Xiaozhuo Gu

Reducing rekeying time using an integrated group key agreement scheme

With the requirement for providing multiple levels of access control for group members, many group key management schemes designed for hierarchical access control have been put forward. However, most of these schemes focus on the efficiency of group key establishment and rekeying in centralized environments. This paper proposes an integrated group key agreement (IGK) scheme for contributory environments. The IGK scheme employs the integrated key graph to remove key redundancies existing in single key trees, and reduces key establishment and rekeying time while providing hierarchical access control. Performance analyses and simulations conducted with respect to computation and communication overheads indicate that our proposed IGK scheme is more efficient than the independent group key agreement scheme.

Dynamic contributory key management based on Weighted-Join-Exit-Tree

Time efficiency in key establishment and update is one of the major problems contributory key managements strive to improve. In this paper, we present a contributory group key management based on weighted-join-exit-tree and named as WJT to get better time efficiency in key update. Built upon tree-based group key management, WJT has three improvements, the first is the join algorithm to inserting the new user at the root of the join tree, the second is the exit tree structure organized as a weighted tree according to userspsila leaving time, and the last is the tree balancing algorithm to minimize the main tree height. Theoretical analysis shows that the asymptotic average join time and leave time of WJT are reduced to O(1) from previous O(log(log n)), where n is the group size. Simulations and comparisons with existing key managements demonstrate that WJT is efficient in group key establishment and update.

Compensation Buffer Sizing for Providing User-Level QoS Guarantee of Media Flows

When transferred in a packet-switched network, the temporal structure of continuous media may be damaged by delay and delay jitter. Compensation buffering is a well-known method to absorb the delay jitter. However, added buffering increases the latency, which may degrade the interactivity between users. As delay and delay jitter are both perceived QoS parameters to users, changing compensation buffer size may result in completely opposite effect on user-level QoS. How to set the buffer size to provide both delay and delay jitter guarantee with preferable user-level QoS? To answer the question, we investigate the effect of buffer size on maintaining the temporal structure of media flows. By performing QoS mapping from network-level to user-level, we prove that there is an optimal buffer size to provide the optimal user-level QoS and obtain the optimal buffer size by differentiating approach. Experiment results validate our studies on the effect of the buffer size.

Design and Buffer Sizing of TCAM-Based Pipelined Forwarding Engines

The ever increasing line speed and the continuous growing demands of various functions support(for example QoS, multicast and security) have interact- tively made it harder for forwarding engines to process packets at line speed, and this will increasingly make the forwarding engines call for additional buffers to accommodate the burst transmission and decrease the packet loss rate. In this paper, a high-speed pipeline designed for TCAM-based forwarding engines is presented, and its buffer analysis model is also given, then, the buffer requirement of the forwarding engine is analyzed under two conditions: the forwarding rate is not less than and less than the input rate. Our analysis results and experiments both show that, the proposed forwarding pipeline is of high performance, and just one pipeline can easily deal with the data transfer rate of 30 Gb/s or even higher; the pipelined forwarding engine only need to buffer a several packets, then the loss rate will be an acceptable value or even zero, further increasing the buffer size will have little effect on reducing the loss rate.

Performance Study on the MPMS Fabric: A Novel Parallel and Distributed Switching System Architecture

As Internet grows exponentially, scalable routers on backbone are required to provide more number of ports, higher line-rates, and larger capacity under acceptable complexity. Until now, most routers are implemented on the centralized single crossbar as the switched backplane fabric. In terms of crosspoint number, however, the complexity of a single Crossbar is unacceptable with large number of ports, which is increased with O(N2). Distributed multiple-stage Clos network and Parallel Packet Switching fabric were proposed to provide large number of ports and high line-card rate, respectively. To obtain both goals simultaneously, we study a novel multiple-plane and multiple-stage (MPMS) switching fabric in this paper. We first bring out a graphic model for the MPMS fabric based on its topological architecture. Then we study the internal connectivity of the MPMS fabric through the concepts of vertex in-degree, vertex out-degree and vertex mux degree. Lastly, we analyze the performance of the MPMS fabric including its maximum number of ports, line-rate, switching capacity and complexity of crosspoints by comparison to that of the single-stage crossbar fabric.

A Practical Scheme for Data Secure Transport in VoIP Conferencing

In the Multi-party VoIP conferencing system, it is important to provide properties of non-repudiation, unforgeable, and privacy. Previous work usually achieve these goals by using digital signature, TLS, IPsec, or other cryptographic tools. However, many approaches either compromise performance or lack of formal security proof, or both. In this work, we construct a practical Multi-party VoIP conferencing scheme based on the Boneh-Canetti-Halevi-Katz construction. Our work focus on the data secure transport stage, (i.e., we assume that the group session key is already distributed in the key distribution stage.). In comparison with previous work, our scheme gives a new paradigm for achieving properties of non-repudiation, unforgeable, and privacy simultaneously. The new paradigm avoids digital signature that have been shown time-consuming. On the other hand, our scheme is provable security. We prove the non-repudiation property in a formal way, and give proof sketches of unforgeable property and privacy property.

Study on a Novel Scheduling Algorithm of the Multiple-Plane and Multiple-Stage Switching Fabric

The multiple-plane and multiple-stage (MPMS) switching fabrics are the next step in scaling current crossbar fabrics to many hundreds or few thousands of ports. However, scheduling cells in the MPMS fabric is complex. With the recent blooming of bandwidth sensitive Internet traffic, scheduling cells with guaranteed bandwidth is becoming an urgent demand. The CRRD algorithm delivers high throughput under uniform traffic pattern, but it does not work well under nonuniform traffic and does not provide any bandwidth guarantees. In this paper, we analyze the graphic model of the MPMS fabric, and propose a novel bandwidth-guaranteed scheduling algorithm based on CRRD. Simulation results show that it delivers 100% throughput under uniform traffic, and achieves much higher throughput than that of CRRD under nonuniform traffic, and keeps its implementation complexity low without internal expansion and allocates the output-link bandwidth fairly for the reserved flows in the overloaded case.

An Efficient and Universal Security Architecture of Implementing IPSec in Broadband Router

With the demand of providing data security and integrity, IPSec is implemented in hardware of router to accelerate processing speed. After analyzing advantages and disadvantages of two traditional security architectures, look-aside architecture and flowthrough architecture, we propose parallel security processing architecture to achieve better time efficiency. This parallel security architecture adopts mechanism of processing IP packets and IPSec packets simultaneously, which optimizes the processing flow and improves the processing efficiency. The design of parallel security architecture is based on universal architecture of broadband, thus requires minimal change of hardware architecture when implemented in broadband router. Testing results based on SRI 880s routers demonstrate that the proposed parallel security architecture is efficient and satisfies the security need of broadband networks.

Detecting and Solving Links Overlap to Make Structured P2P Network Topology-Aware

Mismatching between overlay and physical network in structured P2P system leads to overlap of links crossed on backbone network, thus it brings link waste and congestion. A method used for detecting and resolving the link overlap problem is proposed in this paper. It introduces TTL as the measurement of distance, and adjusts the routing table of node according to redirect message achieved from TTL calculation and comparison. This method is protocol- independent and easy to be built on any structured P2P system. It avoids the inaccuracy problem that the time latency or IP information method contained. Through illustration, it is proved to indeed decrease the number of links crossed in routing procedure, thus resolves the waste of link bandwidth and useless flow over the backbone network brought by mismatching problem.