DEIS

Remote system administration is usually performed according to the standard client-server model. However, important security and flexibility limitations, arising from the usage of a predictable access port for such a critical application, prevent a satisfactory trade-off between authentication strength and service availability. We illustrate an alternative solution, based on an additional system placed in between the remote server and its administrator. Our design ensures that the new component's role does not weaken the existing security mechanisms already in place, but it can instead enhance them, and provide a very effective decoupling between a server and its visible management ports.

Various technical bodies have devised methodologies to guide testers to the selection, design, and implementation of the most appropriate security testing procedures for various contexts. Their general applicability is obviously regarded as a necessary and positive feature, but its consequence is the need for a complex adaptation phase to the specific systems under test. In this work, we aim to devise a simplified, yet effective methodology tailored to suit the peculiar needs related to the security testing of e-voting systems. We pursue our goal by selecting, for each peculiar aspect of these systems, the best-fitting procedures found in the most widely adopted security testing methodologies, at the same time taking into account the specific constraints stemming from the e-voting context to prune the excess of generality that comes with them.

Current security practice is to examine incoming messages, commands, data, and executing processes for attacks that can then be countered. This position paper argues that this practice is counterproductive because the number and variety of attacks are far greater than we can cope with. We propose a results-oriented approach, in which one focuses on the step of the attack that realizes the compromise. Thus, the manner in which the compromise is effected becomes less important than the actual result, and prevention, detection, and recovery efforts are focused on that.

Network intrusion detection is a key security issue that can be tackled by means of different approaches. This paper describes a novel methodology for network attack detection based on the use of data mining techniques to process traffic information collected by a monitoring station from a set of hosts using the Simple Network Management Protocol (SNMP). The proposed approach, adopting unsupervised clustering techniques, allows to effectively distinguish normal traffic behavior from malicious network activity and to determine with very good accuracy what kind of attack is being perpetrated. Several monitoring stations are then interconnected according to any peer-to-peer network in order to share the knowledge base acquired with the proposed methodology, thus increasing the detection capabilities. An experimental test-bed has been implemented, which reproduces the case of a real web server under several attack techniques. Results of the experiments show the effectiveness of the proposed solution, with no detection failures of true attacks and very low false-positive rates (i.e. false alarms).

Silicon Photo-Multipliers (SiPMs) consist of a high density array of p-n junctions with a common output (∼ 10 3 cells per mm 2 ), operated beyond the breakdown voltage in a Geiger-Müller regime. With a typical gain of the order of 10 6 , time resolution at the 100 ps level, a dead time per diode limited to 100 ns, enhanced blue sensitivity, photon detection efficiency in excess of 30% and, notably, a photon number resolving capability up to a few tens of photons even at room temperatures, their performances are comparable with the common use Photo-Multiplier Tubes, with the advantage of operability in magnetic fields. However, SiPMs present a significant Dark Count Rate (DCR), ranging from a few 100 kHZ to the MHz level at room temperature, and a relevant optical cross-talk between the cells, with values depending on the detector design and the biasing condition, so that their use is far from being trivial. The performance of SiPMs have been tested in the context of the characterization of the photon number distribution in a light field. Infact, while the Geiger-Müller avalanche triggering by impinging photons can be modelized as a pure bernoullian process that preserves the photon number distribution of measured light field, relevant values of DCR and cross-talk can cause sizeable deviations from this statistics. Taking into account the DCR and cross-talk effects in the Geiger-Müller avalanche distribution, we demonstrate that photon number distributions in a poissonian and thermal-like light field can be properly reconstructed.

This paper addresses the problem of congestion resolution and quality of service differentiation in optical packet switching. The paper shows that by designing congestion resolution algorithms that combine the use of the wavelength and the time domain it is possible to significantly reduce information loss phenomena and also to guarantee quality of service differentiation among traffic classes. In particular this is achieved by means of QoS algorithms specifically designed to exploit the characteristics of optical technology.

This paper presents some instantiations of novel application-aware network architectures for emerging IT services and future Internet applications. It proposes and analyses network architectures where the Control and Service Planes are closely and seamlessly interacting with the applications. One instantiation, the Grid-GMPLS (G2MPLS, as defined by the Phosphorus project) is presented, which implements the Network Control Plane (NCP) architecture for the support of Grid Network Services (GNS).

We address the problem of congestion resolution in optical packet switching (OPS). We consider a fairly generic all-optical packet switch architecture with a feedback optical buffer constituted of fiber delay lines (FDL). Two alternatives of switching granularity are addressed for a switch operating in a slotted transfer mode: switching at the slot level (ie, fixed length packets of a single slot) or at the burst level (variable length packets that are integer multiples of the slot length).

Abstract The new telecommunication networks scenario is characterised by a very rapid increase of the volume of traffic, and also very variable and unpredictable traffic demands. In this context, all-optical packet switching is emerging as the most promising technology for covering such new requirements. In this paper, we deal with the performance analysis of an optical packet switch with a feedback delay line buffer configuration.

Abstract In this paper we propose a service-oriented networking architecture that, by exploiting the Session Initiation Protocol (SIP), is able to support a population of users moving within a network of trusted domains over wireless and/or wired connections. The proposed architecture combines the flexibility of a peer-to-peer connectivity network with the efficient signaling organization of a hierarchy of domains.

Abstract In the last few years research on optical packet-switching has mainly concentrated on issues at the single node level. This paper intends to discuss about the problems arising when the focus is moved towards a network-wide scope. In particular, an overview of routing techniques that may be adopted in an optical packet-switched backbone is presented, showing the effects of adaptive multi-path routing strategies on the network performance.

Abstract—Programmable hybrid optical networks are investigated as a solution to deploy flexible functionalities in next generation networks. A modular programmable router architecture, based on emerging standards, is proposed to support dynamic management and configuration capabilities of network resources and services. The new node design concepts allow vendor-independent development of hybrid router components and further implementation of new standard interfaces.

Abstract Future network should be able to efficiently serve packet-based networks, such as the Internet. In this paper, based on results from COST 266, we explore characteristics of optical burst switching (OBS) and optical packet switching (OPS). Both node design and metropolitan area network (MAN) are discussed. A unique joint comparative performance evaluation of contention resolution in OBS and OPS are presented, as well as methods of quality of service (QoS) differentiation in OBS/OPS networks, and their performance.

Abstract Optical burst and packet switching are being considered as the most promising paradigms to increase bandwidth efficiency in IP over DWDM networks. In both cases, due to statistical multiplexing, a scheduling policy is needed to solve contentions at the node level caused by more than one burst/packet directed to the same output channel. The scheduling may be performed in the wavelength, time and space domains, turning this problem into a choice of the best available resource in the different domains.

Abstract In this paper the performance of a hybrid optical network composed of multiple Ethernet Passive Optical Networks (EPONs) at the access connected to an Optical Burst Switching (OBS) core is evaluated. The EPONs make use of the IPACT algorithm to manage the upstream transmissions, whereas the OBS edge node employs a time-based assembly scheme for burst aggregation. This leads to interoperability issues between access and core which are investigated in this paper.

Abstract In this paper end-to-end performance is evaluated when multiple high-speed access networks, based on the Ethernet Passive Optical Network (EPON) technology, are interconnected through an Optical Burst Switching (OBS) core network. The inter-working unit, or edge node, between these two different networks is properly studied and discussed. A time-based burst assembly algorithm is assumed, which is analyzed and dimensioned to cope with multiple EPONs.

Advanced transport technologies offer large capacities in both core and access telecommunication networks. This opportunity can be fruitfully exploited to meet the requirements of new network service markets which strongly promote emerging bandwidth-demanding applications, such as large data transfers, immersive video-conferencing, high-definition TV and cinema services.

Abstract: The iSchool at the University of Pittsburgh has designed a new learning experience that will allow future leaders of the iProfession to gain critical skills and to experience working in culturally diverse teams. The iSchool has, as one of its mission-critical goals, to create learning experiences that imitate the collaborative nature of the information professions.

This paper presents PI-OPS (Parallel-Iterative Optical Packet Scheduler) a parallel-iterative scheduler for asynchronous Optical Packet Switching nodes with optical buffering. Optical packets are assembled by aggregating IP packets, and attaching an optical packet header. Conventional schemes process optical packet headers one by one, in a sequential form. Then, the worst case algorithm response time is tightly coupled to switch size.