网站可信标识架构与查验协议研究

高可信性是下一代互联网的重要特征,主要包括服务提供者可信、信息传输可信和终端用户可信,其中服务提供者的身份可信是构建可信网络的前提。为此,提出一种网站身份可信标识的体系结构,描述基于域名资源记录的网站可信标识查验协议。通过该协议,用户可在各种互联网应用中方便地查询服务提供者的身份信息。实验结果表明,该体系结构与相关查询协议在效率、易用性、可扩展性等方面均可满足实际应用需要,单机查询性能达到15万次／s。     

Developing reusable simulation core code for networking: The grid resource discovery example

In this work, first, we present a grid resource discovery protocol that discovers computing resources without the need for resource brokers to track existing resource providers. The protocol uses a scoring mechanism to aggregate and rank resource provider assets and Internet router data tables (called grid routing tables) for storage and retrieval of the assets. Then, we discuss the simulation framework used to model the protocol and the results of the experimentation. The simulator utilizes a simulation engine core that can be reused for other network protocol simulators considering time management, event distribution, and a simulated network infrastructure. The techniques for constructing the simulation core code using C++/CLR are also presented in this paper.     

多媒体会议系统的发言控制协议研究

在多媒体会议中,参与成员需要协调由谁获得向会议发送数据权力,这就是发言权控制。发言权控制是会议控制的一个重要内容,它直接关系到会议的服务质量。文中通过分析发言权控制的典型交互行为,设计了通用发言权控制协议（GFCP）并采用概率CSP加以形式化描述,验证了协议的逻辑正确性和稳定性,同时,该文还在协议实现框架中讨论了GFCP的公平性和缩放性等问题,给出了相应的解决方案。     

纯IPv6网络环境下的应用互通技术研究

在向下一代互联网的转换中,使用户能够无感知地使用 IPv6 是一个理想的目标,而这需要网络运营商、网络内容提供商、网络设备提供商、终端厂商、互联网应用公司五方的共同合作。本研究聚焦于互联网过渡到纯 IPv6 环境下用户工作的情况,从过渡技术及相关机制、访问场景、应用需求等方面对纯 IPv6 网络应用互通进行了初步的理论性研究。在中国科技网网络环境中,构建了一个能与 IPv4 网络应用互通的纯 IPv6 实验网络环境,对不同访问机制下的主流互联网络商业应用进行测试和评价,验证了我们的研究结论的有效性。     

Coordinated load management in Peer-to-Peer coupled federated grid systems

This paper proposes a coordinated load management protocol for Peer-to-Peer?(P2P) coupled federated Grid systems. The participants in the system, such as the resource providers and the consumers who belong to multiple control domains, work together to enable a coordinated federation. The coordinated load management protocol embeds a logical spatial index over a Distributed Hash Table?(DHT) space for efficient management of the coordination objects; the DHT-based space serves as a kind of decentralized blackboard system. We show that our coordination protocol has a message complexity that is logarithmic to the number of nodes in the system, which is significantly better than existing broadcast based coordination protocols. The proposed load management protocol can be applied for efficiently coordinating resource brokering services of distributed computing systems such as grids and PlanetLab. Resource brokering services are the main components that control the way applications are scheduled, managed and allocated in a distributed, heterogeneous, and dynamic Grid computing environments. Existing Grid resource brokers, e-Science application work-flow schedulers, operate in tandem but still lack a coordination mechanism that can lead to efficient application schedules across distributed resources. Further, lack of coordination exacerbates the utilization of various resources (such as computing cycles and network bandwidth). The feasibility of the proposed coordinated load management protocol is studied through extensive simulations.     

End-to-End Resource Management for Federated Delivery of Multimedia Services

Recently, the Internet has become a popular platform for the delivery of multimedia content. Currently, multimedia services are either offered by Over-the-top (OTT) providers or by access ISPs over a managed IP network. As OTT providers offer their content across the best-effort Internet, they cannot offer any Quality of Service (QoS) guarantees to their users. On the other hand, users of managed multimedia services are limited to the relatively small selection of content offered by their own ISP. This article presents a framework that combines the advantages of both existing approaches, by dynamically setting up federations between the stakeholders involved in the content delivery process. Specifically, the framework provides an automated mechanism to set up end-to-end federations for QoS-aware delivery of multimedia content across the Internet. QoS contracts are automatically negotiated between the content provider, its customers, and the intermediary network domains. Additionally, a federated resource reservation algorithm is presented, which allows the framework to identify the optimal set of stakeholders and resources to include within a federation. Its goal is to minimize delivery costs for the content provider, while satisfying customer QoS requirements. Moreover, the presented framework allows intermediary storage sites to be included in these federations, supporting on-the-fly deployment of content caches along the delivery paths. The algorithm was thoroughly evaluated in order to validate our approach and assess the merits of including intermediary storage sites. The results clearly show the benefits of our method, with delivery cost reductions of up to 80 % in the evaluated scenario.     

Internet服务管理技术综述

1 服务与服务的分类经常提到服务这个概念,那么到底什么是服务呢?文[1]对服务进行了定义:服务就是服务提供方向一个或多个所服务的用户提供的一组实际能力。为研究之便,我们将服务分成两类:一类是传输服务,另一类是应用服务。这两种服务并不完全独立,它们是相互依存的,其中传输服务是应用服务的基础与保证,而应用服务是对传输服务的一种增值与体现。应用     

A conceptual model of service customization and its implementation

With the development of Internet and next generation networks in telecommunications, more and more new services are required to be introduced into networks. Introducing new services into traditional network is always associated with standardizing new protocols. The progress of protocol standardization usually takes several years, which cannot meet the increasing demands of the applications in Internet and next generation networks. Service customization in network systems may be one possible solution to cope with this problem. Based on the principle that network service is provided by interactions among protocol entities, this paper proposes a conceptual model of service customization (SECUM) by separating the service logic from protocol interactive logic within existing network architecture. The theory of Communicating Sequential Processes (CSP) is used to formalize the SECUM in order to locate exactly the service logic and to define precisely the SECUM. For validating the SECUM‘s usability in practical network systems, this paper also proposes an implementation model for SECUM: a component-based protocol implementation model (CPIM). CPIM discomposes protocol entity into application component, service component, message component and communication component. Service component associates application component with message component. Users or network managers can customize network services by configuring service component. The paper shows respectively the applications of SECUM and CPIM by proposing a customizable IP service model based on SECUM and describing an implementation of Session Initiation Protocol (SIP) based on CPIM. Compared with the existing service-customization techniques, SECUM is a service customization model internal to network system and may provide more powerful capabilities of service customization.     

A proxy architecture for collaborative media streaming

Streaming media from the Internet is a successful application for end-users. With the upcoming success of mobile devices and home networking environments, cooperation among users will become more important in the future. To achieve such cooperation, explicit middleware standards have been defined. On the other hand, Internet conferencing applications do not handle collaborative streaming sessions with individual control for each user. We propose a new concept for cooperation exemplary for collaborative media streaming using IETF multimedia session control protocols together with a proxy architecture. This concept enables both synchronization among clients and flexible control to individual users.     

Economic model of a Cloud provider operating in a federated Cloud

Resource provisioning in Cloud providers is a challenge because of the high variability of load over time. On the one hand, the providers can serve most of the requests owning only a restricted amount of resources, but this forces to reject customers during peak hours. On the other hand, valley hours incur in under-utilization of the resources, which forces the providers to increase their prices to be profitable. Federation overcomes these limitations and allows providers to dynamically outsource resources to others in response to demand variations. Furthermore, it allows providers with underused resources to rent them to other providers. Both techniques make the provider getting more profit when used adequately. Federation of Cloud providers requires having a clear understanding of the consequences of each decision. In this paper, we present a characterization of providers operating in a federated Cloud which helps to choose the most convenient decision depending on the environment conditions. These include when to outsource to other providers, rent free resources to other providers (i.e., insourcing), or turn off unused nodes to save power. We characterize these decisions as a function of several parameters and implement a federated provider that uses this characterization to exploit federation. Finally, we evaluate the profitability of using these techniques using the data from a real provider.     

基于Internet的多用户共享虚拟环境框架的研究

多用户共享虚拟环境是指网络化的协同虚拟现实系统，在该环境中多个用户之间通过各自的三维图形表示实现在虚拟环境中的多人感知，用户之间的交互以及对虚拟对象的协同操纵，在综合分析现有系统以及Internet的开放性标准化需求基础上，提出了一种基于Internet的多用户共享虚拟环境解决方案，即多用户共享虚拟环境框架（multi-user shared virtual envitonment framework,MSVEF)，该框架描述了多用户虚拟环境的体系结构，定义了基于XML的相关交互协议，通过在原型系统中的初步应用，证明该框架可以支持不同网络平台的用户在同一个虚拟场景中的再现与交互。     

MaxCD: Efficient multi-flow scheduling and cooperative downloading for improved highway drive-thru Internet systems

The limitation of existing wireless wide area networks, coupled with the delay tolerant property of many non-realtime applications (e.g. email, file download) enables drive-thru networking, which depends on roadside units (RSUs) to provide vehicular users with intermittent Internet access service. Focusing on the downlink service, MaxCD – a joint multi-flow scheduling and cooperative downloading protocol is proposed in this paper with the goal of maximizing the amount of data packets that can be downloaded per drive-thru. Based on the macro-level opportunistic scheduling and node cooperation, the best wireless link(s) (with the highest data rate) between the RSU and vehicular users can always be utilized. On the other hand, the advantage of opportunistic overhearing due to the broadcast nature of wireless medium is also exploited to reduce packet retransmission times, so as to further increase the effective data rate. Since the store-carry-forward delivery manner is adopted for the cooperators to avoid introducing interference to the in-range data communication, a multi-channel collision-free relay mechanism is designed to address the reliable and fast data exchange issue when the vehicular users are outside the service area of the RSU. Our theoretical analysis vindicates the performance gain of the cooperation and extensive simulations demonstrate the efficiency of MaxCD.     

面向用户的支持用户掉线的联邦学习数据隐私保护方法

联邦学习是解决多组织协同训练问题的一种有效手段,但是现有的联邦学习存在不支持用户掉线、模型API泄露敏感信息等问题。文章提出一种面向用户的支持用户掉线的联邦学习数据隐私保护方法,可以在用户掉线和保护的模型参数下训练出一个差分隐私扰动模型。该方法利用联邦学习框架设计了基于深度学习的数据隐私保护模型,主要包含两个执行协议:服务器和用户执行协议。用户在本地训练一个深度模型,在本地模型参数上添加差分隐私扰动,在聚合的参数上添加掉线用户的噪声和,使得联邦学习过程满足(ε,δ)-差分隐私。实验表明,当用户数为50、ε=1时,可以在模型隐私性与可用性之间达到平衡。     

Deep packet inspection tools and techniques in commodity platforms: Challenges and trends

Deep packet inspection (DPI) helps Internet service providers in efforts to profile networked applications. By relying on DPI systems, Internet service providers may apply different charging policies, traffic shaping, or offer quality of service (QoS) guarantees to selected users or applications. As critical network services rely on the precise characterization of network flows, building agile and efficient DPI systems has recently become an important research topic. In this paper, we present a comprehensive literature review on the tools and techniques necessary to develop modern DPI systems. We provide the essential technical background material and examine the current body of research in DPI engines’ optimization for commodity platforms. Then we discuss current research challenges and present guidelines for building high performance DPI systems.     

Challenges and future directions of secure federated learning: a survey

Federated learning came into being with the increasing concern of privacy security, as people’s sensitive information is being exposed under the era of big data. It is an algorithm that does not collect users’ raw data, but aggregates model parameters from each client and therefore protects user’s privacy. Nonetheless, due to the inherent distributed nature of federated learning, it is more vulnerable under attacks since users may upload malicious data to break down the federated learning server. In addition, some recent studies have shown that attackers can recover information merely from parameters. Hence, there is still lots of room to improve the current federated learning frameworks. In this survey, we give a brief review of the state-of-the-art federated learning techniques and detailedly discuss the improvement of federated learning. Several open issues and existing solutions in federated learning are discussed. We also point out the future research directions of federated learning.     

TPII: tracking personally identifiable information via user behaviors in HTTP traffic

It is widely common that mobile applications collect non-critical personally identifiable information(PII)from users'devices to the cloud by application service providers(ASPs)in a positive manner to provide precise and recommending services.Meanwhile,Internet service providers(ISPs)or local network providers also have strong requirements to collect PIIs for finer-grained traffic control and security services.However,it is a challenge to locate PIIs accurately in the massive data of network traffic just like looking a needle in a haystack.In this paper,we address this challenge by presenting an efficient and light-weight approach,namely TPII,which can locate and track PIIs from the HTTP layer rebuilt from raw network traffics.This approach only collects three features from HTTP fields as users'behaviors and then establishes a tree-based decision model to dig PIIs efficiently and accurately.Without any priori knowledge,TPII can identify any types of PIIs from any mobile applications,which has a broad vision of applications.We evaluate the proposed approach on a real dataset collected from a campus network with more than 13k users.The experimental results show that the precision and recall of TPII are 91.72%and 94.51%respectively and a parallel implementation of TPII can achieve 213 million records digging and labelling within one hour,reaching near to support 1Gbps wirespeed inspection in practice.Our approach provides network service providers a practical way to collect PIIs for better services.     

面向对象的网络聊天服务器系统的设计

网上卿天可以交流思想,也可以使某些具有分支机构的公司的员工跨区域进行实时的沟通,这里采用了面向对象的方法,设施实现了一个即时消息 网络协议的设计和程序架构的实现。     

Pricing Internet services: proposed improvements

Flat-rate pricing appeals to Internet users and service providers because of its simplicity and predictability. However, congestion is the inevitable consequence of flat-rate pricing because Internet users who pay a fixed access fee have no incentive to limit their network usage. Future applications that require timely delivery of data will require mechanisms for allocating network resources that give consumers choices in services and prices while allowing service providers to recover their costs. We examine the proposed improvements in Internet pricing that are designed to increase its economic efficiency and support the deployment of new applications that require a better quality of service than the Internet currently offers     

区分服务网络中IP多播:问题与解决方案

在下一代因特网中,越来越多的应用将会需要网络提供一定的服务质量以及进行多播传输．因为区分服务体系结构提供了一种可扩展的QoS解决方案,而多播传输则提供了一种节约网络资源的有效方法,二者的集成成为必然趋势．但是,由于区分服务体系结构与多播树结构上的差异,二者的集成存在着一些问题．详细分析了区分服务网络中进行IP多播传输可能出现的问题,并且对近年来提出的各种解决方案进行了分类比较和深入剖析,同时指出了在这一领域中未来的研究方向．     

Internet traffic measurement

The Internet's evolution over the past 30 years (1971-2001), has been accompanied by the development of various network applications. These applications range from early text-based utilities such as file transfer and remote login to the more recent advent of the Web, electronic commerce, and multimedia streaming. For most users, the Internet is simply a connection to these applications. They are shielded from the details of how the Internet works, through the-information-hiding principles of the Internet protocol stack, which dictates how user-level data is transformed into network packets for transport across the network and put back together for delivery at the receiving application. For many networking researchers however, the protocols themselves are of interest. Using specialized network measurement hardware or software, these researchers collect information about network packet transmissions. With detailed packet-level measurements and some knowledge of the IP stack, they can use reverse engineering to gather significant information about both the application structure and user behavior, which can be applied to a variety of tasks like network troubleshooting, protocol debugging, workload characterization, and performance evaluation and improvement. Traffic measurement technologies have scaled up to provide insight into fundamental behavior properties of the Internet, its protocols, and its users. The author introduces the tools and methods for measuring Internet traffic and offers highlights from research results