Search

Passwords should be easy to remember, yet expiration policies mandate their frequent change. Caught in the crossfire between these conflicting requirements, users often adopt creative methods to perform slight variations over time. While easily fooling the most basic checks for similarity, these schemes lead to a substantial decrease in actual security, because leaked passwords, albeit expired, can be effectively exploited as seeds for crackers. This work describes an approach based on Bloom Filters to detect password similarity, which can be used to discourage password reuse habits. The proposed scheme intrinsically obfuscates the stored passwords to protect them in case of database leaks, and can be tuned to be resistant to common cryptanalytic techniques, making it suitable for usage on exposed systems.

Software Defined Networking has put the accent on the implementation of effective, sophisticated algorithms for the control plane, running on centralized devices. Pure centralization, however, also introduces inefficiencies and limitations in many scenarios, often negatively affecting security. Network applications could benefit from data plane programmability, e.g. implementing the increasingly popular P4 language. In this paper, we show that P4-enabled switches can run simple yet significant tasks that enhance the cooperation with the control plane, improving traffic analysis functionalities of practical relevance for security monitoring purposes. We also show how this P4-based solutions can be integrated into an SDN architecture acting as an Intrusion Detection System.

In this manuscript we present an original implementation of network management functions in the context of Software Defined Networking. We demonstrate a full integration of an artificial intelligence driven management, an SDN control plane, and a programmable data plane. Constraint Programming is used to implement a management operating system that accepts high level specifications, via a northbound interface, in terms of operational objective and directives. These are translated in technology-specific constraints and directives for the SDN control plane, leveraging the programmable data plane, which is enriched with functionalities suited to feed data that enable the most effective operation of the “intelligent” control plane, by exploiting the P4 language.

Network Function Virtualization (NFV) and Software Defined Networking (SDN) are technologies that recently acquired a great momentum thanks to their promise of being a flexible and cost-effective solution for replacing hardware-based, vendor-dependent network middleboxes with software appliances running on general purpose hardware in the cloud. Delivering end-to-end networking services across multiple NFV/SDN network domains by implementing the so-called Service Function Chain (SFC) i.e., a sequence of Virtual Network Functions (VNF) that composes the service, is a challenging task. In this paper we address two crucial sub-problems of this task: i) the language to formalize the request of a given SFC to the network and ii) the solution of the SFC design problem, once the request is received. As for i) in our solution the request is built upon the intent-based approach, with a syntax that focuses on asking the user "what" she needs and not "how" it should be implemented, in a simple and high level language. Concerning ii) we define a formal model describing network architectures and VNF properties that is then used to solve the SFC design problem by means of Constraint Programming (CP), a programming paradigm which is often used in Artificial Intelligence applications. We argue that CP can be effectively used to address this kind of problems because it provides very expressive and flexible modeling languages which come with powerful solvers, thus providing efficient and scalable performance. We substantiate this claim by validating our tool on some typical and non trivial SFC design problems., Comment: 10 pages, 6 figures, HICSS-52

Mission Critical (MC) communications are key to effective Public Protection and Risk Reduction (PPRR) actions. The 3GPP standards include the definition of MC applications and services in an architectural framework compatible with current (LTE) and future (5G) mobile networks. In this paper we report an experimental activity where MC communication services are implemented in a fully virtualized environment, being deployed and tested in a multi-domain network slicing architecture compliant with the ETSI NFV MANO specifications. The level of automation in service deployment and the slice isolation features are demonstrated, in line with the 5G approach of separation between control and data plane, showing the benefits in terms of application performance and management flexibility.

As computing and communication infrastructures have gained an ever-increasing role in everybody's life, guaranteeing their reliability has become a critical endeavor. In the face of threats that grow more and more sophisticated, we must turn our attention to the techniques that have the potential to match them and scale with the infrastructure complexity. The current trend in the telecommunication industry towards "softwarized infrastructures" by means of new technologies such as Software Defined Networking and Network Function Virtualization may provide a innovative and effective solutions from this point of view.In this work, we outline a network security monitoring architecture aimed at striking the best trade-off between effectiveness and efficiency. This result is achieved by exploiting the possibility, already enabled by state-of-the-art, yet well tested components for infrastructural orchestration, of dynamic instantiation and composition of functions. We conclude that efficient detection of some classes of network-based denial-of-service attacks is possible, and open the path to mitigation strategies that optimize the usage of resources by deploying and re-configuring them as needed in real-time.

Mobility-as-a-Service (MaaS) applies the everything-as-a-service paradigm of Cloud Computing to transportation: a MaaS provider offers to its users the dynamic composition of solutions of different travel agencies into a single, consistent interface. Traditionally, transits and data on mobility belong to a scattered plethora of operators. Thus, we argue that the economic model of MaaS is that of federations of providers, each trading its resources to coordinate multi-modal solutions for mobility. Such flexibility comes with many security and privacy concerns, of which insider threat is one of the most prominent. In this paper, we revise and extend previous work where we classified the potential threats of individual operators and markets of federated MaaS providers, proposing appropriate countermeasures to mitigate the problems. In addition, we consider the emerging case of Cloud-of-Things (CoT) for mobility, i.e., networks of ubiquitous, pervasive devices that provide real-time data on objects and people. Automation and pervasiveness of CoT make an additional attack surface for insiders. In an effort to limit such phenomenon, we present an overlay networking architecture, based on gossip protocols, that lets users share information on mobility with each other. A peculiarity of the architecture is that it both constrains the quality and quantity of data obtainable by insiders, optimizing the routing of requests to involve only users that are able to answer them.

In Software-Defined Networks (SDNs) the role of the centralized controller is crucial, and thus it becomes a single point of failure. In this work, a distributed controller architecture is explored as a possible solution to improve fault tolerance. A network partitioning strategy, with small subnetworks, each with its own Master controller, is combined with the use of Slave controllers for recovery aims. A novel formula is proposed to calculate the reliability rate of each subnetwork, based on the load and considering the number and degree of the nodes as well as the loss rate of the links. The reliability rates are shared among the controllers through a newly-designed East/West bound interface, to select the coordinator for the whole network. This proposed method is called “Reliable Distributed SDN (RDSDN).” In RDSDN, the failure of controllers is detected by the coordinator that may undertake a fast recovery scheme to replace them. The numerical results prove performance improvement achievable with the adoption of the RDSDN and show that this approach performs better regarding failure recovery compared to methods used in related research.

A key aspect that Telco operators must carefully consider when deploying Network Function Virtualization (NFV) solutions is the level of performance that cloud computing software platforms can guarantee in support of the offered network services. OpenStack is widely considered as one of the most relevant open-source frameworks that could accelerate the NFV adoption, also because the evolution of its networking components sees a progressive integration of SDN-based solutions that could significantly improve the performance of cloud-based connectivity services. In this paper, we discuss some of the most recent OpenStack innovations that enable a native SDN-like approach to firewalling functions in the data plane, as well as a native SDN-oriented control of the virtual network infrastructure. Then we present a detailed performance analysis of the aforementioned innovations at both the data and control/management plane, showing the potentials of native SDN adoption within OpenStack toward an integrated solution for production-level NFV deployments.

One of the major challenges in Internet of Things (IoT) will be management and orchestration of multi-technology/multi-vendor network environments. According to many stakeholders, the adoption of software defined networking (SDN) principles in 5G (5-th Generation) wireless networks will allow the integration of mobile networks and the internet of things and will make it possible to manage billions of connected smart objects through intelligent orchestration and provisioning systems. The special value of SDN lies its ability to support network virtualization and to automate deployment of new services on top of the virtualized network infrastructure. To pave the way towards this novel approach, we present a SDN-based architecture for virtualization of IoT networks, including an intent-based north-bound interface and a virtualized infrastructure manager, allowing virtualization of IoT resources. The architecture exploits SDN controller to program different IoT networks in order to provide to users the intended service at the requested level of quality. A prototype of the architecture is presented and numerical results related to round trip time, measured at the different levels of the architecture, are reported.

Availability is a fundamental operational challenge of any networked system. Software-Defined Networks (SDN) and Network Function Virtualization (NFV) systems are no exception. While extensive work exists on lightweight virtual machines live migration, and SDN controllers are claimed to be only logically centralized, specifications for a live controller migration protocol have not been written yet.In this paper, we propose the design and implementation of Flock, a live controller migration protocol that works independently from the underlying software-defined infrastructure, a feature lacking in every related solution. We also propose the controller-switch assignment problem and show that no pseudo-polynomial algorithm exists to solve it, unless P=NP. Our initial evaluation results with the Ryu controller show expected minimal protocol overhead.

In recent years, the elastic optical networks (EONs) emerged as a potential technology to support a great variety of bandwidth-consuming applications in core and metropolitan area networks. Within EONs framework, it is possible to choose the modulation formats and/or bandwidth requirements depending on the network available resources and on the required transmission distances. However, it is very difficult to make fair performance comparisons when different topologies and network scenarios with different bandwidth demands and traffic probabilities are considered. In this paper, we present and discuss a new methodology to solve this problem. The strategy is based on the normalization of the EONs load and numerical examples are used to illustrate its use and effectiveness.

Made available in DSpace on 2019-10-06T15:36:54Z (GMT). No. of bitstreams: 0 Previous issue date: 2019-03-01 In this paper we show that the adoption of a simple weighted ordering heuristic strategy to find fixed shortest path routes in a topology can improve load-balancing and, consequently, network performance. We compared our fixed routing strategies against the k-shortest paths (k-SP) fixed-alternate routing strategy for three different mesh topologies considering fixed grid networks (FGNs) and elastic optical networks (EONs). The results show that our simple fixed routing strategies can improve network performance for an optical network system, even compared with the fixed alternate routing and always using the shortest path. Results also show that such easy strategies act mainly in longer routes, increasing their probability of use and balancing the link load distribution. Center for Engineering Modeling and Applied Social Sciences Universidade Federal Do ABC Universidade Estadual Paulista (UNESP) University of Bologna Universidade Estadual Paulista (UNESP)

The emerging network paradigms allow service providers to completely rethink the way network services are designed, developed, provisioned, and managed. Service Function Chaining allows to easily deploy complex and composite network services by concatenating one or more physical or virtualized components. However, a step forward in terms of abstraction is needed, and an intent-based approach to service chain specification is considered a promising solution. We demonstrate how to achieve intent-based SFC specification on an ETSI NFV environment, running on top of an experimental test bed based on commonly available open-source software platforms, such as Open Source MANO and OpenStack.

In this work we present an exploitation of the Software Defined Networking paradigm to implement an architecture allowing a system network administrator to implement and verify in a formal way security policies. The main result is a framework that support the network administrator in the security management process providing services during all this phase, from automated traffic analysis during the prevention phase to tools for the exclusion of malicious traffic from the main flow in the reaction phase. In order to validate the proposed architecture we will showcase an industrial network applied scenario, simulating attacks and countermeasures techniques.

One of the goals of Software-Defined Networking (SDN) is to allow users to specify high-level policies into lower level network rules. Managing a network and decide what policy set is appropriate requires, however, expertise and low level know-how. An emerging SDN paradigm is to allow higher-level network level decisions wishes in the form of "intents". Despite its importance in simplifying network management, intent specification is not yet standardized. In this work, we propose a northbound interface (NBI) for intent declaration, based on Behavior-Driven Development. In our approach, intents are specified in plain English and translated by our system into pre-compiled network policies, that are in turn, converted into low-level rules by the software-defined infrastructure e.g. an SDN controller. We demonstrated our behavior-driven approach with two practical use cases: service function chaining deployed on OpenStack, supported by both ONOS and Ryu controllers, and dynamic firewall programming. We also measured the overhead and response time of our NBI. We believe that our approach is far more general and paves the way for a more expressive and simplified northbound interface for intent-driven networking.

The wide diffusion of mobile devices and of digital technologies are dramatically changing the usage scenarios in different contexts. One of them is cultural heritage, where new media are offering huge possibilities for the enhancement and the enrichment of heritage experience, improving the users’ involvement. In particular, tourists equipped with their mobile devices are invading cultural attractions, sharing pictures and comments (together with hashtags and geo-localized positions) on social networks. These represent a source of data, which can be integrated with the official ones provided by GLAM (Galleries, Libraries, Archives, and Museums) and cultural heritage institutions, enriching them. In this paper, we explore how social networks and crowdsourcing activities can be exploited as a source of information for cultural places and pieces? of? art.

Industry 4.0 is a new strategic industrial development that is changing the way business develop communication and management protocols on their networks. Software-Defined Networking (SDN) can help this revolutionary process but to make the most of its potential, more abstract and customizable development paradigms are needed. In this work we present a toolkit whose scope is to allow a system network administrator to implement and verify in a formal way security policies, in the context of an industrial network. The prototype of our tool suite is based on four application plug-ins of the ONOS controller. Our SDN-based toolkit is able to detect compromised network boxes as a result of bogus injected flow-rules, inner loops and black-holes (notoriously difficult to detect via normal network scans), flow-rule replacements or removal and other SDN controller exploitations that may compromise the forwarding activities. We argue that our set of tools is already effective despite being at its development infancy, and its design easily extensible to other use cases.

This article addresses the potential impact of emerging technologies and solutions, such as software defined networking and network function virtualization, on carriers' network evolution. It is argued that standard hardware advances and these emerging paradigms can bring the most impactful disruption at the network's edge, enabling the deployment of clouds of nodes using standard hardware: it will be possible to virtualize network and service functions, which are provided today by expensive middleboxes, and move them to the edge, as close as possible to users. Specifically, this article identifies some of key technical challenges behind this vision, such as dynamic allocation, migration, and orchestration of ensembles of virtual machines across wide areas of interconnected edge networks. This evolution of the network will profoundly affect the value chain: it will create new roles and business opportunities, reshaping the entire ICT world.

The public transport network of a region inhabited by more than 4 million people is run by a complex interplay of public and private actors. Large amounts of data are generated by travellers, buying and using various forms of tickets and passes. Analysing the data is of paramount importance for the governance and sustainability of the system. This manuscript reports the early results of the privacy analysis which is being undertaken as part of the analysis of the clearing process in the Emilia-Romagna region, in Italy, which will compute the compensations for tickets bought from one operator and used with another. In the manuscript it is shown by means of examples that the clearing data may be used to violate various privacy aspects regarding users, as well as (technically equivalent) trade secrets regarding operators. The ensuing discussion has a twofold goal. First, it shows that after researching possible existing solutions, both by reviewing the literature on general privacy-preserving techniques, and by analysing similar scenarios that are being discussed in various cities across the world, the former are found exhibiting structural effectiveness deficiencies, while the latter are found of limited applicability, typically involving less demanding requirements. Second, it traces a research path towards a more effective approach to privacy-preserving data management in the specific context of public transport, both by refinement of current sanitization techniques and by application of the privacy by design approach.

This papers describes a proof-of-concept implementation of the Service Function Chaining Control Plane, exploiting the IETF Network Service Header approach. The proposed implementation combines the OpenFlow protocol to control and configure the network nodes and the NSH method to adapt the service requirements to the transport technology. The manuscript shows that the result of this combination is a very general architecture that may be used to implement any sort of Service Function Chain with great flexibility.

This work presents a use case on multimodal urban paths in a smart mobility context. The proposed solution builds on the experience already matured and developed by the authors in different fields: crowdsourcing and sensing done by users to gather data related to urban barriers and facilities, computation of personalized paths for users with special needs, and integration of open data provided by bus companies to identify the actual accessibility features and estimate the real arrival time of vehicles at stops. In terms of functionality, the first “monolithic” prototype fulfilled the goal of composing the aforementioned pieces of information to support citizens with reduced mobility (users with disabilities and/or elderly people) in their urban movements. In this paper, we describe a service-oriented architecture that exploits the microservices orchestration paradigm to enable the creation of new services and to make the management of the various data sources easier and more effective. The manuscript demonstrates the effectiveness of the approach showing a successful use case of a service that take into account multimodal paths, by involving cyclists, bicycle lanes, and bike sharing services in a urban environments. Such a use case take into account the user's interface and interaction mechanisms, which are strongly affected by the context of use.

Mobility is a crucial sector for the livability of urban spaces, both in terms of accessibility for people with disabilities, and in terms of enjoyability by people with different interests. The deep transformation mobility is undergoing, heading towards commoditization of the full spectrum of transportation services, can lead to efficient solutions based on the same principle for all these needs. This paper shows how the approach based on the flexible orchestration of microservices allows to build applications that are, at the same time, more easily suited to the specific needs of different user categories, and more seamlessly integrated in the Mobility as a Service approach to smart mobility.

Applications supporting the independent living of people with disabilities are usually built in a monolithic fashion for a specific purpose. On the other hand, a crucial sector for the livability of urban spaces such as mobility is undergoing a deep transformation, heading towards flexible composition of standardized services. This paper shows how this approach allows to build better applications for people with specific needs, making them seamlessly integrated in the most modern approach to smart mobility.

International audience; Mobility as a Service (MaaS) applies the everything-as-a-service paradigm of Cloud Computing to transportation: a MaaS provider offers to its users the dynamic composition of solutions of different travel agencies into a single, consistent interface. Traditionally, transits and data on mobility belong to a scattered plethora of operators. Thus, we argue that the economic model of MaaS is that of federations of providers, each trading its resources to coordinate multi-modal solutions for mobility. Such flexibility comes with many security and privacy concerns, of which insider threat is one of the most prominent. In this paper, we follow a tiered structure — from individual operators to markets of federated MaaS providers — to classify the potential threats of each tier and propose the appropriate countermeasures, in an effort to mitigate the problems.

One of the main challenges in delivering end-toend service chains across multiple Software Defined Networking (SDN) and Network Function Virtualization (NFV) domains is to achieve unified management and orchestration functions. A very critical aspect is the definition of an open, vendoragnostic, and interoperable northbound interface (NBI) that should be as abstracted as possible from domain-specific data and control plane technologies. In this paper we propose a reference architecture and an intent-based NBI for end-to-end service orchestration across multiple technological domains. In particular, we consider the use case of an Internet of Things (IoT) infrastructure deployment and the corresponding cloudbased data collection, processing, and publishing services with quality differentiation.We also report the experimental validation of the proposed architecture over a heterogeneous OpenFlow/IoT SDN test bed.

Flexible optical network (FON) architectures are considered a very promising solution where spectrum resources are allocated within flexible frequency grids. These architectures must handle the spectrum more efficiently and must support on-demand elastic bandwidth provisioning. However, when multi-bandwidth services coexist without a suitable bandwidth management, blocking of wider spectrum calls increases compared to narrower spectrum calls. This unfairness effect limits FONs' performance, not fulfilling much of the promise they hold. In this letter we present a new specific variant of trunk reservation policies that can effectively deal with fast on-demand bandwidth provisioning. Through network simulations we show that trunk reservation is able to guarantee fairness and to equalize the performance of an entire network in terms of blocking probability and link utilization with different flexible spectrum allocation policies.

The concept of Mobility as a Service (MaaS) was born in Finland and it is rapidly spreading worldwide [1]. Keypoint of a MaaS provider is that it shall offer a unique and seamless interface to its users, aggregating heterogeneous transport options offered by different mobility providers (e.g., different agencies providing transportation by taxi, bus, train, plane, car-sharing, etc.), handling the whole experience of traveling, from providing information, to travel planning, and payments. To effectively support the creation of a market of MaaS providers, we envision the creation of ICT infrastructures based on microservices. This modern and renowned development model [2] fosters the creation of an ecosystem of reusable components. In the context of MaaS, microservices shall efficiently and flexibly combine heterogeneous data sources, such as available transport options, real-time data regarding vehicles and infrastructures, pricing, etc., to provide customized travel planning, information and ticketing to final users, as well as monitoring and strategic planning tools to policy-makers. We are currently developing one of such infrastructures as a marketplace for mobility services, called Smart Mobility for All (SMAll). In our vision, SMAll is the enabling technology to solve the challenges of the MaaS market, from developing user-contributed, crowd-sourced applications, to launching a MaaS operator, to planning effective and sustainable transport policies for smart cities. However, we recognize that such a promising platform as SMAll has a lot of security issues derived from its openness regarding the usage, deployment, and (above all) reliability of its services.

Techno-economic drivers are creating the conditions for a radical change of paradigm in the design and operation of future telecommunications infrastructures. In fact, SDN, NFV, Cloud and Edge-Fog Computing are converging together into a single systemic transformation termed "Softwarization" that will find concrete exploitations in 5G systems. The IEEE SDN Initiative has elaborated a vision, an evolutionary path and some techno-economic scenarios of this transformation: specifically, the major technical challenges, business sustainability and policy issues have been investigated. This white paper presents: 1) an overview on the main techno-economic drivers steering the "Softwarization" of telecommunications; 2) an introduction to the Open Mobile Edge Cloud vision (covered in a companion white paper); 3) the main technical challenges in terms of operations, security and policy; 4) an analysis of the potential role of open source software; 5) some use case proposals for proof-of-concepts; and 6) a short description of the main socio-economic impacts being produced by "Softwarization". Along these directions, IEEE SDN is also developing of an open catalogue of software platforms, toolkits, and functionalities aiming at a step-by-step development and aggregation of test-beds/field-trials on SDN-NFV-5G. This will prepare the ground for developing new ICT ecosystems, thereby improving the quality of life and facilitating the development of the new digital economy

Crowdsensing is a powerful approach to build representations of specific aspects of reality which are of interest for citizens in smart cities, and in particular for people with special needs. In this work, we present an application of the microservice paradigm to create a mobility services platform. By exposing each part of the process as a microservice, we achieve the ability of developing applications as orchestration of available components. Moreover, we leverage the possibility of sharing data between different applications in a controlled environment.

The technological compound known as Internet of Things is enabling massive transformations in many fields. In this paper, we deal with one emerging scenario, Mobility as a Service, where the interplay between technical, regulatory and social aspects is intense. We advocate the need for interdisciplinary research, taking into account the different facets of a system which, in summary, aims at improving the quality of urban life by collecting personal data, tracking citizens’ movements, correlating them with many other sources of information, and making the results widely available.

This work presents an architecture to help designing and deploying smart mobility applications. The proposed solution builds on the experience already matured by the authors in different fields: crowdsourcing and sensing done by users to gather data related to urban barriers and facilities, computation of personalized paths for users with special needs, and integration of open data provided by bus companies to identify the actual accessibility features and estimate the real arrival time of vehicles at stops. In terms of functionality, the first “monolithic” prototype fulfilled the goal of composing the aforementioned pieces of information to support citizens with reduced mobility (users with disabilities and/or elderly people) in their urban movements. In this paper, we describe a service-oriented architecture that exploits the microservices orchestration paradigm to enable the creation of new services and to make the management of the various data sources easier and more effective. The proposed platform exposes standardized interfaces to access data, implements common services to manage metadata associated with them, such as trustworthiness and provenance, and provides an orchestration language to create complex services, naturally mapping their internal workflow to code. The manuscript demonstrates the effectiveness of the approach by means of some case studies.

An architecture for enabling the internet connection of a fleet of electric vehicles is presented in the paper. The connection is based on the on-board integration of an Arduino platform with the CAN-bus communication network of the vehicle powertrain. The system allows a plurality of networking interface: GPRS, LAN, Wi-fi for the present and Wi-Max, LTE for the future. The proposed system manages the main powertrain parameters and warning/fault condition. Local and remote data storage is possible, such as direct web interface of the vehicle powertrain. Data post processing from the remote server allows the implementation of an automatic diagnostic procedure for the detection of incipient faults in the powertrain.

This article describes the impact of a cognitive transport and resource management paradigm on the convergence of application and network services in next-generation networks. This is achieved by a new transport service layer implementing the functions needed by applications to automatically negotiate the network transport services. A testbed built on widely available technologies is described, presenting and discussing experiments that demonstrate the feasibility and advantages of a network infrastructure equipped with the proposed transport service layer. Two case studies are considered here with reference to the scenario of a user wishing to access a video service. The former is a traditional videoon- demand service, based on dynamic bandwidth allocation; the latter considers a "cloud-based" video-on-demand service, in which the video content is dynamically moved where user location and resource availability require.

This paper describes a possible approach to provide advanced communication services for the Future Internet in an automated way. This is achieved by introducing a newCognitive Transport Servicelayer on top of the traditional transport layer, which is used by the network to automatically negotiate the required transport service with the applications. Experimental validation of the proposed solution is discussed with the help of two case studies: bandwidth reservation on a secure channel and dynamic bandwidth negotiation for variable-quality video streaming.

Summary One of the main challenges in delivering end‐to‐end service chains across multiple software‐defined networking (SDN) and network function virtualization (NFV) domains is to achieve unified ...

The HTTPS protocol is commonly adopted to secure connections to websites, both to guarantee the server's authenticity and to protect the privacy of transmitted data. However, the computational load associated with the protocol's key exchange and encryption/decryption activities isn't negligible. Many trafficked websites must avoid using HTTPS for most of their pages, typically restricting its usage only to encrypting sensitive user data. This article illustrates how this common practice significantly reduces the possibility of detecting manipulations of the data stream by the client, thus exposing the user to potential man-in-the-middle attacks.

This paper reports a summary of the joint research activities on Optical Core Networks within the e-Photon-ONe+ project. It provides a reasonable overview of the topics considered of interest by the European research community and supports the idea of building joint research activities that can leverage on the expertise of different research groups. Thisworkwas supported by the e-Photon/ONe+ and BONE (“Building the Future Optical Network in Europe”) projects funded by the European Commission through the 6th and 7th ICT-Framework Programme

This paper presents some instantiations of novel application-aware network architectures for emerging IT services and future Internet applications. It proposes and analyses network architectures where the Control and Service Planes are closely and seamlessly interacting with the applications. One instantiation, the Grid-GMPLS (G^2MPLS, as defined by the Phosphorus project) is presented, which implements the Network Control Plane (NCP) architecture for the support of Grid Network Services (GNS). The GNS allows the provisioning of network and HPC/Grid resources in a single-step through a set of seamlessly integrated procedures. In a second example of instantiation, a quite popular application in signalling, i.e. the Session Initiation Protocol (SIP), is integrated with the Optical Burst Switched (OBS) network technology. The SIP-enabled OBS network can be used to manage application sessions and provide network and IT services according to application requirements. This paper investigates the requirements that these new integrated architectures impose on supporting network Control and Service Planes, and technologies, and discusses their possible implementations.

Following the current evolution of virtualization techniques and software defined networking, edge networks might evolve towards a fully virtualized implementation by means of a number of virtual machines working cooperatively to perform the tasks of existing network middleboxes. In such a scenario the possibility to migrate groups of cooperating virtual machines as a whole set may be a very important feature, but what will be the performance issues of this solution? The live migration performance of multiple virtual machines working in some sort of correlated manner is a topic that has not been widely studied in the literature. This manuscript presents a model reasonably simple to implement that may be used to derive some performance indicators such as the whole service downtime and the total migration time. The model is used to compare some scheduling strategies for the migration and provide guidelines to such implementation.