面向未来互联网的基于Capabilities的DDoS防御体系研究

介绍了面向未来互联网的防御DDoS攻击的Capabilities机制的原理及其关键技术,阐述了当前基于Capabilities机制的几个典型方案。研究了基于Capabilities机制的DDoS防御体系的全局框架,并探讨了该框架所包含的流分类、执行、Capabilities管理这3部分在未来互联网中可行的实现方案。建立了Capabilities机制框架下的流量模型,从理论上分析并论证了Capabilities机制框架下的安全性与效率等问题。通过仿真实验,比较了在不同场景下各种Capabilities方案的性能及效率。     

未来互联网体系结构中的内生安全研究

未来互联网体系结构试图通过其内生安全特性解决目前互联网中的安全问题。新型的未来互联网体系结构命名空间普遍使用了具备自认证能力的网络标识支持网络的内生安全,但目前的方案不能将用户标识符、网络标识符、公钥三者在脱离PKI的情况下实现同时绑定。本文提出了基于组合公钥密码体制的自认证标识(SCI-CPK)命名方案,可用于未来互联网体系结构命名空间中标识安全绑定,并给出了在未来互联网体系结构XIA、MobilityFirst和NDN中支持实体鉴别的应用方法。分析表明,SCI-CPK方案能够支持未来互联网中泛在互联和泛在移动场景下的大规模实体身份和地址鉴别。     

Supporting the Web with an information centric network that routes by name

Information Centric Networking (ICN) is a new paradigm in which the network layer provides users with content, instead of providing communication channels between hosts, and is aware of the name (or identifiers) of the contents. A fundamental ICN operation is the routing of content requests towards a node that is able to provide the requested content. To meet this goal, different routing architectures have been proposed so far.     

未来互联网体系结构的研究探索

发展到今天的互联网在很多方面已经跟不上用户需求的脚步,一系列问题接连出现。如安全系数低,管理困难和许多还未发掘出来的问题,这些问题已经成为当前互联网架构发展的阻碍,影响了互联网应用的进一步发展,本文对现今互联网架构面临的问题和挑战进行了分析,从中探讨未来互联网体系结构的研究方向和相关技术升级的战略。     

未来互联网虚拟化研究

目前的互联网基于“端到端”原则设计,并且由许多目标与策略迥异的互联网服务提供商共同创建和维护.若想升级互联网体系结构,需要得到他们全体的一致同意,因此几乎不可能在互联网上部署全新的网络结构和协议.为了避免互联网结构出现僵化,人们提出可用网络虚拟化方法增加互联网范式的多样性.通过在一个公共的基底网络上引入多种不同的互联网结构,互联网虚拟化可以促进互联网创新并推动更多种类的新应用出现.分别从互联网体系结构和实验平台2个方面,对过去和当前正在进行的有关未来互联网的虚拟化研究进行分析、归类和概述,并总结未来互联网虚拟化研究的发展趋势.     

自适应的未来网络体系架构

随着计算技术和互联网业务的蓬勃发展,用户对网络应用提出了越来越高的要求,多样化的需求使得现有Internet架构难以适用,成为了网络业务进一步发展的瓶颈.文中在分析当前Internet网络存在的问题、总结本源性因素的基础上,指出了自适应是未来网络的发展方向,可控、可管、可扩展和可信是实现自适应特性应满足的基本指标.在介绍和分析现有自适应未来网络关键技术和体系架构的同时,深入讨论了相关技术和体系结构的优势和兼容性,并在此基础上提出了自适应的未来网络体系架构,为未来网络的研究提供了参考.     

Architectures for the future networks and the next generation Internet: A survey

Networking research funding agencies in USA, Europe, Japan, and other countries are encouraging research on revolutionary networking architectures that may or may not be bound by the restrictions of the current TCP/IP based Internet. We present a comprehensive survey of such research projects and activities. The topics covered include various testbeds for experimentations for new architectures, new security mechanisms, content delivery mechanisms, management and control frameworks, service architectures, and routing mechanisms. Delay/disruption tolerant networks which allow communications even when complete end-to-end path is not available are also discussed.     

On the Internet routing protocol Enhanced Interior Gateway Routing Protocol: is it optimal?

Cisco's proprietary routing protocol, EIGRP (Enhanced Interior Gateway Routing Protocol) is one of the two most widely employed routing protocols in the Internet. The underlying algorithm is reputed to be optimal with respect to the EIGRP metric. We construct a counterexample to illustrate that it is not optimal. We implemented the test network from the counterexample in our Networking Lab and it was confirmed that the Cisco routers did not find optimal routes. We suggest ways in which the EIGRP algorithm can be improved. These suggestions would also improve the operation of the Diffusing Updating Algorithm, the portion of EIGRP used to recover from link/node failures.     

下一代互联网体系结构研究

互联网发展到今天在很多方面已经无法满足用户的需求,面临着一系列问题,如安全性差、难以管理以及不可预测等.当前互联网的体系结构已经不能适应甚至阻碍互联网应用的进一步发展.文章对当前互联网体系结构存在的问题及面临的挑战进行了分析,并对国内外研究动态、在该领域的若干研究方向及提出的解决方案进行了总结评述.在此基础上重新审视互联网最初的基本设计原则是否符合当前和新兴网络应用环境的需求.并对互联网未来的发展进行了展望.     

Future Internet technologies for environmental applications

This paper investigates the usability of Future Internet technologies (aka “Generic Enablers of the Future Internet”) in the context of environmental applications. The paper incorporates the best aspects of the state-of-the-art in environmental informatics with geospatial solutions and scalable processing capabilities of Internet-based tools. It specifically targets the promotion of the “Environmental Observation Web” as an observation-centric paradigm for building the next generation of environmental applications. In the Environmental Observation Web, the great majority of data are considered as observations. These can be generated from sensors (hardware), numerical simulations (models), as well as by humans (human sensors). Independently from the observation provenance and application scope, data can be represented and processed in a standardised way in order to understand environmental processes and their interdependencies. The development of cross-domain applications is then leveraged by technologies such as Cloud Computing, Internet of Things, Big Data Processing and Analytics. For example, “the cloud” can satisfy the peak-performance needs of applications which may occasionally use large amounts of processing power at a fraction of the price of a dedicated server farm. The paper also addresses the need for Specific Enablers that connect mainstream Future Internet capabilities with sensor and geospatial technologies. Main categories of such Specific Enablers are described with an overall architectural approach for developing environmental applications and exemplar use cases.     

Modeling multiple hop wireless networks with varying transmission power and data rate

Wireless multi-hop networks can vary both the transmission power and modulation of links. Those two parameters provide several design choices, which influence the performance of wireless multi-hop networks, e.g. minimize energy consumption, increase throughput, reduce contention, and maximize link quality. However, only network-wide metrics are considered in previous works. Further, per-flow performance metrics, such as the end-to-end energy consumption and latency, have not been studied. Those parameters directly impact the experience of users, which should be considered in capacity and performance studies. Our model incorporates per-flow metrics while also considering fading, contention, hidden terminals and packet error probabilities. We instantiate the model into an IEEE 802.11 multi-hop scenario, and evaluate common routing decisions such as maximizing link quality, maximizing data rate or minimizing the transmission power.     

On the performance of secure user-centric VoIP communication

Motivated by the increased Wi-Fi coverage in metropolitan areas and the emergence of user-centric wireless access schemes, we focus on the provision of secure, user-centric voice services and explore their potential performance-wise, by designing a VoIP communications scheme tailored to open-access wireless environments, but also with wider applicability, and experimenting with it to estimate its upper bounds on VoIP capacity, under constraints posed by user-centrism; operation at low-cost and on user-controlled equipment, minimal dependence on centralized entities, and tackling specific security challenges. We identify quality degradation factors and quantify their importance by simple analysis and experimentation, showing that typical user Wi-Fi equipment can sustain a satisfactory number of concurrent secure VoIP sessions with acceptable Quality of Experience and, at the same time, protection from malicious user activity can be offered to access providers, while a level of roaming privacy can be guaranteed.     

工业控制系统信息安全研究新动态

随着信息技术在工业控制系统(IndustrialControlSystem,ICS)的广泛应用,工业控制系统从封闭系统逐步转化为开放互联系统,进而使工业控制系统面临信息技术带来的网络安全挑战.首先,本文借用ICS安全事件详细阐述了工业控制系统信息安全的现状;其次,重点介绍了工业控制系统架构和ICS信息安全与传统信息安全...     

Research achievements on the new generation Internet architecture and protocols

Despite the great success achieved by the Internet, it has been facing increasingly severe technical challenges that include address exhaustion, low-level network security and trustworthiness, weak quality-of- service control capability, limited bandwidth, and poor support toward mobility. In this paper we summarize the principal challenges facing the current Internet, introduce the research status of the future Internet, analyze the principal design goals of the new generation Internet evaluation methods and models of the present Internet architecture, introduce the research achievements made under the new generation Internet architecture in detail, and propose our next-step research priorities and perspectives in the face of an increasing number of innovative Internet applications.     

The application of wireless local area network technology to the control of mobile robots

This paper describes a communications and control infrastructure for distributed mobile robotics, which makes use of wireless local area network (WLAN) technology and Internet Protocols (IPs). The use of commercial off-the-shelf (COTS) hardware and software components, and protocols, results in a powerful platform for conducting experiments into collective or co-operative robotics. Standard Transmission Control Protocol/Internet Protocol (TCP/IP) compatible applications programming interfaces (APIs) allow for rapid and straightforward development of applications software. Further, the message bandwidth available from WLAN interfaces (1–2 Mbits/s) facilitates multi-robot experiments requiring high data rates, for instance in robot vision or navigation. The infrastructure described is equally applicable to tele-operated mobile robots.     

Beyond the separation of identifier and locator: Building an identity-based overlay network architecture for the Future Internet

The Internet is continuously evolving from a static, host-based, uniquely attached node model to a mobile, host-free node model with the possibility of multiple attachment points to the network. However, the current Internet was not designed to support this type of workload because of its strict addressing mechanism. Thus, the Future Internet promotes the introduction of new architectures that provide the decoupling of identification and location. Moreover, new technologies, like cloud computing and Internet of Things, raise the necessity for a finer granularity of network nodes. Furthermore, the huge number of devices connected to the Internet and their finer granularity impose the necessity of flexible naming and, thus, integrated discovery mechanisms. In this paper we present an architecture that decouples the identification and location by using identities to identify the network nodes and moving from a host-to-host to a fine-grained process-to-process view of the network. Together with the mobility and multi-homing support, it also provides integrated discovery, flexible naming, and integrated security features. Finally, we analyze the architecture to discuss its performance and compare it with other (existing) approaches.     

物联网中可信控制技术研究

在物物通信和物联网技术的基础上综述了国内外物联网的发展现状,提出了物联网中无线传感器网络(WSN)与lnternet的互联融合模型.结合此模型,研究了其可信控制关键技术,包括可信路由技术、信任控制技术,以促进物联网在中国的安全发展.     

智能电网WCSN安全体系架构研究

作为下一代电力系统,智能电网应具备向电网控制中心实时可靠传输信息的能力。为了解决智能电网无线传感器网络面临的异构无线网络共存、频谱资源紧张和海量数据处理等问题,我们在智能电网引入了无线认知传感器网络的理念。文章分析了在智能电网中引入认知无线传感器网络（WCSN）的必要性,列举了智能电网、认知无线电网络和无线传感器网络的相关研究成果,描述了智能电网WCSN分层结构包括家域网、邻域网和广域网,提出了智能电网WCSN安全架构。     

物联网中RFID节点通信安全研究

物联网的不断发展和应用,在带给我们生活便利的同时,也给信息安全带来了挑战。介绍了物联网的体系结构和RFID系统面临的通信安全问题;重点研究了物联网感知层中RFID系统的通信安全,引入了一种2层的RFID体系结构,并基于此结构给出了相应的身份认证和数据加密解决方案。     

The Internet of People (IoP): A new wave in pervasive mobile computing

Cyber–Physical convergence, the fast expansion of the Internet at its edge, and tighter interactions between human users and their personal mobile devices push towardan Internet where the human user becomes more central than ever, and where their personal devices become their proxies in the cyber world, in addition to acting as a fundamental tool to sense the physical world. The current Internet paradigm, which is infrastructure-centric, is not the right one to cope with such emerging scenario with a wider range of applications. This calls for a radically new Internet paradigm, that we name the Internet of People (IoP), where the humans and their personal devices are not seen merely as end users of applications, but become active elements of the Internet. Note that IoP is not a replacement of the current Internet infrastructure, but it exploits legacy Internet services as (reliable) primitives to achieve end-to-end connectivity on a global-scale. In this visionary paper, we first discuss the key features of the IoP paradigm along with the underlying research issues and challenges. Then we present emerging networking and computing paradigms that are anticipating IoP.