Opportunistic Network Sharing for Transporting Smart Grid Data Traffic

Software Defined Networks (SDN) is a networking paradigm that separates the control plane from the data plan of a network, and controls data flow with a SDN controller. This networking model would be useful for ISP (Internet Service Provider) networks in order to control their own networks via the controller. Unfortunately, it is difficult to fully implement SDN in ISP networking due to financial and operational constraints. In this article, we will identify the various migration challenges for hybrid SDN in ISP networks, and investigate on the network planning tools currently available in the market that with regards to facilitate the migration process. Lastly, we will discuss on the future direction of research and development in the field of hybrid SDN migration.

This chapter introduces a greedy approach for delay monitoring of IP networks. It proposed two-phased monitoring scheme that ensures complete coverage of the network from both links and paths point of views, and it minimizes the monitoring overhead on the underlying production network. In the first phase it computes the locations of monitoring stations such that all network links or paths are covered by the minimal number of stations. Subsequently, in the second phase, it computes the minimal set of probe messages to be sent by each station such that the latency of every routing path can be measured. Unfortunately, both the station selection and the probe assignment problems are NP-hard. However, by using greedy approximation algorithms the scheme finds solutions close to the best possible approximations to both the station selection and the probe assignment problems. Further, the experimental results demonstrate the effectiveness of the presented algorithms for accurately monitoring large networks with very few monitoring stations and probe messages close to the number of network links.

Caching is the key feature of Content Centric Networking (CCN) that allows the Internet Service Provider (ISP) to reduce network traffic crossing its network, and save bandwidth usage cost. On the other hand, it is also on benefit of the Content Providers (CPs) to cache the contents within the ISP network near the consumers. However, caching paid contents (the contents that only paying consumers can access), which are the main source of income for CP, in the ISP network complicates the CP's task of controlling content access and payment. Thus, ISP manages content placement inside its cache-enabled routers and serves content based on user demands, without any coordination with CP. There is no profit sharing mechanism between both ISP and CPs. Therefore, a payment mechanism between ISP and CPs that considers paid content caching and distribution inside the ISP network is needed. To address this challenge, we propose a new incentive mechanism for paid content caching that satisfies both ISP and CPs through the use of reverse auction. The ISP monetizes its cache storage through caching contents from multiple CPs and selling them to its customers. The reverse auction helps the ISP to get prices from multiple CPs, and to select the price that minimize its total payment. The simulation results show that our proposal satisfies all network players involved in in- network caching through increasing their utilities.

EPPSQ: Achieving efficient and privacy-preserving statistics queries over encrypted data in smart grids

Distributed Reflected Denial of Service (DRDoS) attacks remain one of the most popular techniques to drain victim's network bandwidth. Despite the goal of disrupting network services of a particular victim, indirectly these attacks affect a large number of benign Internet citizens. In particular, the owners of services vulnerable to amplification have to waste their resources to process incoming requests. Moreover, the voluminous attack traffic generated as a result of the amplification lavishes Internet Service Provider (ISP) resources, bandwidth and money, causing Quality of Service (QoS) degradation and subscription fee increase for the customers. In this work we demonstrate a Software Defined Networking (SDN) based system to filter out garbage traffic from an ISP network. We employ a special type of a honeypot developed to collect information about ongoing DRDoS attacks. The firewall rules derived from this data are used to block incoming amplification requests from reaching amplifiers located within the provider network rescuing vulnerable services from being abused. In its turn, this prevents garbage traffic generation saving ISP's money and improving QoS.

The Fast ReRoute (FRR) is an area that addresses issues of network recovery in the event of crucial devices or line failures in the network. During the event of a failure in the ISP network, the process of network convergence starts. This process may last unpredictable time and traffic affected by the failure may be inevitably lost. FRR mechanisms work mostly on the principle of a precalculated backup route. After a failure at one of the protected nodes in the network, the FRR mechanism will use a specific backup route to redirect traffic away from the location affected by the failure. By using FRR mechanisms in the Internet Service Provider (ISP) network, we can minimize the time required for network recovery to the order of tens of milliseconds and thus ensure immediate recovery of communication after a network outage.

The cost minimization of virtual private networks (VPN) that use the resources of an underlying transport network is the key factor for their successful implementation. The investigation in this paper is focused on 'network based VPNs', where the operation of the VPN is outsourced to an Internet Service Provider (ISP). The interest in such solutions is generated both by customers seeking to reduce support costs and by ISPs seeking new revenue sources. Solving the cost minimization would allow Internet service providers (ISPs) to define and deploy new VPN services. The basic building block of VPN is the tunnel. A tunnel operates as an overlay across the backbone, and the traffic sent through the tunnel is opaque to the underlying backbone. A VPN end point can terminate multiple tunnels or forward packets between different tunnels. Different tunnels can share the same physical link and traffic belonging to the same VPN tunnel can be carried along different physical links. The multiplexing and management of the VPN tunnels is made possible by core routers supporting the VPN of the underlying network. The novelty of the presented work is the network flow model of VPN mapping on the underlying ISP network. We assume that the VPN topology, the topology of the ISP network and the total utilization cost for all underlying links are known parameters. Based on this, we propose a network management system based on a network flow optimization in order to define the minimal cost link allocation for the VPN tunnels. We provide a simulation of the proposed optimal establishment of VPN tunnels and performance evaluation of the simulation results.

Traditionally, Internet Service Providers (ISPs) make profit by providing Internet connectivity, while content providers (CPs) play the more lucrative role of delivering content to users. As network connectivity is increasingly a commodity, ISPs have a strong incentive to offer content to their subscribers by deploying their own content distribution infrastructure. Providing content services in an ISP network presents new opportunities for coordination between traffic engineering (to select efficient routes for the traffic) and server selection (to match servers with subscribers). In this work, we develop a mathematical framework that considers three models with an increasing amount of cooperation between the ISP and the CP. We show that separating server selection and traffic engineering leads to sub-optimal equilibria, even when the CP is given accurate and timely information about the ISP's network in a partial cooperation. More surprisingly, extra visibility may result in a less efficient outcome and such performance degradation can be unbounded. Leveraging ideas from cooperative game theory, we propose an architecture based on the concept of Nash bargaining solution. Simulations on realistic backbone topologies are performed to quantify the performance differences among the three models. Our results apply both when a network provider attempts to provide content, and when separate ISP and CP entities wish to cooperate. This study is a step toward a systematic understanding of the interactions between those who provide and operate networks and those who generate and distribute content.

Device fingerprinting can be used by Internet Service Providers (ISPs) to identify vulnerable IoT devices for early prevention of threats. However, due to the wide deployment of middleboxes in ISP networks, some important data, e.g., 5-tuples and flow statistics, are often obscured, rendering many existing approaches invalid. It is further challenged by the high-speed traffic of hundreds of terabytes per day in ISP networks. This paper proposes DeviceRadar, an online IoT device fingerprinting framework that achieves accurate, real-time processing in ISPs using programmable switches. We innovatively exploit “key packets” as a basis of fingerprints only using packet sizes and directions, which appear periodically while exhibiting differences across different IoT devices. To utilize them, we propose a packet size embedding model to discover the spatial relationships between packets. Meanwhile, we design an algorithm to extract the “key packets” of each device, and propose an approach that jointly considers the spatial relationships and the key packets to produce a neighboring key packet distribution, which can serve as a feature vector for machine learning models for inference. Last, we design a model transformation method and a feature extraction process to deploy the model on a programmable data plane within its constrained arithmetic operations and memory to achieve line-speed processing. Our experiments show that DeviceRadar can achieve state-of-the-art accuracy across 77 IoT devices with 40 Gbps throughput, and requires only 1.3% of the processing time compared to GPU-accelerated approaches.

Modeling router-level networks is a challenging task, for it is unclear today as how to represent such networks by a simple and accurate model of modest size and complexity. To provide more insights into router-level network modeling, this paper studies some topological features of several Internet service provider (ISP) networks. The main concern is on the relationships amongst bandwidth constraints, topological features, and engineering design consideration. Computer experiments show some highly unlikely topological structures to network congestion, which are common amongst several geographically independent ISP networks. It suggests that engineering design consideration paves a feasible way to model router-level networks. The findings in this paper may provide some new information toward developing a more realistic model for the router-level Internet.

The main objective of this paper is to propose and develop a billing system for use by Internet service providers (ISPs) to charge Internet users according to their network usage (i.e. their traffic). This means that users are charged depending on the volume of traffic they create. The main idea of the proposed billing system is that when a user attempts to establish a connection with the outside world, the connection establishment is postponed while the user is authenticated and it is verified that he is ready to pay for this connection. Generally, if the user is ready to pay, the connection is established and his traffic (which reflects his usage) is metered. An invoice is generated according to the metered traffic. The proposed billing system consists of two main components, the meter module and invoice generation module. We measure several key statistics, such as connection setup time, active connection count, response time and complexity of searching the connection tables, without the billing system and with it to determine whether or not it is feasible to implement the proposed billing system. The system can be used to allocate an ISP's network resources fairly and efficiently. It can also be used to overcome network congestion problems.

A privacy-preserving scheme with identity traceable property for smart grid

The paper describes an Internet Protocol (IP) version 6 (v6) introduction to an IP version 4 (v4) Internet Service Provider (ISP) network infrastructure. The case study driver is an ISP willing to introduce a new killer service related to Internet of Things (IoT) style building automation. The ISP and cooperation of third party companies specialized in building automation will provide the service. The ISP has to deliver the network access layer and to accommodate the building automation solution traffic throughout its network infrastructure. The third party companies are system integrators and building automation solution vendors. IPv6 is suitable for such solutions due to the following reasons. The operator can't accommodate large number of IPv4 embedded devices in its current network due to the lack of address space and the fact that many of those will need clear 2-way IP communication channel.The Authors propose a strategy for IPv6 introduction into operator infrastructure based on the current network architecture, present service portfolio and several transition mechanisms. The strategy has been tested in laboratory with setup close or identical to the current operator's network. The criteria for a successful experiment is full two-way IPv6 application layer connectivity between the IPv6 server and the IPv6 Internet of Things (IoT) cloud.

Software-defined networking provides a promising solution for traffic engineering (TE) by utilizing a centralized controller to remotely configure programmable network switches. In order to achieve optimal traffic distribution and meet the Quality of Service (QoS) requirements, the SDN controller must frequently solve complex optimization models. Applying an optimization model in ISP (Internet Service Provider) networks implies abundant routing reconfigurations, which adversely impact the network stability and QoS parameters. Namely, since routing updates usually cannot be applied on all switches at the same time, transient congestion and loops often happen as a result. Here, in this paper, we propose a new control framework that strives to maximize the network throughput and provide QoS with minimal reconfiguration costs. In contrast to the conventional TE approaches, which perform the network optimizations periodically and control the side effects of reconfigurations by carefully choosing the period length between the optimization cycles, we propose a multi-objective optimization model which jointly minimizes the routing cost function and the reconfiguration overhead. The Pareto frontier of the optimization model is generated by the augmented ∈-constrained method, whereas a Lyapunov drift-plus-penalty function is used to select the best compromise solution from the Pareto set. Since the reconfiguration overhead is reduced, the network controller could be allowed to optimize resource allocation more frequently, in order to respond quickly and efficiently to the network changes. Considering that the proposed optimization model is computationally intractable in large-scale networks, we also propose a heuristic algorithm to efficiently solve large instances of the problem. In simulations and Mininet experiments, we show that our solution brings performance improvement over the conventional periodic TE techniques. Moreover, the proposed heuristic achieves better QoS request acceptance ratio than the state-of-the-art multi-objective optimization solution, despite the significantly reduced computational complexity.

While both Internet Service Providers (ISPs) and third-party Security Service Providers (SSPs) offer Distributed Denial-of-Service (DDoS) mitigation services through cloud-based scrubbing centers, it is often beneficial for ISPs to outsource part of the traffic scrubbing to SSPs to achieve less economic cost and better network performance. To explore this potential, we design an online auction mechanism, featured by the challenge of the switching cost of using different winning bids over time. Formulating the social cost minimization as a nonconvex integer program, we firstly relax it and design an online algorithm that breaks it into a series of modified single-shot problems and solves each of them in polynomial time, without requiring knowledge of future inputs; then, we design a randomized rounding algorithm to convert the fractional decisions into integers without violating any constraints; and finally, we design the payment for each bid based on its winning probability. We rigorously prove that our mechanism achieves a parameterized-constant competitive ratio for the long-term social cost, with truthfulness and individual rationality in expectation. We also exhibit its superior practical performance via evaluations driven by real-world data traces.