Search

Data research projects generate huge amounts of data, which are usually stored in cloud networks for processing and storage. Transferring large amounts of data between multiple research sites, often within protected scientific DMZs (Demilitarized Zone) and cloud storage nodes, requires high-speed network connections. To ensure efficient data transfer and processing, parallel data streams are used between multiple research sites, with dedicated cloud infrastructure for processing and storage of a particular experiment. Since multiple nodes or sites are involved in data transfer, DTNs (Data Transfer Nodes) are used to solve the problems of fast data flow and performance between nodes that are not related to network throughput. DTNs include software transfer tools and highend hardware components that are tasked with preparing data for transfer. Several research groups are working to establish multiple DTN instances as part of a large-scale scientific data network. This paper provides a brief overview of the current state of the art in the use of DTN infrastructure and the challenges associated with preparing data for transfer.

Internet of things has been a part of our lives, both at home and in workplace, for several years now. However, due to its popularity, numerous security issues are emerging related to devices, network communication or Internet of things (IoT) acquired data storage and processing in the cloud. This paper presents a model for categorization of existing and novel IoT services based on estimated security risks. The goal is to develop security requirements for each service category in such a way that service creators are able to classify their services and follow the requirements in order to harden the services in development. The paper proposes a categorization model based on DREAD (Damage potential, Reproducibility, Exploitability, affected users, and Discoverability) and gives examples of existing services classification. A set of simple questions is proposed at the end of the paper that should be answered by service creators in order to categorize its service into one of the proposed categories.

Cloud of Things (CoT) is a novel concept driven by the synergy of the Internet of Things (IoT) and cloud computing paradigm. The CoT concept has expedited the development of smart services resulting in the proliferation of their real world deployments. However, new research challenges arise because of the transition of research-driven and proof-of-concept solutions to commercial offerings, which need to provide secure, energy-efficient, and reliable services. An open research issue in the CoT is to provide a satisfactory level of secure communication between various IoT devices and the cloud. Existing solutions for secure CoT communication typically use devices with pre- loaded and pre-configured parameters, which define a static setup for secure communication. In contrast to existing pre-configured solutions, we present an adaptable model for secure communication in CoT environments. The model defines six secure communication operations to enable CoT entities to autonomously and dynamically agree on the security protocol and cryptographic keys used for communication. Further on, we focus on device agreement and present an original solution, which uses the Agile Cryptographic Agreement Protocol in the context of CoT. We verify our solution by a prototype implementation of CoT device agreement based on a required security level, which takes into account the capabilities of communicating devices. Our experimental evaluation compares the average processing times of the proposed secure communication operations demonstrating the viability of the proposed solution in real- world deployments.

Cryptographic protocols are constantly exposed to new attack methods. When some cryptographic protocol gets exposed there is a need to replace it. This is hard because most cryptographic protocols are hard coded in applications. Applications should implement a way of negotiating cryptographic protocols used. In that way old and vulnerable protocols could be easily replaced with new ones. The agile cryptographic negotiation protocol (ACNP) proposed in this paper represents a layer-agnostic, robust solution that can be deployed for providing cryptographic agility and greatly improve security. It provides minimal communication overhead and represents a universal and secure solution independent of the communication layer and application that uses it.

3G mobile broadband evolution offers high speed data transfer. A need to develop QoS mechanisms to ensure effective handling of radio resources occures. Bottleneck for 3G data network may be located in different parts of the network, depending on the infrastructure (eg the radio access part or core network part). Operators will decide how to deal with network congestion problem: expanding the network, increasing CAPEX or finding and using ways to control traffic.

This paper describes challenges faced when building a practical implementation of a smart card authentication protocol. The protocol to be implemented was designed with intention of restricting access to maintenance functions implemented in majority of Point- Of-Sale (POS) terminals. POS terminals have complex software platform that must be kept up-to-date through the use of previously mentioned functions. However, access to such functions must be well protected since misuse could result in disabled terminals. A brief description of the protocol is given, followed by selection of parameters and cryptographic protocols necessary for test implementation. Because smart cards based on Java Card technology are considered to be a well-established and recognized standard, they are chosen as a testing platform. However, like any other smart cards, they are constrained in terms of data storage capacity and available computing power which can create difficulties when building practical system. For this reason an analysis of the implementation is given, which includes performance data on storage requirements protocol completion times based on chosen input parameters. This is followed by a conclusion and set of recommendations regarding future improvements.

In this paper we present improvements of our software architecture for User Behaviour Based Network Traffic Generation (UrBBan-Gen). It consists of four modules Service repository, Control function and user interface, Behaviour process, and Traffic generation process. Improvements are performed on the traffic generation process, specifically on the virtualization section of UrBBaN-Gen through integration of the Distributed Internet Traffic Generator (D-ITG) which we use as a module for traffic generation with network simulator and emulator IMUNES. In this way we achieve two goals: 1) better scalability of the traffic generation and 2) possibility for testing of various network scenarios in simulated networks under realistic loads.

Nedostatak većine današnjih sigurnosnih protokola poput SSH, SSL, IPsec, PPP, TSL i sličnih je taj što se, pomoću unaprijed poznatih algoritama, dogovaraju oko razmjene ključeva za sigurnu komunikaciju, a da pri tome ne daju fleksibilnost odabira samih algoritama. S obzirom na to da danas postoji nekoliko različitih preporuka o tome koje algoritme koristiti (uz preporučenu duljinu ključa), nameće se ideja o protokolu koji bi služio za dogovaranje algoritma koji najviše odgovara i jednom i drugom sugovorniku u komunikaciji. U radu je opisan protokol NgP (Negotiation Protocol) koji omogućava međusobno dogovaranje mrežnih čvorova o kriptografskim algoritmima koje će koristiti prilikom daljnje međusobne komunikacije. Protokol je osmišljen i implementiran tako da omogućuje sigurnu razmjenu i dogovor parametara između dva ravnopravna čvora. Sigurnosni zahtjevi obuhvaćaju zaštitu integriteta i autentifikaciju. Protokol je prvotno specificiran, te potom verificiran pomoću programskih alata za simulaciju Petrijevih mreža. Implementacija je izvedena u programskom jeziku Python i validirana u sklopu mrežnog simulatora/emulatora IMUNES. Kao rezultat dobivena je aplikacija koja je u potpunosti kompatibilna s operacijskim sustavom FreeBSD i programskim alatom IMUNES.

IP protocol version 6 (IPv6), a successor of IP protocol version 4 (IPv4), puts a significant effort in enhancing security facilities. Secure Neighbor Discovery (SEND) is an optional IPv6 protocol that counters threats in link-local communication allowed by Neighbor Discovery protocol (NDP). It protects from attacks against the integrity and authentication capabilities, relying on trustworthiness of cryptographic hash functions. After a recent discovery of reduced hash function resistance, their efficiency has been called into question. Attacks against the collision-free property of hash functions lead to the reexamination of how Internet protocols use hashes. In the paper we contribute with analyzes of attacks on hash functions, use of hashes in SEND, impact of hash attacks on each use of hash functions in SEND, propose and evaluate possible approaches to allowing hash agility, and finally propose the most efficient solution - a solution for SEND hash agility based on a negotiation approach.

Radi ušteda na kapacitetu, troškovima održavanja te pasivnim i aktivnim elementima, sustav prijenosa audio signala između glavne režije Hrvatskog radija i regionalnih centara realiziran je uvođenjem audio trasa temeljenih na internet protokolu. Usprkos pažljivog dimenzioniranja te teoretski i praktično potvrđenih dovoljnih kapaciteta mreže, korištenjem sustava u određenim trenucima zamijećena su dva problema u prijenosu audio signala: preveliko kašnjenje i pojava pucketanja unutar izlaznog audio signala. Oni dovode do degradiranja kvalitete audio signala čime sustav postaje neprihvatljiv za radijski prijenos. U radu je opisan postupak otkrivanja komponenti koje unose preveliko kašnjenje u prijenos audio signala, te kako je to kašnjenje otklonjeno. Iako su mjerenja pokazala da uzrok problema nije u internet protokolu smatramo da su zanimljiva.

Ranjivost sustava posljedica je sigurnosne slabosti i nedostatka sustava. Prilikom napada, napadač iskorištava ranjivost sustava kako bi kompromitirao njegovu sigurnost i neovlašteno mu pristupio. Nadzirući i kontrolirajući ranjivost sustava, moguće je otkloniti prijetnje na njegovu sigurnost.

As invaluable tools in networked and distributed systems research, network emulators offer a viable alternative to live experimental / testbed networks. We present a methodology for emulating computer networks by using a general-purpose OS kernel partitioned into multiple lightweight virtual nodes, which can be interconnected via kernel-level links to form arbitrarily complex network topologies. The concept of using virtual nodes inside a kernel for fast network emulation is not new, yet previously published work generally advocated implementing kernel-level virtual nodes with capabilities limited to only certain simple functions, such as blind passing of network frames from one queue to another based on a static pre-computed path. We show that virtual nodes, offering the identical rich set of capabilities as the standard kernel does, can be implemented very efficiently by reusing the existing OS kernel code. Therefore our model not only provides each virtual node with an independent replica of the entire standard network stack, thus enabling highly realistic and detailed emulation of network routers ; it also enables unmodified user-level applications to run within virtual nodes, thus becoming a powerful tool for development and testing of real-world networked applications ranging from routing protocol daemons to distributed file sharing systems.

Operacijski sustavi opće namjene tradicionalno su opremljeni monolitnim mrežnim stogom. Mogućnost podržavanja istodobnog rada s više potpuno nezavisnih instanci mrežnog stoga unutar jedinstvene jezgre (kernel) predstavlja novi koncept u istraživanjima i razvoju operacijskih sustava. Obrazlažu se temeljne ideje primjenjene u dizajnu i eksperimentalnoj implementaciji klonirajućeg mrežnog stoga u jezgri operacijskog sustava FreeBSD, te daje kratki pregled nekih mogućnosti primjene, uključuju i uspostavu virtualnih poslužitelja, simulaciju i emulaciju IP mreža u stvarnom vremenu, te u nadzoru virtualnih privatnih mreža od strane mrežnog operatora.

This article describes one approach to a TCP simulation. The maing goal was to develop an educational TCP simulator, which would explain main TCP features, but with enough flexibility for further upgrade to more advanced TCP mechanisms. The simulator is a part of the TCP Education Suite, a complete teaching tool for the TCP and TCP related problems.

Interrupt coalescing is a feature implemented in hardware on many of today's high-performance network interface cards (NIC). It allows a reception of a group of network frames to be notified to the operating system kernel via a single hardware interrupt, thus reducing the interrupt processing overhead, particularly at high packet rates. However, the delays introduced by interrupt coalescing can result in significant TCP throughput degradation. In this article we analyze the advantages and drawbacks of a generic interrupt coalescing implementation. We propose an approximate model defining relation between interrupt coalescing delays and steady state TCP throughput, which we validate by laboratory measurements. We conclude our report by showing how the proposed model can be used for determination of optimal delay duration, depending on specific environment and application.

Computer software is overshadowing hardware in cost and complexity and is rapidly becoming the dominant part in the development process of telecommunication systems. FDTs (Formal Description Techniques) represent a promising approach for obtaining confidence in the correctness of system. In order to improve translation from the formal system specification toward its implementation we have developed SDL to Erlang translator. This paper is structured as follows: first we will give a brief introduction to SDL (Specification and Description Language) and Erlang programming language. Since relations between those languages are considered in previous works, we will not focus on it. In the second section we will describe development of our SDL to Erlang translator. Finally, we will give some hints for our future work.

WWW.HR is a joint project between the Faculty of Electrical Engineering and Computing, Department of Telecommunications, and the Croatian Academic and Research Network, CARNet. Since its foundation in February 1994, its purpose has been to promote and maintain the network information services through the "national WWW homepage" and enable easy navigation in Croatian cybespace through the hierarchically and thematically organised directory of WWW servers. This paper retrospects the first five years of WWW.HR project, evaluates its present state, and focuses on future development.

XXX

Software design based on the FDTs is still not widely used, despite of the fact that using of the FDTs can reduce number of errors, price and required time for producing software. Probably the main reason is a big gap between specification and implementation. To reduce this gap, we have proposed way for Erlang code generation from SDL specification. We have found that Erlang (programming language developed by Ericsson) satisfies requirements on “easy” implementation of the specification. One of the reasons is that both Erlang and SDL are based on the finite state automata, process based concurrency model, and asynchronous message passing. We can execute the algorithm either automatically or by handwriting. Algorithm is tested during the specification and the Erlang implementation of the graphical simulation of the switch.

Computer software is overshadowing hardware in cost and complexity and is rapidly becoming the dominant part in the development process of telecommunication systems. FDTs (Formal Description Techniques) represent a promising approach for obtaining confidence in the correctness of system. If we choose Erlang as our implementation language, it is desired to find an appropriate specification language, in order to have easy translation from the specification toward the implementation. We have chosen SDL (Specification and Description Language). SDL is recommended by ITU-T for specification and description of the internal logic processes in SPC telephone exchanges. It is process-based language, with asynchronous message passing between processes, which behave as an extended finite state automaton. This paper is structured as follows: first we will give a brief introduction to SDL with comparison to the Erlang programming language. We will try to show that SDL as a specification language is appropriate for Erlang applications. In the second section we will test similarities between SDL and Erlang during local call handling process specification and implementation. Finally, we will mark some hints connected with design of SDL-to-Erlang translator, which is under construction and will be published in the future.

XXX

U disertaciji su opisani postupci specifikacije i provjere ispravnosti specifikacije telekomunikacijskih procesa s posebnim naglaskom na formalnim metodama. Osnovni cilj formalnih metoda je pomoć inženjerima pri konstrukciji pouzdanijih sustava. Provjera specifikacije uključuje validaciju i verifikaciju. Neformalno se može reći: validacija je pokazivanje da su dobro postavljeni zahtjevi a verifikacija da je sustav izgrađen u skladu sa zahtjevima. Verifikacijske metode svrstane su u dvije grupe koje koriste dokazivanje teorema ili provjeru modela. Posebno su istaknute integracije različitih pristupa verifikaciji s naglaskom na učinkovitost provjere specifikacijske ispravnosti. Postupci provjere ispravnosti specifikacije te njihov preslik u odgovarajuće pomagalo kao sastavnice inteligentne razvojne okoline za razvoj telekomunikacijskog softvera predloženi su u obliku reprezentativnog laboratorijskog modela. Prikazani su modeli i metode transpozicije iz domene znanja o telekomunikacijskim procesima u jezični prostor te kriteriji izbora tipa jezika koji premošćuje relaciju između znanja i procesa temeljem ponuđene tehnologije. Niti jedna od poznatih metoda ne zadovoljava sve potrebe te je istraživanje formalnih specifikacijskih jezika koji bi se upotrebljavali u području programskog inženjeringa još uvijek značajno područje aktivnog istraživanja. Jedno od predloženih rješenja je integriranje dokazivača teorema opće namjene sa specifičnim tehnikama provjere modela. Formalne tehnike mogu osigurati ispravno provođenje međukoraka dizajna ali i dalje ostaje problem ispravnog postavljanja specifikacije na najvišem nivou.

U radu su opisani osnovni koncepti programskih jezika s posebnim naglaskom na njihovim primjenama u telekomunikacijskoj domeni. Plex, Lisp, Prolog, C, C++, Erlang, Occam.

U radu je prikazan razvoj radne stanice LAG (Learning Automata Games). Prikazani su razvijeni programski moduli i dana je koncepcija njihovog međusobnog povezivanja. Posebno je razrađen modul "Igre automata". Razvoj radne stanice ima za cilj izgradnju programskog alata za testiranje modela i metoda proizašlih iz prisutnog istraživanja unutar teorije digitalnih automata. Eksperimentalni rezultati dani su u odnosu prema aktuelnim svjetskim dostignućima, a osnovna sredina primjene definirana je potrebama telekomunikacijske mreže.

U radu su objašnjeni pojmovi, način rada i izvedba raspodijeljenog višemedijskog sustava temeljenog na WWW-u. Prikazani su primjeri WWW poslužitelja na Zavodu za telekomunikacije Fakulteta elektrotehnike i računarstva u Sveučilišta u Zagrebu.

The paper describes three case studies for Web server design: department web site, conference web site, national web site.

This paper presents an experimental model of operation and maintenance workstation for digital switching systems. The model consists of communication subsystem, user interface, database interface and "knowledge servers" for maintenance of I/O and subscriber services switching system subsystems. An expert system module for alarm analysis is described as an example for the integration of "knowledge servers" into ,graphical user interface on Unix-based workstation.

Local communication system design, implementation and management are always difficult problems when flexibility, rearrageability and multimedia capabilities, even in restricted form have to be solved. This paper deals with an approach based on integrated digital voice/data PBX with external packet switch module and Ethernet LAN. Interconnection of different network segments, external communications through the public network, subnetworking and user services are discussed.