog computing is a paradigm that extends Cloud computing and services to the edge of the network. Similar to Cloud, Fog provides data, compute, storage and application services to end users. In this article, we elaborate the motivation and advantages of Fog computing and analyse its applications in a series of real scenarios, such as Smart Grid, smart traffic lights in vehicular networks and software defined networks. We discuss the state of the art of Fog computing and similar work under the same umbrella. Distinguished from other reviewing work of Fog computing, this paper further discloses the security and privacy issues according to current Fog computing paradigm. As an example, we study a typical attack, man-in-the-middle attack, for the discussion of system security in Fog computing. We investigate the stealthy features of this attack by examining its CPU and memory consumption on Fog device. In addition, we discuss the authentication and authorization techniques that can be used in Fog computing. An example of authentication techniques is introduced to address the security scenario where the connection between Fog and Cloud is fragile. Copyright © 2015 John Wiley & Sons, Ltd.

Software-Defined Networking (SDN) is now envisioned for Wide Area Networks (WAN) and constrained overlay networks. Such networks require a resilient, scalable and easily extensible SDN control plane. In this paper, we propose DISCO, an extensible DIstributed SDN COntrol plane able to cope with the distributed and heterogeneous nature of modern overlay networks. A DISCO controller manages its own network domain and communicates with other controllers to provide end-to-end network services. This east-west communication is based on a lightweight and highly manageable control channel. We implemented DISCO on top of the Floodlight OpenFlow controller and the AMQP protocol and we evaluated it through an inter-domain topology disruption use case.

The development of Fog Computing technology is crucial to address the challenges to come with the mass adoption of Internet Of Things technology, where the generation of data tends to grow at an unprecedented pace. The technology brings computing power to the surrounds of devices, to offer local processing, filtering, storage and analysis of data and control over actuators. Orchestration is a requirement of Fog Computing technology to deliver services, based on the composition of microservices. It must take into consideration the heterogeneity of the IoT environment and device's capabilities and constraints. This heterogeneity requires a different approach for orchestration, be it regarding infrastructure management, node selection and/or service placement. Orchestrations shall be manually or automatically started through event triggers. Also, the Orchestrator must be flexible enough to work in a centralized or distributed fashion. Orchestration is still a hot topic and can be seen in different areas, especially in the Service Oriented Architectures, hardware virtualization, in the Cloud, and in Network Virtualization Function. However, the architecture of these solutions is not enough to handle Fog Requirements, specially Fog's heterogeneity, and dynamics. In this paper, we propose an architecture for Orchestration for the Fog Computing environment. We developed a prototype to prof some concepts. We discuss in this paper the implementation, and the tools chose, and their roles. We end the paper with a discussion on performance indicators and future direction on the evaluation of non-functional aspects of the Architecture.

ed descriptions of machines by using a DSL while enjoying the full power of scripting languages (in both Puppet and Chef, you can describe behavior in the Ruby language (a dynamic, general-purpose object-oriented programming language), see http://www.ruby-lang. org/en/). Declarative descriptions of target behavior (i.e., what the system must be). Thus, running the scripts will always lead to the same end result. Management of code in version control. By using a version control system as the leading medium, you do not need to adjust the machines manually (which is not reproducible). Synchronization of environments by using a version control system and automatic provisioning of environments. Continuous integration servers, such as Jenkins, simply have to listen to the path in the version control system to detect changes. Then the configuration management tool (e.g., Puppet) ensures that the corresponding machines apply the behavior that is described in version control. Using tools such as Jenkins (see Chapter 8) and Puppet and Vagrant (see Chapter 9), complete setups, including virtualizations, can be managed automatically. Sharing of scripts (e.g., Puppet manifests). A cross-functional team that includes development and operations can develop this function. Sharing the scripts in the version control system enables all parties, particularly development and operations, to use those scripts to set up their respective environments: test environments (used by development) and production environments (managed by operations). Automation is an essential backbone of DevOps (see Chapter 3 and Chapter 8 for more information on automation). Automation is the use of solutions to reduce the need for human work. Automation can ensure that the software is built the same way each time, that the team sees every change made to the software, and that the software is tested and reviewed in the same way every day so that no defects slip through or are introduced through human error. In software development projects, a high level of automation is a prerequisite for quickly delivering the best quality and for obtaining feedback from stakeholders early and often. Automating aspects of DevOps helps to make parts of the process transparent for the whole team and also helps deploy software to different target environments in the same way. You can best improve what you measure; and to measure something usefully, you need a process that delivers results in a reproducible way. DevOps addresses aspects similar to those tackled by Agile development, but the former focuses on breaking down the walls between developers and operations workers. The challenge is to communicate the benefits of DevOps to both development and operations teams. Both groups may be reluctant to start implementing the shift toward DevOps because their day is already full of activities. So why should they be concerned with the work of others? Why should DEVOPS FOR DEVELOPERS 31 operations want to use unfamiliar tools and adjust their daily routines when their self-made, isolated solutions have worked just fine for years? Because of this resistance, the incentives and commitment provided by upper management are important. Incentives alone are not enough: unified processes and tool chains are also important. Upper management will also resist by questioning the wisdom of implementing DevOps if the concrete benefits are not visible. Better cash flow and improved time to market are hard to measure. Management asks questions that address the core problems of software engineering while ignoring the symptoms: how can the company achieve maximal earnings in a short period of time? How can requirements be made stable and delivered to customers quickly? These results and visions should be measured with metrics that are shared by development and operations. Existing metrics can be further used or replaced by metrics that accurately express business value. One example of an end-to-end metric is the cycle time, which we will discuss in detail in Chapter 3.


Question: SDN Docker: Facilitating automatic application docking/undocking in the edge switch environment.

This paper introduces Maestro, a system designed to optimize and scale OpenFlow control in a network environment. OpenFlow networks rely on a central controller for the initial setup of each flow, necessitating communication with relevant switches. However, this setup can lead to performance bottlenecks, particularly concerning the controller's capabilities. The paper addresses this challenge by leveraging parallel processing. NOX, a state-of-the-art OpenFlow controller, simplifies control function development through a single-threaded event loop. Despite this, NOX has not explored the potential of parallelism. Maestro aims to maintain the straightforward programming model favored by developers while simultaneously harnessing parallelism in every aspect of the system, complemented by throughput optimization techniques. Experimental results on an eight-core server demonstrate that Maestro achieves near-linear scalability in throughput. Keywords: OpenFlow, network management, multithreading, performance optimization

In line with the original document, the transformed version maintains the focus on Maestro as a solution for enhancing OpenFlow control scalability. It preserves the discussion of parallelism, the critique of NOX's single-threaded approach, and the demonstration of Maestro's performance on an eight-core server. The document's length, complexity, and semantic style are conserved, while ensuring the content remains semantically similar and relevant to the topic.

Large-scale data centers are major infrastructures in the big data era. Therefore, a stable and optimized architecture is required for data center networks (DCNs) to provide services to the applications. Many studies use software-defined network (SDN)-based multipath TCP (MPTCP) implementation to utilize the entire DCN’s performance and achieve good results. However, the deployment cost is high. In SDN-based MPTCP solutions, the flow allocation mechanism leads to a large number of forwarding rules, which may lead to storage consumption. Considering the advantages and limitations of the SDN-based MPTCP solution, we aim to reduce the deployment cost due to the use of an extremely expensive storage resource—ternary content addressable memory (TCAM). We combine MPTCP and segment routing (SR) for traffic management to limit the storage requirements. And to the best of our knowledge, we are among the first to use the collaboration of MPTCP and SR in multi-rooted DCN topologies. To explain how MPTCP and SR work together, we use four-layer DCN architecture for better description, which contains physical topology, SR over the topology, multiple path selection supplied by MPTCP, and traffic scheduling on the selected paths. Finally, we implement the proposed design in a simulated SDN-based DCN environment. The simulation results reveal the great benefits of such a collaborative approach.

This article introduces the Follow-Me Cloud concept and proposes its framework. The proposed framework is aimed at smooth migration of all or only a required portion of an ongoing IP service between a data center and user equipment of a 3GPP mobile network to another optimal DC with no service disruption. The service migration and continuity is supported by replacing IP addressing with service identification. Indeed, an FMC service/application is identified, upon establishment, by a session/service ID, dynamically changing along with the service being delivered over the session; it consists of a unique identifier of UE within the 3GPP mobile network, an identifier of the cloud service, and dynamically changing characteristics of the cloud service. Service migration in FMC is triggered by change in the IP address of the UE due to a change of data anchor gateway in the mobile network, in turn due to UE mobility and/or for load balancing. An optimal DC is then selected based on the features of the new data anchor gateway. Smooth service migration and continuity are supported thanks to logic installed at UE and DCs that maps features of IP flows to the session/service ID.

Fog computing is a paradigm that extends Cloud computing and services to the edge of the network. Similar to Cloud, Fog provides data, compute, storage and application services to end users. In this article, we elaborate the motivation and advantages of Fog computing and analyse its applications in a series of real scenarios, such as Smart Grid, smart traffic lights in vehicular networks and software defined networks. We discuss the state of the art of Fog computing and similar work under the same umbrella. Distinguished from other reviewing work of Fog computing, this paper further discloses the security and privacy issues according to current Fog computing paradigm. As an example, we study a typical attack, man-in-the-middle attack, for the discussion of system security in Fog computing. We investigate the stealthy features of this attack by examining its CPU and memory consumption on Fog device. In addition, we discuss the authentication and authorization techniques that can be used in Fog computing. An example of authentication techniques is introduced to address the security scenario where the connection between Fog and Cloud is fragile. Copyright © 2015 John Wiley & Sons, Ltd.

The development of Fog Computing technology is crucial to address the challenges to come with the mass adoption of Internet Of Things technology, where the generation of data tends to grow at an unprecedented pace. The technology brings computing power to the surrounds of devices, to offer local processing, filtering, storage and analysis of data and control over actuators. Orchestration is a requirement of Fog Computing technology to deliver services, based on the composition of microservices. It must take into consideration the heterogeneity of the IoT environment and device's capabilities and constraints. This heterogeneity requires a different approach for orchestration, be it regarding infrastructure management, node selection and/or service placement. Orchestrations shall be manually or automatically started through event triggers. Also, the Orchestrator must be flexible enough to work in a centralized or distributed fashion. Orchestration is still a hot topic and can be seen in different areas, especially in the Service Oriented Architectures, hardware virtualization, in the Cloud, and in Network Virtualization Function. However, the architecture of these solutions is not enough to handle Fog Requirements, specially Fog's heterogeneity, and dynamics. In this paper, we propose an architecture for Orchestration for the Fog Computing environment. We developed a prototype to prof some concepts. We discuss in this paper the implementation, and the tools chose, and their roles. We end the paper with a discussion on performance indicators and future direction on the evaluation of non-functional aspects of the Architecture.

New protocols for the data link and network layer are being proposed to address limitations of current protocols in terms of scalability, security, and manageability. High-speed routers and switches that implement these protocols traditionally perform packet processing using ASICs which offer high speed, low chip area, and low power. But with inflexible custom hardware, the deployment of new protocols could happen only through equipment upgrades. While newer routers use more flexible network processors for data plane processing, due to power and area constraints lookups in forwarding tables are done with custom lookup modules. Thus most of the proposed protocols can only be deployed with equipment upgrades. To speed up the deployment of new protocols, we propose a flexible lookup module, PLUG (Pipelined Lookup Grid). We can achieve generality without loosing efficiency because various custom lookup modules have the same fundamental features we retain: area dominated by memories, simple processing, and strict access patterns defined by the data structure. We implemented IPv4, Ethernet, Ethane, and SEATTLE in our dataflow-based programming model for the PLUG and mapped them to the PLUG hardware which consists of a grid of tiles. Throughput, area, power, and latency of PLUGs are close to those of specialized lookup modules.

Cloud computing infrastructures have become the de-facto platform for data driven machine learning applications. However, these centralized models of computing are unqualified for dispersed high-volume real-time edge data intensive applications such as real time object detection, where video streams may be captured at multiple geographical locations. While many recent advancements in object detection have been made using Convolutional Neural Networks, these performance improvements only focus on a single, contiguous object detection model. In this paper, we propose a distributed Edge-Cloud R-CNN pipeline. By splitting the object detection pipeline into components and dynamically distributing these components in the cloud, we can achieve optimal performance to enable real time object detection. As a proof of concept, we evaluate the performance of the proposed system on a distributed computing platform including cloud servers and edge-embedded devices for real-time object detection on live video streams.

Mobile computing continuously evolve through the sustained effort of many researchers. It seamlessly augments users' cognitive abilities via compute-intensive capabilities such as speech recognition, natural language processing, etc. By thus empowering mobile users, we could transform many areas of human activity. This article discusses the technical obstacles to these transformations and proposes a new architecture for overcoming them. In this architecture, a mobile user exploits virtual machine (VM) technology to rapidly instantiate customized service software on a nearby cloudlet and then uses that service over a wireless LAN; the mobile device typically functions as a thin client with respect to the service. A cloudlet is a trusted, resource-rich computer or cluster of computers that's well-connected to the Internet and available for use by nearby mobile devices. Our strategy of leveraging transiently customized proximate infrastructure as a mobile device moves with its user through the physical world is called cloudlet-based, resource-rich, mobile computing. Crisp interactive response, which is essential for seamless augmentation of human cognition, is easily achieved in this architecture because of the cloudlet's physical proximity and one-hop network latency. Using a cloudlet also simplifies the challenge of meeting the peak bandwidth demand of multiple users interactively generating and receiving media such as high-definition video and high-resolution images. Rapid customization of infrastructure for diverse applications emerges as a critical requirement, and our results from a proof-of-concept prototype suggest that VM technology can indeed help meet this requirement.

Software Defined Networks (SDNs) based on the OpenFlow (OF) protocol export controlplane programmability of switched substrates. As a result, rich functionality in traffic management, load balancing, routing, firewall configuration, etc. that may pertain to specific flows they control, may be easily developed. In this paper we extend these functionalities with an efficient and scalable mechanism for performing anomaly detection and mitigation in SDN architectures. Flow statistics may reveal anomalies triggered by large scale malicious events (typically massive Distributed Denial of Service attacks) and subsequently assist networked resource owners/operators to raise mitigation policies against these threats. First, we demonstrate that OF statistics collection and processing overloads the centralized control plane, introducing scalability issues. Second, we propose a modular architecture for the separation of the data collection process from the SDN control plane with the employment of sFlow monitoring data. We then report experimental results that compare its performance against native OF approaches that use standard flow table statistics. Both alternatives are evaluated using an entropy-based method on high volume real network traffic data collected from a university campus network. The packet traces were fed to hardware and software OF devices in order to assess flow-based datagathering and related anomaly detection options. We subsequently present experimental results that demonstrate the effectiveness of the proposed sFlow-based mechanism compared to the native OF approach, in terms of overhead imposed on usage of system resources. Finally, we conclude by demonstrating that once a network anomaly is detected and identified, the OF protocol can effectively mitigate it via flow table modifications. 2013 Elsevier B.V. All rights reserved.

Network protocols are usually tested in operational networks or in simulated environments. With the former approach it is not easy to set and control the various operational parameters such as bandwidth, delays, queue sizes. Simulators are easier to control, but they are often only an approximate model of the desired setting, especially for what regards the various traffic generators (both producers and consumers) and their interaction with the protocol itself.In this paper we show how a simple, yet flexible and accurate network simulator - dummynet - can be built with minimal modifications to an existing protocol stack, allowing experiments to be run on a standalone system. dummynet works by intercepting communications of the protocol layer under test and simulating the effects of finite queues, bandwidth limitations and communication delays. It runs in a fully operational system, hence allowing the use of real traffic generators and protocol implementations, while solving the problem of simulating unusual environments. With our tool, doing experiments with network protocols is as simple as running the desired set of applications on a workstation.A FreeBSD implementation of dummynet, targeted to TCP, is available from the author. This implementation is highly portable and compatible with other BSD-derived systems, and takes less than 300 lines of kernel code.

Cloud computing is expected to be a promising solution for scientific computing. In this paper, we propose a flexible container-based computing platform to run scientific workflows on cloud. We integrate Galaxy, a popular biology workflow system, with four famous container cluster systems. Preliminary evaluation shows that container cluster systems introduce negligible performance overhead for data intensive scientific workflows, meanwhile, they are able to solve tool installation problem, guarantee reproducibility and improve resource utilization. Moreover, we implement four ways of using Docker, the most popular container tool, for our platform. Docker in Docker and Sibling Docker, which run everything within containers, both help scientists easily deploy our platform on any clouds in a few minutes.


Question: SDN Docker: Facilitating automatic application docking/undocking in edge switches.

This paper provides an in-depth examination of fog computing, its applications, and the challenges it presents, in response to the limitations of cloud computing, particularly concerning latency, mobility, and location-awareness. Fog computing aims to enhance user experience by delivering elastic resources and services directly at the network's edge, complementing cloud computing's focus on resource distribution within the core network. The survey delves into the foundational definition of fog computing, distinguishing it from related concepts, and presents a range of practical application scenarios. It also scrutinizes the multifaceted issues that arise during the design and implementation of fog computing systems, underscoring the need for addressing these challenges. The paper further delineates the potential opportunities and future research directions, emphasizing the critical techniques that must be considered in the fog computing domain, to ensure its successful deployment and integration into existing network infrastructures.

In Software Defined Networking (SDN) the control plane is physically separate from the forwarding plane. Control software programs the forwarding plane (e.g., switches and routers) using an open interface, such as OpenFlow. This paper aims to overcomes two limitations in current switching chips and the OpenFlow protocol: i) current hardware switches are quite rigid, allowing ``Match-Action'' processing on only a fixed set of fields, and ii) the OpenFlow specification only defines a limited repertoire of packet processing actions. We propose the RMT (reconfigurable match tables) model, a new RISC-inspired pipelined architecture for switching chips, and we identify the essential minimal set of action primitives to specify how headers are processed in hardware. RMT allows the forwarding plane to be changed in the field without modifying hardware. As in OpenFlow, the programmer can specify multiple match tables of arbitrary width and depth, subject only to an overall resource limit, with each table configurable for matching on arbitrary fields. However, RMT allows the programmer to modify all header fields much more comprehensively than in OpenFlow. Our paper describes the design of a 64 port by 10 Gb/s switch chip implementing the RMT model. Our concrete design demonstrates, contrary to concerns within the community, that flexible OpenFlow hardware switch implementations are feasible at almost no additional cost or power.

ed as devices to provide services at low-levels as network discovery services, metadata exchange services, and asynchronous publish and subscribe event in (Kranenburg et al. 2011; Sundmaeker et al. 2010); In (Peris-Lopez et al. 2006), a representational state transfer (REST) is defined to increase interoperability between Page 14 of 32 http://mc.manuscriptcentral.com/intr Internet Research 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 or Peer Rview loosely coupled services and distributed applications. In (Hernandez-Castro et al. 2013), the services layer introduced a service provisioning process (SPP) that can provide the interaction between applications and services. It is important to design an effective security strategy to protect services against attacks in the service layer. The security requirements in the service layer include: • Authorization, service authentication, group authentication, privacy protection, integrity, integrity, security of keys, non-repudiation, anti-replay, availability,

Code offloading is a promising way to accelerate mobile applications and reduce the energy consumption of mobile devices by shifting some computation to the cloud. However, existing code offloading systems suffer from a long communication delay between mobile devices and the cloud. To address this challenge, in this paper, we consider to deploy edge nodes in close proximity to mobile devices and study how they benefit code offloading. We design an edge-centric code offloading system, called Echo, over a three-layer computing hierarchy consisting of mobile devices, the edge, and the cloud. A critical problem needs to be addressed by Echo is to decide which methods should be offloaded to which computing platform (the edge or the cloud). Different from existing offloading systems that let mobile devices individually make offloading decisions, Echo implements a centralized decision engine at the edge. This edge-centric design can fully exploit limited hardware resources at the edge to provide offloading services with the quality-of-service guarantee. Furthermore, we propose some novel mechanisms, e.g., lazy object transmission and differential object update, to further improve system performance. The results of a small-scale real deployment and trace-driven simulations show that Echo significantly outperforms existing code offloading systems at both execution time and energy consumption.

As one of the fundamental infrastructures for cloud computing, data center networks (DCN) have recently been studied extensively. We currently use pure software-based systems, FPGA based platforms, e.g., NetFPGA, or OpenFlow switches, to implement and evaluate various DCN designs including topology design, control plane and routing, and congestion control. However, software-based approaches suffer from high CPU overhead and processing latency; FPGA based platforms are difficult to program and incur high cost; and OpenFlow focuses on control plane functions at present. In this paper, we design a ServerSwitch to address the above problems. ServerSwitch is motivated by the observation that commodity Ethernet switching chips are becoming programmable and that the PCI-E interface provides high throughput and low latency between the server CPU and I/O subsystem. ServerSwitch uses a commodity switching chip for various customized packet forwarding, and leverages the server CPU for control and data plane packet processing, due to the low latency and high throughput between the switching chip and server CPU. We have built our ServerSwitch at low cost. Our experiments demonstrate that ServerSwitch is fully programmable and achieves high performance. Specifically, we have implemented various forwarding schemes including source routing in hardware. Our in-network caching experiment showed high throughput and flexible data processing. Our QCN (Quantized Congestion Notification) implementation further demonstrated that ServerSwitch can react to network congestions in 23us. ∗Correspondent author. †This work was performed when Zhiqiang Zhou was a visiting student at Microsoft Research Asia.

Network Function Virtualization has received a large amount of research and recent efforts have been made to further leverage the cloud to enhance NFV. However, since there are privacy and security issues with using cloud computing, work has been done to allow for operating on encrypted data, which introduces a large amount of overhead in both computation and data, while only providing a limited set of operations, since these encryption schemes are not fully homomorphic. We propose using trusted computing to circumvent these limitations by having hardware enforce data privacy and provide guaranteed computation. Prior work has shown that Intel's Software Guard Extensions can be used to protect the state of network functions, but there are still questions about the usability of SGX in arbitrary NFV applications and the performance of SGX in these applications. We extend prior work to show how SGX can be used in network deployments by extending the Click modular router to perform secure packet processing with SGX. We also present a performance evaluation of SGX on real hardware to show that processing inside of SGX has a negligible performance impact, compared to performing the same processing outside of SGX.

The Address Resolution Protocol (ARP) enables communication between IP-speaking nodes in a local network by reconstructing the hardware (MAC) address associated with the IP address of an interface. This is not needed in a Software-Defined Network (SDN), because each device can forward packets without the need to learn this association. We tackle the interoperability problem arising between standard network devices (end systems, routers), that rely on ARP, and SDN datapaths, that do not handle ARP packets natively. In particular, we propose a general approach to handle ARP in a SDN, that is applicable in several network scenarios, is transparent for existing devices, and can coexist with any packet forwarding logic implemented in the controller. Our approach reduces ARP traffic by confining it to the edge of SDNs and requires a minimal set of flow entries in the datapaths. We argument about its applicability and confirm it with experiments performed on SDN datapaths from a range of different vendors.

Today's data networks are surprisingly fragile and difficult to manage. We argue that the root of these problems lies in the complexity of the control and management planes--the software and protocols coordinating network elements--and particularly the way the decision logic and the distributed-systems issues are inexorably intertwined. We advocate a complete refactoring of the functionality and propose three key principles--network-level objectives, network-wide views, and direct control--that we believe should underlie a new architecture. Following these principles, we identify an extreme design point that we call "4D," after the architecture's four planes: decision, dissemination, discovery, and data. The 4D architecture completely separates an AS's decision logic from pro-tocols that govern the interaction among network elements. The AS-level objectives are specified in the decision plane, and en-forced through direct configuration of the state that drives how the data plane forwards packets. In the 4D architecture, the routers and switches simply forward packets at the behest of the decision plane, and collect measurement data to aid the decision plane in controlling the network. Although 4D would involve substantial changes to today's control and management planes, the format of data packets does not need to change; this eases the deployment path for the 4D architecture, while still enabling substantial innovation in network control and management. We hope that exploring an extreme design point will help focus the attention of the research and industrial communities on this crucially important and intellectually challenging area.

The Internet of Things (IoT) is an impending technology that captured the industries and research interests in a brief period. Presently, the number of Internet-connected devices are estimated at billions and by 2020 many studies expect to have around 50 billion devices that are connected to the Internet. The IoT devices have produced a significant amount of data that could be threatening to the security and directing the flow of data in the network. One of the alternative solutions for problems caused by IoT is to have some kind of solutions that are based on programming and primary control. Software Define Network (SDN) offers a programmable and primary control for the basic network without variability of the current architecture of the network. This paper discusses some solutions for various domains for the combined SDN based on IoT and current directions in studies. The relative analysis of these solutions prepares a simple and brief view of those directions.

With the Internet of Things, sensors are becoming ever more ubiquitous, but interacting with them continues to present numerous challenges, particularly for applications running on resource-constrained devices like smartphones. The SOUL abstractions in this paper address two issues faced by such applications: (1) access to sensors with the levels of convenience needed for their ubiquitous, dynamic use, and only by parties authorized to do so, and (2) scalability in sensor access, given today's multitude of sensors. Toward this end, SOUL, first, introduces a new abstraction for the applications to transparently and uniformly access both on-device and ambient sensors with associated actuators. Second, potentially expensive sensor-related processing needs not just occur on smartphones, but can also leverage edge-and remote-cloud resources. Finally, SOUL provides access control methods that permit users to easily define access permissions for sensors, which leverages users' social ties and captures the context in which access requests are made. SOUL demonstrates that the applications on Android platforms can scale the use of 100s of sensors with performance and energy efficiency.

Securing the rapidly expanding Internet of Things (IoT) is critical. Many of these “things” are vulnerable baremetal embedded systems where the application executes directly on hardware without an operating system. Unfortunately, the integrity of current systems may be compromised by a single vulnerability, as recently shown by Google’s P0 team against Broadcom’s WiFi SoC. We present ACES (Automatic Compartments for Embedded Systems), an LLVM-based compiler that automatically infers and enforces inter-component isolation on bare-metal systems, thus applying the principle of least privileges. ACES takes a developer-specified compartmentalization policy and then automatically creates an instrumented binary that isolates compartments at runtime, while handling the hardware limitations of baremetal embedded devices. We demonstrate ACES’ ability to implement arbitrary compartmentalization policies by implementing three policies and comparing the compartment isolation, runtime overhead, and memory overhead. Our results show that ACES’ compartments can have low runtime overheads (13% on our largest test application), while using 59% less Flash, and 84% less RAM than the Mbed μVisor—the current state-of-theart compartmentalization technique for bare-metal systems. ACES ‘ compartments protect the integrity of privileged data, provide control-flow integrity between compartments, and reduce exposure to ROP attacks by 94.3% compared to μVisor.