IP网络安全多播控制机制的设计与实现

多播的安全问题不单单只包括多播分组数据的安全性。利用多播的安全隐患发起拒绝服务攻击现象在网络环境中越来越多。多播的安全隐患根源是多播的开放组模式。通过研究现有多播控制协议的安全问题，总结恶意攻击的特性并提出一种多播安全控制的解决方案，用于缓解多播安全漏洞对多播传输造成的危害。该方案可以使网络管理员按照网络应用的具体要求有效的控制和管理多播分组。并且在Linux平台下实现了该方案。     

一种新的逐跳TCP友好的主动分层多播拥塞控制方案

基于Internet的多媒体多播应用的迅猛发展对多播拥塞控制提出了要求.分层多播是适应网络异构性较有效的方案.针对现有分层多播存在的问题,将主动网技术思想引入到分层多播拥塞控制中,提出了一种逐跳TCP友好的主动分层多播拥塞控制方案(HTLMA),采用主动标记分层、逐跳探测TCP友好可用带宽,以及主动速率控制机制.仿真实验表明,HTLMA方案大大改进了分层多播拥塞控制的性能,具有较快的拥塞响应速度、较好的稳定性和TCP友好特性.     

多播同步协作的动态安全机制

分析了多播同步协作应用的安全问题,提出了一种比较实用的安全机制方案。并据此实现了一个多播视频会议的安全管理模块。     

基于身份的空间网络组密钥管理方案

针对现有组密钥管理方案无法适应空间网络的问题,提出了一种基于身份的空间网络组密钥管理方案.方案设置了一个由卫星节点组成的多播服务节点集合,协助多播群组完成公共参数的生成和广播,解决了组成员开销不平衡的问题;为同一群组提供服务的节点动态可变,避免了单点失效问题.与现有方案相比,本方案在满足安全要求的基础上,具有更小的计算、存储和通信开销.     

对DVB—RCS安全多播的改进

讨论了DVB-RCS标准的安全规范,并针对现有规范在多播安全性上的缺陷,提出了改进方案.通过扩展MKE,QKE和EKE消息发送密钥改进发送与更新多播密钥方案,达到了提供安全的多播卫星服务的目的.     

光网络中的一种基于虚拟源的动态多播保护算法

随着各种多播业务的不断出现,如何在网络的光层实现多播业务的可靠性传输已成为光网络研究中的一个热点问题,而多播保护算法是这一问题的核心.目前多播保护算法的研究都是在假设网络所有节点具有多播功能的条件下进行的,然而由于成本的限制,实际光网络往往是一个稀疏多播光网络,即网络中只有部分节点具有多播功能.针对这一问题,提出了一种基于虚拟源的动态多播保护算法.仿真结果表明:该算法不仅能在稀疏多播光网络中满足多播业务可靠传输的要求,还具有较高的网络资源的利用率和较低的时间复杂度.     

一种基于时间结构树的多播密钥管理方案

随着Internet的发展,多播通信技术得到了广泛的应用.其中组密钥管理是多播安全的核心问题.文中在分析已有研究的基础上,提出了一种基于时间结构树的密钥管理方案,采用周期性的密钥更新机制,通过安全滤波器分配新的组密钥,大大减少了密钥更新时的传输消息,提高了密钥更新的效率,实现密钥更新的可靠性.     

支持多播的基于SIP的PTT服务器设计

PTT业务是近年来研究的一个热点,它将逐步成为人们生产、生活不可缺少的部分。本文结合现代通信技术的发展趋势,提出和设计了基于PC机和IP多播通信方式的PTT服务器方案,并将SIP协议作为呼叫控制信令,其中着重研究了IGMP多播协议在通信传输中的应用。     

一种多播拥塞控制中速率的调节机制

本文针对计算机高速互联网中多播流的速率调节问题,在单点对多点的多播流量模型基础上,提出了一种由发送方驱动的单速率多播拥塞控制器的设计方法。并且运用现代控制理论和方法,讨论如何利用基于多播的单速率拥塞控制方法来对多播发送节点的发送速率进行调节,从而使得发送节点的发送速率趋于稳定。对所提出的拥塞控制方案,本文进行了分类仿真,仿真结果显示,控制方案使网络性能表现良好。     

一种多播密钥管理方案

随着Internet的发展,多播通信技术得到了迅速发展.其中组密钥管理是我播安全的核心问题.文中在分析已有研究的基础上,对树型密钥管理方案进行了改进,经过与逻辑密钥分层LKH方案和单向函数OFT方案进行分析比较,它在密钥存储、密钥更新通信量以及管理者的计算量方面元气有较好的性能.     

MPLS VPN组播的研究与仿真

对MPLS VPN特有的组播问题进行了分析和研究,比较了现有各种组播实现方案的优缺点.在此基础上,提出了一种改进的MPLS VPN组播实现方法--组播域显式组播路由法.最后进行了仿真,验证了改进方案的可行性、实用性和优越性.     

PIMac: Multicast Access Control Implementation in PIM-SM

In this paper, we present an access control scheme for PIM-SM multicast domain. In order to avoid the overhead of digital signature algorithm, the proposed solution makes use of the Rendezvous Point to collect keys and implement a distributed shared-key based multicast access control system. As it supplies efficient host access control in PIM-SM domain, we name this scheme PIMac. Compared with the existing multicast admission control solutions, PIMac has following advantages: (1) support both receiver and sender access control; (2) realize host exclusion based on expire time; (3) compatibility with current PIM-SM protocol; (4) lower join latency; (5) anti-replay and DoS robustness; last but not least, (6) PIMac architecture is divided into two separated domains: AAA domain and multicast routing domain, entities in each domain do not rely on PKI interoperability or common secret to authenticate each other. The experimental results show that PIMac achieves flexible manageability and improves the performance of multicast access control systems effectively.     

Multilayer multicast congestion control in satellite environments

It is well known that long and variable link delays, link errors, and handoffs in satellite environments seriously interfere with transmission control protocol's (TCP's) congestion control mechanisms. These channel characteristics also adversely affect existing multilayer multicast congestion control schemes when they are used in satellite environments. In addition, these schemes still have problems with fairly sharing bandwidth with TCP flows, controlling the overhead of frequent grafting and pruning, and handling misbehaving receivers. In this paper, we present a new multilayer multicast congestion control scheme that is suitable for satellite environments and overcomes most of the disadvantages of existing schemes. Our scheme is not affected by the long and variable delays of satellite links. Link errors also do not decrease the performance of our scheme. Further, our scheme has very limited control overhead. In addition to these advantages specific to satellite environments, our scheme achieves good fairness in sharing bandwidth with TCP sessions and is not sensitive to misbehaving receivers.     

OMAC: A new access control architecture for overlay multicast communications

Multicast communications concern the transfer of data among multiple users. Multicast communications can be provided at the network layer—an example is IP multicast—or at the application layer, also called overlay multicast. An important issue in multicast communications is to control how different users—senders, receivers, and delivery nodes—access the transmitted data as well as the network resources. Many researchers have proposed solutions addressing access control in IP multicast. However, little attention has been paid to overlay multicast. In this paper, we investigate the access control issues in overlay multicast and present OMAC: a new solution to address these issues. OMAC provides access control for senders, receivers, and delivery nodes in overlay multicast. The proposed architecture, which is based on symmetric key cryptosystem, centralizes the authentication process in one server whereas it distributes the authorization process among the delivery nodes. Moreover, delivery nodes are utilized as a buffer zone between end systems and the authentication server, making it less exposed to malicious end systems. To evaluate our work, we have used simulation to compare the performance of OMAC against previous solutions. Results of the simulation show that OMAC outperforms previous multicast access control schemes. Copyright © 2010 John Wiley & Sons, Ltd.     

The Impact of Loss Recovery on Congestion Control for Reliable Multicast

Most existing reliable multicast congestion control (RMCC) mechanisms try to emulate TCP congestion control behaviors for achieving TCP-compatibility. However, different loss recovery mechanisms employed in reliable multicast protocols, especially NAK-based retransmission and local loss recovery mechanisms, may lead to different behaviors and performance of congestion control. As a result, reliable multicast flows might be identified and treated as non-TCP-friendly by routers in the network. It is essential to understand those influences and take them into account in the development and deployment of reliable multicast services. In this paper, we study the influences comprehensively through analysis, modelling and simulations. We demonstrate that NAK-based retransmission and/or local loss recovery mechanisms are much more robust and efficient in recovering from single or multiple packet losses within a single round-trip time (RTT). For a better understanding on the impact of loss recovery on RMCC, we derive expressions for steady-state throughput of NAK-based RMCC schemes, which clearly brings out the throughput advantages of NAK-based RMCC over TCP Reno. We also show that timeout effects have little impact on shaping the performance of NAK-based RMCC schemes except for extremely high loss rates (>0.2). Finally, we use simulations to validate our findings and show that local loss recovery may further increase the throughput and deteriorate the fairness properties of NAK-based RMCC schemes. These findings and insights could provide useful recommendations for the design, testing and deployment of reliable multicast protocols and services     

A study of multicast congestion control for UMTS

In this paper, we study the applicability of multicast congestion control over universal mobile telecommunications system (UMTS) networks. We analyze two well‐known multicast congestion control schemes for fixed networks, namely TCP‐friendly multicast congestion control and pragmatic general multicast congestion control. We investigate their behavior when they are employed in UMTS networks and we analyze the problems arose when these mechanisms are applied over the wireless links of the UMTS terrestrial radio‐access network. Additionally, we propose necessary improvements to these legacy schemes and explain the necessity of these modifications. The proposed schemes are implemented in the ns‐2 network simulator and are evaluated under various network conditions and topologies. Finally, we measure the performance of the proposed modified schemes and compare them with the corresponding legacy mechanisms. Copyright © 2009 John Wiley & Sons, Ltd.     

Minimum-cost multicast over coded packet networks

We consider the problem of establishing minimum-cost multicast connections over coded packet networks, i.e., packet networks where the contents of outgoing packets are arbitrary, causal functions of the contents of received packets. We consider both wireline and wireless packet networks as well as both static multicast (where membership of the multicast group remains constant for the duration of the connection) and dynamic multicast (where membership of the multicast group changes in time, with nodes joining and leaving the group). For static multicast, we reduce the problem to a polynomial-time solvable optimization problem, and we present decentralized algorithms for solving it. These algorithms, when coupled with existing decentralized schemes for constructing network codes, yield a fully decentralized approach for achieving minimum-cost multicast. By contrast, establishing minimum-cost static multicast connections over routed packet networks is a very difficult problem even using centralized computation, except in the special cases of unicast and broadcast connections. For dynamic multicast, we reduce the problem to a dynamic programming problem and apply the theory of dynamic programming to suggest how it may be solved.     

A scalable multicast key management scheme for heterogeneous wireless networks

Secure multicast applications require key management that provides access control. In wireless networks, where the error rate is high and the bandwidth is limited, the design of key management schemes should place emphasis on reducing the communication burden associated with key updating. A communication-efficient class of key management schemes is those that employ a tree hierarchy. However, these tree-based key management schemes do not exploit issues related to the delivery of keying information that provide opportunities to further reduce the communication burden of rekeying. In this paper, we propose a method for designing multicast key management trees that match the network topology. The proposed key management scheme localizes the transmission of keying information and significantly reduces the communication burden of rekeying. Further, in mobile wireless applications, the issue of user handoff between base stations may cause user relocation on the key management tree. We address the problem of user handoff by proposing an efficient handoff scheme for our topology-matching key management trees. The proposed scheme also addresses the heterogeneity of the network. For multicast applications containing several thousands of users, simulations indicate a 55%-80% reduction in the communication cost compared to key trees that are independent of the network topology. Analysis and simulations also show that the communication cost of the proposed topology-matching key management tree scales better than topology-independent trees as the size of multicast group grows.     

Achieving inter-session fairness for layered video multicast

The Internet is increasingly used to deliver multimedia services. Since there are heterogeneous receivers and changing network conditions, it has been proposed to use adaptive rate control techniques such as layered video multicast to adjust the video traffic according to the available Internet resources. A problem of layered video multicast is that it is unable to provide fair bandwidth sharing between competing video sessions. We propose two schemes, layered video multicast with congestion sensitivity and adaptive join-timer (LVMCA) and layered video multicast with priority dropping (LVMPD), to achieve inter-session fairness for layered video multicast. Receiver-driven layered multicast (RLM), layer-based congestion sensitivity, LVMCA, and LVMPD are simulated and compared. Results show both proposed schemes, especially LVMPD, are fairer and have shorter convergence time than the other two schemes.     

基于最优化的多媒体多播速率控制

传输多媒体流的一种有效方法是采用多速率多播,但多速率多播的速率控制面临许多挑战,如异构性、公平性、实时性及服务质量(QoS)等。提出了一种两阶段优化的策略进行多媒体多播速率控制。把问题公式化为求系统效用最大化的最优化问题,推导出有效的算法。方法综合考虑了服务质量、异构性等,且满足协议间的公平性和多播会晤内各接收者间的公平性。仿真实验表明算法的有效性,与现有的算法相比系统总效用大大提高。