Su Jinshu

Network Access Control Mechanism Based on Locator/Identifier Split

Legacy IP address-based access control has met many challenges, because the network nodes cannot be identified accurately based on their variable IP addresses. “Locator/Identifier Split” has made it possible to build a network access control mechanism based on the permanent identifier. With the support of “Locator/Identifier Split” routing and addressing concept, the Identifier-based Access Control (IBAC) makes network access control more accurate and efficient, and fits for mobile nodes’ access control quite well. Moreover, Self-verifying Identifier makes it possible for the receiver to verify the packet sender’s identity without the third part authentication, which greatly reduces the probability of “Identifier Spoofing”.

A Study of Hinge-Transmit Property of BGP Routing System

From the aspect of inter-domain routing security, it is important to identify the critical ASes which transmit a large fraction of data traffic. By analyzing the BGP routing process under the control of routing polices and evaluating a series of Transmit factors, we realize that BGP routing system has a Hinge-Transmit property. It indicates that Tier-1 AS set is the hinge of the Internet, transmitting a large fraction of data traffic to the whole network; a subset of Tier-1 AS set with a special topological location (core AS set) is the hinge of data delivery paths to a specified destination, transmitting a large fraction of data traffic from any source to the destination. These hinge ASes are the keys of Internet security and should be protected carefully. Finally, we verify the result by Route Views routing tables.

Implementation of TCP large receive offload on multi-core NPU platform

Nowadays, the ethernet is developing much faster than memory and CPU technologies, protocol processing has become the bottleneck of TCP performance on end systems. Modern NICs usually support offload techniques such as checksum offload and TCP Segmentation Offload(TSO), allowing the end system to offload some processing work onto the NIC hardware. In this paper, we propose an implementation of Large Receive Offload(LRO) on a multi-core NPU platform to improve TCP performance, particularly, we employ a so called active ACK mechanism to make very large packets(64KB) aggregation possible. We present experiment results to demonstrate the effectiveness of our proposal.

A Structure P2P Based Web Services Registry with Access and Control

In the cloud computing, there are massive functions and resources are encapsulated into Web services. The traditional web service registry systems normally using the central architecture can’t meet the requirements of cloud computing. A web service registry system based on structured P2P system with secure access and control is implemented. Multiple Universal Description, Discovery and Integration (UDDI) nodes are organized by the P2P based schedule and communication mechanism. The registration and discovery of Web services is redesigned to the new system that provides services like one single UDDI server. The experiment results show that the capacity can be extended dynamically and support large scalable access.

Research on AS path betweenness based filtering policy against BGP prefix hijacking

BGP prefix hijacking is a sort of security threaten of the Internet. The current effort on hijacking defense is to deploy filters for hijacking route on the edge of the Internet. In order to reduce the deployment cost of defense filter, we proposed an AS path betweenness based filter policy. By simulating a large amount of prefix hijacking experiments, we found that deploying defense filters on the core of the Internet is an effective and efficient way to gain high resilience of the network.