George Lapiotis

A policy-based approach to wireless LAN security management

Wireless Ethernet (or Wi-Fi) security management is a challenging area of increased interest due to the widespread deployment of Wireless LANs (WLANs) and their well-known vulnerabilities to various types of attacks, as well as stringent scalability requirements in the dynamic wireless domain. Until the adoption of the latest security standards is complete, users and network assets on deployed WLANs, such as 802.11a/b/g networks, need to be protected from existing security threats without depending on the latest features. In addition, while new standards can protect the unauthorized use of network resource for outsiders, they do not deal with the misuse or misbehaviors by insiders. In this paper we present a hierarchically distributed policy-based system architecture and prototype implementation for WLAN security management. The architecture includes a central policy engine that validates policies and computes new configuration settings for network elements when access policies are violated, distributed wireless domain policy managers with consistent local policy autonomy that coordinate dedicated local monitors so as to monitor and control multi-vendor WLAN access points (APs). The local monitors include wireless intrusion detection modules and wireless AP interface adaptors. Although in this paper we focus on wireless security aspects, the overall architecture can be applied to end-to-end security management of wireline and wireless networks.

GPS analysis of multiple sessions with applications to admission control

We introduce a statistical method to analyze multiplexing of multiple sessions sharing link bandwidth using generalized processor sharing (GPS) scheduling. Our method is shown to substantially improve previous upper bounds for GPS scheduling of Markov modulated fluid processes (MMFP) sessions, especially as the number of sessions increases. Application of analytical results to admission control indicate that by sharing bandwidth using GPS among traffic classes there are significant gains over systems that statically segregate the link bandwidth. This effect is quantified in several experiments where various combinations of source types are used. The gains are pronounced when bursty sources with stricter QoS requirements are used.

The effective bandwidth of Markov modulated fluid process sources with a generalized processor sharing server

Generalized processor sharing (GPS) is an important scheduling discipline because it enables bandwidth sharing with work conservation and traffic isolation properties. While Markov modulated fluid processes (MMFP) capture the dynamics of the sources, the analysis of such sources with a GPS server is difficult because of the large state space. We study a multi-queue GPS system with MMFP classes and propose a scalable, low complexity algorithm for the tail distributions of the logical queues. The effective bandwidth of the classes and a simple connection admission control (CAC) scheme are derived. Numerical results illustrate the efficiency and accuracy of the technique. The application to an example system of classes consisting of voice and variable bit rate (VBR) video traffic is included.

Quality of service analysis of shared buffer management policies combined with generalized processor sharing

An objective of the next generation network is the accommodation of services with different QoS requirements. This indicates that the network should provide special mechanisms in order to prioritize the access to network node resources, such as link capacity and buffer space. We studied the performance of sharing buffer space and link capacity between sessions, the traffic of which is modeled by independent general Markov-modulated fluid process (MMFP) sources. For scheduling we use the generalized processor sharing (GPS) policy, and improve previous upper bounds on the queue occupancy distributions. As an example of combining GPS with buffer management we apply our results to complete buffer sharing with virtual partitioning (VP+GPS). We also derive results on the resource allocation trade-off, with applications in traffic management and admission control.