Made available in DSpace on 2016-06-02T19:07:10Z (GMT). No. of bitstreams: 1 SANDRI_Marcus_2015.pdf: 2702736 bytes, checksum: 227059d931183af24cbcab4cc7a1eb19 (MD5) Previous issue date: 2015-06-10 / Financiadora de Estudos e Projetos / This Master s thesis shows a solution for splitting MPTCP subflows in an Openflow network. MPTCP is a network protocol designed to branch a single TCP connection into many subflows. The main idea is to forward subflows th- rough disjointed paths. Commonly, ECMP protocol is adopted together to split flows through distinct paths. Nevertheless, there are many issues that shows that ECMP is not pareto-optimal, such as: ECMP can easily set two subflows from the same TCP connection on the same path and/or set a distinct forward and back forward route to the same subflow. To solve these issues, it is designed MultiFlow, a module which uses a controller for guarantee multipath routing by setting subflows from the same MPTCP connection so that such subflows are forwarded through distinct paths. MultiFlow is evaluated in experimentation where is analyzed throughput and resilience comparing it with Spanning-Tree (STP) and ECMP. The experiments were done by using Mininet: An OpenFlow emulator for experimenting with a set of topologies. / Esta dissertação apresenta uma solução para distribuir subfluxos Multipath-TCP (MPTCP) em redes OpenFlow. MPTCP é um protocolo desenvolvido para derivar um fluxo TCP em diversos subfluxos e estes serem roteados por caminhos disjuntos ao longo da rede. Convencionalmente, adota-se em conjunto o protocolo Equal-Cost Multipath (ECMP), do qual distribui fluxos de todos os tipos de protocolos ao longo de uma rede com múltiplos caminhos. Entretanto, existem diversas questões que mostram que o ECMP não é um protocolo altamente eficiente. Dentre elas, o ECMP comumente pode alocar dois subfluxos de uma mesma conexão em um mesmo caminho e/ou distribuir um caminho de ida diferente do caminho de volta. A fim de solucionar estes problemas, é desenvolvido o MultiFlow, um módulo para o controlador POX a fim de garantir que subfluxos pertencentes a uma mesma conexão MPTCP possam ser encaminhados em caminhos disjuntos, em uma rede OpenFlow. MultiFlow é validado em experimentos de desempenho onde são analisados taxa de transferência (throughput) e resiliência em experimentos comparativos com os protocolos Spanning-Tree (STP) e ECMP. Para isso, utilizamos o Mininet: Um emulador de rede OpenFlow que permite a criação de diferentes topologias para experimentação.

L'un des défis majeurs de l'évolution de l'architecture Internet est la définition d'une architecture protocolaire permettant d'améliorer le routage, et en particulier (i) conserver un système de routage gérable avec les technologies actuelles et futures c'est-à-dire, avec quelques millions d'états, (ii) offrir une architecture apte à faciliter la programmabilité du plan de transfert, (iii) proposer un système de routage évolutif pouvant être régulièrement optimisé avec uniquement les informations sur les flux actifs, (iv) fournir une séparation entre localisateurs et identificateurs pour la mobilité IP avancée, (v) faciliter un déploiement incrémental, (vi) mieux servir les services applicatifs "over-the-top". Le protocole LISP (\textit{Locator/Identifier Separation Protocol}) a été identifié comme l'un des protocoles émergents à cet égard. Dans son état actuel, il répond très bien aux besoins susmentionnés. Cependant, il subit des limitations lorsqu'il s'agit de prendre en compte la résilience et la capacité à réagir rapidement aux mises à jour de l'état du réseau. Ces inconvénients peuvent être compensés en améliorant l'architecture du plan de contrôle et ses algorithmes de routage. Dans cette thèse, nous proposons une nouvelle architecture réseau-système et expérimentons de nouvelles primitives de plan de contrôle, ainsi que d'algorithmes de diffusion des états, en testant son passage à l'échelle avec différentes conditions de réseau. Nous concevons et construisons d'abord un nœud de plan de données et de plan de contrôle LISP open source. Nous le comparons avec d'autres implémentations en montrant que notre implémentation atteint des performances adaptées aux vrais déploiements. Nous montrons comment notre implémentation a permis la mise en oeuvre d'une plateforme d'expérimentation à grande échelle, la plate-forme LISP-Lab, en opération aussi bien les fonctions de plan de transfert que les fonctions de plan de contrôle. En suite, nous proposons une nouvelle solution pour les migrations à chaud de machines virtuelles à travers des centres de données géographiquement répartis sur des réseaux IP étendus. Des tests dans un testbed réel connecté nativement à Internet montrent qu'avec notre approche, nous pouvons facilement atteindre des temps d'arrêt inférieurs à la seconde lors de la migration sur une grande échelle, même pour des clients très distants. En outre, nous avons étudié des protocoles d'optimisation de réseau multicouche, en particulier en relation avec le protocole MPTCP (Multipath Transport Control Protocol), auquel LISP peut offrir une diversité de chemins pour l’agrégation de bande passante, ainsi qu’une plus grande confidentialité et fiabilité des connexions. Bien que nous ne puissions bénéficier que de quelques nœuds de réseau superposés, nous avons pu évaluer expérimentalement nos propositions en montrant l'impact positif de notre solution, l'impact négatif des longs temps d'aller-rétour sur certains sous-flux MPTCP, et la forte corrélation entre le temps d'aller-retour différentiel et le débit. Enfin, nous avons travaillé sur une refonte du plan de contrôle de LISP afin d’améliorer son fonctionnement du à l'échelle d’Internet, en facilitant la coopération entre les systèmes de mapping LISP et en introduisant plus d'automatisation dans la procédure de fourniture de services de connectivité LISP. Nous croyons qu'une telle optimisation pourrait sensibiliser la communauté des fournisseurs de services, générant de nouvelles opportunités commerciales liées aux services de cartographie LISP et l'application de politiques d'ingénierie de trafic interdomaines avancées dans le but d'obtenir de meilleures garanties de qualité de service. / One of the major challenges in the evolution of the Internet architecture is the definition of a protocol architecture that allows to solve the following major issues in Internet routing and traffic forwarding capabilities, (i) keeping a routing state that is manageable with current and forthcoming computing infrastructure – i.e., with few millions of states, (ii) offering a scalable pull architecture in support of data-plane programmability, (iii) offering a scalable forwarding plane able to be regularly optimized with only active flows information, (iv) offering locator/identifier separation for advanced IP mobility, (v) is incrementally deployable, (vi) can enhance the support of over-the-top services. The Locator/Identifier Separation Protocol (LISP) has been identified as one of the rising protocols in this respect. In its current status, it supports the above mentioned requirements at a level that is acceptable for basic networking environments. However, it shows too limited capacities when it comes to take into consideration fault resiliency and capability to react fast to network state updates. These shortcomings can be compensated by enhancing the control-plane architecture, and the routing algorithms therein. In this dissertation, we propose new protocol features and experiment novel control-plane primitives, as well as hybrid distributed-centralized routing state dissemination algorithms, to scale with different network conditions. We first design and build own open source LISP data-plane and control plane node, comparing it with other implementations, showing how our implementation can scale for large networks and reach performances suitable for real deployments. We present how our implementation served to operate all network nodes (data-plane and control-plane nodes) of a large scale experimentation testbed, the LISP-Lab testbed. Then we propose a novel LISP-based solution for VM live migrations across geographically separated datacenters over wide area IP networks. Experimenting it at large scale, we show that with our approach we can easily reach sub-second downtimes upon Internet-wide migration, even for very distant clients. Moreover, we investigate cross-layer network optimization protocols, in particular in relation with the Multipath Transport Control Protocol (MPTCP) to which LISP can deliver path diversity in support of bandwidth increase, confidentiality support and connection reliability, also using LISP traffic engineering network overlays. Despite we could benefit from only few overlay network nodes, we could experimentally evaluate our proposals showing the positive impact by using our solution, the negative impact of long round-trip times on some MPTCP subflows, and the strong correlation between the differential round-trip time among subflows and the throughput performance. Finally, we worked on a framework to improve LISP operation at the Internet scale, by facilitating cooperation between LISP Mapping Systems and introducing more automation in the LISP connectivity service delivery procedure. We believe such optimization could raise awareness among the service providers’ community, yielding new business opportunities related to LISP mapping services and the enforcement of advanced inter-domain traffic engineering policies for the sake of better quality of service guarantees.

No description available.

Approved for public release; distribution is unlimited / Virtual Private Networks (VPNs) are designed to use the Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) to establish secure communication tunnels over public Internet. Multipath TCP (MPTCP) extends TCP to allow data to be delivered over multiple network paths simultaneously. This thesis first builds a testbed and investigates the potential of using MPTCP tunnels to increase the goodput of VPN communications and support seamless mobility. Based on the empirical results and an analysis of the MPTCP design in Linux kernels, we further introduce a full-multipath kernel, implementing a basic Multipath UDP (MPUDP) protocol into an existing Linux MPTCP kernel.We demonstrate the MPUDP protocol provides performance improvements over single path UDP tunnels and in some cases MPTCP tunnels. The MPUDP kernel should be further developed to include more efficient scheduling algorithms and path managers to allow better performance and mobility benefits seen with MPTCP. / Outstanding Thesis / Lieutenant, United States Navy

This work deals with multipath transmission in the data networks to speed up transmission over networks with limited transmission speed. Work compares the characteristics, efficiency and response to changes in individual transmission paths. Work is specifically dedicated to MPT and MPTCP mechanisms.

Les réseaux fixes et mobiles font face à une croissance dramatique du trafic de données, qui est principalement due à la distribution de contenus vidéo. Les opérateurs Télécoms envisagent donc de décentraliser la distribution de contenus dans les futures architectures convergées fixe-mobile (FMC). Cette décentralisation, conjointement au déploiement d'un cœur de réseau mobile distribué, sera un élément majeur des futurs réseaux 5G. L'approche SIPTO définie par 3GPP permet déjà le délestage sur le réseau fixe du trafic mobile, et pourra donc être utilisée en 5G. SIPTO s'appuie sur la distribution des passerelles de données (PGW) qui permet ainsi de décharger le cœur du réseau mobile actuel. Cependant, dans certains cas de mobilité des usagers, SIPTO ne supporte pas la continuité de session, quand il est nécessaire de changer de PGW, donc de modifier l'adresse IP du terminal. Cette thèse commence par quantifier le gain apporté par le délestage du trafic mobile en termes de capacité requise pour différentes portions du réseau. Un état de l'art des différentes solutions de délestage du trafic de données mobiles est fourni, démontrant qu'aucune des solutions existantes ne supporte la continuité de service pour les sessions de longue durée. C'est pourquoi, cette thèse propose des solutions pour supporter une mobilité transparente ; ces solutions s'appuient à la fois sur SIPTO et sur le protocole MultiPath TCP (MPTCP). Les protocoles du 3GPP sont inchangés car la continuité est maintenue par les extrémités. Enfin, ces solutions sont appliquées aux différentes implémentations d'architectures FMC envisagées à ce jour. / Fixed and mobile networks are currently experiencing a dramatic growth in terms of data traffic, mainly driven by video content distribution. Telecoms operators are thus considering de-centralizing content distribution architecture for future Fixed and Mobile Converged (FMC) network architectures. This decentralization, together with a distributed mobile EPC, would be used for future 5G networks. Mobile data offloading, in particular SIPTO approaches, already represent a good implementation model for 5G network as it allows the use of distributed IP edges to offload Selected IP traffic off the currently centralized mobile core network. However, in some cases, SIPTO does not support session continuity during users' mobility. This is due to the fact that user's mobility may imply packet gateway (PGW) relocation and thus a modification of the UE's IP address.This PhD thesis first quantifies the gain, in terms of bandwidth demands on various network portions, brought by the generalized use of mobile traffic offloading. A state of art of existing mobile data offloading solutions is presented, showing that none of the existing solutions solve the problem of session continuity for long-lived sessions. This is why, in the context of future FMC mobile network architectures, the PhD thesis proposes solutions to provide seamless mobility for users relying on SIPTO with the help of Multipath TCP (MPTCP). 3GPP standards are not modified, as session continuity is ensured by end-points. Lastly, the proposed solutions are mapped on different architecture options considered for future FMC networks.

Sharing the resources of multiple wireless networks with overlapped coverage areas has a potential of improving the transmission throughput. However, in the existing frameworks, the improvement cannot be achieved in congestion scenarios because of independent congestion control procedures among the end-to-end paths. Although various network characteristics make the congestion control complex, this variety can be useful in congestion avoidance if the networks cooperate with each other. When congestion happens in an end-to-end path, it is inevitable to have a packet transmission rate less than the minimum requested rate due to congestion window size adjustments. Cooperation among networks can help to avoid this problem for better service quality. When congestion is predicted for one path, some of the on-going packets can be sent over other paths instead of the congested path. In this way, the traffic can be shifted from a congested network to others, and the overall transmission throughput does not degrade in a congestion scenario. However, cooperation is not always advantageous since the throughput of cooperative transmission in an uncongested scenario can be less than that of non-cooperative transmission due to cooperation costs such as cooperation setup time, additional signalling for cooperation, and out-of-order packet reception. In other words, a trade-off exists between congestion avoidance and cooperation cost. Thus, cooperation should be triggered only when it is beneficial according to congestion level measurements. In this research, our aim is to develop an efficient cooperative congestion control scheme for a heterogeneous wireless environment. To this end, a cooperative congestion control algorithm is proposed, in which the state of an end-to-end path is provided at the destination terminal by measuring the queuing delay and estimating the congestion level. The decision on when to start/stop cooperation is made based on the network characteristics, instantaneous traffic condition, and the requested quality of service (QoS). Simulation results demonstrate the throughput improvement of the proposed scheme over non-cooperative congestion control.

Severe weather impacts life and in this dire condition, people rely on communication, to organize relief and stay in touch with their loved ones. In such situations, cellular network infrastructure\footnote{We refer to cellular network infrastructure as infrastructure for the entirety of this document} might be affected due to power outage, link failures, etc. This urges us to look at Ad-hoc mode of communication, to offload major traffic partially or fully from the infrastructure, depending on the status of it. We look into threefold approach, ranging from the case where the infrastructure is completely unavailable, to where it has been replaced by make shift low capacity mobile cellular base station. First, we look into communication without infrastructure and timely, dissemination of weather alerts specific to geographical areas. We look into the specific case of floods as they affect significant number of people. Due to the nature of the problem we can utilize the properties of Information Centric Networking (ICN) in this context, namely: i) Flexibility and high failure resistance: Any node in the network that has the information can satisfy the query ii) Robust: Only sensor and car need to communicate iii) Fine grained geo-location specific information dissemination. We analyze how message forwarding using ICN on top of Ad hoc network, approach compares to the one based on infrastructure, that is less resilient in the case of disaster. In addition, we compare the performance of different message forwarding strategies in VANETs (Vehicular Adhoc Networks) using ICN. Our results show that ICN strategy outperforms the infrastructure-based approach as it is 100 times faster for 63\% of total messages delivered. Then we look into the case where we have the cellular network infrastructure, but it is being pressured due to rapid increase in volume of network traffic (as seen during a major event) or it has been replaced by low capacity mobile tower. In this case we look at offloading as much traffic as possible from the infrastructure to device-to-device communication. However, the host-oriented model of the TCP/IP-based Internet poses challenges to this communication pattern. A scheme that uses an ICN model to fetch content from nearby peers, increases the resiliency of the network in cases of outages and disasters. We collected content popularity statistics from social media to create a content request pattern and evaluate our approach through the simulation of realistic urban scenarios. Additionally, we analyze the scenario of large crowds in sports venues. Our simulation results show that we can offload traffic from the backhaul network by up to 51.7\%, suggesting an advantageous path to support the surge in traffic while keeping complexity and cost for the network operator at manageable levels. Finally, we look at adaptive bit-rate streaming (ABR) streaming, which has contributed significantly to the reduction of video playout stalling, mainly in highly variable bandwidth conditions. ABR clients continue to suffer from the variation of bit rate qualities over the duration of a streaming session. Similar to stalling, these variations in bit rate quality have a negative impact on the users’ Quality of Experience (QoE). We use a trace from a large-scale CDN to show that such quality changes occur in a significant amount of streaming sessions and investigate an ABR video segment retransmission approach to reduce the number of such quality changes. As the new HTTP/2 standard is becoming increasingly popular, we also see an increase in the usage of HTTP/2 as an alternative protocol for the transmission of web traffic including video streaming. Using various network conditions, we conduct a systematic comparison of existing transport layer approaches for HTTP/2 that is best suited for ABR segment retransmissions. Since it is well known that both protocols provide a series of improvements over HTTP/1.1, we perform experiments both in controlled environments and over transcontinental links in the Internet and find that these benefits also “trickle up” into the application layer when it comes to ABR video streaming where HTTP/2 retransmissions can significantly improve the average quality bitrate while simultaneously minimizing bit rate variations over the duration of a streaming session. Taking inspiration from the first two approaches, we take into account the resiliency of a multi-path approach and further look at a multi-path and multi-stream approach to ABR streaming and demonstrate that losses on one path have very little impact on the other from the same multi-path connection and this increases throughput and resiliency of communication.

The evolution in networking coupled with an increasing demand to improve user experience has led to different proposals to extend the standard TCP. Multipath TCP (MPTCP) is one such extension that has the potential to overcome few inherent limitations in the standard TCP. While MPTCP's design and deployment progresses, most of the focus has been on its compatibility. The security aspect is confined to making sure that the MPTCP protocol itself offers the same security level as the standard TCP. The topic of this thesis is to investigate the unexpected security implications raised by using MPTCP in the traditional networking environment. The Internet of today has security middle-boxes that perform traffic analysis to detect intrusions and attacks. Such middle-boxes make use of different assumptions about the traffic, e.g., traffic from a single connection always arrives along the same path. This along with many other assumptions may not be true anymore with the advent of MPTCP as traffic can be fragmented and sent over multiple paths simultaneously. We investigate how practical it is to evade a security middle-box by fragmenting and sending traffic across multiple paths using MPTCP. Realistic attack traffic is used to evaluate such attacks against Snort IDS to show that these attacks are feasible. We then go on to propose possible solutions to detect such attacks and implement them in an MPTCP proxy. The proxy aims to extend the MPTCP performance advantages to servers that only support standard TCP, while ensuring that intrusions can be detected as before. Finally, we investigate the potential MPTCP scenario where security middle-boxes only have access to some of the traffic. We propose and implement an algorithm to perform intrusion detection in such situations and achieve a nearly 90% detection accuracy. Another contribution of this work is a tool, that converts IDS rules into equivalent attack traffic to automate the evaluation of a middle-box. / Multipath TCP (MPTCP) is an extension to standard TCP that is close to being standardized. The design of the protocol is progressing, but most of the focus has so far been on its compatibility. The security aspect is confined to making sure that the MPTCP protocol itself offers the same security level as standard TCP. The topic of this thesis is to investigate the unexpected security implications raised by using MPTCP in a traditional networking environment. Today, the security middleboxes make use of different assumptions that may not be true anymore with the advent of MPTCP.We investigate how practical it is to evade a security middlebox by fragmenting and sending traffic across multiple paths using MPTCP. Realistic attack traffic generated from a tool that is also presented in this thesis is used to show that these attacks are feasible. We then go on to propose possible solutions to detect such attacks and implement them in an MPTCP proxy. The proxy aims to extend secure MPTCP performance advantages. We also investigate the MPTCP scenario where security middleboxes can only observe some of the traffic. We propose and implement an algorithm to perform intrusion detection in such situations and achieve a high detection accuracy. / HITS

The market penetration of mobile access devices with multiple network interfaces has increased dramatically over the last few years. As a consequence, the quest for a widespread multi-path transport protocol that takes advantage of all available interfaces simultaneously to increase data throughput and improve robustness, has received considerable attention. One prominent protocol introduced by the IETF is Multipath TCP (MPTCP). MPTCP is an extension to the predominant single-path transport protocol, the Transport Control Protocol (TCP) that enables multihomed devices to aggregate available resources transparently to the applications. Combining multiple radio access technologies, like LTE and Wi-Fi, with diverse characteristics in terms of transmission rates and fluctuations opens for novel challenges that may disrupt and even harm the data throughput. Therefore MPTCP must take path heterogeneity into account. For MPTCP to supersede single-path TCP it is required that MPTCP always achieve at least the throughput of the best individual TCP path. This thesis investigates if MPTCP with uncoupled congestion control fulfills this condition, and if so, how much it improves the throughput. By examining the protocol in a deterministic emulated environment defined by the characteristics of LTE, we conclude two key factors impacting the outcome: the download size and the difference in characteristics between the paths. Our experiments show that MPTCP overall fulfills this task, especially during path homogeneity with near aggregated results. But we also show that MPTCP may decrease data throughput with 16% compared to TCP during path heterogeneity. Hence MPTCP does not always fulfill the goal of throughput. We therefore conclude further intelligence is needed for the packet scheduling mechanism to avoid throughput degradation in the initial phase of a transmission.