Secure Tunnel Research Articles

Architecture for MPLS L3 VPN Deployment in Service Provider Network

Now a days in Service Provider’s core network we do not use IP forwarding rather we go for MPLS because it gives more efficient switching of packets. MPLS is the combination of layer-3 routing and layer-2 switching because every network prefix is assigned a particular Label. In this paper I am going to do testing and implement scalability over MPLS L3 VPN. This testing and implementation are to proof the scalability is the one important thing when design MPLS L3 VPN technology. This Topology of MPLS L3 VPN also provides the secure tunnel between two customer sites. By this implementation we show that there is a transparent tunneling over SP network. We are also avoiding the BGP implementation In SP core. So we call it as BGP free core. This implementation also saves the routing table space on provider routers. We have used the concept of Route Reflector (RR) to avoid more BGP sessions and to make it more scalable.

A Policy Based Management of a Smart Adaptive QoS for the Dynamic and Multipoint Virtual Private Network

The IP Virtual Private Network technology is increasingly being used due to its efficiency in terms of cost, its availability and its high security level, companies deploy multiple secure tunnels and send through them different traffics, in order to guaranty a reliable level of communication and the availability of resources, many qualities of service’s policies must be defined. According to our research, most of works treat only the problematic of the Quality of Service management in a site to site Virtual Private Network, this was an incentive for us to: design and implement a new model of a smart adaptive quality of service management for the dynamic and multipoint Virtual Private Network, and create a new friendly-user web application to facilitate the quality of service management for such complex networks. This paper discusses a new model for the policy-based management of a smart adaptive quality of service for the Dynamic and Multipoint Virtual Private Network using a new WEB interface.

Design of Mobile Gateway for Implementation of Smart Work System

In the development of new technologies based on mobile system, there is a growing interest as a fundamental technology. In particular, in order to realize a mobile office and mobile phones, conferencing remote document is a technique that can realize smart network services solutions with enhanced real-time communication, real-time information sharing, and collaboration. Therefore, in this paper, the design meets the diverse needs of customers and the smart work platform mobile-based fast and conveniently it is trying to develop. For this reason, I have developed a mobile gateway that is based on the communication server construction OPEN API development, management of mobile ID, protocol design, and design of SSL/TLS security tunnel. Also, we developed a smart work platform that you apply this, you are trying to provide information systems environment of mobile company.

A research for accuracy of infrared computer navigation in arthroscopic anterior cruciate ligament reconstruction bone tunnel positioning of assisted

Objective To explore the accuracy and feasibility of infrared computer navigation for femur, tibia tunnel posi-tioning in arthroscopic anterior cruciate ligament (ACL) reconstruction. Methods Data of patients who had undergone ACL reconstruction using infrared computer navigation from January 2012 to June 2013 were retrospectively analyzed. There were 26 males and 9 females, with an average age of 26.8 years old. 35 patients were with concomitant meniscal injury 21 cases, and 3 cases with medial collateral ligament injury. All patients were treated with gracilis and semitendinosus knit stitch as grafts, and bone ends were made with hydroxyapatite extrusion screws, door-shaped nails and porous plate. Results The mean follow-up time was 16 months. The rate of postoperative femoral tunnel site measurements was 63.8%±6.6%, and tibial tunnel site measurements was 45.7%±4.2%. 1 patient appeared heterotopic ossification in tibia tracker pinhole 3 months after surgery, and the joint activities was normal. Lachman test: there were 1 case with II degree, 30 with III degree, and 4 with IV degree before operation, and 33 with I degree, 1 with II degree, 1 with III degree after operation. The KT-1000 test was from 6.47±0.75 mm preoperatively to 1.01±1.14 mm postoperatively. Preoperative knee laxity differences was more than 5 mm in 32 cases, 3-5 mm in 3, and after operation they were 0-3 mm in 31, 3-5 mm in 2, and less that 0 mm in 2 cases. Lysholm score and Tegner scores were from preoperative 52.74± 10.91 points and 4.64±1.34 points to postoperative 93.97±4.13 and 6.56±0.81 points. ROM was from 85.6°±11.2° to 118.3°±5.7°; 33 cases were without flexion and extension limited; two cases had knee flexion, extension limitation less than 10°. After straight leg raising training and proprioception functional training for 6 months, the knee ROM returned to normal. Conclusion Infrared computer assisted navigation system for arthroscopic ACL reconstruction is to navigate through the use of anatomical landmarks and kinematic data, kinematic data by detecting and recording the knee, selected a secure tunnel site, viable surgical method, you can make femur, tibia tunnel position more accurately, good curative effect evaluation. Key words: Anterior cruciate ligament reconstruction; Knee joint; Arthroscopy; Surgery, computer-assisted

Seamless Mobility Management Schemes for IPv6-based Wireless Networks

Mobility management is one major challenge for wireless network design. Advanced wireless technologies provide mobile nodes with multi-mode radio interfaces, so subscribers can benefit from disparate mobile communication systems. Meanwhile, researchers are putting efforts into standardization of IPv6-based mobility protocols. Hence, wireless networks can offer more flexible mobility support than ever before. However, as the demands for high-speed Internet access and multimedia services increase, guaranteeing host mobility with quality of service provisioning becomes more difficult. Both network connectivity and session continuity need to be carefully handled during handover. This paper proposes a new mobility protocol, called seamless mobile IPv6 (SMIPv6). Its novelty consists of pre-configuring bidirectional secure tunnels among access routers before handoff, as well as using such tunnels to guarantee handoff seamlessness. To evaluate the performance, simulations are conducted using OPNET Modeler v.12.0, of which results demonstrate that SMIPv6 delivers better performance than MIPv6 in terms of handoff latency and packet losses.

The Solution and Management of VPN Based IPSec Technology

The rapid development of electronic businesses raises the need for exchanging information between enterprise networks via internet. If a secure connection is necessary then a virtual private network (VPN) is essential. IPSec use encrypting and encapsulating technology in client device and establishes a secure tunnel connection. The private network built by IPSec technology can ensure good transmission performance and service quality over public networks. This paper analyses the architecture of IPSec and describes the process of creating a site-to-site IPSec VPN between header and branch of enterprise over internet. In addition, this study analyses the encryption at the boundary of the network and concludes a propose some practical problems need to consider inside enterprise network.

Trusted License Distribution System Based on IPSec VPN for Mobile DRM

With the rapid development of mobile applications, DRM systems used for mobile terminals and wireless environment become popular. However, the present DRM schemes are not fit for mobile applications because of the new security problems in wireless environment and the limitations of mobile terminals. In this paper, a trusted license distribution system based on IPSec VPN and its correlative issues are presented. This system supports DRM clients to build IPSec VPN connection based on trusted authentication with DRM license server, and obtains license through secure tunnel. Implementation and testing indicate that the security and efficiency of the proposed scheme can reach the requirement of the mobile DRM.

Study on secure tunnel in the fixation of talar neck fracture based on digital technology

Objective To investigate the establishment of secure tunnel in fixation for the talar neck fracture when screws were fixed from the medial wall of talus.Methods The age of volunteers was limited from 20 to 60 years old,and the height of male volunteers was from 165 to 185 centimeters,while the female volunteers' height was from 155 to 175 centimeters.The body mass index (BMI) was less than 25.The volunteers who were not heavy manual workers or standing working for long time had no history of ankle or foot fractures,and there were no evidence of degeneration changes in ankle joints according to X-ray.At last there were 33 males in this study with an average age of 43.7 (21-59) years and an average height of 176.0 (168-184) centimeters.There were 22 females with an average age of 43.2 (22-60) years and an average height of 165.4 (158-172) centimeters.After the volunteers' ankle joints and feet were scanned by CT,the reconstructed images were stored in CD and the slice thickness was 0.75 millimeters.The SuperImageTM Orthopedics Edition1.1 software was used to display the images and perform three dimensional reconstruction.The height of talar neck and the height of tarsal canal were measured.The models that screws passing into tarsal canals were built.The maximal length and angle that screws were inserted in the middle 1/3 and in the inferior 1/3 of medial wall of talus and run along to two directions were measured.At last,the data were analyzed with SPSS 13.0 software.Results The height of talar neck and tarsal canal had no significant difference between left side and right side in the same gender.The height of male talar neck was greater than the female' s.The models of screws passing into tarsal canals was gained.The length and angle in different insert points and different directions of screw fixation were also gained.When the screws were inserted from the middle 1/ 3 of the medial wall of talus,the angle of screw fixation was much wider than that when the screws were inserted from the inferior 1/ 3 of the medial wall of talus.At last,the safe range of the length and angel of screw fixation was calculated.Conclusion Damage of the blood of talus during internal fixation should be avoided.The middle 1/3 of the medial wall of talus is the most favourable choice to the fixation.Combining the digital technology with internal fixation for talar neck fracture could promote the operation' s security and feasibility. Key words: Talus; Fractures, bone; Internal Fixators; Computers, analog

Improved IPSec tunnel establishment for 3GPP–WLAN interworking

SummaryInterworking between wireless local area network (WLAN) and the 3rd Generation Partnership Project (3GPP) such as Long Term Evolution (LTE) is facing more and more problems linked to security threats. Securing this interworking is a major challenge because of the vastly different architectures used within each network. Therefore, security is one of the major technical concerns in wireless networks that include measures such as authentication and encryption. Among the major challenges in the interworking security is the securing of the network layer. The goal of this article is twofold. First, we propose a new scheme to secure 3GPP LTE–WLAN interworking by the establishment of an improved IP Security tunnel between them. The proposed solution combines the Internet Key Exchange (IKEv2) with the Host Identity Protocol (HIP) to set up a security association based on two parameters, which are location and identity. Our novel scheme, which is called HIP_IKEv2, guarantees better security properties than each protocol used alone. Second, we benefit from Mobile Internet Key Exchange protocol (MOBIKE) in case of mobility events (handover). And we extend HIP_IKEv2 to HIP_MOBIKEv2 protocol in order to reduce the authentication signaling traffic. The proposed solution reinforces authentication, eliminates man‐in‐the‐middle attack, reduces denial‐of‐service attack, assures the integrity of messages, and secures against reply attack. Finally, our proposed solution has been modeled and verified using the Automated Validation of Internet Security Protocols and Applications and the Security Protocol Animator, which has proved its security when an intruder is present. Copyright © 2014 John Wiley & Sons, Ltd.

DynTunKey: a dynamic distributed group key tunneling management protocol for heterogeneous wireless sensor networks

Wireless sensor networks (WSNs) are being used for many applications ranging from mobile target surveillance to intelligent home networking. Due to the sensitive nature of the data transmitted by these applications, appropriate protection mechanisms are needed to prevent attackers from exploiting the weaknesses of the radio links. In this paper, we propose a novel group key management scheme called DynTunKey (dynamic tunneling and group key management protocol). This paper investigates the use of secure tunnels as a solution to improve the protection of WSNs. We propose a tunneling scheme that conforms to the security requirements of WSNs while having less computational and network overhead. We also propose a solution for a dynamic integration in the secured communication of a newly deployed sensor. A set of experiments has been conducted to assess the performance of the proposed scheme with regard to recent key management protocol and to traditional tunnels built using the IPSec protocol. We found that our protocol considerably reduces the number of transmitted messages as well as the computational load, which makes it suitable for WSNs. We tested the proposed protocol considering two models of mobility of the targets which are respectively the Random Walk model and the Gauss Markov model.

Robust and flexible tunnel management for secure private cloud

Private cloud is cloud infrastructure operated solely for a single organization, whether managed internally or by a third-party and hosted internally or externally. It provides a flexible way to extend the working environment. Since the business process that working on them could be critical, it is important to provide a secure environment for organizations to execute those processes. While user mobility has become an important feature for many systems, technologies that provide users a lower cost and flexible way in joining a secure private cloud are in a strong demand. This paper exploits the key management mechanisms to have secured tunnels with private cloud for users who might move around dynamically without carrying the same machine. A strong authentication with a key agreement scheme is proposed to establish the secure tunnel. Furthermore, the proposed framework also provides mutual authentication, session key renewal between the users and the cloud server. Several related security properties of the proposed mechanism are also presented.

Secure Communication Process between Two Versions of Internet Protocols

The Network performance optimization, configuration depends on proper design of complete network. The network layer is concerned with getting packets from source all the way to destination. The packets may cross many networks to reach the destination. To achieve its goals, the network layer must know about the topology, communication subnets and the version of the IP addresses used. Considering the present scenario, we are using IP v4 which needs to communicate with IP v6. The present networks are using only IP version 4 it is necessary to design and deploy certain methods which will help in communicating with the future generation of IP addresses. The present applications are still using IP version 4 to communicate and hence it is necessary to securely migrate them with the latest IP version. We present a secure tunneling mechanism that has some advantages over the other models. The model discussed here can be used to establish hybrid communications between the two different versions of Internet protocol in both ways.

Device-based Isolation for Securing Cryptographic Keys

We describe an effective device-based isolation approach for achieving data security. We show its use in protecting the secrecy of highly sensitive data that is crucial to security operations, such as cryptographic keys used for decrypting ciphertext or signing digital signatures. Private key is usually encrypted in its storage when not used; however, when being used, the plaintext key is loaded into the memory of the host for access. We present a novel and practical solution and its prototype called DataGuard to protect the secrecy of the highly sensitive data through the storage isolation and secure tunneling enabled by a mobile handheld device. DataGuard can be deployed for the key protection of individuals or organizations. We implement three prototypes and conduct extensive experiments to evaluate the feasibility and performance of DataGuard. The results show that our approach performs well without significant overhead.

Principle and verification of novel optical virtual private networks over multiprotocol label switching/optical packet switching networks

A novel realization method of the optical virtual private networks (OVPN) over multiprotocol label switching/optical packet switching (MPLS/OPS) networks is proposed. In this scheme, the introduction of MPLS control plane makes OVPN over OPS networks more reliable and easier; OVPN makes use of the concept of high reconfiguration of light-paths offered by MPLS, to set up secure tunnels of high bandwidth across intelligent OPS networks. Through resource management, the signal mechanism, connection control, and the architecture of the creation and maintenance of OVPN are efficiently realized. We also present an OVPN architecture with two traffic priorities, which is used to analyze the capacity, throughput, delay time of the proposed networks, and the packet loss rate performance of the OVPN over MPLS/OPS networks based on full mesh topology. The results validate the applicability of such reliable connectivity to high quality services in the OVPN over MPLS/OPS networks. Along with the results, the feasibility of the approach as the basis for the next generation networks is demonstrated and discussed.

LOT

We present LOT, a lightweight plug and play secure tunneling protocol deployed at network gateways. Two communicating gateways, A and B, running LOT would automatically detect each other and establish an efficient tunnel, securing communication between them. LOT tunnels allow A to discard spoofed packets that specify source addresses in B’s network and vice versa. This helps to mitigate many attacks, including DNS poisoning, network scans, and most notably (Distributed) Denial of Service (DoS). LOT tunnels provide several additional defenses against DoS attacks. Specifically, since packets received from LOT-protected networks cannot be spoofed, LOT gateways implement quotas, identifying and blocking packet floods from specific networks. Furthermore, a receiving LOT gateway (e.g., B) can send the quota assigned to each tunnel to the peer gateway (A), which can then enforce near-source quotas, reducing waste and congestion by filtering excessive traffic before it leaves the source network. Similarly, LOT tunnels facilitate near-source filtering, where the sending gateway discards packets based on filtering rules defined by the destination gateway. LOT gateways also implement an intergateway congestion detection mechanism, allowing sending gateways to detect when their packets get dropped before reaching the destination gateway and to perform appropriate near-source filtering to block the congesting traffic; this helps against DoS attacks on the backbone connecting the two gateways. LOT is practical: it is easy to manage (plug and play, requires no coordination between gateways), deployed incrementally at edge gateways (not at hosts and core routers), and has negligible overhead in terms of bandwidth and processing, as we validate experimentally. LOT storage requirements are also modest.

A LabVIEW-Based Soundcard Interface for E-Laboratory

Abstract The purpose of this paper is to present a way to develop a technical e-laboratory for students interested in their continuing training. It presents hardware and software aspects regarding design of a LabVIEW-Based Soundcard Interface for E-Laboratory. To realize an e-learning laboratory we used web publishing tool from LabVIEW and the connection between server and remote computer is realized with a VPN software to pass through any router or a NAT device and realise a secure tunnel between remote computers and LabVIEW web-server. Also, the web publishing tool from LabVIEW allows concurrent access from different remote computers to e-laboratory. For example paper offers a LabVIEW application for acquisition and generation of signals using the sound card.

Bilateral cuffed tunnelled femoral dialysis catheters

Dialysis access remains the “Achilles heel” of maintenance hemodialysis. When candidate vessels have been exhausted in pursuit of fashioning native vascular access, alternative vessels are used. With recurrent catheter deployment, venous stenoses develop and render candidate veins unsuitable for catheter reception. We present a neat and novel solution for clinical practice in dealing with unexpected cases. A 68-year-old female, with end-stage renal disease secondary to diabetic nephropathy had been receiving hemodialysis for 4 years. Her past medical history comprised: peripheral arterial disease with resultant bilateral above the knee amputation and iliac artery endovascular stenting; essential hypertension; lifelong tobacco consumption. She had no candidate vessels for venous catheter placement, other than small caliber femoral veins. A decision was made to insert two smaller, more flexible 10 French catheters into bilateral femoral veins to allow better venous reception and more secure tunneling. This takes into account our experience with the use of larger, less supple catheters and the acute angles involved with typically tunneling upwards through the lower abdominal fascia. The patient was keen to continue dialysis and accepted the enhanced risk (two tunnels) of bilateral lower limb venous thrombosis and bacteremia. We present this interesting image Figure 1 (abdominal X-ray), demonstrating bilateral cuffed tunneled femoral dialysis access; concurrent vascular ectopic calcification and the presence of a left iliac stent. We understand this to be, the first medical image in the world literature of bilateral cuffed femoral dialysis catheters in situ – an unlikely clinical situation. Figure 1 Abdominal X-ray.

A Cross Layer Spoofing Detection Mechanism for Multimedia Communication Services

The convergence of different network types under the same architecture offers the opportunity for low cost multimedia services. The main objective has been the high quality of the provided services. However, considering that older equipment with limited processing capabilities may be present in such environments, a tradeoff between security and service quality is inevitable. Specifically, low resource enabled devices cannot utilize state of the art security mechanisms, such as IPSec tunnels, integrity mechanisms, etc., and they simply employ HTTP Digest authentication. The lack of integrity mechanisms in particular raises many security concerns for the IMS infrastructures. Attacks such as Man in the Middle (MitM), spoofing, masquerading, and replay that can be launched in IMS environments, have been pinpointed in bibliography by various researchers. Moreover, an internal attacker may utilize his legitimate security tunnels in order to launch spoofing and identity theft attacks. This paper presents a cross-layer spoofing detection mechanism that protects SIP-based infrastructures from the majority of the aforementioned attacks without requiring an additional cryptographic scheme which would inevitably introduce considerable overheads.

Driving Simulator Research on Safe Highway Design and Operation

With increasing traffic demands and various attempts to get maximum performance out of the road traffic system, the driving task is becoming more and more complex, and the more important it is to consider the human factor in highway design and operation. Successful introduction of new driver support systems, dynamic traffic management systems, or complex road designs depends strongly on how people are able and willing to cope with these developments. Knowledge is needed on how people behave and perform in complex and dynamic task environments. Following a brief description of available driving simulator facilities at TNO in the Netherlands, this paper presents research on human behavior that makes use of advanced human-in-the-loop driving simulators for highway design and operation. A study on the acceptable length of contraflow systems in work zones revealed that a 3–1 contraflow system with a 2.75-m lane width would be acceptable up to 8 km in length. For the Westerschelde tunnel in the Netherlands, a traffic management evacuation scheme of diverting left lanes is much more effective than stopping all traffic in the secure tunnel tube. Given a speed limit of 80 km/h, a 5.4-m-wide single-lane tunnel tube is an acceptable solution, but drivers prefer a wider cross section (6.5 m). Lane departure warning assistant systems improve truck driving behavior on narrow lanes, but at a cost of more strenuous driving. These examples clearly illustrate the added value of driving simulator research for safe and efficient highway design and operation.

Routing, security, resource management, and monitoring in ad hoc networks: Implementation and integration

In this paper we present the implementation and integration of core network functions, including routing, security, resource management, and network monitoring that are critical to the efficient operation of a mobile ad hoc network (MANET). The integration of the aforementioned functionalities enables them to support one another, forming a cohesive system. We design and implement a new ad hoc routing protocol that can relay connectivity, link quality, or any other information that is globally available to the underlying routing mechanism and use such information to improve routing decisions. Our implementation of resource management and topology control utilizes the connectivity information from the routing protocol to derive topologies that consume less energy and cause less interference. Our key management solution supports IPsec deployment and establishes secure paths enabling secure information propagation for routing and topology control messages, as well as for application data. Moreover, it provides an integrated trust component that can guide trust decisions among nodes in a network. To debug and monitor these core functionalities we implement both centralized and decentralized network monitoring solutions, which in turn extract and display information, such as connectivity and secure tunnels, from our security, routing, and topology control solutions. Routing, security, and monitoring mechanisms support concurrent use of IPv6 and IPv4 addresses. We briefly describe each component of the solution and discuss the integration of these components into a unified system to support mobile nodes. We describe experiments conducted on a wireless ad hoc network testbed and thus illustrate the interaction between the various technologies. Concluding, we discuss lessons learned and how we make available our implementations to enable further experimentation by the wireless network research community.