Application-level Gateways Research Articles

Gateway architectures for service oriented application-level gateways

In this paper we present lightweight and generic application level gateways for connecting service oriented sensor networks to service oriented standards in the consumer electronics domain. We study the trade-offs between interface richness, deployment granularity and overhead in discovery protocols and we present how the varying interaction patterns on both sides of the gateway can be efficiently mapped onto each other. As a result we obtain three different application-level gateways architectures. The analysis is kept concrete using the Open Service Architecture for Sensors and Universal Plug and Play (UPnP).

Tunneling Activities Detection Using Machine Learning Techniques

Tunnel establishment, like HTTPS tunnel or related ones, between a computer protected by a security gateway and a remote server located outside the protected network is the most effective way to bypass the network security policy. Indeed, a permitted protocol can be used to embed a forbidden one until the remote server. Therefore, if the resulting information flow is ciphered, security standard tools such as application level gateways (ALG), firewalls, intrusion detection system (IDS), do not detect this violation. In this paper, we describe a statistical analysis of ciphered flows that allows detection of the carried inner protocol. Regarding the deployed security policy, this technology could be added in security tools to detect forbidden protocols usages. In the defence domain, this technology could help preventing information leaks through side channels. At the end of this article, we present a tunnel detection tool architecture and the results obtained with our approach on a public database containing real data flows.

Cache memory design for Internet processors

As a result of the exploding bandwidth demand from the Internet, network router and switch designers are designing and fabricating a growing number of microchips specifically for networking devices rather than traditional computing applications. In particular, a new breed of microprocessors, called Internet processors, has emerged that is designed to efficiently execute network protocols on various types of internetworking devices including switches, routers, and application-level gateways. We evaluate a series of three progressively more aggressive routing-table cache designs and demonstrate that the incorporation of hardware caches into Internet processors, combined with efficient caching algorithms can significantly improve overall packet forwarding performance.

H [formula omitted] N [formula omitted]: Network support for scaling of large-scale services

With the explosive growth of demand for services on the Internet, the networking infrastructure (routers, protocols, servers) is under considerable stress. Mechanisms are needed for current and future IP services to scale in a client-transparent way. We present H YDRA N ET, an infrastructure that allows to dynamically distribute IP services by placing service agents (caching agents, mirrors, replicas) that are under the server's control at strategic points in the internetwork. H YDRA N ET is based on replicating transport-level service access points (TCP or UDP ports in the case of IP) for transparent distribution or replication of IP services. Measurements on a local testbed show that the overhead of our scheme is small. This form of service access point replication is widely applicable. We use H YDRA NET to implement H YDRA W EB, a system for Web server replication to realize intelligent, client-transparent, Web caching. Similarly, H YDRA N ET can be used to implement highly fault-tolerant servers or application-level gateways.

A family of design patterns for application-level gateways

A family of design patterns for application-level gateways

Network firewalls

Computer security is a hard problem. Security on networked computers is much harder. Firewalls (barriers between two networks), when used properly, can provide a significant increase in computer security. The authors classify firewalls into three main categories: packet filtering, circuit gateways, and application gateways. Commonly, more than one of these is used at the same time. Their examples and discussion relate to UNIX systems and programs. The majority of multiuser machines on the Internet run some version of the UNIX operating system. Most application-level gateways are implemented in UNIX. This is not to say that other operating systems are more secure; however, there are fewer of them on the Internet, and they are less popular as targets for that reason. But the principles and philosophy apply to network gateways built on other operating systems as well. Their focus is on the TCP/IP protocol suite, especially as used on the Internet. >