Hassan Habibi Gharakheili

Virtualizing the access network via open APIs

Residential broadband consumption is growing rapidly, increasing the gap between ISP costs and revenues. Meanwhile, proliferation of Internet-enabled devices is congesting access networks, frustrating end-users and content providers. We propose that ISPs virtualize access infrastructure, using open APIs supported through SDN, to enable dynamic and controlled sharing amongst user streams. Content providers can programmatically provision capacity to user devices to ensure quality of experience, users can match the degree of virtualization to their usage pattern, and ISPs can realize per-stream revenues by slicing their network resources. Using video streaming and bulk transfers as examples, we develop an architecture that specifies the interfaces between the ISP, content provider, and user. We propose an algorithm for optimally allocating network resources, leveraging bulk transfer time elasticity and access path space diversity. Simulations using real traces show that virtualization can reduce video degradation by over 50%, for little extra bulk transfer delay. Lastly, we prototype our system and validate it in a test-bed with real video streaming and file transfers. Our proposal is a first step towards the long-term goal of realizing open and agile access network service quality management that is acceptable to users, ISPs and content providers alike.

Network-level security and privacy control for smart-home IoT devices

The increasing uptake of smart home appliances, such as lights, smoke-alarms, power switches, baby monitors, and weighing scales, raises privacy and security concerns at unprecedented scale, allowing legitimate and illegitimate entities to snoop and intrude into the familys activities. In this paper we first illustrate these threats using real devices currently available in the market. We then argue that as more such devices emerge, the attack vectors increase, and ensuring privacy/security of the house becomes more challenging. We therefore advocate that device-level protections be augmented with network-level security solutions, that can monitor network activity to detect suspicious behavior. We further propose that software defined networking technology be used to dynamically block/quarantine devices, based on their network activity and on the context within the house such as time-of-day or occupancy-level. We believe our network-centric approach can augment device-centric security for the emerging smart-home.

An experimental study of security and privacy risks with emerging household appliances

Smart household appliances, ranging from light-bulbs and door-locks to power switches and smoke-alarms, are rapidly emerging in the marketplace, with predictions that over 2 billion devices will be installed within the next four years. However, security implementations vary widely across these devices, while privacy implications are unclear to users. In this paper we dissect the behavior of a few household devices, specifically the Phillips Hue light-bulb, the Belkin WeMo power switch, and the Nest smoke-alarm, and highlight the ease with which security and privacy can be compromised. We then propose a new solution to protect such devices by restricting access at the network-level. Our solution does not require changes from device manufacturers, reduces burden on the end-users, and allows security to be offered as an overlay service by the ISP or from a specialist provider in the cloud.

User control of quality of experience in home networks using SDN

Home networks are becoming increasingly complex, with many household devices (PCs tablets, phones, media gateways, smart TVs) and diverse user applications (browsing, video streaming, peer-to-peer, VoIP, gaming) sharing the single broadband access link. In todays architecture the traffic streams compete for bandwidth on a best-effort basis, resulting in poor quality of experience for users. In this paper, we leverage the emerging paradigm of software defined networking (SDN) to enable the ISP to expose some controls to the users to manage service quality for specific devices and applications in their household. Our contributions are to develop an architecture and interface for delegation of such control to the user, and to demonstrate its value via experiments in a laboratory test-bed using three representative applications: video, web-browsing, and large downloads.

Personalizing the home network experience using cloud-based SDN

Home networks are becoming increasingly rich in devices and applications, but continue to share the broadband link in a neutral way. We believe the time is ripe to personalize the home network experience, allowing a household to differentiate its users (e.g. fathers laptop prioritized over kids iPad) and services (e.g. video streaming prioritized over downloading). In this paper we argue that SDN provides a way to automate self-customization by households, while cloud-based delivery simplifies subscriber management. We develop an architecture comprising a cloud-based front-end portal and SDN-based back-end APIs, and show how these can be used by the subscriber to improve streaming-video (YouTube) quality and video conferencing (Skype) experience, and to permit device-specific parental controls (e.g. Facebook access). We prototype and validate our solution in a platform comprising the Floodlight controller and OVS switches. Lastly, we evaluate our solutions via experiments of realistic scenarios to quantify the benefits in terms of improved quality of experience and new features for the user.

Low-cost flow-based security solutions for smart-home IoT devices

The rapid growth of Internet-of-Things (IoT) devices, such as smart-bulbs, smoke-alarms, webcams, and health-monitoring devices, is accompanied by escalating threats of attacks that can seriously compromise household and personal safety. Recent works have advocated the use of network-level solutions to detect and prevent attacks on smart-home IoT devices. In this paper we undertake a deeper exploration of network-level security solutions for IoT, by comparing flow-based monitoring with packet-based monitoring approaches. We conduct experiments with real attacks on real IoT devices to validate our flow-based security solution, and use the collected traces as input to simulations to compare its processing performance against a packet-based solution. Our results show that flow-based monitoring can achieve most of the security benefits of packet-based monitoring, but at dramatically reduced processing costs. Our study informs the design of future smart-home network-level security solutions.

Pricing user-sanctioned dynamic fast-lanes driven by content providers

The notion of “fast-lanes” for prioritising certain Internet content on residential broadband access links is being vigorously debated today. While Internet Service Providers (ISPs) see fast-lane revenue as an imperative for their economic sustainability, end-users and several Content Providers (CPs) feel threatened by the violation of network neutrality. In this paper we argue that fast-lanes can present a win-win-win situation for ISPs, CPs, and end-users alike, if implemented in a way that gives each party appropriate control knobs. To this end, we present an architecture in which fast-lanes are dynamically created and destroyed on-the-fly on a per-session basis using input from all three parties - this departs from current proposals that have largely focused on static fast-lanes. We then present a simplified economic model that demonstrates the benefits for each entity: users can get enhanced Quality of Experience (QoE) at no extra cost, CPs can monetise user-satisfaction using business-models of their discretion, and the ISP can experiment with two-sided pricing models of their choice. We evaluate our proposal using real traffic traces and multiple pricing models, and set the ground for a deeper study into the economics of dynamic fast-lanes.

Third-party customization of residential Internet sharing using SDN

Todays residential Internet service is bundled and shared by a multiplicity of household devices and members, causing several performance problems. Customizing broadband sharing to the needs and usage patterns of each individual house has hitherto been difficult for ISPs and home router vendors. In this paper we design, implement, and evaluate a system that allows a third-party to create new services by which subscribers can easily customize Internet sharing within their household. Our specific contributions are three-fold: (1) We develop an over-the-top architecture that enables residential Internet customization, and propose new APIs to facilitate service innovation. (2) We identify several use-cases where subscribers benefit from the customization, including: prioritizing quality-of-experience amongst family members; monitoring individual usage volumes in relation to the household quota; and filtering age-appropriate content for selected users. (3) We develop a fully-functional prototype of our system leveraging open-source SDN platforms, deploy it in selected households, and evaluate its usability and performance benefits to demonstrate feasibility and utility in the real world.

Comparing edge and host traffic pacing in small buffer networks

As packet switching speeds scale to Terabits-per second and beyond, power considerations are increasingly forcing core router manufacturers to adopt all-optical and hybrid opto-electronic single-chip switching solutions. Such routers will have small buffers, typically in the range of a few tens of Kilobytes, causing potentially increased packet loss, with adverse impact on end-to-end TCP performance. We recently proposed and analysed the benefits of pacing traffic at the network edge for open-loop real-time traffic in a small buffer network. However, no detailed study of the efficacy of edge pacing on closed-loop TCP performance has been undertaken for such a network.In this paper, we consider two pacing methods - TCP pacing at the end-hosts, and traffic pacing by the network edge - in the context of small buffer networks, and undertake a comprehensive comparison. Our contributions are threefold: First, we show via extensive simulations that under most scenarios (considering bottleneck and non-bottleneck core links, low-speed and high-speed access links, long- and short-lived TCP flows, and different variants of TCP) edge pacing performs as well or better than host pacing in terms of link utilisation (TCP throughputs) and average per-flow goodputs. Second, we provide analytical insight into the setting of the edge pacing delay parameter, showing how the efficacy of pacing relates to bottleneck buffer size. Third, we demonstrate the benefits of pacing in practical scenarios multiplexing both TCP and real-time traffic, and discuss incremental deployment of pacing, highlighting that unlike host pacing that requires adoption by a critical mass of users, edge pacing can be deployed relatively easily under service provider control to facilitate rapid migration to core networks with small buffers.

An economic model for a new broadband ecosystem based on fast and slow lanes

Todays residential broadband ecosystem is in stasis: ISPs suffer from low margins and flat revenues, content service providers (CSPs) have unclear incentives to invest in broadband infrastructure, and users have limited dimensions (speed/quota) in which to compare broadband pricing. This article explores the use of service quality capabilities, in the form of fast and slow lanes, for overcoming this stasis. We propose an architecture in which all entities have a say: CSPs request dynamic fast and slow lane creation for specific sessions, ISPs operate and charge for these lanes, and users control their broadband bandwidth available to such lanes. We develop an economic model that balances fast and slow lane pricing by the ISP with the returns for CSPs and service quality improvement for end users, and evaluate the parameters of our model with real traffic traces. We believe our proposal based on dynamic fast and slow lanes can represent a win-win-win situation for ISPs, CSPs, and end users alike, and has the potential to overcome the current stagnation in broadband infrastructure investment.