Ingress Router Research Articles

A lightweight deployment of TD routing based on SD-WANs

Multipath routing conforms to the evolution principle of network development and is a trend of routing architectures. It can not only meet the needs but also enhance the performance and security of a network. However, deploying multipath routing further increases the scale of the forwarding information base (FIB) and the cost of forwarding devices. Therefore, to realize the lightweight deployment of multipath routing with a distributed architecture, this paper takes two-dimensional routing (TD routing) as an example to provide a solution. We propose a distributed storage mechanism of TD routing in combination with SRv6 (TDSR) and the corresponding SRv6 header (SRH) compression (CARD) method. The main methods are as follows: Inspired by a software-defined wide area network (SD-WAN), this paper introduces segment routing (SR) in the data plane, which can disperse TD-FIBs in different ingress nodes. The ingress routers push path information into the stack, and the intermediate routers forward the packets according to the SRH. Second, for the bandwidth waste of the SRH, compression is attempted by comparing the difference between the the shortest path first (SPF) path and the SRv6 path. Only a few hops in the TD path that are different from those in the one-dimensional (OD) path are kept. Finally, we sort out several typical application scenes of multipath routing and discuss several simplification algorithms. The experimental results show that the TDSR can reduce TD entries by 69%, and the average compression rate of CARD can reach 70%. In addition, CARD can be combined with existing methods to improve their effect.

An Adaptive Hierarchical Hybrid Multicast Based on Information-Centric Networking

Many information-centric services have emerged, such as IPTV and video conferencing. These services put a lot of demands on scalable multicast communication. However, traditional IP multicast has low adoption because of its poor scalability. Therefore, some stateless multicast methods were proposed, which encapsulate the destination’s information into the packet header without requiring routers to maintain the multicast forwarding state. However, stateless multicast also faces some problems, such as ingress router overload, high forwarding overhead, packet redundancy, etc. In addition, most multicast methods cannot optimize the multicast tree because the multicast flow is simply forwarded along the shortest path tree from the source to receivers. This paper proposes an Adaptive Hierarchical Hybrid Multicast (AHHM) based on Information-Centric Networking. To balance the forwarding states and forwarding overhead, AHHM is designed as a two-layer structure, in which the upper layer establishes a stateful main tree and the lower layer establishes several stateless sub trees. The router on the main tree is defined as the multicast join node (MJN), and AHHM uses the Name Resolution System to maintain the mapping between each multicast group name and corresponding MJNs. To optimize the multicast transmission path, we designed the minimum cost selection strategy for users to select the appropriate MJN to join. Simulation results show that compared with Source-Specific Multicast (SSM) and Bit Index Explicit Replication (BIER), AHHM can not only reduce the multicast forwarding states but also reduce the control overhead and link load.

Hybrid Approach for IP Traceback Analysis in Wireless Networks

Distributed Denial-Of-Service (DDoS) attacks are one of the all the more difficult security issues on the Internet today. They can without much of a stretch, fumes the assets of the potential Victims. The issue is much more extreme since the aggressors regularly produce their IP delivers to shroud their character. The current guard mechanism against DDoS attacks, the attack traffic will be filtered at the victim’s side. For this situation, regardless of whether the attacking traffic is filtered by the victim, the attacker may achieve the objective of blocking access to the victim’s bandwidth. IP-Traceback approaches enable the victim to traceback to the wellspring of an attack and they will not be able to minimize the attack when the attack is in progress. Hence in this work we proposed a hybrid method to minimize the quantity of malicious packets entering into the network. We introduce a quantum annealing technique at the server side to identify and mitigate the DDoS attack. The attack messages are minimized by utilizing client puzzle as a part of the ingress router; the path fingerprint is used at the egress side. Simulation studies prove that the proposed mechanism is optimally successful in recognizing and mitigating the DDoS attacks.

Feasible DDoS attack source traceback scheme by deterministic multiple packet marking mechanism

A main purpose of network security is to secure the system and its element parts from illegal access and misuse. Distributed denial of service (DDoS) attack is a crucial risk to the internet. A source traceback is a technology to control each and every computer crime. A feasible DDoS attack source traceback technique based on marking on demand (MOD) scheme is proposed to detect computer attack by using multiple packets for marking coding. In this proposed scheme, the MOD scheme is based on the deterministic multiple packet marking mechanism. Depending upon this finding, the proposed technique basically addresses the scalability issue of existing deterministic packet marking-based traceback schemes and perhaps to traceback to the individual cooperated computers more willingly than the present defined routers of attacking computers. Also, this technique is used to identify the malicious users who form the volume of traffic necessary to reject a service to computer user. To traceback the engaged attack source, there is a need to mark these engaged ingress routers by deterministic multiple packet marking mechanism. Simultaneously, the MOD server reports information of the marks and their connected requesting IP addresses. Once DDoS attack is proved, the victim will acquire attack sources through requesting MOD server by marks refined from attack packets. The confirmed DDoS attack is identified when it is higher than the tested threshold value. In this study, a mathematical model is established to prove the efficiency of the proposed source traceback technique in both real-world experiments and theoretical analysis. Extensive real-world experiments and theoretical analysis show that the proposed technique is efficient and feasible.

A Review on Various DPM Traceback Schemes to Detect DDoS Attacks

Objectives: Network security deals with the various attacks, in which distributed denial of service (DDoS) is a kind of attacks are thriving every day in networks. The specified users of node or theirs network information’s are hidden by Denial of Service (DoS) attack. The aim is to detect the source of attack using improved marking schemes. Method: The nodes and networks are very often affected by the Distributed Denial of Service attack (DDoS) from the category of DoS attack. The affected path of DDoS attacks are identified by various IP trace back schemes. Packet marking approach is one type to detect the source of attack from the identified node. Finding: PPM and DPM techniques were used to detect the DDoS attack but the performance should be improved in both marking scheme. In DPM marking process done by ingress router to avoid marking process in subsequent egress router. Further DPM is improved with hash functions which is also an overloaded in router. MOD server concepts are used to increase the scalability using Dynamic DPM approach. Improvement: To reduce the trace back mechanism procedure and to concern about the memory requirement using Enhanced DPM and DADPM method is considered when detecting the source of attack from the victim node.

PALS: Saving Network Power With Low Overhead to ISPs and Applications

Power saving in the network infrastructure has received great attention in recent years. Power-aware traffic management is proposed in many works, in which a subset of routers/links are preferentially used to carry traffic while other links are activated only when traffic load is high. However, it remains challenging how to minimize the overhead to both ISPs and applications, which is important to the successful deployment of power-aware traffic management in a real network. This paper presents PALS, a new Power-Aware Link State routing based traffic management protocol. Compared with previous solutions, PALS remarkably reduces the overheads to ISPs and applications by the following innovations. First, PALS minimizes the forwarding table expansion due to dynamic power-aware routing, by using destination based routing instead of pairwise routing (e.g., MPLS). Second, PALS limits packet reordering for applications, by never splitting traffic between an IE (ingress-egress) router pair to multiple paths. Third, PALS significantly reduces the computation complexity of the power-aware routing algorithm, by running a simple path selection algorithm at each ingress router with the knowledge of local traffic information as well as global link utilization, which are much easier to obtain than global traffic matrix required by the state-of-the-art solutions (e.g., Zhang , IEEE ICNP 2010). Extensive simulations and testbed experiments show that, although bearing the simplicities to minimize the overhead, PALS saves satisfactory network power, with quick response to traffic variance and negligible impact on the packet delivery performance for applications.

A Feasible IP Traceback Framework through Dynamic Deterministic Packet Marking

DDoS attack source traceback is an open and challenging problem. Deterministic packet marking (DPM) is a simple and effective traceback mechanism, but the current DPM based traceback schemes are not practical due to their scalability constraint. We noticed a factor that only a limited number of computers and routers are involved in an attack session. Therefore, we only need to mark these involved nodes for traceback purpose, rather than marking every node of the Internet as the existing schemes doing. Based on this finding, we propose a novel marking on demand (MOD) traceback scheme based on the DPM mechanism. In order to traceback to involved attack source, what we need to do is to mark these involved ingress routers using the traditional DPM strategy. Similar to existing schemes, we require participated routers to install a traffic monitor. When a monitor notices a surge of suspicious network flows, it will request a unique mark from a globally shared MOD server, and mark the suspicious flows with the unique marks. At the same time, the MOD server records the information of the marks and their related requesting IP addresses. Once a DDoS attack is confirmed, the victim can obtain the attack sources by requesting the MOD server with the marks extracted from attack packets. Moreover, we use the marking space in a round-robin style, which essentially addresses the scalability problem of the existing DPM based traceback schemes. We establish a mathematical model for the proposed traceback scheme, and thoroughly analyze the system. Theoretical analysis and extensive real-world data experiments demonstrate that the proposed traceback method is feasible and effective.

Common Protection Path: Novel MPLS-based Recovery using Path Failure Probability and Service Criticality

Background/Objectives: Existing one-to-one, dedicated path-based and link-based MPLS-based recovery schemes are not resource efficient. We propose Common Protection Path, a novel protection scheme which ensures efficient utilization of resources. Methods/Statistical Analysis: Common Protection Path (CPP) selects a common protection path for traffic demands having the same ingress and egress routers. CPP factors in path failure probability and restoration priority levels of the traffic demands, unlike other schemes. We validated CPP algorithm using ns-2, over realistic network topology COST 239 with different link capacities. We compared CPP with one-to-one, dedicated path-based, link-based schemes and our modification of UNIFR (RFNS) i.e. UNIFR-similar. Findings: Our results show that using CPP scheme, more working bandwidth can be protected and more number of demands can be protected as compared to dedicated path-based, oneto- one, link-based and UNIFR-similar schemes. Our experimental results show that depending on the link capacity and the scheme taken for comparison, CPP provides up to 7.72% to 93.63% higher protection for COST 239 topology. Also with respect to restoration overbuild per Gbps protected bandwidth, CPP scheme is better as compared to other schemes. Applications/Improvements: Our results show that the CPP scheme results in efficient utilization of resources.

A novel framework to mitigate the negative impacts of green techniques on BGP

Green networking techniques usually shut down the least utilized links and/or routers during off-peaks hours. In a prior work, we showed conclusively that these actions trigger what is known as hot-potato routing changes. These changes are well known to negatively impact the operation of the Border Gateway Protocol (BGP). Critically, they may cause packet loss due to slow BGP convergence and increased congestion. In order to overcome such negative impacts, in this paper, we propose a novel framework that allows Ingress Routers (IRs) to work collaboratively to determine the set of links that should be carrying their respective traffic to Egress Routers (ERs). IRs exchange information about their established paths with each other, and each IR determines whether to shift their existing paths to ERs to optimize a given objective, e.g., energy savings. The IRs repeat the process until convergence. Unused links are then shut down, and thereby, lowering the energy consumption rate of a network. In this framework, we study a number of key issues: first, we study the order in which IRs establish paths, namely (i) most savings, (ii) round robin, and (iii) random order. Our results show that similar performance is achieved regardless of employed method. However, in some cases, IRs that establish paths using round robin took up to 23% more time to converge than IRs that used the most savings method. Second, we study path selection metrics. In particular, IRs select paths according to (i) shortest path, where paths with the minimum number of hops are selected, (ii) longest path, where paths with the largest number of hops are preferred, and (iii) random, where paths are randomly selected. Our experimental results over five topologies show that using shortest paths is the most efficient where IRs use as little as 25% more active links than a global optimal solution. However, IRs establishing paths in a robin manner are able to utilize 5% fewer number of links than when they employ the shortest path to each ER.

A Network Management System for Handling Scientific Data Flows

Large scientific data transfers often occur at high rates causing increased burstiness in Internet traffic. To limit the adverse effects of these high-rate large-sized flows, which are referred to as $$\alpha $$? flows, on delay-sensitive audio/video flows, a network management system called Alpha Flow Traffic Engineering System (AFTES) is proposed for intra-domain traffic engineering. An offline approach is used in which AFTES analyzes NetFlow records collected by routers, extracts source---destination address prefixes of $$\alpha $$? flows, and uses these prefixes to configure firewall filters at ingress routers of a provider's network to redirect future $$\alpha $$? flows to traffic-engineered paths and isolated queues. The effectiveness of this scheme was evaluated through an analysis of 7 months of NetFlow data obtained from an ESnet router. For this data set, 91 % of bytes generated by $$\alpha $$? flows during high-rate intervals would have been directed had AFTES been deployed. The negative aspect of using address prefixes in firewall filters, i.e., the redirection of $$\beta $$β flows to $$\alpha $$?-flow paths/queues, was also quantified.

Advanced multicast class-based bandwidth over-provisioning

Dynamic bandwidth aggregate over-provisioning has been proposed to provide differentiated services with scalable Quality of Service (QoS) control. Previous research showed that efficient over-reservation control allows minimizing QoS control overhead with reduced waste of bandwidth and blocking probability. However, existing over-reservation centric solutions are still inefficient in the face of network dynamics, as they are not able to accommodate the dynamic service demands, thus failing to optimize the bandwidth usage. This paper proposes a new Advanced Class-based resource Over-Reservation (ACOR) solution for multicast sessions, which seeks increased network resources utilization while minimizing QoS control overhead. More specifically, ACOR is able to dynamically update the share of bandwidth between different classes of service, providing improved results with less complexity than current solutions. Our analytical and simulation results prove the cost-effective and scalable QoS control capabilities of ACOR in decentralized networks with multiple distributed ingress routers coordinating the QoS control.

Easing Congestion in Computer Networks using the Receiver-Window Modification (RWM) Scheme

Random Early Detection (RED), Adaptive RED (ARED), BLUE and other Active Queue Management (AQM) queues have been proposed to replace drop-tail queues for Transmission Control Protocol/Internet Protocol (TCP/IP) networks to ease network congestion. Together with the Exp licit Congestion Notification (ECN) scheme, they had shown some pro mise over the drop tail queues. However, the timeout mechanism or the duration of the reception of three duplicate acknowledgements (ACKs), due to early-dropped packets, delays the response time of TCP in reducing the network congestion. Moreover, using ECN has its downsides: i) its messages may get lost; and ii) TCP implementations at the source, router and the destination have to be ECN-co mpliant (which presents a significant problem in today's implementations). To minimize these problems, this paper presents a novel AQM modification scheme called Receiver-W indow Modification (RWM), wh ich can be used together with any AQM queue for congestion avoidance in packet switched networks, especially at ingress and gateway routers. RWM improves on the average queue sizes, one-way end-to-end packet delays, delay jitter, throughput and number of dropped packets. It also overcomes the dependency of these AQM queues on the queues of downstream routers since ECN messages may get dropped or delayed due to congestion at these routers. We carry out extensive NS2 simulat ions to show our results and to support our claims.

에너지 절약을 위해 적응적 버퍼링 기법을 이용한 버스트 구성 방법 및 특성

This paper analyses the energy saving basic power models in core IP networks, and proposes the adaptive buffer and burst scheme which is a possible energy saving method, and its implementation algorithm in core IP networks. Especially this paper describes the adaptive buffer and burst scheme dynamically varying the buffering interval B according to the input traffic volume of ingress router, and explains the operation principle of proposed scheme. This method is to adjust the buffering interval B according to input traffic volume of ingress router, that is increasing the interval B when input traffic volume is low, and decreasing the interval B when input traffic volume is high between some given interval regions. This method can gets the high energy saving effect as decreasing the transition number of idle/active in networks when input traffic volume is low, and decreasing the transition number of idle/active by the continuous of burst packets in transit router when input traffic volume is high. This paper shows the increasing of asleep rate for the energy saving of core IP networks and confirms the energy saving of core IP networks by the computer simulation. We confirmed that proposed method can be save the energy of IP networks by properly trade off network performances.

Combining quality of services path first routing and admission control to support VoIP traffic

Existing interactive communication applications, like VoIP, are designed to manage losses and delay in real IP networks. We present a novel call admission control for VoIP based on blocking percentage calculation (BPC). Blocking rates were measured carrying VoIP for every router across the source–destination path. Ingress router selects the optimal path for the new request by calculating blocking rates across all source–destination paths. The proposed scheme dynamically adjusts the admission threshold to guarantee the voice quality of each flow. A simple algorithm design and evaluation results show that the proposed scheme is effective to achieve high utilization of network resources, while satisfying end-to-end targets in terms of blocking rate, delay, packet loss rate and fairness.

Novel optical packet switching scheme using OFDM label with one core router and two edge routers

In this paper, we propose and experimentally demonstrate a novel optical packet switching scheme with one core router and two edge routers, in which an orthogonal frequency division multiplexing (OFDM) signal is generated as a label. In this experiment there are two transmission spans, each span consists of 50-km SMF-28 and an erbium-doped optical fiber amplifier (EDFA) without dispersion management. A 10Gb/s on-off keying (OOK) optical payload and a 2.5Gb/s OFDM optical label are generated, encapsulated, and transmitted in the first span. And then old label is replaced by new label, the generated new optical packet after transmission over the second span is detached and detected. The transmission performance of the optical label and payload is experimentally investigated at the ingress router, core router and egress router.

Topology-assisted deterministic packet marking for IP traceback

A novel deterministic packet marking (DPM) for IP traceback against denial of service (DoS) and distributed denial of service (DDoS) attacks is presented, which features good scalability and high accuracy. In this scheme, an ingress router pre-calculates a Hash of its IP address and splits the Hash into several fragments. When marking a packet, the router randomly selects a fragment to mark into the packet. In the traceback stage the victim identifies the marked router with the help of the map of its upstream routers. Based on the map, the victim can identify a candidate ingress router after receiving only several marked packets. The scheme overcomes defects in previous deterministic packet marking schemes, where too much packets are required to recover a router and high false positive rate occurs in case of large-scale DDoS. Theoretical analysis, the pseudo code and experimental results are provided. The scheme is proved to be accurate and efficient and can handle large-scale DDoS attacks.

Flow Controlling of Access at Edge Routers

It is very important to allocate and manage resources for multimedia type of data traffic flows with real-time performance requirements in order to guarantee quality-of-service (QoS). In this paper, we develop a scalable architecture and an algorithm for access control of real-time flows. Since individual management of each traffic flow on each transit router can cause a fundamental scalability problem in both data and control planes, we consider that each flow is classified at the ingress router and data flow is aggregated according to the class inside the core network as in a DiffServ framework. In our approach, access decision is made for each flow at the edge routers, but it is scalable because per-flow states are not maintained and the access algorithm is simple. In the proposed access control scheme, an admissible bandwidth, which is defined as the maximum rate of a flow that can be accommodated additionally while satisfying the delay performance requirements for both existing and new flows, is calculated based on the available bandwidth measured by edge routers. The admissible bandwidth is a entry for access control, and thus, it is very important to accurately estimate the acceptable bandwidth. The performance of the proposed algorithm is evaluated by taking a set of simulation experiments using bursty traffic flows.

Performing Admission Control Concurrently in Core-stateless Networks

In this paper we propose a concurrent admission control scheme for the QoS sensitivity traffic in core-stateless networks. In this scheme, the ingress router of core-stateless network domain is capable of performing admissibility test in concurrent for requests by per-assigning core-link resource to each edge routers. Then, we introduce a novel two phase token passing mechanism to adaptively optimize the proportion of bandwidth dividing among contending edge routers according to the dynamic of their traffic. In addition, we adopt a measurement based admission decisionmaking criterion to gain the benefit of high utilization of statistical multiplexing. Our simulation results are very promising indicating that even under very high request load it is possible to perform admission control and resource allocation in concurrent without suffering in terms of response time, packet loss rate, or utilization.

A Virtualized Network Architecture for Improving QoS

Recently, researches have shown that today's best-effort Internet with one fits all principle comes to an impasse. Addressed to the different QoS requirements of today's network services, we propose a new network architecture based on network virtualization technology for improving Internet QoS. It divides a thick network into multiple thin virtual networks deploying on the same substrate, each is customized with a special designing goal and runs a customized protocol. Then the traffic with different QoS requirements is classified at the ingress router, and distributed to different virtual networks, which are the most suitable for carrying the special traffic. Also, we can deploy a service on multiple virtual networks, and making them working collaboratively to achieve a better QoS. To verify this idea, a prototype is implemented in LAN-scale network. By some simply designed experiments for comparison, we observe that, by use of our network architecture, service provider with specific QoS requirement can take its choice to choose appropriate virtual networks to achieve better QoS performance.

MPLS security: an approach for unicast and multicast environments

Multi-Protocol Label Switching (MPLS) network architecture does not protect the confidentiality of data transmitted. This paper proposes a mechanism to enhance the security in MPLS networks by using multi-path routing combined with a modified (k, n) threshold secret sharing scheme. An Internet Protocol (IP) packet entering MPLS ingress router can be partitioned into n shadow (share) packets, which are then assigned to maximally node disjoint paths across the MPLS network. The egress router at the end will be able to reconstruct the original IP packet if it receives any k share packets. The attacker must therefore tap at least k paths to be able to reconstruct the original IP packet that is being transmitted, while receiving k − 1 or less of share packets makes it hard or even impossible to reconstruct the original IP packet. In this paper, we consider the multicast case in addition to the unicast. To our best knowledge, no work has been published for MPLS multicast security. We have implemented our model and measured its time complexity on variable packets size.