The world has emerged as a global village. Internet has brought an amazing change in the era of modern communications. Demand for multimedia applications and an ever increasing amount of VoIP traffic have increased data rate and bandwidth requirements. It has become a big chal-lenge to provide best quality applications. Traffic engineers are working hard over Internet Protocol (IP) and Routing Protocols (RPs) in order to cope with this challenge. IP networks have offered these services efficiently until now, but there are several issues with IP routing that affect the Quality of Service (QoS). Multi-Protocol Label Switching (MPLS) has emerged as an agile technology which promises effective security together with high speed data delivery. MPLS networks use switching instead of conventional routing. MPLS doesn’t replace existing IP networks, but guarantees instead better QoS in existing IP networks as well as future routing technologies, providing thus a suitable environment for Traffic Engineering (TE). The Class of Service (CoS) architecture provided by MPLS can easily be coordinated with IP QoS mecha-nisms. Traffic can be switched based on resource utilization and network performance instead of using static routing techniques such as selecting a path with least cost, optimizing thus the MPLS network for heavy application at desired quality. / Världen har blivit en global by. Internet har inneburit en fantastisk förändring i en tid präglad av modern kommunikation. Efterfrågan på multimediaapplikationer och en allt större mängd VoIP-trafik har ökat datahastighet och krav på bandbredd. Det har blivit en stor utmaning att ge bästa kvalitet ansökningar. Trafiken tekniker arbetar hårt over Internet Protocol (IP) och routingprotokoll (RPS) för att klara av denna utmaning. IP-nät har erbjudit dessa tjänster på ett effektivt fram tills nu, men det finns flera problem med IP-routing som påverkar Quality of Service (QoS). Multi-Protocol Label Switching (MPLS) har utvecklats till en flexibel teknik som utlovar effektiv säkerhet tillsammans med hög hastighet leverans. MPLS-nätverk används byte istället för konventionella routing. MPLS ersätter inte de befintliga IP-nät, utan garantier i stället bättre QoS i befintliga IP-nät samt framtida routing-teknik, vilket har en lämplig miljö för trafikteknik (TE). Den klass som (COS) arkitektur som MPLS kan enkelt styras med IP QoS meka-nismer. Trafiken kan kopplas grundas på resursutnyttjande och nätverksprestanda istället för att använda statisk routing tekniker som att välja en väg med lägsta kostnad, vilket optimerar därmed MPLS nät för tunga ansökan till önskad kvalitet.

This thesis will address a problem concerning availability of information systems at an enterprise within the financial sector and its external suppliers, so called trusted third party. The information system resides on the internal network of the enterprise and must be available to both employees of the enterprise and the trusted third party simultaneously. This contradicts the company policy which disallows third parties access to the internal network. The HAVECA-model introduced in this thesis provides a framework of methods, each solving a sub problem identified in the model. The identified methods are hardening, verification, control and assurance, together supplying a method for continuously securing the internal network against a trusted third party. The HAVECA-model will be applied to a scenario, providing real-world examples of techniques of allowing the trusted third party to a restricted number of servers on the network. / Robert Karlsson e-mail: robert@iron.se Aron Rydquist e-mail: aaron@linux.se

The point of this project is to cover a gap in today’s supply of provisioning systems for VoIP endpoint devices. Today the norm is that every manufacturer of endpoints builds their own system to provision their endpoints, but most operators use a vast verity of products to meet their customers’ needs. This system is based on open source software to allow adaptations to different environments and demands from customers and to require no license fee thus being affordable to the small size and midsized operators. This thesis is mainly an engineering type of thesis and the main bulk of the work has been put in developing the solution.

There are several weaknesses in the popular transport protocol TCP (Transmission Control Protocol). A possible replacement to TCP would be the newer protocol SCTP (Steam Control Transmission Protocol). This thesis presents three different proposed implementations of SCTP: HTTP over SCTP, online games over SCTP and IP mobility over SCTP. The proposed implementations are analyzed, based on relevant literature, and recommendations are issued on the importance of moving forward with them. The result of the thesis is that HTTP over SCTP is recommended. SCTP features such as multi-streaming, multi-homing and the four-way handshake addresses the inherent weaknesses with using TCP for HTTP traffic. IP mobility over SCTP is also recommended since it results in lower delay in the handover process compared to MIPv6 (Mobile IPv6). Online games over SCTP, however, is not recommended since the existing implementations of SCTP results in poor latency for the kind of traffic online games produce.

IP-telefoni introducerades 1995 och har sedan dess växt sig starkare och starkare men det är först nu i samband med att fler och fler får tillgång till bredband som lanseringen av tjänsten tagit fart på allvar. Vid lanseringen av nya produkter framkommer det alltid vissa problem, så är även fallet med IP-telefoni. FOI (2004) beskriver två av de största vilka är beroendet av konstant strömförsörjning och säkerhet mot intrång och attacker, och Gulliksson och Lindström (2000) tar upp det som kan klassas som det tredje vilket är samtalskvaliteten. Dessa problem kan ses ha en gemensam lösning nämligen olika hårdvara. För att ta reda på vilken hårdvarufunktionalitet som används för att lösa problemen har det gjorts intervjuer med företag inom branschen. Resultatet visar att vad som behövs är framförallt trafikprioriterande och strömmatandenätverksenheter, stabila brandväggar och sekundära strömkällor. Allt detta behövs för att kunna uppnå ett likvärdigt system som dagens telefonnät, dock är det nu upp till kunden att själv stå för all teknik som behövs.

The Range Commanders Council has been attempting to standardize Telemetry over IP (TMoIP) for many years now. While the attempt has been valiant, the outcome to date has not been very successful. As a result, many vendors have implemented their own proprietary methods for sending PCM data over IP networks resulting in a lack of interoperability. As telemetry ground stations are finally making the move toward network centric architectures, it is worth considering the lessons learned over the previous 10 years of designing, installing, troubleshooting and optimizing telemetry data distribution over IP networks. This paper describes a proposed revision to IRIG 218 based on these real life experiences. It discusses the critical decisions and architectural decisions to be made and some of the pitfalls to be avoid.

The enormous increase in device connectivity for data and telecom devices places significant challenges on the packet processing techniques used in embedded systems such as IP stacks. Therefore, the traditional packet processing software cannot handle the line rate packet flow even for the most cutting edge devices. A solution to this problem is to allow applications to directly receive packets without passing through the normal kernel stack and drivers i.e. interface directly with the hardware. Two such open source libraries for Linux are PF_RING and Netmap. In addition Freescale has a similar technology called USDPAA. In order to satisfy the first goal of this project, a detailed analysis and evaluation of PF_RING, Netmap and USDPAA has been conducted in order to determine how they compare in relation to a number of criteria such as functionality, support, performance, ease of use, software/ hardware dependencies and project stability etc. Secondly based on the earlier work, a design is proposed that can be used to build and port an application to run on Freescale DPAA based hardware (P4080) on top of USDPAA.

Currently, a viable solution to provide multicast provision over a multiprotocol label switch with traffic engineering (MPLS-TE) domain is unavailable because of the missing link able to couple multicast traffic distribution with an MPLS-TE enabled network. This is due to the limited or less research investigation that was done in this area. Most of the investigation methods tackle the problem individually such as deploying internet protocol (IP) multicast in a plain network or MPLS domain but without considering a combination of both technologies that is aware of differentiated services requirements. This thesis presents an alternative solution for the multicast differentiated services provision problem over a MPLS-TE enabled network. The approach is exposed and analyzed through a practical solution that was developed within a network simulation environment. The research presented in this thesis orchestrates the already available technologies offered by the multicast protocols suite and differentiated services (DiffServ) aware MPLS-TE that allows applying separately the constraint-based routing and admission control to different classes of services. The novelty and solution of this thesis relies on using MPLS constraint-based routing concepts (e.g.traffic trunks) in order to solve TE issues revealed during multicast traffic distribution.

Border Gateway Protocol (BGP) is the backbone of routing infrastructure in the Internet. In its current form, it is an insecure protocol with potential for propagation of bogus routing information. There have been several high-profiles Internet outages linked to BGP in recent times. Several BGP security proposals have been presented in the literature; however, none has been adopted so far and, as a result, securing BGP remains an unsolved problem to this day. Among existing BGP security proposals, Secure BGP (S-BGP) is considered most comprehensive. However, it presents significant challenges in terms of number of signature verifications and deployment considerations. For it to provide comprehensive security guarantees, it requires that all Autonomous Systems (ASes) in the Internet to adopt the scheme and participate in signature additions and verifications in BGP messages. Among others, these challenges have prevented S-BGP from being deployed today. In this thesis, we present two novel lightweight security protocols, called Credible BGP (C-BGP) and Hybrid Cryptosystem BGP (HC-BGP), which rely on security mechanisms in S-BGP but are designed to address signature verification overhead and deployment challenges associated with S-BGP. We develop original and detailed analytical and simulation models to study performance of our proposals and demonstrate that the proposed schemes promise significant savings in terms of computational overhead and security performance in presence of malicious ASes in the network. We also study the impact of IP prefix hijacking on control plane as well as data plane. Specifically, we analyze the impact of bogus routing information on Inter-Domain Packet Filters and propose novel and simple extensions to existing BGP route selection algorithm to combat bogus routing information.

The Internet, with cloud computing, offers amazing services that require a fast, intelligent, reliable network connection. Current networks, electrical or optical, need to work together to provide the user with a high-quality connection. The IP protocol as Layer 3 and an optical network as Layer 2 need to talk to each other and help each other instead of working separately. Therefore, this thesis proposes using software-defined network (SDN) technology for integrating the IP protocol into an optical network to fill the gap between the two layers and to give the network more intelligence and flexibility for new connection requests, choosing the best route, and monitoring the network. A two-layer SDN centralized controller design has been used. The Layer 1 SDN controller is the centralized controller that connects and updates all Layer 2 SDN controllers which control traffic in each domain. New connection requests are processed in the SDN controller and the traffic is forwarded by the optical network. SDN technology and the integration of IP into the optical network promise to enhance network connectivity.