No abstract

Abstract. Concast is a customizable many-to-one network-layer communication service. Although programmable services like concast can improve the efficiency of group applications, accompanying security concerns must be addressed before they are likely to be deployed. The problem of securing such services is interesting because conventional end-to-end security mechanisms are not applicable when messages are processed inside the network, and also because of the potential for interaction among the various policies involved. In this paper we describe our implementation of a secure concast service, which leverages existing network-level security mechanisms (IPsec) to provide secure distribution of program code (merge specifications) as well as authentication of participating nodes. We describe the various policies supported, how they interact, and how our approach provides security against various attacks.

Multicast services have been used to transmit multimedia data to large receiver groups. Only recently have counterpart network services been introduced to provide similar scalability and anonymity in the opposite direction (i.e. messages from a group of senders destined for a common receiver).In this paper, we explore how these many-to-one services, specifically the concast service, can be used to improve the scalability and performance of multimedia applications. In particular, we show how such services can be used in both the control and data planes to overcome well-known scalability problems (e.g. with Real Time Protocol) that are difficult to solve effectively with end-system approaches alone. We validate our solutions by presenting experimental results taken from prototype video and audio applications we designed and implemented. Our initial results show substantial reductions in congestioninduced loss using these generic services. 1378K. CALVERT ET AL. from senders and allowing them to deal with the group as a single entity). Multimedia applications have long been the primary users of multicast services. For example, multicast real-time audio and video applications have been running over the Internet for many years.Traditionally, the only way for a multicast application to send information in the reverse directionfrom the group members to a single destination-was via unicast (or possibly multicast). As an example of where such information flow is required, consider that many multimedia applications need control information (feedback) to be sent from the receivers to the source; these applications use N unicast channels or worse yet, N multicast channels. This limits the scalability of such applications, because (i) as data from many sources is 'funneled' toward one receiver, the load may exceed available resources, either in the network or in the end system, resulting in implosion [1,2]; and (ii) the receiver is forced to deal with the many group members individually, destroying anonymity.These limits are difficult to overcome with end-system-only mechanisms. Existing solution approaches typically fall into one of two categories: either the end-systems learn/guess/infer the group size and adjust the feedback rate appropriately [2-4], or they create an overlay network in the reverse direction to aggregate control information [5,6]. Recently, however, various networklevel mechanisms have been proposed to help overcome these limitations. For example, Pragmatic General Multicast (PGM) [7] is a protocol that uses a set of router-based mechanisms to improve the scalability of multicast applications by subcasting retransmissions. Follow-on work, namely Generic Router Assist [8], generalizes the PGM mechanisms via simple router-based services that can be programmed to address the scalability and performance needs of group applications. Yet another service, concast [9,10], is a backward-compatible many-to-one service that allows application-specified merging functionality to be loaded into supporting routers, so tha...

No abstract

Abstract