Nariyoshi Yamai

NFS‐based secure file sharing over multiple administrative domains with minimal administration

Although several schemes of file sharing for Unixes have been proposed so far, file sharing by these schemes between different administrative domains is difficult and imposes enormous burden on the administrators even if file sharing is possible since the user information differs by such computers in general. In this paper, the file system PNFS (Proxy/Private Network File System), which makes file sharing based on NFS easy between different administrative domains, is proposed. With PNFS, a user can share files of a server that has his account without intervention of its administrator. Although, in general, a decrease in security occurs when intervention of an administrator is omitted, security is enhanced by encryption and the like by the PNFS. In addition, the efficacy of the proposed system has been verified by performance evaluation of a prototype system, which shows a practically sufficient throughput even with simultaneous accesses from a multiple number of clients.

A dynamic traffic sharing with minimal administration on multihomed networks

Multihomed network is one of the most efficient configuration to improve the response time of network services. However, it is hard to introduce or manage because the existing configuration methods have several problems in that they require much technical skill, involve administrative over-burden for the administrator and so on. In this paper, we propose a dynamic traffic sharing technique and suitable backbone selection metrics to address some of these problems. Using the proposed technique, an appropriate backbone can be selected per connection with minimal technical skill and low administrative cost. In addition, the proposed metrics performs more efficient traffic sharing as compared to others techniques that were investigated.

An Identification Method of PCs behind NAT Router with Proxy Authentication on HTTP Communication

NAT (Network Address Translation) is widely used as a technique that shares a single IP address in several PCs, and is widely used for alleviating the IPv4 address exhaustion and as a security solution. However, when a backbone network has access control function for PCs based on their IP addresses, it can not identify the PCs behind a NAT router since their original IP addresses are hidden by the NAT router. In this research, to solve this problem, we focus on www which is the most popular service of the Internet and propose an identification method of PCs behind a NAT router with proxy authentication. In this method, we modified the proxy server so that it is able to identify PCs by using the field called realm in the authentication header and allocating it uniquely to PCs.

Performance Improvement of TCP using Performance Enhancing Proxies — Effect of Premature ACK Transmission Timing on Throughput —

In order to improve TCP performance, a method using a PEP (performance enhancing proxy) is proposed. The PEP operates on a router along a TCP connection. When a data packet arrives at the PEP, it forwards the packet to the destination host, transmits the corresponding ACK (premature ACK) to the source host in behalf of the destination host and stores the copy of the packet into its own buffer (PEP buffer) in case of the retransmission of the packet. In this paper, under the strategy which keeps the number of packets in the PEP buffer for which premature ACKs have been returned being less than or equal to a fixed threshold value (watermark value), we investigate the relation between the watermark value and the maximum throughput. Extensive simulation runs show that the simulation results are roughly classified into two cases. One case is that the maximum throughput becomes larger for larger watermark value and becomes a constant value when the watermark value is over a value. The other case is that though the maximum throughput becomes larger for lager watermark value in the same way, it reversely decreases when the watermark value is over a value. We also show that the latter (former) case is easier to occur as the propagation delay in the input side network of the PEP becomes smaller (larger) and the propagation delay in the output side network of the PEP becomes larger (smaller) and the PEP buffer capacity becomes smaller (larger)

A MAC-address Relaying NAT Router for PC Identification from Outside of a LAN

NAT (Network Address Translation) is well-known as one of the short-term solutions of IPv4 address exhaustion. NAT is a technique that shares a single IP address in several PCs, and is widely used for alleviating the IPv4 address exhaustion and as a security solution. However, when a backbone network has access control function for PCs based on their IP addresses, it cannot identify the PCs under a NAT router since their original IP addresses are hidden by the NAT router. In this research, we focus on MAC address which identifies PC at datalink layer and propose a NAT router which relays the MAC addresses of PCs inside of a LAN to the outside. Since the source MAC addresses of packets sent from PCs are preserved even after being relayed by the NAT router, a LAN access control server outside of the NAT router can still identify these PCs based on their MAC addresses instead of their IP addresses.

A Cooperative Routing Method for Multiple Overlay Networks

When multiple overlay networks are constructed over the same underlying IP network, overlay paths on different overlay networks may share some links on the IP network. In general, however, because overlay networks do not recognize the existence of each other, they have no consideration on such shared physical links. In this paper, a cooperative routing method for multiple overlay networks is proposed to improve the throughput of all overlay networks.

A protection method against massive error mails caused by sender spoofed spam mails

Wide spread of spam mails is one of the most serious problems on e-mail environment. Particularly, spam mails with a spoofed sender address should not be left alone, since they make the mail server corresponding to the spoofed address be overloaded with massive error mails generated by the spam mails, and since they waste a lot of network and computer resources. In this paper, we propose a protection method of the mail server against such massive error mails. This method introduces an additional mail server that mainly deals with the error mails in order to reduce the load of the original mail server. This method also provide a function that refuses error mails to these two mail servers to save the network and computer resources.

Performance Improvement of SCTP Communication Using Selective Bicasting on Lossy Multihoming Environment

In recent years, with proliferation of smart phones and tablet PCs, speedup of wireless LAN communication is required for dealing with increase of traffic in wireless networks. However, transmission speed through a wireless network often slows down in comparison with that through a wired network since packets of wireless networks frequently drop due to the influence of surrounding environment such as electromagnetic noise. In this paper, we propose a method to mitigate the impacts caused by packet loss by virtue of SCTP bicasting in lossy multihoming environment with two or more wireless networks. This method bicasts not all packets but only important packets concerning retransmission for efficiency since bicasting all packets would cause congestion. We also implemented a prototype system based on the proposed method. According to the result of performance evaluation experiment, we confirmed the effectiveness of the proposed method by the fact that the prototype system performed faster transmission than normal SCTP transmission even in high packet loss rate environment.

An Execution Control System for Application Software Reducing Administrative Burden of Educational PCs

In recent years, there have been a large number of educational PCs in many universities with the development of computer-assisted teaching. As the number of educational PCs has increased, the burden on the administrators has also increased. In general, these educational PCs have been configured from one or a few model disk images to reduce this burden. This method, however, lacks flexibility of administration. Use of some application software is restricted to specific users or specific sites in the universities. Use of other application software is prohibited by teachers during some examinations. The traditional method does not work well under these conditions. This paper proposes a system to reduce the administrative burden of educational PCs even in those situations. The proposed system controls the execution of individual application software on each educational PC depending on the attributes or the location of users. Teachers as well as administrators are allowed to configure the settings for the proposed system to control the execution of application software dynamically during their class.

Throughput Optimization in TCP with a Performance Enhancing Proxy

To improve TCP throughput performance, a method using a PEP (Performance Enhancing Proxy) has been proposed. The PEP operates on a router along a TCP connection. When a data packet arrives at the PEP, it forwards the packet to the destination host, transmits the corresponding ACK (premature ACK) to the source host in behalf of the destination host, and stores a copy of the packet into its own buffer (PEP buffer) in case retransmission of the packet is required. As a congestion control method on the PEP, a method which keeps the number of prematurely acknowledged packets in the PEP buffer below a threshold (watermark) value has been proposed. However, the relation between the watermark value and throughput is not sufficiently investigated, and an optimization method of the watermark value is not proposed. In this paper, we first investigate the relation between the watermark value and the average throughput. Extensive simulations show that the simulation results are roughly classified into two cases. In the first case, the average throughput becomes larger for larger watermark values and becomes a constant value when the watermark is over a certain value. In the second case, although the average throughput becomes larger for larger watermark values in the same way, it decreases when the watermark is over a certain value. Next, based on the results about the relation, we propose an watermark optimization algorithm which can adaptively maximize the average throughput of each connection and also satisfy a fairness condition that the average throughputs of connections are equal to each other.