WiFi has become one of the most popular ways to access the Internet.However,in large-scale campus wireless networks,it is challenging for network administrators to provide optimized access quality without knowledge on...WiFi has become one of the most popular ways to access the Internet.However,in large-scale campus wireless networks,it is challenging for network administrators to provide optimized access quality without knowledge on fine-grained traffic characteristics and real network performance.In this paper,we implement PerfMon,a network performance measurement and diagnosis system,which integrates collected multi-source datasets and analysis methods.Based on PerfMon,we first conduct a comprehensive measurement on application-level traffic patterns and behaviors from multiple dimensions in the wireless network of T university(TWLAN),which is one of the largest campus wireless networks.Then we systematically study the application-level network performance.We observe that the application-level traffic behaviors and performance vary greatly across different locations and device types.The performance is far from satisfactory in some cases.To diagnose these problems,we distinguish locations and device types,and further locate the most crucial factors that affect the performance.The results of case studies show that the influential factors can effectively characterize performance changes and explain for performance degradation.展开更多
The basic function of the Internet is to delivery data(what) to serve the needs of all applications. IP names the attachment points(where) to facilitate ubiquitous interconnectivity as the current way to deliver data....The basic function of the Internet is to delivery data(what) to serve the needs of all applications. IP names the attachment points(where) to facilitate ubiquitous interconnectivity as the current way to deliver data. The fundamental mismatch between data delivery and naming attachment points leads to a lot of challenges, e.g., mapping from data name to IP address, handling dynamics of underlying topology, scaling up the data distribution, and securing communication, etc. Informationcentric networking(ICN) is proposed to shift the focus of communication paradigm from where to what, by making the named data the first-class citizen in the network, The basic consensus of ICN is to name the data independent from its container(space dimension) and session(time dimension), which breaks the limitation of point-to-point IP semantic. It scales up data distribution by utilizing available resources, and facilitates communication to fit diverse connectivity and heterogeneous networks. However, there are only a few consensuses on the detailed design of ICN, and quite a few different ICN architectures are proposed. This paper reveals the rationales of ICN from the perspective of the Internet evolution, surveys different design choices, and discusses on two debatable topics in ICN, i.e.,self-certifying versus hierarchical names, and edge versus pervasive caching. We hope this survey helps clarify some mis-understandings on ICN and achieve more consensuses.展开更多
The gradual deployment of Low-Earth Orbit(LEO)mega constellations with inter-satellite links(ISLs)promises ubiquitous,low-latency,and high-throughput satellite network services.However,networked LEO satellites with IS...The gradual deployment of Low-Earth Orbit(LEO)mega constellations with inter-satellite links(ISLs)promises ubiquitous,low-latency,and high-throughput satellite network services.However,networked LEO satellites with ISLs are also at risk of routing attacks such as hijacking.Existing defenses against route hijacking in terrestrial networks can hardly work for the LEO satellite network due to its high spatiotemporal dynamics.To deal with it,we propose RPD,a high-risk routing path detection method for LEO mega-constellation networks.RPD detects abnormal high-risk LEO network paths by checking the consistency between the path delay and the geographical distance.This is efficiently achieved by combining in-band measurements and out-of-band statistical processing to detect the anomaly of the clustering feature in the reference delay matrix.RPD avoids the recalculation of the header cryptographic marks when the handover occurs,thus greatly reducing the cost and improving the performance of highrisk path detection.Experiments showed that the proposed RPD mechanism achieves an average detection accuracy of 91.64%under normal network conditions,and maintain about 89%even when congestion occurs in multiple areas of the network and measurement noise is considered.In addition,RPD does not require any cryptographic operation on the intermediate node,only minimal communication cost with excellent scalability and deployability.展开更多
The network resource allocation in SDN for control applications is becoming a key problem in the near future because of the conflict between the need of the flow-level flexibility control and the limited capacity of f...The network resource allocation in SDN for control applications is becoming a key problem in the near future because of the conflict between the need of the flow-level flexibility control and the limited capacity of flow table.Based on the analysis of the difference of the definition of network resource between SDN and traditional IP network,the idea of the integrated allocation of link bandwidth and flow table for multiple control applications in SDN is proposed in this paper.Furthermore,a price-based joint allocation model of network resource in SDN is built by introducing the price for each of the resources,which can get the proportional fair allocation of link bandwidth and the minimum global delay at the same time.We have also designed a popular flow scheduling policy based on the proportional fair allocation of link bandwidth in order to achieve the minimum global delay.A flow scheduling module has been implemented and evaluated in Floodlight,named virtual forwarding space(VFS).VFS can not only implement the fair allocation of link bandwidth and minimum delay flow scheduling in data plane but also accelerate packet forwarding by looking up control rules in control plane.展开更多
In order to improve the scalability and reliability of Software Defined Networking(SDN),many studies use multiple controllers to constitute logically centralized control plane to provide load balancing and fail over.I...In order to improve the scalability and reliability of Software Defined Networking(SDN),many studies use multiple controllers to constitute logically centralized control plane to provide load balancing and fail over.In this paper,we develop a flexible dormant multi-controller model based on the centralized multi-controller architecture.The dormant multi-controller model allows part of controllers to enter the dormant state under light traffic condition for saving system cost.Meanwhile,through queueing analysis,various performance measures of the system can be obtained.Moreover,we analyze the real traffic of China Education Network and use the results as the parameters of computer simulation and verify the effects of parameters on the system characteristics.Finally,a total expected cost function is established,and genetic algorithm is employed to find the optimal values of various parameters to minimize system cost for the deployment decision making.展开更多
With the booming development of terrestrial network, scaling terrestrial network over satellite network to build Integrated Terrestrial-Satellite Network(ITSN) and meanwhile to provide the global Internet access, has ...With the booming development of terrestrial network, scaling terrestrial network over satellite network to build Integrated Terrestrial-Satellite Network(ITSN) and meanwhile to provide the global Internet access, has become ever more attractive. Naturally, the widely and successfully used terrestrial routing protocols are the promising protocols to integrate the terrestrial and satellite networks. However, the terrestrial routing protocols, which rely on propagating routing messages to discover New Network Topology(NNT) in the terrestrial network with rare topology changes, will suffer from overly numerous routing messages in satellite network whose topology frequently changes as satellites move. In this paper, a Topology Discovery Sub-layer for ITSN Routing Schemes(TDS-IRS) is firstly proposed to avoid the propagation of numerous routing messages by taking advantage of the movement predictability of satellite and the requirements of routing schemes to discover NNT in advance of topology change. Secondly, a Weighted Perfect Matching based Topology Discovery(WPM-TD) model is designed to conduct the NNT discovery on the ground. Thirdly, this paper builds a testbed with real network devices and meanwhile interconnect that testbed with real Internet, to validate that RS-TDS can discover NNT immediately with the less on-board overhead compared with optimized routing schemes. Finally, different network scenarios are applied to validate the WPM-TD, i.e., the core module of TDS-IRS. Extensive experiments show WPM-TD can work efficiently, avoiding the invalid NNT discovery and decreasing 20% ~ 57% of potential topology changes, which can also improve up to 47% ~ 105% of network throughput.展开更多
With the challenges brought by the expansion of network scale,as well as the diversity of the equipments and the complexity of network protocols,many self-configurable systems have been proposed combining formal speci...With the challenges brought by the expansion of network scale,as well as the diversity of the equipments and the complexity of network protocols,many self-configurable systems have been proposed combining formal specification and model finding techniques.In this paper,we pay more attention to formal specifications of network information,i.e.,exploring principles and algorithm to map network information(topology,devices and status,etc.) to Alloy specifications.We first model network information in relational form,which is easy to realize because of the structured feature of network information in nature.Then we map the relational data to Alloy specifications according to our novel data mapping principles and algorithm.Based on the transition of relational data,it is possible to automatically map network information to Alloy specifications.We evaluate our data mapping principles and algorithm by applying them to a practical application scenario.The results illustrate that we can find a model for the task within a tolerant time interval,which implies that our novel approach can convert relational data to Alloy specifications correctly and efficiently.展开更多
Information-Centric Networking(ICN)is an emerging direction in Future Internet architecture research,gaining significant tractions among academia and industry.Aiming to replace the conventional host-to-host communicat...Information-Centric Networking(ICN)is an emerging direction in Future Internet architecture research,gaining significant tractions among academia and industry.Aiming to replace the conventional host-to-host communication model by a data-centric model,ICN treats data content as the first class entity in network architecture.展开更多
Software defined networking(SDN)has attracted significant attention from both academia and industry by its ability to reconfigure network devices with logically centralized applications.However,some critical security ...Software defined networking(SDN)has attracted significant attention from both academia and industry by its ability to reconfigure network devices with logically centralized applications.However,some critical security issues have also been introduced along with the benefits,which put an obstruction to the deployment of SDN.One root cause of these issues lies in the limited resources and capability of devices involved in the SDN architecture,especially the hardware switches lied in the data plane.In this paper,we analyze the vulnerability of SDN and present two kinds of SDN-targeted attacks:1)data-to-control plane saturation attack which exhausts resources of all SDN components,including control plane,data plane,and the in-between downlink channel and2)control plane reflection attack which only attacks the data plane and gets conducted in a more efficient and hidden way.Finally,we propose the corresponding defense frameworks to mitigate such attacks.展开更多
Discrete mathematics studies the respective structures,laws and interrelationships of different discrete quantities,which has a wide range of applications in computer science and software engineering.It has the charac...Discrete mathematics studies the respective structures,laws and interrelationships of different discrete quantities,which has a wide range of applications in computer science and software engineering.It has the characteristics of research,practice and innovation.The teaching goals of the course of discrete mathematics include not only the understanding and mastery of knowledge,but also the study of methodology.However,current teaching mechanism has limitations in outdated course contents,rare real project examples and nonscientific scoring modes.This paper attempts to think about the course construction of discrete mathematics to improve the teaching effects and cultivate students’practical ability.展开更多
Configuration errors are proved to be the main reasons for network interruption and anomalies.Many researchers have paid their attention to configuration analysis and provisioning,but few works focus on understanding ...Configuration errors are proved to be the main reasons for network interruption and anomalies.Many researchers have paid their attention to configuration analysis and provisioning,but few works focus on understanding the configuration evolution.In this paper,we uncover the configuration evolution of an operational IP backbone based on the weekly reports gathered from January 2006 to January 2013.We find that rate limiting and launching routes for new customers are configured most frequently.In addition,we conduct an analysis of network failures and find that link failures are the main causes for network failures.We suggest that we should configure redundant links for the links which are easy to break down.At last,according to the analysis results,we illustrate how to provide semi-automated configuration for rate limiting and adding customers.展开更多
Software-Defined Networking(SDN)is now considered as one of the promising future networking technologies,and this trend can be clearly verified by observing activities of both industry and academia.In industry,we can ...Software-Defined Networking(SDN)is now considered as one of the promising future networking technologies,and this trend can be clearly verified by observing activities of both industry and academia.In industry,we can easily notice that many major展开更多
Amajor recent development in computer networking is the emergence of Software Defined Networking(SDN),whose goal is to provide a centralized,programmable control plane that is decoupled from the distributed data plane...Amajor recent development in computer networking is the emergence of Software Defined Networking(SDN),whose goal is to provide a centralized,programmable control plane that is decoupled from the distributed data planes on individual network devices.In particular,the development of OpenFlow has demonstrated many potential benefits of SDN,and multiple vendors have started to offer commercial switches supporting the OpenFlow standard.Researchers have also made progress on SDN components including SDN controllers,展开更多
Named-data Networking(NDN) is a promising future Internet architecture, which introduces some evolutionary elements into layer-3, e.g., consumer-driven communication, soft state on data forwarding plane and hop-byhop ...Named-data Networking(NDN) is a promising future Internet architecture, which introduces some evolutionary elements into layer-3, e.g., consumer-driven communication, soft state on data forwarding plane and hop-byhop traffic control. And those elements ensure data holders to solely return the requested data within the lifetime of the request, instead of pushing data whenever needed and whatever it is. Despite the dispute on the advantages and their prices, this pattern requires data consumers to keep sending requests at the right moments for continuous data transmission, resulting in significant forwarding cost and sophisticated application design. In this paper, we propose Interest Set(IS) mechanism, which compresses a set of similar Interests into one request, and maintains a relative long-term data returning path with soft state and continuous feedback from upstream. In this way, IS relaxes the above requirement, and scales NDN data forwarding by reducing forwarded requests and soft states that are needed to retrieve a given set of data.展开更多
Software defined networking(SDN) has been applied increasingly in practical networks. Currently, SDN is mainly used to improvethe flexibility and efficiency of datacenter networks, enterprise networks and wide-area ne...Software defined networking(SDN) has been applied increasingly in practical networks. Currently, SDN is mainly used to improvethe flexibility and efficiency of datacenter networks, enterprise networks and wide-area networks(WAN). There also emerge somestudies that try to deploy SDN to inter-domain settings. In this article, we introduce the progress stages of inter-domain SDN andstudies related to each stage. Finally, we discuss the applications and challenges of inter-domain SDN.展开更多
In the design and construction process of Next Generation Internet, it is important to identify the source of each IP packet forwarding accurately, especially for the support of precise fine-grained management,control...In the design and construction process of Next Generation Internet, it is important to identify the source of each IP packet forwarding accurately, especially for the support of precise fine-grained management,control, traceability and improving the trustworthiness of the Internet. This paper designed a scalable Network Identity(NID) scheme for the Internet users, proposed NIDTGA(Network Identity and Time Generated Address), an IPv6 address generation algorithm embedded NID and time information, then designed and implemented an IPv6 address generation and traceback system based on NIDTGA. The design of NIDTGA, which reflects the length, time and owner attributes of the IP address, can be a good support to ADN(Address Driven Network). At the same time, by embedding the key elements of user identity and time in the IPv6 address,and by taking into account both the traceability and privacy, NIDTGA can provide a technical basis for the establishment of the network trust mechanism, and achieve the traceability of security event.展开更多
With the rapid developmen of the Internet, the exhaustion of IPv4 address limited the development of the Internet for years. IPv6, as the core technology of the next generation Internet, has since been rapidly deploye...With the rapid developmen of the Internet, the exhaustion of IPv4 address limited the development of the Internet for years. IPv6, as the core technology of the next generation Internet, has since been rapidly deployed around the world. As the widely deployed address configuration protocol, DHCPv6 is responsible for allocating globally unique IPv6 addresses to clients, which is the basis for all the network services. However, the initial design of the DHCPv6 protocol gave little consideration to the privacy and security issues, which has led to a proliferation of privacy and security accidents breaches in its real deployment. In this paper, to fundamentally solve a range of possible security and privacy issues, we propose a secure DHCPv6 mechanism, which adds authentication and encryption mechanisms into the original DHCPv6 protocol. Compared with other proposed security mechanisms for the DHCPv6, our method can achieve all-around protection for the DHCPv6 protocol with minimal change to the current protocol, easier deployment, and low computing cost.展开更多
This article introduces FINE(Future Internet iNnovation Environment) project,which is supported by National High-tech R&D Program( "863" Program) of China.
With the rapid development of wireless transmission technologies and the proliferation of mobile terminals, the mobile Internet has experienced exponential growth in recent years. However, at the same time, it is also...With the rapid development of wireless transmission technologies and the proliferation of mobile terminals, the mobile Internet has experienced exponential growth in recent years. However, at the same time, it is also facing more challenges, particularly regarding bandwidth, address space, security, mobility, and energy. In this article, we analyse the five abovementioned challenges and then survey related technology trends. We also describe the progress of architecture research aimed at the future mobile Internet. We reach the conclusion that a single technology cannot solve all the problems of mobile Internet, and future research should focus more on how to make architectures and technologies work together more effectively.展开更多
As a typical representative of the so-called cyber-physical system,smart grid reveals its high efficiency,robustness and reliability compared with conventional power grid.However,due to the deep integration of electri...As a typical representative of the so-called cyber-physical system,smart grid reveals its high efficiency,robustness and reliability compared with conventional power grid.However,due to the deep integration of electrical components and computinginformation in cyber space,smart grid is vulnerable to malicious attacks,especially for a type of attacks named false data injection attacks(FDIAs).FDIAs are capable of tampering meter measurements and affecting the results of state estimation stealthily,which severely threat the security of smart grid.Due to the significantinfluence of FDIAs on smart grid,the research related to FDIAs has received considerable attention over the past decade.This paper aims to summarize recent advances in FDIAs against smart grid state estimation,especially from the aspects of background materials,construction methods,detection and defense strategies.Moreover,future research directions are discussed and outlined by analyzing existing results.It is expected that through the review of FDIAs,the vulnerabilities of smart grid to malicious attacks can be further revealed and more attention can be devoted to the detection and defense of cyber-physical attacks against smart grid.展开更多
基金supported by the National Key Research and Development Program of China(No.2020YFE0200500)。
文摘WiFi has become one of the most popular ways to access the Internet.However,in large-scale campus wireless networks,it is challenging for network administrators to provide optimized access quality without knowledge on fine-grained traffic characteristics and real network performance.In this paper,we implement PerfMon,a network performance measurement and diagnosis system,which integrates collected multi-source datasets and analysis methods.Based on PerfMon,we first conduct a comprehensive measurement on application-level traffic patterns and behaviors from multiple dimensions in the wireless network of T university(TWLAN),which is one of the largest campus wireless networks.Then we systematically study the application-level network performance.We observe that the application-level traffic behaviors and performance vary greatly across different locations and device types.The performance is far from satisfactory in some cases.To diagnose these problems,we distinguish locations and device types,and further locate the most crucial factors that affect the performance.The results of case studies show that the influential factors can effectively characterize performance changes and explain for performance degradation.
基金supported by the National High-tech R&D Program("863"Program)of China(No.2013AA013505)the National Science Foundation of China(No.61472213)State Scholarship Fund from China Scholarship Council(No.201406210270)
文摘The basic function of the Internet is to delivery data(what) to serve the needs of all applications. IP names the attachment points(where) to facilitate ubiquitous interconnectivity as the current way to deliver data. The fundamental mismatch between data delivery and naming attachment points leads to a lot of challenges, e.g., mapping from data name to IP address, handling dynamics of underlying topology, scaling up the data distribution, and securing communication, etc. Informationcentric networking(ICN) is proposed to shift the focus of communication paradigm from where to what, by making the named data the first-class citizen in the network, The basic consensus of ICN is to name the data independent from its container(space dimension) and session(time dimension), which breaks the limitation of point-to-point IP semantic. It scales up data distribution by utilizing available resources, and facilitates communication to fit diverse connectivity and heterogeneous networks. However, there are only a few consensuses on the detailed design of ICN, and quite a few different ICN architectures are proposed. This paper reveals the rationales of ICN from the perspective of the Internet evolution, surveys different design choices, and discusses on two debatable topics in ICN, i.e.,self-certifying versus hierarchical names, and edge versus pervasive caching. We hope this survey helps clarify some mis-understandings on ICN and achieve more consensuses.
基金supported by National Key Research and Development Plan of China under Grant 2022YFB3105203National Natural Science Foundation of China(62132009)+2 种基金key fund of National Natural Science Foundation of China(62272266)Tsinghua University-China Mobile Communications Group Co.,Ltd.Joint InstituteZhongguancun Laboratory。
文摘The gradual deployment of Low-Earth Orbit(LEO)mega constellations with inter-satellite links(ISLs)promises ubiquitous,low-latency,and high-throughput satellite network services.However,networked LEO satellites with ISLs are also at risk of routing attacks such as hijacking.Existing defenses against route hijacking in terrestrial networks can hardly work for the LEO satellite network due to its high spatiotemporal dynamics.To deal with it,we propose RPD,a high-risk routing path detection method for LEO mega-constellation networks.RPD detects abnormal high-risk LEO network paths by checking the consistency between the path delay and the geographical distance.This is efficiently achieved by combining in-band measurements and out-of-band statistical processing to detect the anomaly of the clustering feature in the reference delay matrix.RPD avoids the recalculation of the header cryptographic marks when the handover occurs,thus greatly reducing the cost and improving the performance of highrisk path detection.Experiments showed that the proposed RPD mechanism achieves an average detection accuracy of 91.64%under normal network conditions,and maintain about 89%even when congestion occurs in multiple areas of the network and measurement noise is considered.In addition,RPD does not require any cryptographic operation on the intermediate node,only minimal communication cost with excellent scalability and deployability.
基金Supported by the National High-tech R&D Program("863" Program) of China (No.2013AA013505)the National Science Foundation of China(No.61472213)National Research Foundation of Korea(NRF 2014K1A1A2064649)
文摘The network resource allocation in SDN for control applications is becoming a key problem in the near future because of the conflict between the need of the flow-level flexibility control and the limited capacity of flow table.Based on the analysis of the difference of the definition of network resource between SDN and traditional IP network,the idea of the integrated allocation of link bandwidth and flow table for multiple control applications in SDN is proposed in this paper.Furthermore,a price-based joint allocation model of network resource in SDN is built by introducing the price for each of the resources,which can get the proportional fair allocation of link bandwidth and the minimum global delay at the same time.We have also designed a popular flow scheduling policy based on the proportional fair allocation of link bandwidth in order to achieve the minimum global delay.A flow scheduling module has been implemented and evaluated in Floodlight,named virtual forwarding space(VFS).VFS can not only implement the fair allocation of link bandwidth and minimum delay flow scheduling in data plane but also accelerate packet forwarding by looking up control rules in control plane.
基金the National High-tech R&D Program ("863" Program) of China,the National Science Foundation of China,National Science & Technology Pillar Program of China,the National Science Foundation of China,the Post-Doctoral Funding of China,Tsinghua-Huawei joint research project
文摘In order to improve the scalability and reliability of Software Defined Networking(SDN),many studies use multiple controllers to constitute logically centralized control plane to provide load balancing and fail over.In this paper,we develop a flexible dormant multi-controller model based on the centralized multi-controller architecture.The dormant multi-controller model allows part of controllers to enter the dormant state under light traffic condition for saving system cost.Meanwhile,through queueing analysis,various performance measures of the system can be obtained.Moreover,we analyze the real traffic of China Education Network and use the results as the parameters of computer simulation and verify the effects of parameters on the system characteristics.Finally,a total expected cost function is established,and genetic algorithm is employed to find the optimal values of various parameters to minimize system cost for the deployment decision making.
基金supported by State Key Program of National Natural Science of China (91738202)Science &Technology Program of Beijing (Z171100005217001)
文摘With the booming development of terrestrial network, scaling terrestrial network over satellite network to build Integrated Terrestrial-Satellite Network(ITSN) and meanwhile to provide the global Internet access, has become ever more attractive. Naturally, the widely and successfully used terrestrial routing protocols are the promising protocols to integrate the terrestrial and satellite networks. However, the terrestrial routing protocols, which rely on propagating routing messages to discover New Network Topology(NNT) in the terrestrial network with rare topology changes, will suffer from overly numerous routing messages in satellite network whose topology frequently changes as satellites move. In this paper, a Topology Discovery Sub-layer for ITSN Routing Schemes(TDS-IRS) is firstly proposed to avoid the propagation of numerous routing messages by taking advantage of the movement predictability of satellite and the requirements of routing schemes to discover NNT in advance of topology change. Secondly, a Weighted Perfect Matching based Topology Discovery(WPM-TD) model is designed to conduct the NNT discovery on the ground. Thirdly, this paper builds a testbed with real network devices and meanwhile interconnect that testbed with real Internet, to validate that RS-TDS can discover NNT immediately with the less on-board overhead compared with optimized routing schemes. Finally, different network scenarios are applied to validate the WPM-TD, i.e., the core module of TDS-IRS. Extensive experiments show WPM-TD can work efficiently, avoiding the invalid NNT discovery and decreasing 20% ~ 57% of potential topology changes, which can also improve up to 47% ~ 105% of network throughput.
基金supported by the National Science Foundation for Distinguished Young Scholars of China under Grant No.61225012 and No.71325002the Specialized Research Fund of the Doctoral Program of Higher Education for the Priority Development Areas under Grant No.20120042130003the Liaoning BaiQianWan Talents Program under Grant No.2013921068
文摘With the challenges brought by the expansion of network scale,as well as the diversity of the equipments and the complexity of network protocols,many self-configurable systems have been proposed combining formal specification and model finding techniques.In this paper,we pay more attention to formal specifications of network information,i.e.,exploring principles and algorithm to map network information(topology,devices and status,etc.) to Alloy specifications.We first model network information in relational form,which is easy to realize because of the structured feature of network information in nature.Then we map the relational data to Alloy specifications according to our novel data mapping principles and algorithm.Based on the transition of relational data,it is possible to automatically map network information to Alloy specifications.We evaluate our data mapping principles and algorithm by applying them to a practical application scenario.The results illustrate that we can find a model for the task within a tolerant time interval,which implies that our novel approach can convert relational data to Alloy specifications correctly and efficiently.
文摘Information-Centric Networking(ICN)is an emerging direction in Future Internet architecture research,gaining significant tractions among academia and industry.Aiming to replace the conventional host-to-host communication model by a data-centric model,ICN treats data content as the first class entity in network architecture.
基金supported in part by the National Key R&D Program of China under Grant No.2017YFB0801701the National Science Foundation of China under Grant No.61472213CERNET Innovation Project(NGII20160123)
文摘Software defined networking(SDN)has attracted significant attention from both academia and industry by its ability to reconfigure network devices with logically centralized applications.However,some critical security issues have also been introduced along with the benefits,which put an obstruction to the deployment of SDN.One root cause of these issues lies in the limited resources and capability of devices involved in the SDN architecture,especially the hardware switches lied in the data plane.In this paper,we analyze the vulnerability of SDN and present two kinds of SDN-targeted attacks:1)data-to-control plane saturation attack which exhausts resources of all SDN components,including control plane,data plane,and the in-between downlink channel and2)control plane reflection attack which only attacks the data plane and gets conducted in a more efficient and hidden way.Finally,we propose the corresponding defense frameworks to mitigate such attacks.
基金supported by the Hainan Provincial Natural Science Foundation of China(Grant No.620RC562)the Program of Hainan Association for Science and Technology Plans to Youth R&D Innovation(Grant No.QCXM201910)the National Natural Science Foundation of China(Grant No.61802092).
文摘Discrete mathematics studies the respective structures,laws and interrelationships of different discrete quantities,which has a wide range of applications in computer science and software engineering.It has the characteristics of research,practice and innovation.The teaching goals of the course of discrete mathematics include not only the understanding and mastery of knowledge,but also the study of methodology.However,current teaching mechanism has limitations in outdated course contents,rare real project examples and nonscientific scoring modes.This paper attempts to think about the course construction of discrete mathematics to improve the teaching effects and cultivate students’practical ability.
基金supported by the National Natural Science Foundation of China under Grant Nos.61602105 and 61572123China Postdoctoral Science Foundation under Grant Nos.2016M601323+1 种基金the Fundamental Research Funds for the Central Universities Project under Grant No.N150403007CERNET Innovation Project under Grant No.NGII20160126
文摘Configuration errors are proved to be the main reasons for network interruption and anomalies.Many researchers have paid their attention to configuration analysis and provisioning,but few works focus on understanding the configuration evolution.In this paper,we uncover the configuration evolution of an operational IP backbone based on the weekly reports gathered from January 2006 to January 2013.We find that rate limiting and launching routes for new customers are configured most frequently.In addition,we conduct an analysis of network failures and find that link failures are the main causes for network failures.We suggest that we should configure redundant links for the links which are easy to break down.At last,according to the analysis results,we illustrate how to provide semi-automated configuration for rate limiting and adding customers.
文摘Software-Defined Networking(SDN)is now considered as one of the promising future networking technologies,and this trend can be clearly verified by observing activities of both industry and academia.In industry,we can easily notice that many major
文摘Amajor recent development in computer networking is the emergence of Software Defined Networking(SDN),whose goal is to provide a centralized,programmable control plane that is decoupled from the distributed data planes on individual network devices.In particular,the development of OpenFlow has demonstrated many potential benefits of SDN,and multiple vendors have started to offer commercial switches supporting the OpenFlow standard.Researchers have also made progress on SDN components including SDN controllers,
基金supported by the National Hightech R&D Program ("863" Program) of China (No.2013AA013505)the National Science Foundation of China (No.61472213)
文摘Named-data Networking(NDN) is a promising future Internet architecture, which introduces some evolutionary elements into layer-3, e.g., consumer-driven communication, soft state on data forwarding plane and hop-byhop traffic control. And those elements ensure data holders to solely return the requested data within the lifetime of the request, instead of pushing data whenever needed and whatever it is. Despite the dispute on the advantages and their prices, this pattern requires data consumers to keep sending requests at the right moments for continuous data transmission, resulting in significant forwarding cost and sophisticated application design. In this paper, we propose Interest Set(IS) mechanism, which compresses a set of similar Interests into one request, and maintains a relative long-term data returning path with soft state and continuous feedback from upstream. In this way, IS relaxes the above requirement, and scales NDN data forwarding by reducing forwarded requests and soft states that are needed to retrieve a given set of data.
基金supported in part by the National Key R&D Program of China under Grant No.2017YFB0801701in part by the National Science Foundation of China under Grant No.61472213
文摘Software defined networking(SDN) has been applied increasingly in practical networks. Currently, SDN is mainly used to improvethe flexibility and efficiency of datacenter networks, enterprise networks and wide-area networks(WAN). There also emerge somestudies that try to deploy SDN to inter-domain settings. In this article, we introduce the progress stages of inter-domain SDN andstudies related to each stage. Finally, we discuss the applications and challenges of inter-domain SDN.
基金supported by National Natural Science Foundation of China(Grant No.NSFC61402257)National Basic Research Program of China(973 Program)(Grant Nos.2009CB320500+1 种基金2009CB320501)Tsinghua University Self-determined Project(No.2014z21051)
文摘In the design and construction process of Next Generation Internet, it is important to identify the source of each IP packet forwarding accurately, especially for the support of precise fine-grained management,control, traceability and improving the trustworthiness of the Internet. This paper designed a scalable Network Identity(NID) scheme for the Internet users, proposed NIDTGA(Network Identity and Time Generated Address), an IPv6 address generation algorithm embedded NID and time information, then designed and implemented an IPv6 address generation and traceback system based on NIDTGA. The design of NIDTGA, which reflects the length, time and owner attributes of the IP address, can be a good support to ADN(Address Driven Network). At the same time, by embedding the key elements of user identity and time in the IPv6 address,and by taking into account both the traceability and privacy, NIDTGA can provide a technical basis for the establishment of the network trust mechanism, and achieve the traceability of security event.
基金supported by the National Natural Science Foundation of China(Nos.61772307 and 61402257)Tsinghua University Self-determined Project(No.2014z21051)
文摘With the rapid developmen of the Internet, the exhaustion of IPv4 address limited the development of the Internet for years. IPv6, as the core technology of the next generation Internet, has since been rapidly deployed around the world. As the widely deployed address configuration protocol, DHCPv6 is responsible for allocating globally unique IPv6 addresses to clients, which is the basis for all the network services. However, the initial design of the DHCPv6 protocol gave little consideration to the privacy and security issues, which has led to a proliferation of privacy and security accidents breaches in its real deployment. In this paper, to fundamentally solve a range of possible security and privacy issues, we propose a secure DHCPv6 mechanism, which adds authentication and encryption mechanisms into the original DHCPv6 protocol. Compared with other proposed security mechanisms for the DHCPv6, our method can achieve all-around protection for the DHCPv6 protocol with minimal change to the current protocol, easier deployment, and low computing cost.
基金supported by National High-tech R&D Program("863" Program)of China
文摘This article introduces FINE(Future Internet iNnovation Environment) project,which is supported by National High-tech R&D Program( "863" Program) of China.
基金supportedin part by Sub-project "Mobile Internet Architecture and Key Technology Research" of National Core Electronic Devices,High-end Generic Chips and Basic Software (CHBS) Project "Development Strategy and Planning ofMobile Internet System Hardware and Software Technology and Service" under Grant No.2012ZX01039003Sub-project "IPv6 Application and Demonstration of Mobile Internet inCampus Environment" of National Sci-Tech Major Special Item Project "IPv6 Applicationand Demonstration of Mobile Internet" under Grant No. 2012ZX03002015-003A New Network Architecture:Address Driven Network Architecture and Technology Research and Development under Grant No. CNGI-12-03-001
文摘With the rapid development of wireless transmission technologies and the proliferation of mobile terminals, the mobile Internet has experienced exponential growth in recent years. However, at the same time, it is also facing more challenges, particularly regarding bandwidth, address space, security, mobility, and energy. In this article, we analyse the five abovementioned challenges and then survey related technology trends. We also describe the progress of architecture research aimed at the future mobile Internet. We reach the conclusion that a single technology cannot solve all the problems of mobile Internet, and future research should focus more on how to make architectures and technologies work together more effectively.
基金supported by the National Natural Science Foundation of China(Grant Nos.61822309,61773310&U1736205)
文摘As a typical representative of the so-called cyber-physical system,smart grid reveals its high efficiency,robustness and reliability compared with conventional power grid.However,due to the deep integration of electrical components and computinginformation in cyber space,smart grid is vulnerable to malicious attacks,especially for a type of attacks named false data injection attacks(FDIAs).FDIAs are capable of tampering meter measurements and affecting the results of state estimation stealthily,which severely threat the security of smart grid.Due to the significantinfluence of FDIAs on smart grid,the research related to FDIAs has received considerable attention over the past decade.This paper aims to summarize recent advances in FDIAs against smart grid state estimation,especially from the aspects of background materials,construction methods,detection and defense strategies.Moreover,future research directions are discussed and outlined by analyzing existing results.It is expected that through the review of FDIAs,the vulnerabilities of smart grid to malicious attacks can be further revealed and more attention can be devoted to the detection and defense of cyber-physical attacks against smart grid.