Securebox

Security functions are usually deployed on proprietary hardware, which makes the delivery of security service inflexible and of high cost. Emerging technologies such as software-defined networking and network function virtualization go in the direction of executing functions as software components in virtual machines or containers provisioned in standard hardware resources. They enable network to provide customized security service by deploying Security Service Chain (SSC), which refers to steering flow through multiple security functions in a particular order specified by individual user or application. However, SSC Deployment Problem (SSC-DP) needs to be solved. It is a challenging problem for various reasons, such as the heterogeneity of instances in terms of service capacity and resource demand. In this paper, we propose an SSC-based approach to deliver security service to users without worrying about physical locations of security functions. For SSC-DP, we present a three-phase method to solve it while optimizing network and security resource allocation. The presented method allows network to serve a large number of flows and minimizes the latency seen by flows. Comparative experiments on the fat-tree and Waxman topologies show that our method performs better than other heuristics under a wide range of network conditions.

Attack-aware Security Function Management

Cloud computing has become the technology of choice to deliver services to end‐users over the Internet. Cloud computing offers a wide range of services, including computing, storage and delivery, and different modes of providing services, that is, Software/Platform/Infrastructure‐as‐a‐Service (S/P/IaaS). This chapter focuses on the intersection of content delivery network (CDN) and cloud computing by exposing a number of trade‐offs on the deployment of multimedia processing functions inside the cloud and the complementarity of cloud and CDN deployments. It shows how the popularity of the cloud and its deployment at various scale factors has further blurred the distinction between the different service delivery infrastructures. There are three established content delivery platforms‐CDN, peer‐to‐peer (P2P), and cloud computing‐to support large‐scale service deployment in the Internet. The chapter presents a distinction between the traditional, remote, cloud, and the edge cloud. Next, it talks about a model for a cloud‐based deployment of media functions.

Advanced Communications, Technology and Services, known simply as ACTS, is one of the specific programmes of the “Fourth Framework Programme of European Community activities in the field of research and technological development and demonstration (1994–1998)” [1]. It provides the main focus of the European Unions research effort to accelerate deployment of advanced communications infrastructures and services, and is complemented by extensive European research in the areas of information technology and telematics. The stated objectives of ACTS are to “develop advanced communication systems and services for economic development and social cohesion within Europe, taking account of the rapid evolution of technologies, the changing regulatory situation and opportunities for development of advanced transeuropean networks and services”. Within ACTS, the emphasis of the work has shifted from the exploration of fundamental concepts and detailed system engineering, as it had been in earlier programs such as RACE (Research and development in Advanced Communication technologies for Europe), to issues relating to implementation of advanced systems and generic services, and applications which demonstrate the potential use of advanced communications in Europe. A key feature of the ACTS program is that the research be undertaken in the context of real-world trials.KeywordsField TrialSaturable AbsorberTiming JitterFibre LossOrder DispersionThese keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.

Information and Communication Technology (ICT) makes cities "smart", capable of providing advanced municipal services to citizens more efficiently. In the literature, many applications of municipal service platform based on cloud computing and edge computing have been proposed, but the reference model and application instance based on cloud-edge collaboration specially for municipal service platform is rarely studied. In this context, this paper first develops a reference model, including resource collaboration, application collaboration, service collaboration, and security collaboration, and discusses the main contents and challenges of each part. Then, aiming at the problem of computing and communication resources allocation in the cloud-edge collaboration, a game-theory-based dynamic resource allocation model is introduced. Finally, an e-government self-service system based on the cloud-edge collaboration is designed and implemented. The cloud side is a cloud computing server, and the edge side are the self-service terminals integrating various edge computing devices with Artificial Intelligence (AI) embedded. The experimental results show that the designed system combines the advantages of cloud computing and edge computing, and provides a better user experience with lower processing latency, larger bandwidth, and more concurrent tasks. Meanwhile, the findings show that the evolutionary equilibrium and the Nash equilibrium are the optimal solutions, respectively.

Smartphones can implement various security services from mobile banking to security tokens used for physical access control. System-wide trusted execution environments (TEEs), like ARM TrustZone, allow implementation of these services that withstand malware and operating system compromise. While researchers and developers have focused on secure storage and processing of credentials on such mobile TEEs, secure and practical bootstrapping of security services has been overlooked. The goal of this paper is to put forward the problem of secure user enrollment in the context of mobile system-wide TEEs. We explain why user identity binding to a mobile device is challenging on current smartphone platforms, and argue that current mobile device architectures do not facilitate secure enrollment and migration for such TEEs. We outline possible architecture changes that would enable the realization of secure and practical enrollment, and thus enable more widespread secure deployment of various mobile security services.

Testing and evaluation are critical to the development and deployment of autonomous vehicles (AVs). Given the rarity of safety-critical events such as crashes, millions of tests are typically needed to accurately assess AV safety performance. Although techniques like importance sampling can accelerate this process, it usually still requires too many tests for field testing. This severely hinders the testing and evaluation process, especially for third-party testers and governmental bodies with very limited testing budgets. The rapid development cycles of AV technology further exacerbate this challenge. To fill this research gap, this paper introduces the few-shot testing (FST) problem and proposes a methodological framework to tackle it. As the testing budget is very limited, usually smaller than 100, the FST method transforms the testing scenario generation problem from probabilistic sampling to deterministic optimization, reducing the uncertainty of testing results. To optimize the selection of testing scenarios, a cross-attention similarity mechanism is proposed to extract the information of AV’s testing scenario space. This allows iterative searches for scenarios with the smallest evaluation error, ensuring precise testing within budget constraints. Experimental results in cut-in scenarios demonstrate the effectiveness of the FST method, significantly enhancing accuracy and enabling efficient, precise AV testing.

ARVMEC: Adaptive Recommendation of Virtual Machines for IoT in Edge–Cloud Environment

Web-based DNNs provide accurate object recognition to the mobile Web AR, which is newly emerging as a lightweight mobile AR solution. Webbased DNNs are attracting a great deal of attention. However, balancing the UX against the computing cost for DNN-based object recognition on the Web is difficult for both self-contained and cloud-based offloading approaches, as it is a latency-sensitive service but also has high requirements in terms of computing and networking abilities. Fortunately, the emerging 5G networks promise not only bandwidth and latency improvement but also the pervasive deployment of edge servers which are closer to the users. In this article, we propose the first edge-based collaborative object recognition solution for mobile Web AR in the 5G era. First, we explore the finegrained and adaptive DNN partitioning for the collaboration between the cloud, the edge, and the mobile Web browser. Second, we propose a differentiated DNN computation scheduling approach specially designed for the edge platform. On one hand, performing part of DNN computations on mobile Web without decreasing the UX (i.e., keep response latency below a specific threshold) will effectively reduce the computing cost of the cloud system; on the other hand, performing the remaining DNN computations on the cloud (including remote and edge cloud) will also improve the inference latency and thus UX when compared to the self-contained solution. Obviously, our collaborative solution will balance the interests of both users and service providers. Experiments have been conducted in an actually deployed 5G trial network, and the results show the superiority of our proposed collaborative solution.

As a new way to design, deploy and manage networkservices, network functions virtualization (NFV) decouplesthe network functions, from one or more physical networkinfrastructures and black boxes so they can run in software.It therefore comes as no surprise that NFV originated fromservice providers, who were looking to improve the deploymentof new network services to support their revenue and growthobjectives. Within the NFV ecosystem, high availability and lowlatency are one of the key QoS benefits that service providerscan expect from the 5G Cloud and the NFV networks to makedelay-critical services such as remote surgery a reality. Therefore,network services should be placed, chained and routed throughthe network considering users/tenants stringent quality of service(QoS) and service-level agreement (SLA) requirements. To thisend, routing and placement optimization plays a major rolein improving network performance and the overall networkcost. In this paper, we study the problem of virtual networkfunctions (VNFs) placement and routing across the physical hoststo minimize overall latency defined as the queuing delay withinthe edge clouds and in network links. In that respect, this worktakes a holistic view by considering not only VNFs chaining andplacement problem but also considering the flows routing aspectsince these two problems are inter-related and have a majorimpact on network latency.

This paper presents some problems that arise in the deployment of new advanced telecommunication services and a new way to deal with them using hypermedia distributed systems. A special emphasis is placed on the propagation of the service in order to rapidly reach the subscriber/user.

With the large-scale commercial application of data center networks, the security problem of data center network is attracting more and more attention. However, security functions are usually placed on proprietary hardware, which makes the delivery of security service inflexible and of high cost. The emerging software-defined networking and network function virtualization in a joint manner are promising technology that can solve these outlined problems through a process named security service chaining (SSC) composition. Determining the composition of SSC that optimizes the resource allocation is a challenging problem, particularly without violating security and resource requirements. This problem is called the dynamic SSC composition problem, and an integer linear programming formulation with implementation in GLPK is provided. A novel heuristic solution is provided based on the breadth first search algorithm. The obtained experimental results show that the proposed algorithm can perform better than the compared ones, and the advantage of the proposed mechanism is also demonstrated via NetFPGA-10G prototype.

The ARINC-653 standard defines temporal partitioning that enables multiple avionics applications to execute independently from each other without interference in terms of CPU resources. Though partitioning has been mainly discussed from the viewpoint of manned aircraft, it can also efficiently integrate multiple applications on civilian Unmanned Aerial Vehicles (UAVs) that have even severer limitations on size, weight, power, and cost. In order to employ ARINC-653 temporal partitioning to civilian UAVs, its implementation must be flexible enough to be applied to diverse run-time software environments and computing hardware platforms. In this paper, we suggest a portable and configurable implementation of ARINC-653 for small-sized civilian UAVs aiming for low cost, easy development, and easy extension. Our implementation provides the Operating System (OS) abstraction layer that defines the essential OS-level features and the OS-independent interfaces to the upper layer that actually implements the ARINC-653 standard. Our implementation is also modularized so that the policies of resource management in CPU scheduling and memory allocation can be easily extended and selectively configured. In addition, we implement the advanced resource management schemes to promote the benefits of multi-core processors that are already widely deployed in Commercial Off-The-Shelf (COTS) systems. We show that our ARINC-653 implementation is portable across different OS, such as Linux and RTEMS, reusing the most of source codes thanks to the layered and modular design. We also analyze the overheads of the ARINC-653 APEX interfaces and multi-core scheduling. Moreover, we conduct a case study for a small-sized quad-copter.

To meet the urgent security demands, 5G aims to deploy virtualized and programmable security services and defense potential threats in real time. With the development of network function virtualization and software-defined networking, security functions can be dynamically and flexibly chained to cope with many types of malicious attacks. Although there are a number of studies on security function chaining for the 5G, they primarily focus on the security function composition, rather than rule enforcement. In fact, the misconfiguration of rules for security functions is notably common because of the security function diversity and rule heterogeneity that causes many unexpected and serious problems. Therefore, in this paper, we propose a priority-based anomaly-free mechanism with defined security rule anomalies. To avoid misconfiguration, we also propose and implement a simply configured rule management framework with anomaly resolution. With extensive performance evaluations, we show the availability and efficiency of our proposed mechanism to resolve security rule anomalies.

Customers now expect advanced IP services like video conferencing and application rental become customizable and easy to use. So, network service providers must be able to dynamically deploy such Internet services fitting the requirements of service customers while avoiding the expensive solution of over-provisioning the service. However, the current Internet technologies are lacking when it comes to developing and deploying new services, integrating together service offerings. This paper presents a service architecture which enables the creation, on-demand deployment and management of advanced IP services using the active network capabilities. In our approach, each business IP service is considered as a composition of basic service components which can be shared among different business IP services. Upon the requests of service users and Service Definition information, initialized by providers, mobile code is downloaded into active nodes and installed in the network as new basic service components. Finally, this paper presents the implementation of a Content Delivery Service using our proposed service architecture.