Performance analysis of in-network caching for content-centric networking

With the explosion of multimedia content, Internet bandwidth is wasted by repeated downloads of popular content. Recently, Content-Centric Networking (CCN), or the so-called Information-Centric Networking (ICN), has been proposed for efficient content delivery. In this paper, we investigate the performance of in-network caching for Named Data Networking (NDN), which is a promising CCN proposal. First, we examine the inefficiency of LRU (Least Recently Used) which is a basic cache replacement policy in NDN. Then we formulate the optimal content assignment for two in-network caching policies. One is Single-Path Caching, which allows a request to be served from routers only along the path between a requester and a content source. The other is Network-Wide Caching, which enables a request to be served from any router holding the requested content in a network. For both policies, we use a Mixed Integer Program to optimize the content assignment models by considering the link cost, cache size, and content popularity. We also consider the impact of link capacity and routing issues on the optimal content assignment. Our evaluation and analysis present the performance bounds of in-network caching on NDN in terms of the practical constraints, such as the link cost, link capacity, and cache size.     

一种改进的BGP路由源认证机制

资源公钥基础设施(Resource Public Key Infrastructure,RPKI)是当前用于保护互联网码号资源分配真实性的技术.作为一种支撑域间路由安全的体系,它解决了边界网关协议(Border Gateway Protocol,BGP)缺乏路由源认证的问题.然而当前RPKI体系中的依赖方(Relying Party,RP)与路由器数据同步机制可能会导致路由源授权(Route Originate Authorization,ROA)信息缺乏真实性和有效性,并且不断查询缓存列表会带给路由器很大的性能负载.据此,本文提出一种改进的BGP路由源认证方案,发送端路由器实时申请存储在RP中的ROA证书,将其附加到BGP update报文中进行传输,以待对等端路由器申请证书公钥对证书进行验证并完成路由源认证功能.该方案将原来周期性更新路由器缓存列表机制改为路由器实时申请认证机制,有效解决了RP与路由器数据同步可能导致的ROA存在错误的问题,降低路由器查询缓存列表造成的路由器运行负载.此外,本文通过Quagga仿真实验表明该方案具有可行性,并对该方案的适用情形进行了具体分析.     

ICN中基于节点权重的缓存大小分配方案研究

网内缓存功能是信息中心网络ICN（Information-Centric Networking）最重要的特性之一,大大减小了信息请求的响应时间和网内流量。合理地分配每个路由器的缓存空间大小,对网络性能有较大影响,也可以节约网络成本。为了使路由器的缓存大小配置合理,首先综合考虑路由器的度数权重、紧密度、网络的中心度、请求影响度等度量指标,定义了一个新的度量指标,称为节点权重;然后,提出一种基于节点权重的缓存大小分配方案,将网络所需的容量按比例分配给路由器。仿真结果表明,与均匀分配相比,路由器的缓存空间利用率至少提升了8%,命中率至少提高了6%;与基于请求影响度的分配方案相比,路由器的缓存空间利用率至少提升3%,命中率至少提高了3%。     

内容中心网络数据污染的快速检测机制

内容中心网络通过路由器缓存内容来提高网络的整体性能.为防止被污染的数据在网络中扩散,路由器需要对进入网络的内容进行验证.原始的验证机制需要对内容的数字签名进行非对称密钥解密操作,导致内容验证速度不能满足高速路由器的需求.提出了基于着色的快速内容验证机制,以减少内容验证的计算复杂度,加快内容的检测速度.该机制通过对第1次进入网络的正确内容进行着色操作以保证其正确性.被着色的内容再次进入网络时,路由器可以通过着色信息来快速验证内容的正确性,从而提高路由器的检测速度.     

针对层次化名字路由的聚合机制

为了从根本上解决现有互联网存在的可扩展性、移动性和安全性等方面的问题,全新的未来互联网体系结构得到了广泛研究.其中,命名数据网络（named data networking,简称NDN）利用网内缓存和多路转发实现了基于层次化名字的高效数据传输,从根本上解决了现有互联网所面临的问题.内容的层次化名字具有数量庞大、结构复杂等特点,现有的基于IP的路由转发机制无法直接应用于NDN网络,需要有针对性地研究高效的层次化名字路由机制,保证海量网络内容的正常路由转发.路由聚合是缩减网络路由规模的主要措施.不同于现有的面向本地NDN路由表查表过程的优化,路由聚合需要全网协同处理,在不同网络节点上不断对聚合路由进行聚合.这对聚合路由标识和聚合路由可用性评估提出了诸多要求.为此,研究并提出了针对层次化名字路由的聚合机制,包括两个方面的工作：（1）构建了一种全新的计数布隆过滤器——堆叠布隆过滤器,该过滤器支持多过滤器合并,用于压缩表示被聚合路由名字;（2）给出了一种动态路由聚合机制,在保证NDN网络路由转发准确性的同时,缩小全网路由规模,最大程度地优化了路由转发效率.在真实网络拓扑上构建了仿真平台,经过实验验证,该路由聚合机制以可控的少量冗余转发为代价,有效地压缩了全网路由规模,提升了全网路由转发效率,保证了海量在线内容的高效路由转发,为NDN网络投入实际部署提供了前提.     

A Centrality-measures based Caching Scheme for Content-centric Networking (CCN)

Content-centric networking (CCN) is gradually becoming an alternative approach to the conventional Internet architecture through the distribution of enlightening information (named as content) on the Internet. It is evaluated that the better performance can be achieved by caching is done on a subset of content routers instead of all the routers in the content delivery path. The subset of a content router must be selected in a manner such that maximum cache performance can be achieved. Motivated by this, we propose a Centrality-measures based algorithm (CMBA) for selection of an appropriate content router for caching of the contents. The Centrality-measures are based on the question: ”Who are the most important or central content router in the network for the caching of contents?”. We found that our novel CMBA could improve content cache performance along the content delivery path by using only a subset of available content routers. Our results recommend that our proposed work consistently achieves better caching gain across the multiple network topologies.     

Cooperative-Filter: countering Interest flooding attacks in named data networking

Named data networking (NDN) is an emerging networking paradigm that is considered as one of the promising candidates for next-generation Internet architecture. To be a viable Internet architecture, NDN must be resilient against current and emerging threats. This paper focuses on how to detect and mitigate the Interest flooding attack (IFA) in NDN, which can excessively consume the resource of each involved router by flooding too many malicious Interest packets with fake names. In this paper, to counter IFA, an architecture called Cooperative-Filter is proposed. It detects IFA using fuzzy logic, and mitigates it based on the cooperation between routers at the granularity of per-prefix-per-interface, by taking advantages of the state statistics of each router. Moreover, the performance of Cooperative-Filter is evaluated, based on both effect of it on reducing memory resource consumption of each involved router and the effect on increasing Interest satisfaction rate for legitimate users when suffering IFA as well as on decreasing the Interest-retrieving delay. Simulation results demonstrate that Cooperative-Filter can detect IFA and effectively mitigate its damage effect on NDN. To the best of our knowledge, this is the first attempt to design an IFA countermeasure embedding with fuzzy logic as well as countering IFA at the granularity of per-prefix-per-interface.     

命名数据网络中基于内容类型的隔跳概率缓存机制

网络化缓存是命名数据网络实现对信息的高效获取,有效降低互联网骨干网络流量的关键技术.网络化缓存将缓存作为普适的功能添加到每个网络节点.用户需要获取信息时,缓存有该内容的任意网络节点(例如路由器)接收到用户请求后都可直接向用户返回相应内容,提升用户请求响应效率.然而,命名数据网络采用泛在缓存使得内容发布者到用户的传输路径...     

一种核心无状态保存的自适应成比例公平带宽分配机制

提出了一种核心无状态的自适应比例公平带宽分配机制CSPAFA（core stateless proporitonal adaptive fair allocation)，在边界路由器完成基于每个流的状态处理，将所有流分成标记流和非标记流两种业务类型，采用DPS（dynamic packet state)技术将有关信息编码进IP分组头，在核心将输出链路带宽分成两部分，核心根据当前的网络负荷对标记流按服务规格成比例的分配输出链路带宽，对未标记流公平分配带宽，并且能自适应地调整两类业务的带宽共享比例，最后，给出了在NS网络仿真环境下的仿真实验结果。     

Optimal State Allocation for Multicast Communications With Explicit Multicast Forwarding

In this paper, we propose a scalable and adaptive multicast forwarding mechanism based on explicit multicast (Xcast). This mechanism optimizes the allocation of forwarding states in routers and can be used to improve the scalability of traditional IP multicast and source-specific multicast. Compared with previous work, our mechanism needs fewer routers in a multicast tree to store forwarding states and therefore leads to a more balanced distribution of forwarding states among routers. We focus on two problems and formulate each of them as an optimization problem. The first problem, referred to as minstate, minimizes the total number of routers that store forwarding states in a multicast tree. The second problem, referred to as balancestate, minimizes the maximum number of forwarding states stored in a router for all multicast groups, which is proved to be an NP-hard problem. We design a distributed algorithm that obtains the optimal solution to the first problem and propose an approximation algorithm for the second problem. We also prove that the approach adopted by most existing works to allocate forwarding states in the branching routers of a multicast tree is a special case of our mechanism. The simulation results show that the forwarding state allocation provided by previous work is concentrated on the backbone routers in the Internet, which may cause the scalability problem. In contrast, our mechanism can balance forwarding states stored among routers and reduce the number of routers that store the forwarding states for a multicast tree.     

Shared memory multiprocessor architectures for software IP routers

We propose new shared memory multiprocessor architectures and evaluate their performance for future Internet protocol (IP) routers based on symmetric multiprocessor (SMP) and cache coherent nonuniform memory access (CC-NUMA) paradigms. We also propose a benchmark application suite, RouterBench, which consists of four categories of applications representing key functions on the time-critical path of packet processing in routers. An execution driven simulation environment is created to evaluate SMP and CC-NUMA router architectures using this RouterBench. The execution driven simulation can produce accurate cycle-level execution time prediction and reveal the impact of various architectural parameters on the performance of routers. We port the FUNET trace and its routing table for use in our experiments. We find that the CC-NUMA architecture provides an excellent scalability for design of high-performance IP routers. Results also show that the CC-NUMA architecture can sustain good lookup performance, even at a high frequency of route updates.     

An ANFIS-based cache replacement method for mitigating cache pollution attacks in Named Data Networking

Named Data Networking (NDN) is a candidate next-generation Internet architecture designed to overcome the fundamental limitations of the current IP-based Internet, in particular strong security. The ubiquitous in-network caching is a key NDN feature. However, pervasive caching strengthens security problems namely cache pollution attacks including cache poisoning (i.e., introducing malicious content into caches as false-locality) and cache pollution (i.e., ruining the cache locality with new unpopular content as locality-disruption).In this paper, a new cache replacement method based on Adaptive Neuro-Fuzzy Inference System (ANFIS) is presented to mitigate the cache pollution attacks in NDN. The ANFIS structure is built using the input data related to the inherent characteristics of the cached content and the output related to the content type (i.e., healthy, locality-disruption, and false-locality). The proposed method detects both false-locality and locality-disruption attacks as well as a combination of the two on different topologies with high accuracy, and mitigates them efficiently without very much computational cost as compared to the most common policies.     

GPU-accelerated name lookup with component encoding

Named Data Networking (NDN) aims at redesigning the current Internet: using names to identify the wanted contents instead of using IP addresses to locate the end hosts, with the goal of substantially improving the data retrieval efficiency. Different from IP routers, NDN routers forward packets by names. An NDN name is composed of a number of length-variable components, causing the name to be tens or even hundreds of characters in length. Meanwhile, NDN routing tables could be several orders of magnitude larger than the current IP routing tables. This kind of complex name constitution plus the huge-sized name table makes wire speed name lookup an extremely challenging task.     

一种短流优先的公平带宽分配机制

提出一种短流优先的公平带宽分配机制FPIP(fair PIP).通过区别处理短流和长流的报文,FPIP能够将带宽优先分配给短流,然后将剩余的带宽在长流之间公平分配.此外,FPIP采用主动队列管理机制AQM(active queue management)检测拥塞并控制队列长度.仿真结果表明,FPIP在保证公平性、控制队列长度、减小Web流的响应时间等方面具有良好的性能.     

路由器交换过程中信息安全分析

路由器是实现多台电脑组建局域网并连接互联网的主要设备之一,在我们工作和生活之中被普遍应用。路由器的联网通过TCP/IP协议连接互联网,而网络协议TCP/IP协议存在安全漏洞,因此路由器便成为主要攻击的对象。不法分子和黑客通过获取路由器交换过程中的IP地址控制路由器所连接的联网电脑,或者在路由器交换过程中的报文破译网络传输的信息和数据。本文对路由器交换过程中的信息安全进行分析,安全优化路由器,构建路由器交换过程中信息安全策略。     

基于内容热度与节点介数的NDN网络缓存策略

缓存技术是数据命名网络（Named data networking,NDN）的关键技术之一. NDN传统的LCE缓存策略会造成较大的冗余. 改进的RCOne策略采用随机放置的方法,没有利用任何内容、节点信息,对网络缓存性能的提升有限. Betw策略只考虑到节点介数,导致高介数节点缓存更替频繁,当节点缓存容量远小于内容总量时,缓存性能下降. 为了解决这些问题,本文提出一种结合内容热度与节点介数的新型缓存策略HotBetw（Hot content placed on node with high Betweenness）,充分利用内容与节点信息选择最佳的位置放置缓存. 仿真实验表明相对于典型NDN缓存策略,HotBetw缓存策略在提高缓存命中率、降低平均跳数方面具有很好的效果.     

基于动态内容流行度的NDN缓存决策和替换策略研究

命名数据网络(NDN)中的路由器节点具有缓存能力,这就极大地提高了网络中的数据发送与检索效率。然而,由于路由器的缓存能力是有限的,设计有效的缓存策略仍然是一项紧迫的任务。为了解决这个问题,提出了一种动态内容流行度缓存决策和替换策略(DPDR)。DPDR综合考虑内容流行度和缓存能力,利用一个和式增加、积式减少(AIMD)的算法动态调节流行度阈值,并将超过流行度阈值的内容存入缓存空间;同时提出了一个缓存替换算法,综合考虑了缓存空间中内容的流行度和内容最后被访问时间等因素,将替换值最小的内容移出内容缓存。大量仿真结果显示,与其他算法相比,本文所提的算法能够有效提高缓存命中率,缩短平均命中距离和网络吞吐量。     

Routing table partitioning for speedy packet lookups in scalable routers

Most of the high-performance routers available commercially these days equip each of their line cards (LCs) with a forwarding engine (FE) to perform table lookups locally. This work introduces and evaluates a technique for speedy packet lookups, called SPAL, in such routers. The BGP routing table under SPAL is fragmented into subsets which constitute forwarding tables for different FEs so that the number of table entries in each FE drops as the router grows. This reduction in the forwarding table size drastically lowers the amount of SRAM (e.g., L3 data cache) required in each LC to hold the trie constructed according to the prefix matching algorithm. SPAL calls for caching the lookup result of a given IP address at its home LC (denoted by LC/sub ho/, using the LR-cache), such that the result can satisfy the lookup requests for the same address from not only LC/sub ho/, but also other LCs quickly. Our trace-driven simulation reveals that SPAL leads to improved mean lookup performance by a factor of at least 2.5 (or 4.3) for a router with three (or 16) LCs, if the LR-cache contains 4K blocks. SPAL achieves this significant improvement, while greatly lowering the SRAM (i.e., the L3 data cache plus the LR-cache combined) requirement in each LC and possibly shortening the worst-case lookup time (thanks to fewer memory accesses during longest-prefix matching search) when compared with a current router without partitioning the routing table. It promises good scalability (with respect to routing table growth) and exhibits a small mean lookup time per packet. With its ability to speed up packet lookup performance while lowering overall SRAM substantially, SPAL is ideally applicable to the new generation of scalable high-performance routers.     

一种虚拟路由器资源映射算法研究

网络虚拟化技术的提出,为解决互联网"僵化"问题找到了新的思路,受到广泛的关注。在虚拟路由器平台中,若干台互联的网络服务器资源组成了底层物理网络,通过虚拟网络映射技术,将物理网络资源有效地映射到虚拟网络设备上,组成多个虚拟网络,满足用户对网络的多样化需求。虚拟路由器资源映射问题是虚拟网络映射问题的基础,虚拟路由器实例与物理资源的映射方法决定了虚拟网络平台资源的利用率和虚拟网络系统的性能。针对虚拟路由器平台资源分配的问题,提出了物理网络资源模型和虚拟路由器资源请求模型,设计了一种启发式虚拟路由资源分配算法,并对算法的复杂性和优化目标进行了分析。     

邻居发现协议在高性能IPv6路由器上的实现

在对邻居发现协议进行分析的基础上,重点讨论了它在高性能IPv6路由器中的实现,并针对邻居发现协议在主控上实现时带来的链路层地址解析问题提出了具体解决方案。通过实验证明,该方案不仅解决了主动地址解析的问题,而且也便于路由管理模块对内核邻居表的管理,具有良好的实用性和可行性。目前已被成功应用。