Scalable multicast MPLS protocol for next generation broadband service convergence network

MPLS technology has recently been widely adopted, not only in large-scale IP backbones, but in metro and enterprise networks as well. Among the merits of MPLS, effective and efficient support of TE (traffic engineering) and VPN (virtual private network) services is the most influential factor that has facilitated the diffusion of the technology. However, although MPLS itself has become a currently operational technology, issues regarding the management of various services that are built on top of individually operating MPLS capable network elements have not been well identified or solved. These service level management issues arise, not only under heterogeneous conditions, but even when the target network is homogeneously composed. The paper discusses the requirements and architectural aspects of an integrated service management system for MPLS TE and VPN services. The discussion encompasses fault and performance management issues and information models which should be flexible to support newer services that can be rendered by merging TE, VPN, and QoS technologies. We also examine performance, fault tolerance, and scalability issues that cannot be neglected when such systems are deployed in a real-world environment.

The Locator/ID Separation Protocol (LISP) is being standardized in IETF, which separates the IP address functionality into routing locators (RLOC) and endpoint identifiers (EID). LISP is applicable for instant Virtual Private Network (VPN) services because it has IP tunneling features. However, there are two main issues with application to VPN. One is a Map server/Map resolver (MS/MR) basically allows any third party to know a mapping table even if it is irrelevant to the VPN. The other is an MS/MR should identify the VPN to which the requested site belongs because the requested EIDs can be private addresses and may overlap with other VPN sites. A simple solution is to deploy an independent MS/MR for every VPN. However, this is undesirable from a cost perspective. We present a new LISP-MS/MR that provides a large number of VPN services using a single set. This MS/MR creates a logically separated EID-to-RLOC mapping table for each VPN and selects an appropriate type according to the requesting VPN site. To ensure this, our scheme uses Authentication data included in the Map register for an initial VPN identification of the registering site and associates the identified VPN ID with the registered RLOC. In following Map requests, the appropriate mapping table for the requesting VPN site is selected based on its RLOC. We confirmed the basic network functions of VPN using the prototype system. The results of scalability tests show that our MS/MR completes the transaction for nearly-simultaneous 10,000 Map registers or requests within three seconds.

The ITU-T defined next generation network (NGN) architecture designates the resource admission control function to perform the application-driven Quality of Service (QoS) control across access and core networks. The Generalized Multiprotocol Label Switching (GMPLS) was introduced by the Internet Engineering Task Force (IETF) to cope with new traffic engineering challenges in fast optical networks and provide them with reliable end-to-end QoS mechanisms. However, an actual Connection Admission Control (CAC) implementation inside the resource reservation protocol - traffic engineering extension (RSVP-TE) in GMPLS networks does not provide the ability of effective decision making, since the applied threshold CAC lacks of the capability to consider QoS policies on GMPLS network nodes. This prevents an effective end-to-end QoS control in a fully dynamic, application driven Label Switched Path (LSP) setup scenario. This work presents a specific implementation of fuzzy-CAC operating over an RSVP-TE agent in GMPLS network domain. This fuzzy-CAC implementation is applied to a testbed where a client application requests a real-time data transfer through a GMPLS network, which results in dynamic LSP setup and exclusion. The admission control is performed upon service request based on QoS class requirements and network resource availability. The differentiated traffic treatment on per-flow basis is realized through employment of IF-THEN rule based expert knowledge. Effective traffic differentiation is achieved in a multi-service network scenario and thus it validates fuzzy-CAC as candidate for RSVP-TE protocol enhancement for application driven QoS provisioning in GMPLS networks.

Global Internet users increasingly rely on virtual private network (VPN) services to preserve their privacy, circumvent censorship, and access geo-filtered content. Due to their own lack of technical sophistication and the opaque nature of VPN clients, however, the vast majority of users have limited means to verify a given VPN service's claims along any of these dimensions. We design an active measurement system to test various infrastructural and privacy aspects of VPN services and evaluate 62 commercial providers. Our results suggest that while commercial VPN services seem, on the whole, less likely to intercept or tamper with user traffic than other, previously studied forms of traffic proxying, many VPNs do leak user traffic---perhaps inadvertently---through a variety of means. We also find that a non-trivial fraction of VPN providers transparently proxy traffic, and many misrepresent the physical location of their vantage points: 5--30% of the vantage points, associated with 10% of the providers we study, appear to be hosted on servers located in countries other than those advertised to users.

With the rapid development of Virtual Private Network (VPN), many companies and organizations use VPN to implement their private communication. Traditionally, VPN uses security protocols to protect the confidentiality of data, the message integrity and the endpoint authentication. One core technique of VPN is tunneling, by which clients can access the internal servers traversing VPN. However, the tunneling technique also introduces a concealed security hole. It is possible that if one vicious user can establish tunneling by the VPN server, he can compromise the internal servers behind the VPN server. So this paper presents a novel Application-layer based Centralized Information Access Control (ACIAC) for VPN to solve this problem. To implement an efficient, flexible and multi-decision access control model, we present two key techniques to ACIAC—the centralized management mechanism and the stream-based access control. Firstly, we implement the information center and the constraints/events center for ACIAC. By the two centers, we can provide an abstract access control mechanism, and the material access control can be decided dynamically by the ACIAC's constraint/event mechanism. Then we logically classify the VPN communication traffic into the access stream and the data stream so that we can tightly couple the features of VPN communication with the access control model. We also provide the design of our ACIAC prototype in this paper.

Chapter 7 - Virtual Private Networks and MPLS

Virtual Private Network (VPN) is a private network that uses public network to tunnel the connection from the users’ end to the VPN server. VPN allows users to create a secure connection to another network over the public Internet. VPNs can be used to shield users’ browsing activity and encrypts data transmitted over the network to prevent sniffing attack. Nowadays, users can either pay a premium price for a good VPN service or risk their privacy using free browser-based VPN. Thus, SafeSearch is developed to address these issues in mind. With SafeSearch, users will not need to fork out a lot of money for premium VPN subscription services or expose themselves to targeted advertising when utilising free browser-based VPN. In this study, open VPN protocol was used to create the VPN server on a microcomputer called Raspberry Pi. The software used was mostly open-source except for the VPN client. Obfuscation technique was used to hide VPN traffic by disguising it as just another normal Internet traffic against Deep Packet Inspection when passing through firewall. After the VPN server was established, tests were carried out to evaluate the functionality and reliability of the VPN server in “real-world” environment. The tests conducted were network restriction penetration assessment, network performance and user acceptance test. Penetration assessment result showed that SafeSearch is capable of bypassing web filtering and deep packet inspection. Network performance during SafeSearch connection has slight latency and bandwidth decline, although it is not overly affected. The outcome of the user acceptance test was positive as the majority of participants of the study were confident that SafeSearch can secure their connection and protect their privacy when browsing the web. To conclude, both objectives of this project were fully achieved and the scope of study was followed thoroughly.

Virtual private networks (VPNs) enable companies to connect geographically dispersed offices and remote workers via secure links to the private company network, using the public Internet as a backbone. Specially, VPN service in the broadband data communication network is very important and necessary to take in users who want to specify group communication. VPN mechanisms are needed which work over existing deployed backbones, and which can also be migrated to new backbones like MPLS (Multi-Protocol Label Switching). MPLS is the latest step in the evolution of multi-layer switching in the Internet. In this paper, we clarify how MPLS can be applied to creating VPNs. For this, we researched an architectural model for building VPNs in an MPLS domain. The proposed model takes advantage of both network layer peering and packet switching, and link-layer circuit and per-stream switching. It comes with a design scheme and an implementation procedure for VPN services in MPLS systems. Then we describe MPLS-based VPN service procedures and we describe MPLS VPN schemes that must be accommodated with existing network backbones and must also provide for a full range of QoS characteristics.

The cost minimization of virtual private networks (VPN) that use the resources of an underlying transport network is the key factor for their successful implementation. The investigation in this paper is focused on 'network based VPNs', where the operation of the VPN is outsourced to an Internet Service Provider (ISP). The interest in such solutions is generated both by customers seeking to reduce support costs and by ISPs seeking new revenue sources. Solving the cost minimization would allow Internet service providers (ISPs) to define and deploy new VPN services. The basic building block of VPN is the tunnel. A tunnel operates as an overlay across the backbone, and the traffic sent through the tunnel is opaque to the underlying backbone. A VPN end point can terminate multiple tunnels or forward packets between different tunnels. Different tunnels can share the same physical link and traffic belonging to the same VPN tunnel can be carried along different physical links. The multiplexing and management of the VPN tunnels is made possible by core routers supporting the VPN of the underlying network. The novelty of the presented work is the network flow model of VPN mapping on the underlying ISP network. We assume that the VPN topology, the topology of the ISP network and the total utilization cost for all underlying links are known parameters. Based on this, we propose a network management system based on a network flow optimization in order to define the minimal cost link allocation for the VPN tunnels. We provide a simulation of the proposed optimal establishment of VPN tunnels and performance evaluation of the simulation results.

In recent times, secure communication protocols over web such as HTTPS (Hypertext Transfer Protocol Secure) are being widely used instead of plain web communication protocols like HTTP (Hypertext Transfer Protocol). HTTPS provides end-to-end encryption between the user and service. Nowadays, organizations use network firewalls and/or intrusion detection and prevention systems (IDPS) to analyze the network traffic to detect and protect against attacks and vulnerabilities. Depending on the size of organization, these devices may differ in their capabilities. Simple network intrusion detection system (NIDS) and firewalls generally have no feature to inspect HTTPS or encrypted traffic, so they rely on unencrypted traffic to manage the encrypted payload of the network. Recent and powerful next-generation firewalls have Secure Sockets Layer (SSL) inspection feature which are expensive and may not be suitable for every organizations. A virtual private network (VPN) is a service which hides real traffic by creating SSL-protected channel between the user and server. Every Internet activity is then performed under the established SSL tunnel. The user inside the network with malicious intent or to hide his activity from the network security administration of the organization may use VPN services. Any VPN service may be used by users to bypass the filters or signatures applied on network security devices. These services may be the source of new virus or worm injected inside the network or a gateway to facilitate information leakage. In this paper, we have proposed a novel approach to detect VPN activity inside the network. The proposed system analyzes the communication between user and the server to analyze and extract features from network, transport, and application layer which are not encrypted and classify the incoming traffic as malicious, i.e., VPN traffic or standard traffic. Network traffic is analyzed and classified using DNS (Domain Name System) packets and HTTPS- (Hypertext Transfer Protocol Secure-) based traffic. Once traffic is classified, the connection based on the server’s IP, TCP port connected, domain name, and server name inside the HTTPS connection is analyzed. This helps in verifying legitimate connection and flags the VPN-based traffic. We worked on top five freely available VPN services and analyzed their traffic patterns; the results show successful detection of the VPN activity performed by the user. We analyzed the activity of five users, using some sort of VPN service in their Internet activity, inside the network. Out of total 729 connections made by different users, 329 connections were classified as legitimate activity, marking 400 remaining connections as VPN-based connections. The proposed system is lightweight enough to keep minimal overhead, both in network and resource utilization and requires no specialized hardware.

Performing QoS (Quality of Service) control in large computing systems requires an on line metric that is representative of the real state of the system. The Tardiness Quantile Metric (TQM) introduced earlier allows control of QoS by measuring efficiently how close to the specified QoS the system is, assuming specific distributions. In this paper we generalize this idea and propose the Generalized Tardiness Quantile Metric (GTQM). By using an online convergent sequential process, defined from a Markov chain, we derive quantile estimations that do not depend on the shape of the workload probability distribution. We then use GTQM to keep QoS controlled in a fine grain manner, saving energy in soft real-time web clusters. To evaluate the new metric, we show practical results in a real web cluster running Linux, Apache, and MySQL, with our QoS control and for both a deterministic workload and an e-commerce workload. The results show that the GTQM method has excellent workload prediction capabilities, which immediately translates in more accurate QoS control, allowing for slower speeds and larger energy savings than the state-of-the-art in soft real-time web cluster systems.

Reliability and security concerns have increased demand for Virtual Private Networks (VPNs). Ideally, a VPN service should offer autonomous overlay networks with guaranteed bandwidth allocations over a shared network. Network providers seek an automated VPN creation and management process, while users of a VPN would greatly benefit from secure control over the handling of their traffic. Currently, network infrastructure does not support such partitioning services and, due to its static nature, it cannot be adapted to meet such new demands. Active and Programmable Network research has developed a number of adaptable architectures. However, its current focus is on theoretical service deployment rather than on applicability to large and shared networking environments. This paper presents the application of a new programmable architecture to enable on-demand VPN construction, bandwidth management, and secure autonomous VPN control onto shared commercial infrastructure.

Scalable Quality of Service (QoS) control is of paramount importance to effectively enable a seamless convergence of the rapidly evolving Peer-to-Peer (P2P) overlay communications over the Internet since the latter only supports best-effort service paradigm. For example, the European Union (EU) funded ROMEO project is focusing on a joint use of DVB-T2 and P2P overlay networks for live multimedia content sharing and collaboration among multiple users. This raises a strong need that the media packets transmitted through the P2P overlay delivery system must arrive earlier enough at the end users to assure a proper synchronization of the multiple views that may be received via the hybrid network. For this purpose, the P2P network must assure a certain QoS guarantee in terms of bandwidth, delay, jitter, and loss. More importantly, the control must be scalable to prevent excessive signalling and the related processing overhead, usually suffered in the traditional per-flow QoS control approaches. In this view, recent research effort claimed that the Internet resources can be efficiently over-provisioned (booking more resources in-advance) in such a way to allow differentiation of QoS control with reduced signalling overhead and increased resource utilization. This approach, however, needs further investigations for proper integration into innovative networking architectural designs to achieve performance. In addition to that, and in order to provide an end-to-end QoS, a mechanism to enforce prioritization policies within the customer’s access network is also needed. Hence, this chapter proposes a cross-layer control architecture that takes advantage of the Internet resources over-provisioning and the QoS policy enforcement within access networks to facilitate rapid development of P2P applications. The design aims to alleviate the requirements of buffers and the need for adaptation on end users’ devices, thus allowing for cost-effective and rapid development of attractive services in similar hybrid content delivery networks.

We define a quality of service (QoS) model for QoS-NSIS signaling layer protocol (QoS-NSLP) application for supporting the virtual private network (VPN) QoS called 'hose-NSIS-QoSM'. The hose-NSIS-QoSM reserves and manages resources according to the hose based resource provisioning mechanisms. Specially, we specify the formats of NSLP signaling messages, the modification to the information in NSLP state and resource management (RM) state tables, and the procedure of signaling messages in NSIS node. Also, we compare the hose-NSIS-QoSM with the hose-RSVP-TE-QoSM that supports the hose based VPN QoS in the multi-protocol layer signaling (MPLS) networks using the extended point-to-multipoint (P2MP) resource reservation protocol-traffic engineering (RSVP-TE) mechanism.

Needs for internetworking private networks over a commonly shared public network have expanded the usage of Virtual Private Networks (VPNs). Customers, through the use of a RFC 4364 VPN, use service provider (SP) backbones to establish private connectivity between geographically disparate networks. As a direct result of SPs migrating towards an Internet Protocol (IP) over a Multi-Protocol Label Switching (MPLS) infrastructure, as observed within the Defense Information Switched Network (DISN) of the Global Information Grid (GIG), SPs have also begun to transition from providing traditional circuit-switched leased permanent virtual circuits through a layer two (L2) protocol (e.g., Asynchronous Transfer Mode (ATM) or Frame Relay (FR) to providing layer three (L3) VPN services. Currently, requirements for securing the GIG control plane traffic are undecided. A potential solution for protecting the GIG control plane includes instantiating Internet Protocol security (IPsec) Encapsulating Security Payload (ESP) Transport Mode across all GIG routers on a router-to-router basis. Although the use of IPsec has been proven to provide effective data confidentiality, data integrity, and authentication to devices operating on the data plane, both routing vendors and SP operators have shared concerns regarding network performance degradation associated with the use of IPsec on the control plane. This paper will investigate the performance implications of applying IPsec ESP Transport Mode to routers participating in 4364 VPNs, given a typical GIG scenario. Testing has been recently completed to determine the impacts of using IPsec protection on 4364 VPNs, specifically in a simulated GIG operating environment.