Multi-domain Environment Research Articles

Secure access control in multidomain environments and formal analysis of model specifications

Distributed multiple organizations interact with each other. If the domains employ role-based access control, one method for interaction between domains is role-mapping. However, it may violate constraints in the domains such as role hierarchy, separation of duty, and cardinality. Therefore, autonomy of the domains is lost. This paper proposes secure interoperation in multidomain environments. For this purpose, a cross-domain is created by foreign permission assignment. In an effort to maintain the autonomy of every domain, several rules are defined formally. Then, a decentralized scheme is used to provide permission mapping between domains. At the next stage, the proposed cross-domain is specified using Alloy, the first logic language. Subsequently, validity of the rules is analyzed through Alloy analyzer.

A Stochastic Analytical Modeling Framework on ISP–P2P Collaborations in Multidomain Environments

Cooperation between peer-to-peer (P2P) overlays and underlying networks has been proposed as an effective approach to improve the efficiency of both the applications and the underlying networks. However, fundamental characteristics with respect to Internet service providers (ISP) business relationships and inter-ISP routing information are not sufficiently investigated in the context of collaborative ISP–P2P paradigms in multidomain environments. In this paper, we focus on such issues and develop an analytical modeling framework for analyzing optimized interdomain peer selection schemes concerning ISP policies, with the main purpose of mitigating cross-ISP traffic and enhancing service quality of end users. In addition, we introduce an advanced hybrid scheme for peer selections based on the proposed analytical theory framework, in accordance with practical network scenarios, wherein cooperative and noncooperative behaviors coexisting. Numerical results show that the proposed scheme incorporating ISP policies is able to achieve desirable network efficiency as well as great service quality for P2P users. Our analytical modeling framework can be used as a guide for analyzing and evaluating future network-aware P2P peer selection paradigms in general multidomain scenarios.

Cyclic Generative Neural Networks for Improved Face Recognition in Nonstandard Domains

A system of methods for improving the quality of face recognition from infrared images is described. For testing the recognition algorithm in a multidomain environment, a database of ordinary and infrared face images is collected. An algorithm based on cyclic generative neural networks is developed. This algorithm makes it possible to transform images from the color domain into the infrared domain, which significantly increases the size of the training sample. It is shown that fine-tuning the recognition algorithm using the generated infrared images improves the recognition result on the test sample.

Intelligent conversation system using multiple classification ripple down rules and conversational context

We introduce an extension to Multiple Classification Ripple Down Rules (MCRDR), called Contextual MCRDR (C-MCRDR). We apply C-MCRDR knowledge-base systems (KBS) to the Textual Question Answering (TQA) and Natural Language Interface to Databases (NLIDB) paradigms in restricted domains as a type of spoken dialog system (SDS) or conversational agent (CA). C-MCRDR implicitly maintains topical conversational context, and intra-dialog context is retained allowing explicit referencing in KB rule conditions and classifications. To facilitate NLIDB, post-inference C-MCRDR classifications can include generic query referencing – query specificity is achieved by the binding of pre-identified context. In contrast to other scripted, or syntactically complex systems, the KB of the live system can easily be maintained courtesy of the RDR knowledge engineering approach. For evaluation, we applied this system to a pedagogical domain that uses a production database for the generation of offline course-related documents. Our system complemented the domain by providing a spoken or textual question-answering alternative for undergraduates based on the same production database. The developed system incorporates a speech-enabled chatbot interface via Automatic Speech Recognition (ASR) and experimental results from a live, integrated feedback rating system showed significant user acceptance, indicating the approach is promising, feasible and further work is warranted. Evaluation of the prototype’s viability found the system responded appropriately for 80.3% of participant requests in the tested domain, and it responded inappropriately for 19.7% of requests due to incorrect dialog classifications (4.4%) or out of scope requests (15.3%). Although the semantic range of the evaluated domain was relatively shallow, we conjecture that the developed system is readily adoptable as a CA NLIDB tool in other more semantically-rich domains and it shows promise in single or multi-domain environments.

A Tiered Control Plane Model for Service Function Chaining Isolation

This article presents an architecture for encryption automation in interconnected Network Function Virtualization (NFV) domains. Current NFV implementations are designed for deployment within trusted domains, where overlay networks with static trusted links are utilized for enabling network security. Nevertheless, within a Service Function Chain (SFC), Virtual Network Function (VNF) flows cannot be isolated and end-to-end encrypted because each VNF requires direct access to the overall SFC data-flow. This restricts both end-users and Service Providers from enabling end-to-end security, and in extended VNF isolation within the SFC data traffic. Encrypting data flows on a per-flow basis results in an extensive amount of secure tunnels, which cannot scale efficiently in manual configurations. Additionally, creating secure data plane tunnels between NFV providers requires secure exchange of key parameters, and the establishment of an east–west control plane protocol. In this article, we present an architecture focusing on these two problems, investigating how overlay networks can be created, isolated, and secured dynamically. Accordingly, we propose an architecture for automated establishment of encrypted tunnels in NFV, which introduces a novel, tiered east–west communication channel between network controllers in a multi-domain environment.

Horizontal-based orchestration for multi-domain SFC in SDN/NFV-enabled satellite/terrestrial networks

It's promising to use Software-Defined Networking (SDN) and Network Functions Virtualization (NFV) to integrate satellite and terrestrial networks. To construct network service function chains in such a multi-domain environment, we propose a horizontal-based Multi-domain Service Function Chaining (Md-SFC) orchestration framework. In this framework, multi-domain orchestrators can coordinate with each other to guarantee the end-to-end service quality. Intra-domain orchestrators also coordinate SDN controllers and NFV management components to implement intra-domain service function chains. Based on this, we further propose a heuristic SFC mapping algorithm with a cooperative inter-domain path calculation method to map service function chains to infrastructures. In this method, master multi-domain orchestrator and intra-domain orchestrators coordinate to select proper inter-domain links. We compare the cooperative method with a naive uncooperative way that domains' topology information is provided to the master multi-domain orchestrator and it calculates the shortest inter-domain path between intra-domain service function chains directly. Simulation results demonstrate that our solution is feasible. It is able to construct end-to-end performance guaranteed service function chain by horizontal-based cooperation. The cooperative inter-domain path calculation method decreases the mapping load for the master orchestrator and gets the same end-to-end performance.

Data Sharing in a Technological-driven Research Environment

Analogous to the technological developments, research data is being produced at a higher rate than ever, making research data management a current scientific issue. In this context researchers are encouraged not only to disclose, but also actively manage their data, including data description, so others can benefit from it. Controlled vocabularies, ontologies and metadata schemas are examples of tools that can support researchers to communicate their work. This paper consists in an overview on how metadata can be a useful asset to improve data sharing between researchers, given the biodiversity domain as an example to illustrate this scenario. Being aware that institutions usually struggle to keep up with the demands of a fast-paced, multi-domain research environment it is arguable that researchers, if provided with tools that best fit their requirements, should play a central role in the research data management workflow.

Multilingual opinion mining on YouTube – A convolutional N-gram BiLSTM word embedding

Opinion mining in a multilingual and multi-domain environment as YouTube requires models to be robust across domains as well as languages, and not to rely on linguistic resources (e.g. syntactic parsers, POS-taggers, pre-defined dictionaries) which are not always available in many languages. In this work, we i) proposed a convolutional N-gram BiLSTM (CoNBiLSTM) word embedding which represents a word with semantic and contextual information in short and long distance periods; ii) applied CoNBiLSTM word embedding for predicting the type of a comment, its polarity sentiment (positive, neutral or negative) and whether the sentiment is directed toward the product or video; iii) evaluated the efficiency of our model on the SenTube dataset, which contains comments from two domains (i.e. automobile, tablet) and two languages (i.e. English, Italian). According to the experimental results, CoNBiLSTM generally outperforms the approach using SVM with shallow syntactic structures (STRUCT) – the current state-of-the-art sentiment analysis on the SenTube dataset. In addition, our model achieves more robustness across domains than the STRUCT (e.g. 7.47% of the difference in performance between the two domains for our model vs. 18.8% for the STRUCT)

RBACA: role-based access control architecture for multi-domain cloud environment

Cloud computing is an emerging area as a new arrangement of wide-area distributed computing. Sharing of resources and services over the network are heterogeneous, dynamic, and multi-domain. Security issue is also a serious problem in a cloud computing environment. Similarly, access control and authorisation are an important aspect of the security. The paper proposes a scalable access control architecture and authorisation, for cloud computing environment. A new access control architecture is proposed which is based on traditional access control, role-based access control (RBAC) model. The paper provides a flexible framework for policy announcement management approach for a multi-domain cloud environment. A policy language (XACML) is used for the demonstration of access control policies. This provides a general and standard provision of different resources and services.

Parallel Access Control Model in Cross-Domain Grid Computing Environment

Despite the various attractive features that grid computing has to offer, it has many great security challenges, such as access control. With the expansion of the network scale, a large number of authorization requests have to be treated; on the other hand, the multi-domain nature of grid computing generates difficult to manage questions about cross-domain access control, and a variety of solutions use the role mapping mechanism to allow collaborations between domains. But this mechanism gives a potential risk of violating consistency properties of domains. This article aims to address this issue and proposes a parallel access control model in cross-domain grid computing architecture to be more convenient to the security requirements of the multi-domain environment. Finally, as a proof of concept, the authors implement a cross-domain and parallel authorization simulator (CD-PAS) where experiments are done. The obtained results show that the proposed model is sensitive to the number of authorization requests. In addition, it can effectively reduce the execution time of access control mechanism.

"Real-time recommendations in a multi-domain environment" by Emanuel Lacic with Prateek Jain as coordinator

Emanuel Lacić is a Software Engineer and Scientific Researcher in the Social Computing division at the Know-Center. Additionally, he is a PhD student at the Interactive Systems & Data Science Institute of Graz University of Technology. He has a M.Sc. and B.Sc. in Software Engineering and Information Systems from the Faculty of Electrical Engineering and Computing at the University of Zagreb. His PhD focus is on real-time recommender systems in large-scale settings. Apart from that, his research is utilized in several industry and European-funded projects such as Learning Layers, AFEL or MoreGrasp. His main research interests are in the fields of Recommender Systems, Deep Learning, Information Retrieval, Big Data, as well as Social and Complex Network Analysis. For more information please see https://lacic.github.io/

Searching for discriminative words in multidimensional continuous feature space

Word feature vectors have been proven to improve many natural language processing tasks. With recent advances in unsupervised learning of these feature vectors, it became possible to train it with much more data, which also resulted in better quality of learned features. Since it learns joint probability of latent features of words, it has the advantage that we can train it without any prior knowledge about the goal task we want to solve. We aim to evaluate the universal applicability property of feature vectors, which has been already proven to hold for many standard NLP tasks like part-of-speech tagging or syntactic parsing. In our case, we want to understand the topical focus of text documents and design an efficient representation suitable for discriminating different topics. The discriminativeness can be evaluated adequately on text categorisation task. We propose a novel method to extract discriminative keywords from documents. We utilise word feature vectors to understand the relations between words better and also understand the latent topics which are discussed in the text and not mentioned directly but inferred logically. We also present a simple way to calculate document feature vectors out of extracted discriminative words. We evaluate our method on the four most popular datasets for text categorisation. We show how different discriminative metrics influence the overall results. We demonstrate the effectiveness of our approach by achieving state-of-the-art results on text categorisation task using just a small number of extracted keywords. We prove that word feature vectors can substantially improve the topical inference of documents’ meaning. We conclude that distributed representation of words can be used to build higher levels of abstraction as we demonstrate and build feature vectors of documents. Our method can help in any multi-domain environment to automatically extract discriminative keywords. It can be used to organise and search documents more efficiently.

Composability Verification of Multi-Service Workflows in a Policy-Driven Cloud Computing Environment

The emergence of cloud computing infrastructure and Semantic Web technologies has created unprecedented opportunities for composing large-scale business processes and workflow-based applications that span multiple organizational domains. A key challenge related to composition of such multi-organizational business processes and workflows is posed by the security and access control policies of the underlying organizational domains. In this paper, we propose a framework for verifying secure composability of distributed workflows in an autonomous multi-domain environment. The objective of workflow composability verification is to ensure that all the users or processes executing the designated workflow tasks conform to the time-dependent security policy specifications of all collaborating domains. A key aspect of such verification is to determine the time-dependent schedulability of distributed workflows, assumed to be invoked on a recurrent basis. We use a two-step approach for verifying secure workflow composability. In the first step, a distributed workflow is decomposed into domain-specific projected workflows and is verified for conformance with the respective domain's security and access control policy. In the second step, the cross-domain dependencies amongst the workflow tasks performed by different collaborating domains are verified.

Cost-Efficient Virtual Network Function Graph (vNFG) Provisioning in Multidomain Elastic Optical Networks

Acting as a promising technology to bring revolutionary changes to how the networks are architected, network function virtualization (NFV) leverages IT virtualization technologies to instantiate various types of virtual network functions (vNFs) flexibly and dynamically on commodity hardware, which can be easily found in a variety of NFV infrastructure points-of-presence, e.g., datacenters. In this paper, we investigate how to cost-effectively provision vNF graphs (vNFGs) with arbitrary topologies in a multidomain elastic optical network that consists of two domains, i.e., the private and public ones. We first formulate an integer linear programming (ILP) model with the objective to minimize the total resource cost of vNFG provisioning, and show that it can solve the problem exactly. With the ILP model, we analyze the complexity of the problem and prove that it is an $\mathcal {NP}$ -hard one. Then, we leverage the minimum $k$ -cut problem to design two time-efficient heuristics. The results from extensive simulations verify the performance of our proposed algorithms, and indicate that they can balance the IT and spectrum resource usages intelligently according to the resource price setting in multidomain environment.

Semantic Based Authorization Framework For Multi-Domain Collaborative Cloud Environments

Abstract: Currently, organizations are growing and continuously improving their services while reducing budget in a competitive market. This is achieved by reusing existing well designed and proved services delivered by third parties in the cloud. Additionally, multi- domain collaborative cloud environments are a promising approach that enables to build and deliver new adaptive, distributed and reliable services. In this case, the data interoperability, the process interoperability and the security open new challenges and issues. In this paper, we propose semantic-based decision making process and consistent with XACML architecture to deal with contextual access control in multi-domain collaborative cloud environments.

A Multidomain Survivable Virtual Network Mapping Algorithm

Although the existing networks are more often deployed in the multidomain environment, most of existing researches focus on single-domain networks and there are no appropriate solutions for the multidomain virtual network mapping problem. In fact, most studies assume that the underlying network can operate without any interruption. However, physical networks cannot ensure the normal provision of network services for external reasons and traditional single-domain networks have difficulties to meet user needs, especially for the high security requirements of the network transmission. In order to solve the above problems, this paper proposes a survivable virtual network mapping algorithm (IntD-GRC-SVNE) that implements multidomain mapping in network virtualization. IntD-GRC-SVNE maps the virtual communication networks onto different domain networks and provides backup resources for virtual links which improve the survivability of the special networks. Simulation results show that IntD-GRC-SVNE can not only improve the survivability of multidomain communications network but also render the network load more balanced and greatly improve the network acceptance rate due to employment of GRC (global resource capacity).

Controllable processing time policy in job shop manufacturing systems: design and evaluation by simulation modelling

The research proposed in this paper concerns the management of job-shop manufacturing systems with machines characterised by controllable process times. The process times are controlled by the selection of cutting speed. It has been developed a multi-domain simulation environment by ExtendSim package linked to the cutting parameters' database of the tools. Two combined simulation models have been developed. The first simulation model uses the cutting tool parameters to define the relation between the cutting speed and the waiting time of the parts in queue. The output of this model is the knowledge used by the control time policy. It is controlled the waiting time of the parts in each machine; based on the information provided by the first simulation model it is selected the cutting speed of the tools, and the process time is modified. The second simulation model is used to test the proposed policy. The numerical results highlight the benefit in terms of performance measures obtained.

Personalized recommender system based on friendship strength in social network services

The rapid growth of social network services has produced a considerable amount of data, called big social data. Big social data are helpful for improving personalized recommender systems because these enormous data have various characteristics. Therefore, many personalized recommender systems based on big social data have been proposed, in particular models that use people relationship information. However, most existing studies have provided recommendations on special purpose and single-domain SNS that have a set of users with similar tastes, such as MovieLens and Last.fm; nonetheless, they have considered closeness relation. In this paper, we introduce an appropriate measure to calculate the closeness between users in a social circle, namely, the friendship strength. Further, we propose a friendship strength-based personalized recommender system that recommends topics or interests users might have in order to analyze big social data, using Twitter in particular. The proposed measure provides precise recommendations in multi-domain environments that have various topics. We evaluated the proposed system using one month's Twitter data based on various evaluation metrics. Our experimental results show that our personalized recommender system outperforms the baseline systems, and friendship strength is of great importance in personalized recommendation.

A novel ID-based multi-domain handover protocol for mesh points in WMNs

Wireless mesh networks (WMNs) provide an efficient and flexible method to the field of wireless networking, but also bring many security issues. A mesh point may lose all of its available links during its movement. Thus, the mesh point needs to handover to a new mesh point in order to obtain access to the network again. For multi-domain WMNs, we proposed a new ID-based signcryption scheme and accordingly present a novel ID-based handover protocol for mesh points. The mutual authentication and key establishment of two mesh points which belong to different trust domains can be achieved by using a single one-round message exchange during the authentication phase. The authentication server is not involved in our handover authentication protocol so that mutual authentication can be completed directly by the mesh points. Meanwhile, the data transmitted between the two mesh points can be carried by the authentication messages. Moreover, there are no restrictions on the PKG system parameters in our proposed multi-domain ID-based signcryption scheme so our handover scheme can be easily applied to real WMNs circumstances. Security of the signcryption scheme is proved in the random oracle model. It shows that our protocol satisfies the basic security requirements and is resistant to existing attacks based on the security of the signcryption. The analysis of the performance demonstrates that the protocol is efficient and suitable for the multi-domain WMNs environment.

Protection Management for Guaranteed User-Driven Virtual Circuit Services in Dynamic Multi-domain Environments: Design Issues and Challenges

Fault management of virtualized network environments using user-driven network provisioning systems (NPSs) is crucial for guaranteeing seamless virtual network services irrespective of physical infrastructure impairment. The network service interface (NSI) of the Open Grid Forum reflects the need for a common standard management API for the reservation and provisioning of user-driven virtual circuits (VCs) across global networks. NSI-based NPSs (that is, network service agents) can be used to compose user-driven VCs for mission-critical applications in a dynamic multi-domain. In this article, we first attempt to outline the design issues and challenges faced when attempting to provide mission-critical applications using dynamic VCs with a protection that is both user-driven and trustworthy in a dynamic multi-domain environment, to motivate work in this area of research. We also survey representative works that address inter-domain VC protection and qualitatively evaluate them and current NSI against the issues and challenges.