Pan-Lung Tsai

An efficient and anonymous buyer-seller watermarking protocol

For the purpose of deterring unauthorized duplication and distribution of multimedia contents, a seller may insert a unique digital watermark into each copy of the multimedia contents to be sold. When an illegal replica is found in the market sometime later, the seller can determine the responsible distributor by examining the watermark embedded. However, the accusation against the charged distributor, who was the buyer in some earlier transaction, is objectionable because the seller also has access to the watermarked copies and, hence, is able to release such a replica on her own. In this paper, a watermarking protocol is proposed to avoid such difficulties, known as the customers right problem, in the phase of arbitration. The proposed watermarking protocol also provides a fix to Memon and Wongs scheme by solving the unbinding problem. In addition, the buyer is no longer required to contact the watermark certification authority during transactions, and the anonymity of the buyer can be retained through a trusted third party. The result is an efficient and anonymous buyer-seller watermarking protocol.

An evaluation of the virtual router redundancy protocol extension with load balancing

Virtual router redundancy protocol (VRRP) is designed to eliminate the single point of failure in the static default routing environment in LAN. The original VRRP protocol does not support load balancing for both incoming and outgoing traffic. This paper describes EVRRP, i.e. enhanced VRRP. EVRRP supports an efficient multiple-node cluster and symmetric load balancing among routers. Each router periodically exchanges information to determine the status of the master and backups. The master router distributes and redirects the traffic to one of the backup routers by ICMP redirect message. Backup routers accept the traffic from the master and one of the backup routers takes over the master traffic using a gratuitous ARP message when the master fails. The improved election protocol speeds up the original VRRP election protocol and shortens the failover time by adding a new state in the previous VRRP state diagram and a new protocol type. An extensive evaluation of the EVRRP protocol is described in the paper.

A remote control scheme for ubiquitous personal computing

In the schemes designed for ubiquitous computing, remote access to private data is generally achieved by requiring users to deposit the data on certain always-on-line servers in the network infrastructure. However, when the data to be accessed remotely is somewhat sensitive, as implied by many applications of personal computing, users may prefer to warehouse the data in their residences rather than in some public places. In this paper, a novel scheme is proposed to realize personal computing ubiquitously by satisfying such demand. The proposed scheme employs home-automation techniques to grant properly authenticated users remote access to the data stored somewhere off the infrastructure (e.g., their personal workstations) while avoiding the expense of deploying high-availability servers at home. It also provides three kinds of authentication mechanisms and hence allows users to choose among different levels of the tradeoff between security and ubiquity, providing a complete solution for ubiquitous personal computing.

A clustering and traffic-redistribution scheme for high-performance IPsec VPNs

CPE-based IPsec VPNs have been widely used to provide secure private communication across the Internet. As the bandwidth of WAN links keeps growing, the bottleneck in a typical deployment of CPE-based IPsec VPNs has moved from the last-mile connections to the customer-edge security gateways. In this paper, we propose a clustering scheme to scale the throughput as required by CPE-based IPsec VPNs. The proposed scheme groups multiple security gateways into a cluster using a transparent self-dispatching technique and allows as many gateways to be added as necessary until the resulting throughput is again limited by the bandwidth of the last-mile connections. It also includes a flow-migration mechanism to keep the load of the gateways balanced. The results of the performance evaluation confirm that the clustering technique and the traffic-redistribution mechanism together create a transparent, adaptive, and highly scalable solution for building high-performance IPsec VPNs.

Towards ubiquitous computing via secure desktop service

Among all the approaches enabling remote access to the private information stored at some static locations, one approach, often referred to as remote desktop control, provides the most intuitive form of such operations. With remote desktop control, people are able to access their personal desktops remotely and operate on them in the same way as they do when sitting in front of their consoles. A side-effect of this approach is that the potential damages caused by misuses get more severe, and security issues hence become more important. In this paper, a scheme of authentication via mobile phones is proposed to make the approach of remote desktop control more secure. Another benefit of this scheme comes from the globally deployed telecommunication network, which makes the application truly ubiquitous.

Building High-Performance and Reconfigurable Bandwidth Controllers with Adaptive Clustering

As quality of service gains more and more attention, bandwidth controllers gradually become one of the most important network systems used in modern Internet environment. The demand for high-performance in-line bandwidth controllers is driven by the growing bandwidth available in the last mile WAN links as well as the sophisticated packet processing functions that become essential in current computer networks. In this paper, we propose an adaptive clustering scheme to scale the throughput of in-line devices and implement the bandwidth control functions over a cluster of in-line devices. The proposed scheme aggregates the processing power of multiple in-line devices in the cluster by making incoming traffic self-dispatched in a transparent fashion, and incorporates a flow migration mechanism that keeps the load of each device balanced. The resulted cluster is also able to tolerate device failures and hence is run-time reconfigurable. Based on the proposed scheme, we successfully design a distributed policy adjustment algorithm, the proportional bandwidth allocation algorithm, and implement a clustered bandwidth controller over embedded Linux. The results of performance evaluation suggest that the proposed traffic redistribution mechanism and distributed policy adjustment algorithm can be used together to realize high-performance and reconfigurable bandwidth controllers.

Analysis and evaluation of a multiple gateway traffic-distribution scheme for gateway clusters

Next-generation Internet gateways are expected to deal with higher volume of network traffic and also perform more sophisticated tasks besides packet forwarding. As the scale-up approach does not escape from the tradeoff between functionality and performance, architectural improvements such as clustering become necessary in the design of future Internet gateways. In this paper, we investigate different clustering architectures for high-performance, feature-rich Internet gateways and formally define the optimization problem behind these architectures as Multiple Gateway Traffic-Distribution Problem, both in a discrete and a continuous form. In addition to proposing various algorithms that solve the problem exactly and approximately, we also develop an on-line, self-adjusting scheme based on the solution algorithms. The numerical results of simulation suggest that the proposed approximate solution algorithms are effective and efficient, and the derived adaptive scheme is able to make the best decision on traffic distribution when dealing with the dynamic nature of network traffic in practice.

An on-line page-structure approximation scheme for Web proxies

To render a Web page, a browser must first download an HTML document, parse it, and then issue a sequence of additional requests to fetch the embedded objects according to the content of the HTML document. Therefore, it should be straightforward for Web proxies to accurately predict future client requests by considering the characteristics of such regular behavior. However, the strong bindings between embedded objects and their containing documents are often ignored by modern Web proxies because there still exists no efficient solution for Web proxies to obtain the knowledge of page structures without performing the computation-intensive operations of HTML parsing. In this paper, we propose an effective and low-overhead scheme for Web proxies to approximate page structures and refine the approximation as new client requests arrive. The results of simulation show that the approximation converges quickly and reaches high accuracy after a relatively small number of incoming requests have been processed.

A CONTENT-PROTECTION SCHEME FOR MULTI-LAYERED RESELLING STRUCTURES

Since the idea of digital watermarks was proposed, various watermarking schemes have been developed to protect digital contents in electronic transactions. However, most schemes limit themselves to the simplified buyerseller model that can be applied to only a small number of cases rather than common scenarios in real life. In this paper, a more practical watermarking scheme is proposed to protect digital contents in real-world transactions using PKI (Public-Key Infrastructure). The proposed scheme is considered more practical in the sense that one or more reselling agents may exist between buyers and the original seller, and the seller can package the merchandise in advance without the involvement of buyers. The packaged merchandize can hence be made publicly accessible (e.g., on top of an open shelf) for the purpose of demonstration and circulates in the market. The proposed scheme also preserves the anonymity of the buyers while guaranteeing that the distributor of any illegal copy will be unambiguously identified.