Search

Communication networks (wired or wireless) have traditionally been assumed to be connected at least most of the time. However, emerging applications such as emergency response, special operations, smart environments, VANETs, etc. coupled with node heterogeneity and volatile links (e.g. due to wireless propagation phenomena and node mobility) will likely change the typical conditions under which networks operate. In fact, in such scenarios, networks may be mostly disconnected, i.e., most of the time, end-to-end paths connecting every node pair do not exist. To cope with frequent, long-lived disconnections, {\em opportunistic routing} techniques have been proposed in which, at every hop, a node decides whether it should either forward and/or store-and-carry a message. As a result, a number of message replicas may be created and routed independently (``spraying''). Most opportunistic routing schemes to-date perform {\em greedy} replication handing over a copy of a message to the first nodes encountered. Yet, in a network with heterogeneous nodes, where some nodes may be much ``better'' relays than others, such greedy schemes waste a lot of message replicas (and thus energy, storage space, etc.) on ``useless'' relays. For this reason, we propose the idea of \emph{utility-based replication}, where some \emph{fitness} or \emph{utility} function is maintained for all nodes in a distributed fashion, and a small budget of message replicas is allocated according to this utility only to the fittest nodes. We describe a number of variations using different utility functions, and show that an improvement of up to 5-6 times in delay can be achieved over greedy algorithms.

Network coding is a new transmission paradigm that proved its strength in optimizing the usage of network resources. In this paper, we evaluate the gain from using network coding for file sharing applications running on top of wireless mesh networks. With extensive simulations carried out on a simulator we developed specifically for this study, we confirm that network coding can improve the performance of the file sharing application, but not as in wired networks. The main reason is that nodes over wireless cannot listen to different neighbors simultaneously. Nevertheless, one can get more from network coding if the information transmission is made more diverse inside the network. We support this argument by varying the loss rate over wireless links and adding more sources.

Recent proposals in multicast overlay networks have demonstrated the importance of exploiting underlying network topology data to construct efficient overlays. While they avoid virtual coordinates embedding and fixed landmarks measurements, these topology-aware proposals often rely on incremental and periodic refinements to improve each node's position in the delivery tree. We claim that there are barriers for the scalability of existing overlay multicast protocols. In fact, periodical refinement and control processes induce additional overhead and high communication cost. On the other hand, users attending a video conferencing session or an event broadcast expect an acceptable quality as soon as they join the multicast session. It is then important to overcome an efficiency problem from which almost all current overlay multicast proposals suffer. This problem is the long convergence time to reach a stabilized quality state in the overlay delivery tree. We propose a novel overlay multicast tree construction scheme, called LCC : Locate, Cluster and Conquer, designed to address the aforementioned scalability and efficiency issues. The scheme consists in two phases: a selective locating phase and an overlay construction phase. Using partial knowledge of location-information for participating nodes, the selective locating phase algorithm consists in locating the closest existing set of nodes (cluster) in the overlay for a newcomer. It allows then to avoid initially randomly-connected structures without using virtual coordinates system embedding nor fixed landmarks measurements. Then, on the basis of this locating process, the overlay construction phase consists in building and managing a topology-aware clustered hierarchical overlay.

A block ACK (BTA) scheme has been proposed in IEEE 802.11e to improve medium access control (MAC) layer performance. It is also a promising technique for next-generation high-speed wireless LANs (WLANs) such as IEEE 802.11n. We present a theoretical model to evaluate MAC saturation throughput of this scheme. This model takes into account the effects of both collisions and transmission errors in a noisy channel. The accuracy of this model is validated by NS-2 simulations.

Internet coordinate-based systems are poised to become an important service to support overlay construction and topology-aware applications. Indeed, through network distance embedding into an appropriate geometric space, such systems allow for accurate network distance estimations with low overhead. However, coordinate systems often rely on good cooperation between nodes for correct coordination and assume that information reported by probed nodes is correct. In this paper, we identify various attacks against coordinate embedding systems and show their effectiveness on two representative positioning systems, namely Vivaldi and NPS. Our study demonstrates that these attacks can seriously disrupt the operations of these systems and therefore the virtual networks and applications relying on them for distance measurements. Through simulations of different potential scenarios where malicious nodes provide biased coordinate information and delay measurement probes, we quantify the effects of attack strategies that aim to (i) introduce disorder in the system, (ii) fool honest nodes to move far away from their correct positions and (iii) isolate particular target nodes in the system through collusion. Our findings confirm the susceptibility of the coordinate systems to such attacks.

International audience; Multicast applications and network monitors can potentially benefit from the ability to infer the loss rates along links within a multicast tree. Estimators, known generically by MINC, or multicast inference of network characteristics, have been developed to provide this ability. They consider multicast data packets to be probes, and conduct inference based upon reports of which probes reached each receiver. In practice, gathering reports from receivers in real time is a non-trivial task that presents scaling problems as the number of receivers increases. Prior work has led to an extension of the RTP data transport protocol to permit receivers to report per-probe information in packets known as RTCP XR packets. This paper demonstrates how MINC inference can, in fact, be conducted using only a default RTP packet format known as RTCP RR. RTCP RR packets contain summary information rather than per-probe information. They thus offer bandwidth savings, although this comes at the expense of an increase in estimator convergence time. Furthermore, this technique can be used by the observer of any standard RTP session, whereas estimation based upon per-probe information is only possible when a session explicitly employs the extended reporting format.

International audience; We present a simple extension to the MINC loss estimator which can be used to perform loss tomography with less feedback bits per probe. In MINC loss inference, each receiver in the multicast tree reports one bit of feedback per probe. This poses constraints when MINC is used with RTCP and feedback bandwidth must not exceed 5% of data bandwidth. In the Extended MINC loss estimator (EMLE), receivers report feedbacks for groups of w consecutive probes. Each feedback requires only 1 bit per w probes. EMLE leverages the analysis of MINC loss estimator itself and results in the reduction of feedback bits without substantial loss of accuracy.

This paper describes an adaptive service differentiation scheme for QoS enhancement in IEEE 802.11 wireless ad-hoc networks. Our approach, called adaptive enhanced distributed coordination function (AEDCF), is derived from the new EDCF introduced in the upcoming IEEE 802.11e standard. Our scheme aims to share the transmission channel efficiently. Relative priorities are provisioned by adjusting the size of the contention window (CW) of each traffic class taking into account both applications requirements and network conditions. We evaluate through simulations the performance of AEDCF and compare it with the EDCF scheme proposed in the 802.11e. Results show that AEDCF outperforms the basic EDCF, especially at high traffic load conditions. Indeed, our scheme increases the medium utilization ratio and reduces for more than 50% the collision rate. While achieving delay differentiation, the overall goodput obtained is up to 25% higher than EDCF. Moreover, the complexity of AEDCF remains similar to the EDCF scheme, enabling the design of cheap implementations.

International audience; This paper introduces source-channel adaptive rate control (SARC), a new congestion control algorithm for layered video transmission in large multicast groups. In order to solve the well-known feedback implosion problem in large multicast groups, we first present a mechanism for filtering RTCP receiver reports sent from receivers to the whole session. The proposed filtering mechanism provides a classification of receivers according to a predefined similarity measure. An end-to-end source and FEC rate control based on this distributed feedback aggregation mechanism coupled with a video layered coding system is then described. The number of layers, their rate, and their levels of protection are adapted dynamically to aggregated feedbacks. The algorithms have been validated with the NS2 network simulator.

IEEE 802.11 is currently the most deployed wireless local area networkingstandard. It uses carrier sense multiple access with collision avoidance (CSMA/CA) to resolve contention between nodes. Contention windows (CW) change dynamically to adapt to the contention level: Upon each collision, a node doubles its CW to reduce further collision risks. Upon a successful transmission, the CW is reset, assuming that the contention level has dropped. However, the contention level is more likely to change slowly, and resetting the CW causes new collisions and retransmissions before the CW reaches the optimal value again. This wastes bandwidth and increases delays. In this paper we analyze simple slow CW decrease functions and compare their performances to the legacy standard. We use simulations and mathematical modeling to show their considerable improvements at all contention levels and transient phases, especially in highly congested environments.

The emerging widespread use of real-time multimedia applications over wireless networks makes the support of quality of service (QoS) a key problem. In this paper, we focus on QoS support mechanisms for IEEE 802.11 wireless ad-hoc networks. First, we review limitations of the upcoming IEEE 802.11e enhanced DCF (EDCF) and other enhanced MAC schemes that have been proposed to support QoS for 802.11 ad-hoc networks. Then, we describe a new scheme called adaptive fair EDCF that extends EDCF, by increasing the contention window during deferring periods when the channel is busy, and by using an adaptive fast backoff mechanism when the channel is idle. Our scheme computes an adaptive backoff threshold for each priority level by taking into account the channel load. The new scheme significantly improves the quality of multimedia applications. Moreover, it increases the overall throughput obtained both in medium and high load cases. Simulution results show that our new scheme outperforms EDCF and other enhanced schemes. Finally, we show that the adaptive fair EDCF scheme achieves a high degree of fairness among applications of the same priority level.

We present a media-oriented mechanism for selecting the appropriate transmission mode in 802.11-based wireless LANs (WLANs). The main goal of this mechanism is to improve the effective throughput for transporting loss-tolerant multimedia traffic over a WLAN by taking into account both the application characteristics and the physical channel conditions. In particular, the proposed cross-layer mechanism exploits the robustness of multimedia coding by allowing packets with corrupted payloads reach the receiving application. The sending application specifies its quality of service requirements (data rate, BER tolerance, etc.), and the receiver selects the best transmission mode (transmission rate, modulation scheme, FEC scheme) while taking into account the time-varying channel conditions. We discuss the modifications needed for the control and data-packet headers to implement our approach in the framework of the IEEE 802.11 standards. We use ns2 simulations to contrast our scheme with an existing 802.11 rate selection algorithm. The results indicate that the proposed cross-layer approach achieves up to 5 Mbps increase in throughput and 20-meter increase in the coverage range. Furthermore, by disabling FEC from some of the standard transmission modes, we show that the goodput of loss-tolerant applications can be improved significantly.

This paper addresses the problem of rate and congestion control for video transmission in large multicast groups. A classification of the receivers is performed according to a predefined similarity measure (e.g. packet loss rate observed or TCP-friendly bandwidth share). The RTCP receiver reports are then filtered accordingly. The classification of receivers done by feedback aggregation agents helps in solving the feedback implosion problem in large multicast groups. The clustering and feedback aggregation mechanisms are coupled with an FGS layered video coding system in which the number of layers as well as their respective rates are adapted dynamically to aggregated feedback. The algorithm has been validated via NS 2 simulations.

Bluetooth is an emerging standard for short range, low cost, low power wireless access technology. The Bluetooth technology is just starting to appear on the market and there is an urgent need to enable new applications with real time constraints to run on top of Bluetooth devices. The Bluetooth Specification proposes a Round Robin scheduler as possible solution for scheduling the transmissions in a Bluetooth Piconet. However, this basic scheme performs badly under asymmetric traffic conditions. Recently, several polling schemes have been proposed to improve performance on asymmetric transmissions and to support bandwidth guarantee. However, there is no solution available to support both delay and bandwidth guarantees required by real time applications. In this paper, we present FPQ, a new polling algorithm for Bluetooth Piconet that supports both delay and bandwidth guarantees and aims to remain fair and efficient with asymmetric flow rates. We present an extensive set of simulations and provide performance comparisons with other polling algorithms. Our performance study indicates that FPQ, while supporting flow rate and maximum delay QoS requests, outperforms Deficit Round Robin in term of delays by at least 10% in all cases, sometimes by more than 30% to 50%. Moreover, FPQ was designed to take the specifics of Bluetooth into consideration, in particular the low complexity required for cheap implementation.

Anecdotal evidence suggests that the quality of many videoconferences in the Internet is mediocre because of high packet loss rates. This makes it important to design and implement mechanisms that minimize packet loss and its impact in video (and audio) applications. There are two such types of mechanisms. Rate control mechanisms attempt to minimize the amount of packet loss by matching the bandwidth requirements of a video flow to the capacity available in the network. However, they do not prevent packet loss altogether. Error control mechanisms attempt to minimize the visual impact of lost packets at the destinations. We provide motivation for using error control mechanisms based on forward error correction (FEC) and packet reconstruction. We examine a specific mechanism, and evaluate its cost as well as the benefit expected from using it. This mechanism can be augmented to obtain a joint source/channel coding scheme suitable for both the current and the future integrated services Internet.

Datagram networks such as the Internet do not provide guaranteed resources such as bandwidth or guaranteed performance measures such as maximum delay. One way to support packet video in these networks is to use feedback mechanisms that adapt the output rate of video coders based on the state of the network. The authors present one such mechanism. They describe the feedback information, and how it is used by the coder control algorithm. They also examine how the need to operate in a multicast environment impacts the design of the control mechanism. This mechanism has been implemented in the H.261 video coder of IVS. IVS is a videoconference system for the Internet developed at INRIA. Experiments indicate that the control mechanism is well suited to the Internet environment. In particular, it makes it possible to establish and maintain quality videoconferences even across congested connections in the Internet. Furthermore, it prevents video sources from swamping the resources of the Internet, which could lead to unacceptable service to all users of the network. >

This paper addresses the problem of congestion control for video transmission in large multicast groups. In order to solve the well-known feedback implosion problem in large multicast groups, we first present a mechanism for filtering RTCP receiver reports sent from receivers to the whole session. The proposed filtering mechanism provides a classification of receivers according to a predefined similarity measure. An end-to-end source and FEC rate control based on this distributed feedback aggregation mechanism coupled with a video layered coding system is then described. The number of layers, their rate and levels of protection are adapted dynamically to aggregated feedbacks. The algorithms have been validated with the NS2 network simulator.

International audience; In this paper we propose a novel algorithm, namely Multi-Objective Placement (MOP), for the efficient placement of Virtualized Network Function (VNF) chains in future 5G systems. Real datasets are used to evaluate the performance of MOP in terms of acceptance ratio and embedding time when placing the time critical radio access network (RAN) functions as a chain. In addition, we rely on a realistic infrastructure topology to assess the performance of MOP with two main objectives: maximizing the number of base stations that could be embedded in the Cloud and load balancing. The results reveal that the acceptance ratio of embedding RAN functions is only 5% less than the one obtained with the optimal solution for the majority of considered scenarios, with a speedup factor of up to 2000 times.

The IEEE 802.11 medium access control (MAC) protocol provides a contention-based distributed channel access mechanism for mobile stations to share the wireless medium, which may introduce a lot of collisions in case of overloaded active stations. Slow contention window (CW) decrease scheme is a simple and efficient solution for this problem. In this paper, we use an analytical model to compare the slow CW decrease scheme to the IEEE 802.11 MAC protocol. Several parameters are investigated such as the number of stations, the initial CW size, the decrease factor value, the maximum backoff stage and the coexistence with the RequestToSend and ClearToSend (RTS/CTS) mechanism. The results show that the slow CW decrease scheme can efficiently improve the throughput of IEEE 802.11, and that the throughput gain is higher when the decrease factor is larger. Moreover, the initial CW size and maximum backoff stage also affect the performance of slow CW decrease scheme.

Addressing transport-layer issues in cellular networks is still a hot research topic, despite the fact that a wide range of solutions have been proposed over the last decades. One reason that could explain this phenomenon is the difficulties in the real-world adoption of the proposed solutions as they require either drastic changes in the cellular network protocol stack (in the UE and/or in the base station) or a standardization effort so that TCP headers can include radio information. Another reason is the fact that most of these solutions are effective only in a few scenarios and fail to mitigate the transport-layer issues considered on a global or large scale.Inspired by these limitations and the growing trend towards Mobile and Multi-Access Edge Computing (MEC), we set out in this thesis to demonstrate that several transport-layer issues in a MEC-enabled 4G/5G network can be mitigated without requiring any modifications in the end-user's device or in the 4G/5G stack. To this end, we propose novel transport-layer optimization solutions that leverage the MEC Radio Network Information Service (RNIS) and other MEC capabilities to improve some key traditional transport-layer mechanisms such as slow start, steady state behavior, loss detection and flow control mechanisms. We show the efficiency of this approach by first proposing SIGMA, an uplink-oriented Congestion Control Algorithms (CCA) that outperforms BBR and existing CCAs in terms of throughput and delay; then we propose and implement MELD, a loss discrimination algorithm that can improve the throughput of loss-based CCAs by up to 80% in case of wireless/random losses; and lastly we propose RAPID, a RAN-aware Performance Enhancing Proxy (PEP) capable of transparently reducing the increase in delay by a factor of 10 to 50 without lowering the throughput, regardless of the number or the behaviors of the TCP flows sharing the same per-user buffer. Finally, we implement MELD and RAPID in Linux and validate their performance in a real-world 4G network based on OpenAirInterface and FlexRAN.; La résolution des problèmes de la couche transport dans les réseaux cellulaires est toujours un sujet d'actualité, malgré le fait que de nombreuses solutions ont été proposées au cours des dernières décennies. Une des raisons qui pourrait expliquer ce phénomène, est la difficulté d'adoption des solutions proposées dans le monde réel car elles nécessitent soit des changements drastiques dans la pile protocolaire des réseaux cellulaires (au niveau de l'UE et/ou au niveau de la station de base), soit un effort de normalisation pour que les en-têtes TCP puissent inclure des informations radio. Une autre raison est le fait que la plupart de ces solutions ne sont efficaces que dans quelques scénarios et ne parviennent pas à résoudre les problèmes de couche transport considérés d'une manière générale ou à grande échelle.Inspiré par ces limitations et aussi par la tendance grandissante vers le traitement à la bordure des réseaux mobiles ou Multi-access Edge Computing (MEC), nous nous sommes donné comme objectif dans cette thèse de démontrer qu'un très grand nombre de problèmes de couche transport dans un réseau cellulaire avec nœuds de traitement en bordure du réseau (scénario MEC), peuvent être resolus sans nécessiter de modifications dans l'appareil de l'utilisateur final ou dans la pile protocolaire 4G/5G. À cette fin, nous proposons de nouvelles solutions d'optimisation de la couche de transport qui exploitent le service de collecte d'informations radio du MEC (nommé RNIS) et d'autres moyens fournis par l'environnement MEC pour améliorer certains mécanismes clés de la couche transport tels que, le mécanisme de démarrage lent ou slow start, le mécanisme d'évitement de congestion ou régime permanent, le mécanisme de détection des pertes, ou encore le mécanisme de contrôle de flux. Nous montrons l'efficacité de cette approche en proposant d'abord SIGMA, un algorithme de contrôle de congestion (CCA) orienté lien-montant (uplink) qui surpasse les performances de BBR et des CCAs existants en termes de débit et de délai; puis nous proposons et implémentons MELD, un algorithme de discrimination de pertes capable d'améliorer jusqu'à 80% le débit des CCAs de type loss-based (i.e., les CCAs qui utilisent les pertes comme signaux de congestion) en cas de pertes aléatoires; et enfin nous proposons RAPID, un proxy d'amélioration de performance (PEP) qui tient compte de l'environnement radio et qui permet de réduire les augmentations de délais de bout-en-bout de manière transparente par un facteur de 10 à 50 sans introduire une diminution de débit, et ceci, quel que soit le nombre ou le comportement des flux TCP partageant la file d'attente dédiée à l'utilisateur. Enfin, nous avons implémenté les solutions MELD et RAPID sur Linux et avons validé leurs performances dans un réseau 4G basé sur OpenAirInterface et FlexRAN.

In recent years, there have been multiple enhancements in virtualization technologies, cloud computing, and network programmability. The emergence of concepts like Software Defined Networking (SDN) and Network Function Virtualization (NFV) are changing the way the Internet Service Providers manage their services. In parallel, the last decade witnessed the rise of secure public cloud platforms like Amazon AWS and Microsoft Azure. These new concepts lead to cost reductions and fast innovation, driving the adoption of these paradigms by the industry. All these changes also bring new challenges. Networks have become huge and complex while providing different kinds of services. Testing them is increasingly complicated and resource-intensive. To tackle this issues, we propose a new tool that combines emulation technologies and optimization techniques to distribute SDN/NFV experiments in private test-beds and public cloud platforms. Cloud providers, in general, deliver specific metrics to the users in terms of CPU and memory resources for the services they propose, but they tend to give a high-level overview for the network delay, without any specific value. This is a problem when deploying a delay-sensitive application in the cloud, since the users do not have any precise data about the delay. We propose a testing framework to monitor the network delay between multiple datacenters in the cloud infrastructures. Finally, in the context of SDN/NFV networks, we exploit the SDN centralized logic to implement an optimal routing strategy in case of multiple link failures in the network. We also created a test-bed environment to validate our proposition in different network topologies.; De nombreux progrès ont eu lieu ces dernières années dans les domaines de la virtualisation, l’informatique en nuage et la programmation des fonctions réseau. L’essor des concepts tels que Software Defined Networking (SDN) et Network Function Virtualization (NFV) a largement modifié la manière dont les fournisseurs de services Internet gèrent leurs offres. Parallèlement, au cours de la dernière décennie, les plateformes sécurisées de Cloud publiques telles que Amazon AWS ou Microsoft Azure sont devenues des acteurs incontournables de la scène. Ces nouveaux concepts permettent des réductions de couts et une plus grande rapidité d’innovation, ce qui a conduit à l’adoption de ces paradigmes par l’industrie. Tous ces changements apportent également leur lot de nouveaux défis. Tout en étant devenus tentaculaires et complexes, ces réseaux offrent une plus grande diversité de services: les tester devient ainsi de plus en plus compliqué, tout en nécessitant beaucoup de ressources. Pour résoudre ce problème, nous proposons un nouvel outil qui combine les technologies d’émulation et les techniques d’optimisation afin de distribuer les simulations SDN/NFV dans des bancs de test privés et des plateformes de Cloud publiques. Par ailleurs, les fournisseurs de Cloud proposent en général aux utilisateurs des métriques spécifiques en termes de CPU et de ressources mémoire afin de caractériser leurs services, mais ont tendance à présenter une vue d’ensemble de haut niveau du délai maximum engendré par le réseau, sans aucune valeur spécifique. Ceci peut constituer un problème lorsqu’il s’agit de déployer des applications sensibles au délai dans le Cloud, car les utilisateurs n’ont pas de données précises sur ce sujet. Nous proposons un cadre de test pour surveiller le délai engendré par le réseau entre plusieurs centres de données des infrastructures Cloud. Enfin, dans le contexte des réseaux SDN/NFV, nous exploitons la logique centralisée SDN pour implémenter une stratégie optimale de routage en cas de défaillances multiples des liens dans le réseau. Un environnement de banc de test a également été créé afin de valider nos propositions pour différentes topologies de réseau.

Traditional networks are based on an ever-growing variety of network functions that run on proprietary hardware devices called middleboxes. Designing these vendor-specific appliances and deploying them is very complex, costly and time-consuming. Moreover, with the ever-increasing and heterogeneous short-term services requirements, service providers have to scale up their physical infrastructure periodically, which results in high CAPEX and OPEX. This traditional paradigm leads to network ossification and high complexity in network management and services provisioning to address emerging use cases. Network Function Virtualization (NFV) has attracted notable attention as a promising paradigm to tackle such challenges by decoupling network functions from the underlying proprietary hardware and implementing them as software, named Virtual Network Functions (VNFs), able to work on inexpensive commodity hardware. These VNFs can be arranged and chained together in a predefined order, the so-called Service Function chaining (SFC), to provide end-to-end services. Despite all the benefits associated with the new paradigm, NFV comes with the challenge of how to place the functions of the users' requested services within the physical network while providing the same resiliency as if a dedicated infrastructure were used, given that commodity hardware is less reliable than the dedicated one. This problem becomes particularly challenging when service requests have to be fulfilled as soon as they arise (i.e., in an online manner). In light of these new challenges, we propose new solutions to tackle the problem of online SFC placement while ensuring the robustness of the placed services against physical failures in data-center (DC) topologies. Although recovery solutions exist, they still require time in which the impacted services will be unavailable while taking smart placement decisions can help in avoiding the need for reacting against simple network failures. First, we provide a comprehensive study on how the placement choices can affect the overall robustness of the placed services. Based on this study we propose a deterministic solution applicable when the service provider has full knowledge and control on the infrastructure. Thereafter, we move from this deterministic solution to a stochastic approach for the case where SFCs are requested by tenants oblivious to the physical DC network, where users only have to provide the SFC they want to place and the required availability level (e.g., 5 nines). We simulated several solutions and the evaluation results show the effectiveness of our algorithms and the feasibility of our propositions in very large scale data center topologies, which make it possible to use them in a productive environment. All these solutions work well in trusted environments with a central authority that controls the infrastructure. However, in some cases, many enterprises need to collaborate together in order to run tenants' application, e.g., MapReduce applications. In such a scenario, we move to a completely untrusted decentralized environment with no trust guarantees in the presence of not only byzantine nodes but also rational nodes. We considered the case of MapReduce applications in such an environment and present an adapted MapReduce framework called MARS, which is able to work correctly in such a context without the need of any trusted third party. Our simulations show that MARS grants the execution integrity in MapReduce linearly with the number of byzantine nodes in the system., Les réseaux traditionnels reposent sur un grand nombre de fonctions réseaux très hétérogènes qui s'exécutent sur du matériel propriétaire déployé dans des boîtiers dédiés. Concevoir ces dispositifs spécifiques et les déployer est complexe, long et coûteux. De plus, comme les besoins des clients sont de plus en plus importants et hétérogènes, les fournisseurs de services sont contraints d'étendre ou de moderniser leur infrastructure régulièrement, ce qui augmente fortement les coûts d'investissement (CAPEX) et de maintenance (OPEX) de l'infrastructure. Ce paradigme traditionnel provoque une ossification du réseau et rend aussi plus complexe la gestion et la fourniture des fonctions réseau pour traiter les nouveaux cas d'utilisation. La virtualisation des fonctions réseau (NFV) est une solution prometteuse pour relever de tels défis en dissociant les fonctions réseau du matériel sous-jacent et en les implémentant en logiciel avec des fonctions réseau virtuelles (VNFs) capables de fonctionner avec du matériel non spécifique peu coûteux. Ces VNFs peuvent être organisés et chaînés dans un ordre prédéfini, formant des chaînes de Services (SFC) afin de fournir des services de bout-en-bout aux clients. Cependant, même si l'approche NFV comporte de nombreux avantages, il reste à résoudre des problèmes difficiles comme le placement des fonctions réseau demandées par les utilisateurs sur le réseau physique de manière à offrir le même niveau de résilience que si une infrastructure dédiée était utilisée, les machines standards étant moins fiables que les dispositifs réseau spécifiques. Ce problème devient encore plus difficile lorsque les demandes de service nécessitent des décisions de placement à la volée. Face à ces nouveaux défis, nous proposons de nouvelles solutions pour résoudre le problème du placement à la volée des VNFs tout en assurant la résilience des services instanciés face aux pannes physiques pouvant se produire dans différentes topologies de centres de données (DC). Bien qu'il existe des solutions de récupération, celles-ci nécessitent du temps pendant lequel les services affectés restent indisponibles. D'un autre côté, les décisions de placement intelligentes peuvent épargner le besoin de réagir aux pannes pouvant se produire dans les centres de données. Pour pallier ce problème, nous proposons tout d'abord une étude approfondie de la manière dont les choix de placement peuvent affecter la robustesse globale des services placés dans un centre de données. Sur la base de cette étude, nous proposons une solution déterministe applicable lorsque le fournisseur de services a une connaissance et un contrôle complets de l'infrastructure. Puis, nous passons de cette solution déterministe à une approche stochastique dans le cas où les SFCs sont demandées par des clients indépendamment du réseau physique du DC, où les utilisateurs n'ont qu'à fournir les SFC qu'ils veulent placer et le niveau de robustesse requis (e.g., les 5 neufs). Nous avons développé plusieurs algorithmes et les avons évaluées. Les résultats de nos simulations montrent l'efficacité de nos algorithmes et la faisabilité de nos propositions dans des topologies de centres de données à très grande échelle, ce qui rend leur utilisation possible dans un environnement de production. Toutes ces solutions proposées fonctionnent de manière efficace dans un environnement de confiance, comme les centres de données, avec la présence d’une autorité centrale qui contrôle toute l'infrastructure. Cependant, elles ne s'appliquent pas à des scénarios décentralisés comme c'est le cas lorsque différentes entreprises ont besoin de collaborer pour exécuter les applications de leurs clients. Nous étudions cette problématique dans le cadre des applications MapReduce exécutées en présence de nœuds byzantins et de nœuds rationnels et en l’absence de tiers de confiance.

Network operators are facing great challenges in terms of cost and complexity in order to incorporate new communication technologies (e.g., 4G, 5G, fiber) and to keep up with increasing demands of new network services to address emerging use cases. Softwarizing the network operations using SoftwareDefined Networking (SDN) and Network Function Virtualization (NFV) paradigms can simplify control and management of networks and provide network services in a cost effective way. SDN decouples control and data traffic processing in the network and centralizes the control traffic processing to simplify the network management, but may face scalability issues due to the same reasons. NFV decouples hardware and software of network appliances for cost effective operations of network services, but faces performance degradation issues due to data traffic processing in software. In order to address scalability and performance issues in SDN/NFV, we propose in the first part of the thesis, a modular network control and management architecture, in which the SDN controller delegates part of its responsibilities to specific network functions instantiated in network devices at strategic locations in the infrastructure. We have chosen to focus on a modern application using an IP multicast service for live video streaming applications (e.g., Facebook Live or Periscope) that illustrates well the SDN scalability problems. Our solution exploits benefits of the NFV paradigm to address the scalability issue of centralized SDN control plane by offloading processing of multicast service specific control traffic to Multicast Network Functions (MNFs) implemented in software and executed in NFV environment at the edge of the network. Our approach provides smart, flexible and scalable group management and leverages centralized control of SDN for Lazy Load Balance Multicast (L2BM) traffic engineering policy in software defined ISP networks. Evaluation of this approach is tricky, as real world SDN testbeds are costly and not easily available for the research community. So, we designed a tool that leverages the huge amount of resources available in the grid, to easily emulate such scenarios. Our tool, called DiG, takes into account the physical resources (memory, CPU, link capacity) constraints to provide a realistic evaluation environment with controlled conditions. Our NFV-based approach requires multiple application specific functions (e.g., MNFs) to control and manage the network devices and process the related data traffic in an independent way. Ideally, these specific functions should be implemented directly on hardware programmable routers. In this case, new routers must be able to execute multiple independently developed programs. Packet-level programming language P4, one of the promising SDN-enabling technologies, allows applications to program their data traffic processing on P4 compatible network devices. In the second part of the thesis, we propose a novel approach to deploy and execute multiple independently developed and compiled applications programs on the same network device. This solution, called P4Bricks, allows multiple applications to control and manage their data traffic, independently. P4Bricks merges programmable blocks (parsers/deparsers and packet processing pipelines) of P4 programs according to processing semantics (parallel or sequential) provided at the time of deployment., Les opérateurs de réseau sont confrontés à de grands défis en termes de coût et de complexité pour intégrer les nouvelles technologies de communication (e.g., 4G, 5G, fibre optique) et pour répondre aux demandes croissantes des nouveaux services réseau adaptés aux nouveaux cas d’utilisation. La "softwarization" des opérations réseau à l'aide des paradigmes SDN (Software Defined Networking) et NFV (Network Function Virtualization) est en mesure de simplifier le contrôle et la gestion des réseaux et de fournir des services réseau de manière efficace. Les réseaux programmables SDN permettent de dissocier le plan de contrôle du plan de données et de centraliser le plan de contrôle pour simplifier la gestion du réseau et obtenir une vision globale. Cependant, ceci amène des problèmes de passage à l'échelle difficiles à résoudre. Par ailleurs, en dissociant la partie matérielle de la partie logicielle des routeurs, NFV permet d'implanter de manière flexible et à moindre coût toutes sortes de fonctions réseau. La contrepartie est une dégradation des performances due à l'implantation en logiciel des fonctions réseau qui sont déportées des routeurs. Pour aborder les problèmes de passage à l'échelle et de performance des paradigmes SDN/NFV, nous proposons dans la première partie de la thèse, une architecture modulaire de gestion et de contrôle du réseau, dans laquelle le contrôleur SDN délègue une partie de ses responsabilités à des fonctions réseau spécifiques qui sont instanciées à des emplacements stratégiques de l'infrastructure réseau. Nous avons choisi un exemple d'application de streaming vidéo en direct (comme Facebook Live ou Periscope) utilisant un service de multicast IP car il illustre bien les problèmes de passage à l'échelle des réseaux programmables. Notre solution exploite les avantages du paradigme NFV pour résoudre le problème de scalabilité du plan de contrôle centralisé SDN en délégant le traitement du trafic de contrôle propre au service multicast à des fonctions réseau spécifiques (appelées MNF) implantées en logiciel et exécutées dans un environnement NFV localisé à la périphérie du réseau. Notre approche fournit une gestion flexible des groupes multicast qui passe à l'échelle. De plus, elle permet de bénéficier de la vision globale du contrôle centralisé apportée par SDN pour déployer de nouvelles politiques d'ingénierie du trafic comme L2BM (Lazy Load Balance Multicast) dans les réseaux de fournisseurs d’accès à Internet (FAI) programmables. L'évaluation de cette approche est délicate à mettre en œuvre car la communauté de recherche ne dispose pas facilement d'infrastructure SDN à grande échelle réaliste. Pour évaluer notre solution, nous avons élaboré l'outil DiG qui permet d'exploiter l'énorme quantité de ressources disponibles dans une grille de calcul, pour émuler facilement de tels environnements. DiG prend en compte les contraintes physiques (mémoire, CPU, capacité des liens) pour fournir un environnement d'évaluation réaliste et paramétrable avec des conditions contrôlées. La solution que nous proposons délègue le contrôle et la gestion du réseau concernant le service de multicast aux fonctions spécifiques MNF exécutées dans un environnement NFV. Idéalement, pour davantage d'efficacité, toutes ces fonctions spécifiques devraient être implantées directement au sein des routeurs avec du hardware programmable mais cela nécessite que ces nouveaux routeurs puissent exécuter de manière indépendante plusieurs fonctions réseau à la fois. Le langage de programmation P4 est une technologie prometteuse pour programmer le traitement des paquets de données dans les routeurs programmables (hardware et logiciels).

International audience; Cloud Computing and virtualization are largely adopted in the IT world and starts to gain momentum in networking to implement network functions such as switches or routers but also complex network service chains such as end to end security services. Surprisingly, while robustness is the first question that comes when deploying dedicated network infrastructures, cloud infrastructures provide little or no robustness guarantees for virtualized network functions.As a matter of facts, traditional Cloud infrastructure are several order of magnitude slower than dedicated network infrastructures to react to faults. In this work, we aim at providing robustness guarantees for network functions deployed with OpenStack, the leading open source project for cloud computing.Multiple options are possible to implement such robustness in OpenStack but we designed an approach that minimizes the changes required in OpenStack in order such that it can be smoothly integrated with the official releases. Our well documented implementation follows the best programming practices to guarantee its correctness and integration in a large open source project. Our tests in a real Open-Stack environment composed of multiple compute nodes validate our choices and prove its usability.

International audience; In this work, we propose, implement, and evaluate a Network as a Service (NaaS) API. This API abstracts the network and devices operations to simplify their management, and to provide functionalities offered by the SDN architecture. We focus on a particular application: content distribution over an SDN network. More specifically, we have implemented an API to represent the entire network and to place a copy of the most popular content in the caching unit close to the client in order to balance the load and increase the performance of the network. The goal of this work is to prove that content distribution and network management can both be done without radically modifying the network architecture, therefore we implemented a proof-of-concept leveraging OpenFlow controllers, an HTTP proxy and a RESTful API.

The massive number of connected devices combined with an increasing traffic push network operators to their limit by limiting their profitability. To tackle this problem, Software-Defined Networking (SDN), which decouples network control logic from forwarding devices, has been proposed. An important part of the SDN concepts is implemented by the OpenFlow protocol that abstracts network communications as flows and processes them using a prioritized list of rules on the network forwarding elements. While the abstraction offered by OpenFlow allows to implement many applications, it raises the new problem of how to define the rules and where to place them in the network while respecting all requirements, which we refer as the OpenFlow Rules Placement Problem (ORPP). In this thesis, we focus on the ORPP and hide the complexity of network management by proposing a black box abstraction. First, we formalize that problem, classify and discuss existing solutions. We discover that most of the solutions enforce the routing policy when placing rules, which is not memory efficient in some cases. Second, by trading routing for better resource efficiency, we propose OFFICER and aOFFICER, two frameworks that select OpenFlow rules satisfying policies and network constraints, while minimizing overheads. The main idea of OFFICER an aOFFICER is to give high priority for large flows to be installed on efficient paths, and let other flows follow default paths. These proposals are evaluated and compared to existing solutions in realistic scenarios. Finally, we study a use case of the black box abstraction, in which we improve the performance of content delivery services in cellular networks, Le grand nombre d’appareils connectés combiné au volume croissant de trafic ont poussé les réseaux dans leurs derniers retranchements. Pour résoudre ce problème, l’approche “Software-Defined Networking” (SDN) qui découple le plan de contrôle du plan de données a été proposée. OpenFlow est un nouveau protocole qui réalise le concept SDN. Pour traiter ces flux, OpenFlow utilise des listes de règles sur les commutateurs. Ces règles sont utilisées pour déterminer les actions dans le réseau. Ceci permet de simplifier la mise en place de services réseaux complexes mais soulève la question de savoir quelles règles définir et où les placer dans le réseau afin d’en respecter ses contraintes. Dans cette thèse, nous nous concentrons sur le problème de placement de règles dans OpenFlow (ORPP) et proposons une abstraction de type boite noire afin de masquer la gestion du réseau. Tout d'abord, nous formalisons le problème de placement de règles et faisons une étude des solutions existantes. Les solutions existantes sont cependant inefficaces car elles reposent majoritairement sur le concept du plus court chemin. Nous proposons de relaxer le problème en autorisant l’utilisation de chemins arbitraires et proposons deux algorithmes complémentaires : OFFICER et aOFFICER. L'idée générale d’OFFICER et aOFFICER est d’utiliser les chemins les plus efficaces pour le trafic de haute importance et autoriser le trafic de plus basse importance à suivre des détours. Ces deux propositions sont évaluées en utilisant des traces de trafic. Finalement, nous appliquons le principe de la boite noire pour améliorer les performances d'un service de diffusion de contenus dans les réseaux cellulaires

This thesis proposes a generic approach to automate network experiments for scenarios involving any networking technology on any type of network evaluation platform. The proposed approach is based on abstracting the experiment life cycle of the evaluation platforms into generic steps from which a generic experiment model and experimentation primitives are derived. A generic experimentation architecture is proposed, composed of an experiment model, a programmable experiment interface and an orchestration algorithm that can be adapted to network simulators, emulators and testbeds alike. The feasibility of the approach is demonstrated through the implementation of a framework capable of automating experiments using any combination of these platforms. Three main aspects of the framework are evaluated: its extensibility to support any type of platform, its efficiency to orchestrate experiments and its flexibility to support diverse use cases including education, platform management and experimentation with multiple platforms. The results show that the proposed approach can be used to efficiently automate experimentation on diverse platforms for a wide range of scenarios., Cette thèse propose une approche générique pour automatiser des expériences sur des réseaux quelle que soit la technologie utilisée ou le type de plate-forme d'évaluation. L'approche proposée est basée sur l'abstraction du cycle de vie de l'expérience en étapes génériques à partir desquelles un modèle d'expérience et des primitives d'expérimentation sont dérivés. Une architecture générique d'expérimentation est proposée, composée d'un modèle d'expérience générique, d'une interface pour programmer des expériences et d'un algorithme d'orchestration qui peux être adapté aux simulateurs, émulateurs et bancs d'essai de réseaux. La faisabilité de cette approche est démontrée par la mise en œuvre d'un framework capable d'automatiser des expériences sur toute combinaison de ces plateformes. Trois aspects principaux du framework sont évalués : son extensibilité pour s'adapter à tout type de plate-forme, son efficacité pour orchestrer des expériences et sa flexibilité pour permettre des cas d'utilisation divers, y compris l'enseignement, la gestion des plate-formes et l'expérimentation avec des plates-formes multiples. Les résultats montrent que l'approche proposée peut être utilisée pour automatiser efficacement l'expérimentation sur les plates-formes d'évaluation hétérogènes et pour un éventail de scénarios variés.

As the networks are becoming increasingly heterogeneous, it is expected that future internetworks will interconnect different types of network including infrastructure-based and ad-hoc wireless networks including MANETs. Additionally, a number of emerging applications such as environmental monitoring, emergency response, require that future internetworks be tolerant to connectivity disruptions. Interconnecting these heterogeneous networks poses several challenges including seamless message delivery and identification of mobile nodes. The contributions of this thesis are three fold. First, we present a classification of existing DTN routing protocols by breaking up existing routing strategies into tunable routing modules. Then, we identify some design guidelines to show how and when a given routing module should be used. Second, we propose a new framework called MeDeHa to provide message delivery across heterogeneous networks prone to intermittent connectivity. MeDeHa is able to seamlessly bridge infrastructure-based and ad-hoc networks, through devices carrying multiple interfaces and by the integration of existing protocols. We evaluate MeDeHa through extensive simulations using realistic synthetic and real mobility traces, and by performing hybrid experiments which run partly on simulator and partly on real machines. Third, we propose a naming mechanism called HeNNA for heterogeneous networks prone to connectivity disruptions, which provides message delivery to nodes irrespective of their IP addresses. Henna is compatible with the status-quo Internet routing. We also implement HeNNA within MeDeHa to showcase the operation of complete message delivery protocol suite.; Il est très probable que l'Internet du futur interconnectera des réseaux encore plus hétérogènes qu'ils ne le sont aujourd'hui. Aussi, les nouvelles applications incluant la surveillance de l'environnement, l'intervention d'urgence et la communication véhiculaire nécessitent une plus grande tolérance aux délais ainsi qu'aux pertes de connectivité. L'interconnexion des réseaux hétérogènes robustes aux coupures de connectivité pose de nombreux défis scientifiques. Dans cette thèse nous proposons trois contributions principales dans ce domaine. Premièrement, nous présentons une classification des protocoles de routage DTN qui se base sur les stratégies de routage. Nous proposons des heuristiques pour choisir le meilleur module de routage à utiliser. Deuxièmement, nous proposons un nouveau protocole, appelé MeDeHa, pour disséminer des messages dans les réseaux hétérogènes à connectivité intermittente. MeDeHa permet d'interconnecter des réseaux infrastructures avec des réseaux ad-hoc, en utilisant plusieurs interfaces réseaux et il permet d'utiliser des protocoles de routage existants comme OLSR pour les réseaux MANETs. Nous évaluons MeDeHa par des simulations utilisant des traces de mobilités synthétiques et réelles, mais aussi en effectuant des expérimentations hybrides fonctionnant en partie sur simulateur et en partie sur des machines réelles. Troisièmement, nous proposons un mécanisme de nommage appelé HeNNA pour des réseaux hétérogènes à connectivité épisodique. Ce mécanisme permet de transmettre des messages aux noeuds indépendamment de leurs adresses IP et donc de leur localité. HeNNA est compatible avec le routage actuel de l'Internet. Enfin, nous avons intégré HeNNA dans le protocole MeDeHa afin d'illustrer le fonctionnement de l'ensemble de la pile de communication.

Since the inception of the 802.11 standard in 1999, WLANs, which used to be exceptional, became a massive phenomena together with the evolution of portable devices. At the same pace, research on wireless networks, where both simulation and experimentation are used to validate protocols, has evolved rapidly. Nevertheless, the models used in this area were adapted from the wired paradigm, which has led to a significant gap between the simulated and the experimental results. Therefore, to validate wireless protocols or algorithms, wireless experimentation remains as an important resource. This thesis explores the improvements to experimentation on WLANs, from a methodological point of view. The main contributions of this thesis are: First, the new model for data abstraction to represent network events and aggregated data logs; second, the methodology to manage data in order to support a database model; and third the replacement of custom made processing scripts with data-oriented filter modules. These three key points converge to a proposal of a wireless experimentation methodology in order to attain reproductible experiments. We implement this methodology within a Wireless Experimentation Tool, and furthermore we show the improvement results through a wireless multicast experimentation use case.; Depuis la création de la norme 802.11, en 1999, les réseaux locaux sans fil, qui était exceptionnelle à l'époque, sont devenus un phénomène incontournable après la l'évolution des appareils mobiles. Au même rythme, la recherche sur les réseaux sans-fil a rapidement évolué suivant des modèles adaptés du paradigme des réseaux filaires, qui a conduit un écart significatif entre la simulation et les résultats expérimentaux. En conséquence, afin de valider les protocoles sans fil ou des algorithmes, l'expérimentation sans fil devient un ressource importante. Cette thèse étudie les améliorations sur l'expérimentation sur les réseaux locaux sans fil, d'un point de vue méthodologique.Dans cette thèse, nous avons d'abord créé un nouveau modèle d'abstraction de données pour représenter les événements de réseau et de l'agrégation de données statistiques, en deuxième lieu, nous élaborons une méthodologie pour la gestion des données en vue de supporter un modèle de base de données et enfin on remplace le traitement avec scripts sur mesure avec des modules de filtrage et traitement. Ces trois principaux éléments convergent dans une méthodologie d'expérimentation qui pointe sur les conditions d'expérience et d'amélioration de la reproductibilité. Après, nous présentons Wextool, la mise en oeuvre d'un outil d'expérimentation sans fil qui applique la méthodologie et enfin, nous montrons les améliorations à travers une étude du multicast dans un scenario sans fil comme un cas d'utilisation, et nous évaluons la performance du processus.

Internet coordinate-based systems allow easy network positioning. In such systems, the basic idea is that if network distances between Internet nodes can be embedded in an appropriate space, unmeasured distances can be estimated using a simple distance computation in that space. Recently, these coordinates-based systems have been shown to be accurate, with very low distance prediction error. However, most, if not all, of current proposals for coordinate systems assume that the nodes partaking in the system cooperate fully and honestly with each other – that is that the information reported by probed nodes is correct – this could also make them quite vulnerable to malicious attacks. In particular, insider attacks executed by (potentially colluding) legitimate users or nodes infiltrating the system could prove very effective.As the use of overlays and applications relying on coordinates increases, one could imagine the release of worms and other malware, exploiting such cooperation, which could seriously disrupt the operations of these systems and therefore the virtual networks and applications relying on them for distance measurements.In this thesis, we first identify such attacks, and through a simulation study, we observed their impact on two recently proposed positioning systems, namely Vivaldi and NPS. We experimented with attack strategies, carried out by malicious nodes that provide biased coordinates information and delay measurement probes, and that aim to (i) introduce disorder in the system, (ii) fool honest nodes to move far away from their correct positions and (iii) isolate particular target nodes in the system through collusion. Our findings confirm the susceptibility of the coordinate systems to such attacks.Our major contribution is therefore a model for malicious behavior detection during coordinates embedding. We first show that the dynamics of a node, in a coordinate system without abnormal or malicious behavior, can be modeled by a Linear State Space model and tracked by a Kalman filter. Then we show, that the obtained model can be generalized in the sense that the parameters of a filter calibrated at a node can be used effectively to model and predict the dynamic behavior at another node, as long as the two nodes are not too far apart in the network. This leads to the proposal of a Surveyor infrastructure: Surveyor nodes are trusted, honest nodes that use each other exclusively to position themselves in the coordinate space, and are therefore immune to malicious behavior in the system. During their own coordinate embedding, other nodes can then use the filter parameters of a nearby Surveyor as a representation of normal, clean system behavior to detect and filter out abnormal or malicious activity.A combination of simulations and PlanetLab experiments are used to demonstrate the validity, generality, and effectiveness of the proposed approach for both Vivaldi and NPS.Finally, we address the issue of asserting the accuracy of Internet coordinates advertised by nodes of Internet coordinate systems during distance estimations. Indeed, some nodes may even lie deliberately about their coordinates to mount various attacks against applications and overlays. Our proposed method consists in two steps: 1) establish the correctness of a node's claimed coordinate by using the Surveyor infrastructure and malicious embedding neighbor detection; and 2) issue a time limited validity certificate for each verified coordinate. Validity periods are computed based on an analysis of coordinate inter-shift times observed by Surveyors. By doing this, each surveyor can estimate the time until the next shift and thus, can limit the validity of the certificate it issues to regular nodes for their calculated coordinates. Our method is illustrated using a trace collected from a Vivaldi system deployed on PlanetLab, where intershift times are shown to follow long-tail distribution (log-normal distribution in most cases, or Weibull distribution otherwise). We show the effectiveness of our method by measuring the impact of a variety of attacks, experimented on PlanetLab, on distance estimates.; Dans ce type de systèmes, l'idée principale est que si les distances réseau entre différents nœuds Internet peuvent être plongées dans un espace approprié, alors les distances non mesurées peuvent être estimées en utilisant une simple opération de calcul de distance géométrique dans cet espace. Récemment, on a pu prouver que ces systèmes à base de coordonnées étaient précis, avec une faible erreur de prédiction. Cependant, ces systèmes se basent souvent sur une coordination entre les nœuds, et font l'hypothèse que les informations reportées par les nœuds sont correctes. Dans cette thèse, nous avons identifie plusieurs attaques, exploitant cette hypothèse d'honnêteté des nœuds, et pouvant être lancées contre des systèmes de positionnement Internet à base de coordonnées. Nous avons en l'occurrence étudié l'impact qu'avaient de telles attaques sur deux systèmes représentatifs des systèmes de positionnement actuels : NPS et Vivaldi. Nous avons entre autres montre que ces attaques, pouvaient dangereusement mettre en péril le bon fonctionnement de ces systèmes de coordonnées, et par la même les applications se basant sur ce système pour les estimations de distances. A travers les simulations de plusieurs attaques, menées par des nœuds malhonnêtes, fournissant des coordonnées biaisées ou retardant les mesures, nous avons expérimenté plusieurs stratégies d'attaques qui ont pour objectifs: (i) d'introduire du désordre dans le système, (ii) de tromper les nœuds honnêtes afin qu'ils se positionnent loin de leurs coordonnées correctes et (iii) d'isoler certains nœuds cibles à travers des collusions. Nos résultats confirment la vulnérabilité de tels systèmes à ces attaques. Notre contribution majeure a été par la suite de proposer un modèle de détection des comportements malicieux au sein de ces systèmes de positionnement durant le calcul des cordonnées. Nous avons montré en premier lieu que la dynamique d'un nœud, dans un système de coordonnées, exempt de comportements anormaux ou malhonnêtes, peut être modélisée par un modèle d'états linéaire, et traqué par un filtre de Kalman. De plus, les paramètres d'un filtre calibre au niveau d'un nœud donne, peuvent être utilises pour modéliser et prédire le comportement dynamique d'un autre nœud, tant que ces deux nœuds sont proches l'un de l'autre dans le réseau. Nous avons d`es lors propose une infrastructure de nœuds experts : des nœuds de confiance, se positionnant dans l'espace des coordonnées, en utilisant exclusivement d'autres nœuds experts. Ils sont alors immunisés contre n'importe quel comportement malicieux dans le système. Pendant le calcul de leurs propres coordonnées, les autres nœuds utilisent les paramètres du filtre d'un nœud expert proche, comme étant une représentation d'un comportement normal, pour détecter et filtrer toute activité malicieuse ou anormale. Une combinaison de simulations et d'expérimentations PlanetLab a été utilisée pour démontrer la validité, la généralité et l'efficacité de l'approche proposée pour chacun des deux systèmes Vivaldi et NPS. Enfin, nous nous sommes penchés sur le problème de la validité des coordonnées Internet telles qu'annoncées par les nœuds d'un système de coordonnées durant la phase d'estimation des distances. En effet, certains nœuds peuvent délibérément mentir quant à la valeur exacte de leurs coordonnées afin de lancer diverses attaques contre les applications et les réseaux de couverture. La méthode proposée se divise en deux étapes : 1) établir l'exactitude des coordonnées annoncées en utilisant l'infrastructure des nœuds experts et la méthode de détection des nœuds malicieux, et 2) délivrer un certificat `a validité limitée pour chaque coordonnée vérifiée. Les périodes de validité sont calculées à partir d'une analyse des temps d'inter changement observés par les nœuds experts. En faisant cela, chaque nœud expert, peut estimer le temps jusqu'au prochain changement de coordonnées, et ainsi, peut limiter le temps de validité du certificat qu'il délivrerait aux nœuds normaux. Notre méthode est illustrée en utilisant une trace recueillie à partir d'un système Vivaldi déployé sur PlanetLab, ou les distributions de temps d'inter changements suivent des distributions longue traîne (distribution log-normale dans la plupart des cas, et distribution Weilbull sinon). Nous montrons l'efficacité de notre méthode en mesurant l'impact de plusieurs attaques sur les estimations de distance, expérimentées sur PlanetLab.

This thesis focuses on problems related to Inference of Congestion in the Internet and Multicast Traffic Engineering in Overlay Networks. In the first part of the thesis, we propose methods which help to improve the quality of the congestion inference on both end-to-end paths and internal network links in the Internet. Today, transport protocols which transfer data in the Internet classify all packet losses as congestion. However, the development of various wireless access networks had led to the growth of wireless links in the Internet. Therefore, the packet losses observed by a transport protocol may have resulted either due to congestion or due to the presence of wireless links on the end-to-end path. In order to make best use of available network bandwidth, a transport protocol must reduce its sending rate only in response to congestion losses and not in response to wireless losses. In the second chapter of this dissertation, we consider the problem of differentiating congestion and wireless losses for unreliable transport protocols which transfer multimedia flows. Previously proposed end-to-end loss differentiation schemes chapter of this dissertation, we show efficient ways of encoding multicast trees within data packets. These encodings are almost optimal in terms of space and can be read and processed efficiently. They can be used to represent multicast trees within data packets to route multicast traffic on explicit trees in a stateless manner. We show the correspondence of multicast trees to theoretical tree data structures and obtain lower bounds on the number of bits needed to represent multicast trees.significantly misclassify wireless and congestion losses. We propose an explicit loss differentiation scheme which uses agents at the boundaries of wireless links and results in an accurate inference of congestion on the end-to-end path. We show how the agents can intelligently record the cause of packet losses within packets which are not lost, with low overhead. Inferring the level of congestion on internal network links or paths is useful for the purposes of monitoring and management of networks. The level of congestion on a link can be inferred by measuring the loss rate on that link. Installing or upgrading network elements to monitor internal links is an expensive process and hence the characteristics of internal links are often inferred from end-to-end measurements. The process of inferring characteristics of internal links from end-to-end measurements has come to be known as Network Tomography. One of the earliest proposed methods of performing network tomography is MINC (Multicast-based Inference of Network Characteristics), which infers loss rates (congestion) on internal network links using end-to-end multicast measurements. In MINC, per-link loss rates are inferred by analyzing binary feedbacks which are reported by multicast receivers in response to measurement probes sent from the source. However, due to the presence of buggy or malicious multicast receivers, feedbacks collected may be incorrect leading to a faulty inference of link loss rates. In the third chapter of this dissertation, we present a statistical verification procedure which can identify if the binary feedback data collected from receivers of a multicast tree contains incorrect feedbacks. The procedure does not require the knowledge of multicast tree topology and is able to identify incorrect data even in the presence of colluding receivers. In order to infer link characteristics from end-to-end multicast measurements, dedicated infrastructures to perform these measurements need to be deployed. For large scale multicast measurements, the task of deployment is complex and expensive. To avoid this, it was proposed to couple the process of reporting binary feedbacks for MINC loss inference with RTCP (Real-Time Control Protocol). In this passive measurement architecture, existing multicast sessions which use RTP (Real-Time Transport Protocol) to transfer their data can use their data packets as probes and report binary feedbacks needed for loss inference by piggy-backing them on RTCP packets. For loss inference, MINC requires receivers to report per probe binary feedbacks and this poses constraints since RTCP feedback bandwidth must not exceed 5% of data bandwidth. In the fourth chapter of this dissertation, we develop an extended MINC loss estimator which can perform loss inference using aggregate receiver feedbacks. Aggregate feedbacks require less feedback bandwidth and the estimator is able to perform loss inference using aggregate feedbacks without significant loss of accuracy. We also compare this estimator to the approach where MINC loss inference is performed using a reduced set of binary feedbacks. In the second part of the thesis, we propose a method which helps to perform multicast traffic engineering in overlay networks. In overlay networks, the network nodes which are generally servers can perform intelligent and adaptive networking functions which normally routers do not support. By studying the state of overlay paths, nodes can route traffic dynamically and perform load balancing or routing based on certain constraints. One of the tasks which overlay networks support is multicast routing. To make best use of the traffic conditions in the network, overlay nodes can route multicast traffic adaptively and achieve goals of traffic engineering. To be able to do so, they need mechanisms to choose specific or explicit multicast trees in the overlay. One way of routing traffic on explicit trees is to perform source routing, that is, to specify the tree within multicast data packets. In the fifth; Résumé non disponible en français

The current IP multicast model has a lot of imperfections to handle Large-Scale Virtual Environments (LSVE) applications. Today, many of these applications have to handle an increasing number of participants and deal with the difficult problem of scalability. We have designed SCORE, a communication architecture that enables such applications to run on the Internet today. We propose to use a filtering mechanism done at the transport-layer, using multiple multicast groups and agents. We implemented this architecture to show its feasibility, then performed several experimentations to evaluate its cost and its capacity to improve the performance in LSVEs. Our results show the situations, where our communication architecture is able to maintain a high level of scalability.; Le modèle IP multipoint actuel rend particulièrement difficile le déploiement à grande-échelle d'Environnements Virtuels Partagés (EVPs) sur l'Internet. Cependant les concepteurs de ce type d'applications désirent permettre la connexion simultanée d'un nombre toujours plus important d'utilisateurs. Nous avons défini SCORE, une architecture de communication permettant d'améliorer la scalabilité et de déployer à grande-échelle des EVPs. Dans cette architecture, nous avons élaboré des mécanismes de filtrage et des protocoles au niveau de la couche transport, s'appuyant sur plusieurs agents et sur un ensemble de groupes multipoints. Afin d'évaluer les coûts introduits par SCORE ainsi que sa capacité à améliorer les performances, nous avons réalisé plusieurs séries d'expérimentations. Nos résultats montrent les situations dans lesquelles notre architecture de communication permet d'offrir un haut degré de scalabilité.