Supporting reliable and secure transport services over DVB-RCS satellite systems using XCP

It has long been understood that Transport Control Protocol (TCP) traffic performs poorly across satellite links. To overcome this performance challenge, SATCOM users have traditionally used Performance Enhancing Proxies (PEP) to "accelerate" TCP traffic. PEPs work by breaking the end-to-end TCP connection, running a different layer 4 protocol across the satellite link, and proxying the TCP connections with each end host. To do this, PEPs must be able to inspect and modify the entire IP packet, including the TCP segment header, to ensure proper handling of TCP traffic over the link. The Department of Defense (DoD) is in the process of implementing the Global Information Grid (GIG), an Internet-like network for warfighters anywhere on Earth. Current plans call for the GIG to transition to a "Black", or IP-encrypted, Core in the future [3]. Within the Black Core, IP packets will be completely encrypted, obscuring all information at layer 3 and above. Such an approach would render existing PEPs useless if placed in the Black Core. This is referred to in this paper as the Black Core problem. Many solutions have been proposed to the Black Core problem. Proposed solutions have included making changes to the network architecture, to the network protocols, or both. This paper expands upon the overview of PEP-based solutions presented in [4], and details several additional approaches. Additionally, this paper overviews the advantages and disadvantages for each method.

This paper presents a TCP/IP-based architecture (IPSecOPEP) to resolve the interoperability issue between PEPs (Performance Enhancing Proxies) and IPSec (Internet Protocol Security). Where this problem is due to the cryptographic protection of TCP header by IPSec ESP protocol, which prohibits TCP enhancing mechanisms to be performed by PEPs. The key idea of this solution is that IPSec devices can perform well as a bridge between end users and PEPs in such situations, because they can access to both TCP headers of original packets and IPSec headers of encrypted packets. By this way, IPSec devices can perform a simple mapping between original TCP headers and their corresponding IPSec headers to resolve the interoperability issue. In our proposed IPSecOPEP architecture, we add a new components to the standard TCP/IP stack for IPSec devices and PEPs proxies, to ensure cooperatively and transparently the interoperability between them, without affecting the security privacy and performance level in such situations. In fact, this solution doesn't need to exchange any secret information about IPSec-related security associations. Furthermore it doesn't imply the use of any additional headers to IPSec packets by the PEPs. However, IPSec devices should coordinate between end users and PEPs to ensure spoofing mechanism, to avoid slow start problem of a standard TCP. After that, PEPs can continue to apply other enhancing mechanisms over the satellite link. Hence, this solution presents a double advantages concerning both the security and the performance at once. Moreover, the components of this solution can be easily standardized, implemented, integrated and enabled, in IPSec and PEPs devices.

Satellites have played an important role in global telecommunications. However, transmission control protocol (TCP) suffers performance degradations over satellite links due to the long propagation delay and high bit‐error rate. Among methods proposed to alleviate the impact of satellite link characteristics on TCP performance, split TCP connections separated by performance enhancement proxies (PEPs) have been proven attractive because they can keep TCP configurations in the end systems unchanged. While many protocols applied over satellite links between PEPs can effectively mitigate the effect of high loss rates, the long latency still limits the effectiveness of congestion control in these protocols. To minimize the effect of congestion we propose to take advantage of active queue management at the medium access control layer to provide immediate cross‐layer feedback to the TCP segment over satellite. This approach also achieves proper differentiation between packet losses due to channel errors and congestion. Simulation results show that our novel mechanism can give substantial improvements in TCP performance over satellite networks, compared to the best performing version of TCP with or without PEPs. Copyright © 2006 John Wiley & Sons, Ltd.

Mobile computing and security in Internet have become two of the most important challenges in the information technology world. Among wireless technologies which support user mobility, satellites will play a very important role. Unfortunately, TCP does not perform well on satellite channels because of the related high delay-bandwidth product, high bit error rate (BER) and burst errors mainly due to shadowing. In order to obtain improvements in TCP performance, an approach local to the satellite link could be adopted. In fact, recently, some studies showed the effectiveness of the use of a reliable data link protocol that is well suited to mobile geo-stationary satellite channel characteristics. However, the resultant more variable end-to-end delay causes, as a side effect, a new problem: the competition between retransmission mechanisms at transport layer and data link layer. The introduction of a suitable performance enhancing proxy (PEP) on the satellite gateway has proved to be a viable technique to face the problem. However, the compatibility with the usage of network layer security mechanisms, such as IPSec, should be pursued. This paper just deals with the definition of an IPSec-aware TCP PEP, called secure PEP (SPEP), that is completely transparent to IPSec architecture. The performances of SPEP have been validated in the context of Web application by using network simulator tool. The simulation results, in terms of Web-page download mean time, have shown that the proposed solution provides substantial improvements in TCP performance.

위성 통신은 넓은 지역에 통신 서비스를 제공하는 광역 네트워크이다. 하지만, 위성 통신은 대역폭이 제한되고 매우 긴 전파 지연 시간과 높은 BER(Bit Error Rate)로 인해 위성 통신을 고려하지 않은 TCP의 성능이 저하 된다. 본 논문에서는 위성 통신에서의 TCP 성능을 향상시키기 위해 DVB-RCS(Digital Video Broadcasting-Return Channel via Satellite) 네트워크 환경을 고려한 cross-layer 기반 PEP(Performance Enhancing Proxy) 기술을 제안한다. 제안하는 프로토콜은 TCP와 링크 계층 간 위성 자원 할당 정보를 정보 교환을 통해 최적의 TCP CWND(Congestion Window)를 설정한다. 제안한 프로토콜의 성능 평가를 위해 리눅스 기반의 PEP 테스트 베드를 구현하였다. 성능 평가 결과 다양한 BER에서 제안한 프로토콜은 위성 자원 할당 정보를 이용하여 최적의 TCP CWND 크기를 설정하기 때문에 단일 및 다중 세션 환경에서 기존 TCP 보다 제안한 프로토콜이 더 좋은 성능을 보여준다는 것을 확인할 수 있었다. Satellite communication is a wide area network (WAN) which provides communication service worldwide. However, the performance of TCP can be seriously degraded in the satellite networks due to limited bandwidth, long round-trip time (RTT) and high bit error rate (BER) over satellite links. In order to improve the performance of TCP, this paper proposes cross-layer Performance Enhancing Proxy (PEP) in digital video broadcasting-return channel via satellite (DVB-RCS) networks. The proposed protocol sets TCP Congestion Window (CWND) size by using satellite resource allocation information exchanged between TCP and the link-layer. we implement PEP testbed based on Linux to evaluate the performance of the proposed protocol. The simulation results show that the proposed protocol performs better than standard TCP both in single and multiple sessions in variant BER, because the proposed protocol sets TCP CWND size by using satellite resource allocation.

SUMMARYApplications that use the reliable Transmission Control Protocol (TCP) have a significant degradation over satellite links. This degradation is mainly a consequence of the congestion control algorithm used by standard TCP, which is not suitable for overcoming the impairments of satellite networks. To alleviate this problem, two TCP Performance Enhancing Proxies (PEPs) can be deployed at the edges of the satellite segment. Then these PEPs can use different mechanisms such as snooping, spoofing and splitting to achieve a better TCP performance. In general, these mechanisms require the manipulation of the Internet Protocol (IP) and TCP headers that generates a problem when deploying the standard IP security (IPsec) protocol. The security services that IPsec offers (encryption and/or authentication) are based on the cryptographic protection of IP datagrams, including the corresponding IP and TCP headers. As a consequence, these cryptographic protections of IPsec conflict with the mechanisms that PEPs use to enhance the TCP performance in the satellite link. In this article, we detail the reasons that cause this conflict, and we propose three different approaches to deploy IPsec in a scenario with TCP PEPs. Our proposals provide different trade‐offs between security and TCP performance in some typical scenarios that use satellite networks. Copyright © 2012 John Wiley & Sons, Ltd.

With the advent of gaining popularity in cloud computing, there is an increase in demand of resources among the heterogeneous workload types on cloud. Resource management is a key challenging problem that is faced by the cloud service providers, by achieving business goals and agreed level of service with the subscribers. This paper focuses on dynamic resource allocation with risk analysis by meeting service level agreements. Further proposed framework handles heterogeneous workload types by dynamic capacity planning with risk assessment to maximise the profit and resource utilisation on clouds. In addition to advanced resource reservation, SLA-based scheduling/rescheduling with risks involved in resource allocation is considered in the proposed model. The experimental results demonstrate that proposed framework maximises the resource utilisation and profit gain of the cloud service provider when evaluated against widely used static configuration strategy.

We highlight the advantages of dynamic wavelength allocation and path rerouting in hybrid optical flow-switched data center networks compared with static electronic packet-switched data center networks. Current electronic packet-switched networks perform routing based on lookup tables and shortest path routing over high speed optical connections. However, load balancing and path rerouting are not designed in coordination with the optical data plane. In this work, we design and analyze the performance of load balancing and resource allocation in hybrid flow data center architectures. In the hybrid flow architecture, the transport layer and control plane are responsible for load balancing, congestion control and reliable data delivery in wavelength division multiplexed networks. The transport layer abstracts the underlying network and data link layers from user applications. Applications are unaware of whether flows are transmitted via the electronic data plane, optical data plane, or both, where the relevant metric for applications is transaction delay. We show that the data center architecture that minimizes delay in the presence of elephant flows and dynamic loads is the hybrid flow architecture with dynamic resource allocation.

Traditional algorithms for dynamic OFDMA resource allocation have relatively deterministic system capacity and user fairness. Thus, in this letter, an efficient scheme is proposed to flexibly adjust quality-of-service for users, which is achieved by appropriately setting minimum data-rate of each user.

The architecture of the global information grid with respect to network centric operations is being established and refined through successive reference models, whose communities of interest are geographic in nature. The general problem domain of network operations represents a challenge, given the primitive nature of COTS components. A latent problem of dynamic network reconfiguration and resource allocation exists, for which a cross-industry model is being developed. State-based network management introduces an object-oriented framework for operating data networks that uses Hayes-Roth's concept of valued information at the right time (VIRT). Traditional network management requires a static topology and extensive heuristic filtering of redundant data to identify the origin of faults. SBNM instead relies on publish-subscribe mechanisms for horizontally-organized systems for the most efficient "push and pull" of information. Data stores necessary for SBNM include application-specific, geographically-located data flow information with service quality requirements, as well as an inventory of available links and nodes. An SBNM engine regularly compile network topology and, upon some network alarm event, recommend a new topology to meet application-location requirements. Some regions in the U.S. electricity grid are adopting a similar XML messaging scheme, as well as synchronized and standardized instrumentation and telemetry. This approach develops appropriate definitions for system state and stability but does not maintain detailed demand or load requirements. In this regard, network SBNM holds an advantage. State-based network management is an application that can be a leading exemplar of network centric information sharing at the application layer. Through the Worldwide Consortium for the grid, the development of SBNM can affect standards and policy in both government and commercial sectors

In view of the fact that the limited wireless resources and the asymmetric traffic between uplink and downlink in the trunking communication system based on TD-SCDMA network, a design scheme of dynamic resource allocation (DCA) is given. DCA is a very effective technology to solve those problems and enhance the utilization of resource. Based on the characteristics of the trunking communication system, we combine with the DCA algorithms of TD-SCDMA network in this paper, and give an optimal DCA strategy for the truking communication system in TD-SCDMA network. Finally, the simulation result shows the DCA strategy markedly improve the system performance and gain higher resource utilization.

An IP-ERN architecture to enable hybrid E2E/ERN protocol and application to satellite networking

This paper discusses the issue of dynamic resource allocation (DRA) in the context of cognitive radio (CR) networks. We present a general framework adopting generalized transmitter and receiver signal-expansion functions, which allow us to join DRA with waveform adaptation, two procedures that are currently carried out separately. Moreover, the proposed DRA can handle many types of expansion functions or even combinations of different types of functions. An iterative game approach is adopted to perform multi-player DRA, and the best-response strategies of players are derived and characterized using convex optimization. To reduce the implementation costs of having too many active expansion functions after optimization, we also propose to combine DRA with sparsity constraints for dynamic function selection. Generally, it incurs little rate-performance loss since the effective resources required by a CR are in fact sparse.

A Dynamic Operations Research Framework for Military Logistics and Resource Allocation Under Uncertainty: A War Simulation Case Study

Future wireless networks will support the growing demands of heterogeneous services. Dynamic resource allocation is essential to guarantee quality of service (QoS) and enhance the network performance. We propose a novel resource allocation framework to cope with the time-varying channel conditions, co-channel interferences, and different QoS requirements in various kinds of services. We define a QoS measurement for delay sensitive applications. We introduce a credit system, where users have their autonomy to decide when and how to use their resources, and users can borrow or lend resources from the system. We also develop a simple feedback mechanism to report the system with the users' QoS satisfaction levels and channel conditions. Then the system will adapt its resource allocation strategy according to the users' feedbacks to favor the users with the bad QoS satisfaction levels or the good channels. We develop adaptive algorithms at both the user and system levels. From simulations, the proposed algorithms efficiently allocate the resources to different types of users. The users' delay constraints are satisfied and the links can survive under a long period of bad channels.