Search

Although the Internet offers numerous advantages, it raises many information security risks, especially against young people and children, who are today amongst the largest user groups of mobile and online technologies all around the world. Therefore, to empower and protect Internet users, it is necessary to develop proper strategies and tools to encapsulate their needs, and identify and prevent all types of the information security risks that may arise during the use of the Internet. In this study, a tracking system to ensure the safe use of the Internet is proposed. Considering the distribution of its potential users, the system has an easy-to-use graphical user interface. By recognizing dangerous web sites and IP addresses, the proposed system blocks access to those sites and this way provides reliable Internet access to its users. During the Internet access, it analyzes accessed IP addresses and port numbers in terms of access type and time and informs the user of the corresponding port numbers which must be closed for safe Internet access. Moreover, by continuously checking the host redirection file of the computer it runs on, it identifies redirections from web addresses to specific IP addresses and this way provides protection against phishing attacks which are becoming one of the most common Internet threats. Although the proposed system is a simple application since it is an open source, freeware application designed for children, it can be improved to consider more sophisticated attack types.

To better understand the Internet infrastructure services is crucial to the design, operation, and management of Internet applications. The lack of better understanding of the actual usage of allocated IP addresses is among many such challenges, due to the wide deployment of IP address multiplexing techniques, such as NAT. To address this issue, we propose a novel analysis approach based on large-scale SSL/TLS flow records of Apple and Amazon services in this paper. This method characterizes the behaviors of different types of multiplexing by three steps: grouping, dividing, and profiling. Our preliminary analysis shows several promising findings, e.g., encrypted data flows still reveals the valuable application behaviors; the multiplexing behaviors of mobile or wired Internet are quite different.

The Internet is facing the accelerating growth of routing table size. Backbone routers' routing table has already reached 512k entries, which has a negative effect on the scalability of the Internet. Hierarchical addressing and locator/ID separation solutions have been proposed to address the scalability issue. However, there has been little focus on how to efficiently represent hierarchical location addresses for a large scale distributed network, such as today's Internet. In this paper, we present a variable-length address encoding method to represent hierarchical location addresses. Our analysis and evaluation results show that 1) it is difficult to use fixed-length encoding to represent hierarchical location addresses for a large scale network; and 2) the proposed variable-length addresses could guarantee the scalability property of hierarchical addressing, and alleviate the inefficiency of address space due to fixed-length addresses.

Internet has been being becoming the most famous and biggest communication networks as social, industrial, and public infrastructure since Internet was invented at late 1960s. In a historical retrospect of Internet's evolution, the Internet architecture continues evolution repeatedly by going through various technical challenges, for instance, in early 1990s, Internet had encountered danger of scalability, after a short while it had been overcome and successfully evolved by applying emerging techniques such as CIDR, NAT, and IPv6. Especially this paper emphasizes scalability issues as technical challenges with forecasting that Internet of things era has come. Firstly, we describe the Identifier and locator separation scheme that can achieve dramatically architectural evolution in historical perspective. Additionally, it reviews various kinds of Identifier and locator separation scheme because recently the scheme can be the major design pillar towards future of Internet architecture such as both various clean-slated future Internet architectures and evolving Internet architectures. Lastly we show a result of analysis by analysis table for future of internet of everything where number of Internet connected devices will growth to more than 20 billion by 2020.

Many of today's devices are internet-enabled with IPv4 internet addresses, exposing them to internet threats. To determine the true scale of vulnerabilities being introduced, particularly in the IPv4 internet address space, a new methodology of scanning the entire IPv4 internet space is required. To improve scanning speeds we created a framework combining fast connectionless port scanners with a thorough and accurate connection-oriented scanner to verify results. The results are stored to a database. This combined framework provides more robust results than current connectionless scanners, yet still scans the IPv4 internet fast enough to be practically usable for mass scanning.

The vision behind the Internet of Things (IoT) is that any things that need communications, are universally connected, and becoming an integral part of the future Internet. However, the existing of Low Power Networks (LPN) consisting of battery-powered nodes poses great challenge for traditional addressing and routing protocols. The paper proposes a geographical topology-enabled IPv6 addressing framework (gIPv6), which define a geographical IPv6 adaption layer for enabling the interconnection between Lower power networks and the global IPv6 Internet at any access point. IPv6 addresses for LPNs are generated based on the short format of geographical location information, so the proposed scheme can potentially extended IPv6 to various networking scenarios with energy restriction and resource limitations.

Private IP addressing is commonly used in enterprise networks. Different enterprises or even different locations/business units of the same enterprise may use the same IP address ranges as long while those networks are separate. Consequently, during mergers and acquisitions, or network consolidations within an enterprise, overlapped and conflicted IP segments (subnets) arise frequently. These must be identified and resolved to allow communication between any pair of source and destination hosts in the merged networks. Furthermore, the combined network may unnecessarily use many disparate IP address ranges which increases the size of the routing tables and makes routing integrity verification difficult. In this paper, we identify different conflict scenarios and consider ways of resolving those conflicts to minimize manual changes and to minimize the routing table sizes. The problem turns out to be NP-hard and rather complex, and we devise effective heuristics to solve the problem. By taking some real-world examples, we show that by changing 6-8% of the subnet addresses the outlined method can effectively resolve the subnet conflicts. The scheme also reduces the number of subnet entries by 80-90% by consolidating the subnet entries, which significantly reduces the routing table sizes.

As the Internet of Things technologies evolve, billions of smart devices will be connected to the Internet. Therefore, the accelerated growth of users, applications and devices pose a great demand on the scalability of the Internet. In this paper, we develop a new Internet architecture -- Multiple-inherited Locators (MiL) -- to meet the future demand on addressing. MiL is based on Locator/ID addressing and hierarchical address allocation. The benefit of this new addressing scheme is the improved scalability of Internet routing by enhancing the prefix aggregation of locators. The number of locators which are needed grows with the Internet scale. In order to represent each locator as a unique binary representation by as few bits as possible, we develop a distributed encoding method to efficiently encode locators. As the Internet topology evolves, the distributed encoding method renumbering locators' codeword for the optimal encoding performance, and meanwhile endeavors to keep their codewords unchanged as much as possible. Because, we want to represent locators by fewer bits as well as keep addressing stable. We adopt an Encoding Table Adjustment algorithm to find a "sweet spot" that balances these two goals. According to our experiment, within a 2% increase on the expected locator length, our algorithm reduces the cost of renumbering locator by 99.9%.

Nowadays industrial control devices are crucial for infrastructure-critical systems such as factories, power plants, and water treatment facilities. Devices with IP addresses are visible on the Internet and they connect cyber space and physical world. The first step in protecting devices from attackers is a deep understanding of the devices' characteristics in the cyber space. In this paper, we take a first step in this direction by investigating physical devices running one of the two specific protocols that are widely adopted in industrial control systems. In order to detect these devices in real-time, we propose a two-stage discovery mechanism: first filtering out unqualified hosts from 4 billion remote hosts and then identifying physical devices from qualified candidates. We have conducted a real-world experiment to verify the mechanism and identified dozens of thousands of physical devices from the entire Internet. Results show that our method discovers all devices in 20 hours with 89.5% precision and 79.3% recall.

It has been widely agreed that the architecture of the Internet is ossified. Many advanced technologies were proposed to deal with the shortcomings of the Internet, such as Quality of Service (QoS), IP multicast, and BGP multipath, but they have not been deployed widely in the Internet. Information-Centric Networking (ICN) has attracted many interests in the research community. The key insight of ICN is that the usage of the Internet has dramatically changed from connecting nodes to accessing information. By the inspiration of ICN thinking, we argue that it is not the ossification of the IP architecture which matters, but the ossification of the business model between ISPs. In this paper, we propose a Supply Chain Management (SCM) based business model to regulate the business relationships between ISPs. The payment flow along Internet Service Providers (ISPs) is changed from the conventional bottom up mode to a chain like mode, very similar to the payment flow of SCM. Simulation results show that the average Autonomous System (AS) hops can be reduced by 47% at most. The hit ratio of replicated contents can be improved by 28% at most, and the profit change of various ASes is almost balanced.

Caches pose a significant challenge to formal proofs of security for code executing on application processors, as the cache access pattern of security-critical services may leak secret information. This paper reveals a novel attack vector, exposing a low-noise cache storage channel that can be exploited by adapting well-known timing channel analysis techniques. The vector can also be used to attack various types of security-critical software such as hypervisors and application security monitors. The attack vector uses virtual aliases with mismatched memory attributes and self-modifying code to misconfigure the memory system, allowing an attacker to place incoherent copies of the same physical address into the caches and observe which addresses are stored in different levels of cache. We design and implement three different attacks using the new vector on trusted services and report on the discovery of an 128-bit key from an AES encryption service running in TrustZone on Raspberry Pi 2. Moreover, we subvert the integrity properties of an ARMv7 hypervisor that was formally verified against a cache-less model. We evaluate well-known countermeasures against the new attack vector and propose a verification methodology that allows to formally prove the effectiveness of defence mechanisms on the binary code of the trusted software. QC 20161123 PROSPER, CERCES

Billions of devices are projected for deployment in the Internet of Things (IoT). Deploying these devices and their associated services is impossible manually, thus a seamless and scalable service discovery mechanism is mandatory for realizing the IoT vision. In this paper, we propose a lightweight application-layer service discovery protocol for IPv6 Low-power Personal Area Networks (6LoWPAN) called 6LoWDIS. 6LoWDIS has two different modes of operation: poll and push both of which require the support of multicast routing in the network layer. 6LoWDIS is built on CoAP/HTTP, thus 6LoWDIS exploits the capabilities of RESTful architectures. We also examine the impact of multicast forwarding techniques on the performance of 6LoWDIS. Simulation shows the delay and the capacity of 6LoWDIS with different multicast forwarding techniques. The results indicate that the mean time-to-enter of poll mode is higher than in push mode and mean time-to-leave of poll is smaller than in case of push mode. Also, the underlying multicast protocol has a significant effect on the performance of the schemes.

Change is necessary to update for IPV6 and evolution in Internet is inevitable, ever since the Internet was born. Internet protocols kept on improving and changing dramatically. They expose new challenges and new features. It's high time that our Internet address have to be upgraded as heap of thing around us got upgraded. Internet protocol is currently version 4 and is being upgraded to 6. Internet was once very inaccessible and limited to very few mass, but today it's a primary quill and basic need. Every user has connectivity through various range of devices such as Laptop's, tablet's, desktop's and IOT (Internet of Things). A few decades ago one IP per user was sufficient but now a user with a range of devices needs more than 8 IP's on average. This resulted in exhausting IP at IANA (Internet Assigned Number Authority) and forcing it to update and upgrade to a better version of protocol. Although the new version looks promising, it has to overcome certain challenges of compatibility. IPV6 is similar to IPV4 but it has very significant features it's easy to adopt, but highly irritating for transition. Although for quite a few years many transition techniques are introduced but not all could actually bring a change due to the lack of flexibility and the amount of difficulty involved. This approach not only aid in retaining the present good practices but also supplies the goodies of modern version unless the transition is complete. Nonetheless, even after transition we will have to be able to have the previous generation utilities still being legitimate and not being void. Certain features such as Auto-configuration of IPV6 will build users to mislead ISP and access higher volumes of data at greater than usual speeds they're allotted. Specific blocked sites may be unblocked by connecting to any IP over the globe as a result resulting a deep flaw within the grounds of security. Security is a most important trouble over Internet, because of above flaws very less are ready to adopt this latest IP variant. This paper deals with IPV6 transition in much huge sense, permitting ISP's to keep the existing security principles still valid making internet a long way safer than ever before. This paper presents a software solution to help the transition, it re-addresses the basic needs and finally establishes a feasible solution which still maintains the applicability and maintainability of both systems until the last device upgrades to ipv6 with no compromise to any existing applications or new applications to come. The solution proposed is for ISP's and the backbone providers of internet and not for individual users.

The Internet of Things (IoT) is a vision for interconnecting all of the world's "things" -- from vehicles to diet scales, smart homes and electrical grids -- through a common set of networking technologies. Realizing this vision using a host-to-host communication paradigm, such as that of the Internet Protocol (IP), is challenging in the context of highly heterogeneous, constrained devices that connect intermittently to one or more networks, often using multiple interfaces, communicate within various security regimes, and require both local and global communication capability. Using IP and similar protocols as the narrow waist of interoperability for IoT requires managing data exchange and security in terms that are largely orthogonal to application semantics, while simultaneously needing to minimize resource usage. This paper explores how Named Data Networking (NDN), a proposed future Internet architecture, addresses the root causes of these challenges and can help achieve the IoT vision in a more secure, straightforward, and innovation-friendly manner. NDN's data-centric communication model aligns network and application semantics, enabling developers to work with "things" and their data directly, and for IoT networks to be deployed and configured easily. To substantiate the high-level discussion, we give examples of ongoing design and implementation work in IoT over NDN and compare the architecture to well-known existing protocols and frameworks. Finally, we discuss short-and long-term scenarios for employing NDN to enable the Internet of Things.

According to an estimate several billion smart devices will be connected to the Internet by year 2020. This exponential increase in devices is a challenge to the current Internet architecture, where connectivity is based on host-to-host communication. Information-Centric Networking is a novel networking paradigm in which data is addressed by its name instead of location. Several ICN architecture proposals have emerged from research communities to address challenges introduced by the current Internet Protocol (IP) regarding e.g. scalability. Content-Centric Networking (CCN) is one of the proposals. In this paper we present a way to use CCN in an Internet of Things (IoT) context. We quantify the benefits from hierarchical content naming, transparent in-network caching and other information-centric networking characteristics in a sensor environment. As a proof of concept we implemented a presentation bridge for a home automation system that provides services to the network through CCN.

The internet faces severe routing scalability problem - the rapid increasing of prefix and updates. There are two classes of factors that contribute to scalability problem: inappropriate allocation of IP addresses and inappropriate usage of them. Existing works mainly focus on inappropriate usage of allocations, so this work focuses on inappropriate allocation of IP addresses. We carry out the measurement from two perspectives. From the perspective of each AS, we classify preprocessed prefixes according to their contribution to aggregating addresses inside the AS. We find that factors due to inappropriate allocation of IP address contribute more than that of inappropriate usage of them in values. From the perspective of Internet, we propose a new metric Brother Prefix Distance, which implies the likelihood of aggregating addresses of different ASes. We find that Brother Prefix Distance increase over time, which implies that impact of address allocation on routing scalability increases over time.

Internet of Things deployments and systems that accompany their functioning, data provisions and actuations are undoubtedly marking the new era of opportunities present in the communication networks and the Internet. The technologies of Internet of Things are extremely diverse. At the moment, there are numerous types of small devices, communication technologies, operating systems, protocols, platforms for data collections and pro ces sing. many with proven and expanding commercial exploitations. This paper outlines a practical approach for understanding the challenges and design issues encountered when a new Internet of Tings system is built by taking all the existing technology as experience and options in the design. Internet of Things system design considered in the paper is multi-purpose meaning it is unbounded in terms of the technology and applications. In the process of building such a system, there are many generic and converging functional and architecture points. Hence, many of the available technology can be understood and integrated not exclusively but coexisting with their alternatives.

The explosion of the number of devices and users on the Internet results in massive amounts of data and information. This poses the most complex challenges in security we have ever faced. The detection of malicious domains and Internet protocol (IP) addresses has been a hot topic in cyber security. We present a scalable and effective graph inference system for detecting malicious domains and IP addresses. The goal is to protect Internet users from network threats. Based on the loopy belief propagation algorithm, the system infers every domain or IP reputation, flagging it with high reputation as malicious one. We have evaluated the system with 75 million-node graph constructed from the huge dataset (500 gigabytes). The system attains performance with 86% and 87% area under receiver operating curves for inferring domain and IP reputations respectively. We demonstrate that the graphical solution provides rapid assessment of safe or risky sites on McAfee's data. It provides an automatic tool for web reputation inference in the field and serves as an assisting tool for “first pass” classification and triaging.

Today's capability of fast Internet-wide scanning allows insights into the Internet ecosystem, but the on-going transition to the new Internet Protocol version 6 (IPv6) makes the approach of probing all possible addresses infeasible, even at current speeds of more than a million probes per second. As a consequence, the exploitation of frequent patterns has been proposed to reduce the search space. Current patterns are manually crafted and based on educated guesses of administrators. At the time of writing, their adequacy has not yet been evaluated. In this paper, we assess the idea of pattern-based scanning for the first time, and use an experimental set-up in combination with three real-world data sets. In addition, we developed a pattern-based algorithm that automatically discovers patterns in a sample and generates addresses for scanning based on its findings. Our experimental results confirm that pattern-based scanning is a promising approach for IPv6 reconnaissance, but also that currently known patterns are of limited benefit and are outperformed by our new algorithm. Our algorithm not only discovers more addresses, but also finds implicit patterns. Furthermore, it is more adaptable to future changes in IPv6 addressing and harder to mitigate than approaches with manually crafted patterns.

The Internet is nowadays divided into multiple segments with different address spaces such as IPv4, IPv6 and private address. To interconnect such segments, NAT, firewall or similar devices are indispensable in the current Internet. Placing such devices on the Internet unnecessarily complicated the Internet. It is extremely difficult and even impossible to strictly preserve the original end-to-end principle of the Internet. We think that it is still possible to preserve the key feature of the end-to-end principle of the Internet even in the current Internet, by just relaxing this strict principle. To this end, we propose a new Internet architecture, which is called a Virtual IP Layer (VIP) that virtually realizes IP connectivity between hosts that belong to different IP address realms. The virtual IP layer is placed just over the IP layer, and performs the IP address translation in a consistent manner, by applying the label-switching technique to forwarding of IP packets. To verify the feasibility of this architecture, we have applied it to communication between hosts, which belong to different private IPv4 realms, via the global IPv4 address realm (i.e. the Internet), and developed its prototype.

With the rapid development of wireless communication technologies, machine-to-machine (M2M) communications, which is an essential part of the Internet of Things (IoT), allows wireless and wired systems to monitor environments without human intervention. To extend the use of M2M applications, the standard of Internet Protocol version 6 (IPv6) over Low power Wireless Personal Area Networks (6LoWPAN), developed by The Internet Engineering Task Force (IETF), would be applied into M2M communication to enable IP-based M2M sensing devices to connect to the open Internet. Although the 6LoWPAN standard has specified important issues in the communication, security functionalities at different protocol layers have not been detailed. In this paper, we propose an enhanced authentication and key establishment scheme for 6LoWPAN networks in M2M communications. The security proof by the Protocol Composition Logic (PCL) and the formal verification by the Simple Promela Interpreter (SPIN) show that the proposed scheme in 6LoWPAN could enhance the security functionality with the ability to prevent malicious attacks such as replay attacks, man-in-the-middle attacks, impersonation attacks, Sybil attacks, and etc.

The Internet has enabled wide use of content delivery services. However, while the functional form of the Internet has changed over time, today's Internet still cannot fully accommodate users' demands regarding content delivery. This is because the conventional IP network has been designed from a location-oriented viewpoint, while users generally have a content-oriented viewpoint. That is, users are generally best satisfied if desired content can be obtained from any one of multiple nearby points holding duplicate content distributed over networks. Since the conventional IP network cannot efficiently deliver content, content-centric networking (CCN), which is designed for content delivery services, is attracting much attention [1], [2].

Internet routers are a commons. While modest regulatory measures have generally been successful for Information Communication Technologies (ICT), this paper argues that the lack of regulation has hindered the technological evolution of the Internet in some areas. This issue is examined through five Internet problems, and the technological solutions adopted. The key contribution of this paper is the explanation of these issues and the identification of areas where misaligned incentives promote inadequate solutions or inaction. The paper reviews the available measures to encourage the adoption of globally beneficial Internet technologies.

In this paper an Internet service audience is studied in order to create a user kernel, with the audience represented as a list of IP addresses able to authorize access to the beginning of a network attack. Methods with which to determine the regular audience of an Internet service and to identify IP addresses from which such a network attack is carried out are offered. Experiments were performed involving a real network attack on a popular Internet portal. In order to isolate the source IP address of the attack a demonstration is provided regarding the efficacy of the simultaneous application of two criteria: exceeding the threshold for the UDP stream speed limit, and the number of flows generated with the test IP addresses.

As the Internet continues to establish itself as a utility, like power, transport or water, it becomes increasingly important to provide an engaging educational experience about its operation for students in related STEM disciplines such as Computer Science and Electrical Engineering. Routing is a core functionality of the global Internet. It can be used as an example of where theory meets practice, where algorithms meet protocols and where science meets engineering. Routing protocols can be included in the Computer Science curriculum in distributed systems, computer networking, algorithms, data structures, and graph theory. While there is a plethora of computer networking textbooks, and copious information of varying quality about the Internet spread across the Web, there is still an essential need for exploratory learning facilities of the type that support group work, experimentation and experiential learning. This paper reports on work using open virtual worlds to provide a multi-user interactive learning environment for Internet routing which exemplifies the capabilities of emerging immersive education technologies to augment conventional practice. The functionality of the learning environment is illustrated through examples and the underlying system which was built to support the routing simulations is explained. Postprint

The Internet Engineering Task Force (IETF) standardized and published the IPv4 protocol in September 1981. After almost 30 years, the remaining IPv4 addresses have been distributed by Internet Assigned Numbers Authority (IANA) in February 2011. Due to the exhaustion of IPv4 addresses, the transition from IPv4 to IPv6 is required definitely. The IPv6 protocol and address will gradually replace IPv4, and they might coexist in the Internet for a long time. In Taiwan, the Government plans to migrate most of websites and Internet services during 2013 to 2016. In order to prevent the IPv6-only users cannot acquire the same information as IPv4 users, some content providers start to evaluate the content consistency of websites. However, these tasks need manpower and waste time. In this paper, we propose an on-line evaluation system for reducing the efforts of content comparison. We utilize the concept of web crawler to detect the website supports dual-stack or not, and evaluate the content consistency automatically. According to the evaluation report, the engineers are able to realize the inconsistent contents of website between IPv4 and IPv6.