Abstract. Denial of service by server resource exhaustion has become a major security threat in open communications networks. Public-key authentication does not completely protect against the attacks because the authentication protocols often leave ways for an unauthenticated client to consume a server’s memory space and computational resources by initiating a large number of protocol runs and inducing the server to perform expensive cryptographic computations. We show how stateless authentication protocols and the client puzzles of Juels and Brainard can be used to prevent such attacks. 1

Recent work in network coding shows that, it is necessary to consider both the routing and coding strategies to achieve optimal throughput of information transmission in data networks. So far, most research on network coding has focused on the model of directed networks, where each communication link has a fixed direction. In this paper, we study the benefits of network coding in undirected networks, where each communication link is bidirectional. Our theoretical results show that, for a single unicast or broadcast session, there are no improvements with respect to throughput due to network coding. In the case of a single multicast session, such an improvement is bounded by a factor of two, as long as half integer routing is permitted. This is dramatically different from previous results obtained in directed networks. We also show that multicast throughput in an undirected network is independent of the selection of the sender within the multicast group. We finally show that, rather than improving the optimal achievable throughput, the benefit of network coding is to significantly facilitate the design of efficient algorithms to compute and achieve such optimal throughput. I.

With the constraints of network topologies and link capacities, achieving the optimal end-to-end throughput in data networks has been known as a fundamental but computationally hard problem. In this paper, we seek efficient solutions to the problem of achieving optimal throughput in data networks, with single or multiple unicast, multicast and broadcast sessions. Although previous approaches lead to solving NP-complete problems, we show the surprising result that, facilitated by the recent advances of network coding, computing the strategies to achieve the optimal end-to-end throughput can be performed in polynomial time. This result holds for one or more communication sessions, as well as in the overlay network model. Supported by empirical studies, we present the surprising observation that in most topologies, applying network coding may not improve the achievable optimal throughput; rather, it facilitates the design of significantly more efficient algorithms to achieve such optimality. Index terms: Graph theory, Information theory, Mathematical programming/optimization, Simulations.

Two simple approximation algorithms for the minimum k-cut problem are presented. Each algorithm finds a k-cut having weight within a factor of (2 \Gamma 2=k) of the optimal. One of our algorithms is particularly efficient - it requires a total of only n \Gamma 1 maximum flow computations for finding a set of near-optimal k-cuts, one for each value of k between 2 and n. i 1 Introduction The minimum k-cut problem is as follows: given an undirected graph G = (V; E) with non-negative edge weights and a positive integer k, find a set S ` E of minimum weight whose removal leaves k connected components. This problem is of considerable practical significance, especially in the area of VLSI design. Solving this problem exactly is NP-hard [GH], but no efficient approximation algorithms were known for it. In this paper we give two simple algorithms for finding k-cuts. We prove a performance guarantee of (2 \Gamma 2=k) for each algorithm; however, neither algorithm dominates the other on a...

We present a branch-and-cut algorithm to solve capacitated network design problems. Given a capacitated network and point-to-point traffic demands, the objective is to install more capacity on the edges of the network and route traffic simultaneously, so that the overall cost is minimized. We study a mixed-integer programming formulation of the problem and identify some new facet defining inequalities. These inequalities, together with other known combinatorial and mixed-integer rounding inequalities, are used as cutting planes. To choose the branching variable, we use a new rule called "knapsack branching". We also report on our computational experience using real-life data.

In this paper, we study network flow algorithms for bipartite networks. A network G = (V; E) is called bipartite if its vertex set V can be partitioned into two subsets V 1 and V 2 such that all edges have one endpoint in V 1 and the other in V 2 . Let n = jV j, n 1 = jV 1 j, n 2 = jV 2 j, m = jEj and assume without loss of generality that n 1 n 2 . We call a bipartite network unbalanced if n 1 ø n 2 and balanced otherwise. (This notion is necessarily imprecise.) We show that several maximum flow algorithms can be substantially sped up when applied to unbalanced networks. The basic idea in these improvements is a two-edge push rule that allows us to "charge" most computation to vertices in V 1 , and hence develop algorithms whose running times depend on n 1 rather than n. For example, we show that the two-edge push version of Goldberg and Tarjan's FIFO preflow push algorithm runs in O(n 1 m + n 3 1 ) time and that the analogous version of Ahuja and Orlin's excess scaling algori...

Networked and distributed systems have introduced a new significant threat to the availability of data and services: network denial of service attacks. A well known example is the TCP SYN ooding. In general, any statefull handshake protocol is vulnerable to similar attacks. This paper examines the network denial of service in detail and surveys and compares different approaches towards preventing the attacks. As a conclusion, a number of protocol design principles are identified essential in designing network denial of service resistant protocols, and examples provided on applying the principles.

The problems of computing the maximum increase in the weight of the minimum spanning trees of a graph caused by the removal of a given number of edges, or by finite increases in the weights of the edges, are investigated. For the case of edge removals, the problem is shown to be NP-hard and an \Omega\Gamma/ = log k)-approximation algorithm is presented for it, where k is the number of edges to be removed. The second problem is studied assuming that the increase in the weight of an edge has an associated cost proportional to the magnitude of the change. An O(n 3 m 2 log(n 2 =m)) time algorithm is presented to solve it. 1 Introduction Consider a communication network in which information is broadcast over a minimum spanning tree. There are applications for which it is important to determine the maximum degradation in the performance of the broadcasting protocol that can be expected as a result of traffic fluctuations and link failures [25]. Also, there are several combinatorial op...

In this paper, we examine the problem of large-volume data dissemination via overlay networks. A natural way to maximize the throughput of an overlay multicast session is to split the traffic and feed them into multiple trees. While in single-tree solutions, bandwidth of leaf nodes may remain largely under-utilized, multi-tree solutions increase the chances for a node to contribute its bandwidth by being a relaying node in at least one of the trees. We study the following problems: (1) What is the maximum capacity multi-tree solutions can exploit from overlay networks? (2) When multiple sessions compete within the same network, what is the relationship of two contradictory goals: achieving fairness and maximizing overall throughput? (3) What is the impact of IP routing in achieving at constraining the optimal performance of overlay multicast? We extend the multicommodity flow model to the case of overlay data dissemination, where each commodity is associated with an overlay session, rather than the traditional source-destination pair. We first prove that the problem is solvable in polynomial time, then propose an #-approximation algorithm, assuming that each commodity can be split in arbitrary ways. The solution to this problem establishes the theoretical upper bound of overall throughput that any multi-tree solution could reach. We then study the same problem with the restriction that each commodity can only be split and fed into a limited number of trees. A randomized rounding algorithm and an online tree-construction algorithm are presented. All these algorithms are evaluated by extensive simulations.

The transmission of information within a data network is constrained by the network topology and link capacities. In this paper, we study the fundamental upper bound of information dissemination rates with these constraints in undirected networks, given the unique replicable and encodable properties of information flows. Based on recent advances in network coding and classical modeling techniques in flow networks, we provide a natural linear programming formulation of the maximum multicast rate problem. By applying Lagrangian relaxation on the primal and the dual linear programs (LPs), respectively, we derive a) a necessary and sufficient condition characterizing multicast rate feasibility, and b) an efficient and distributed subgradient algorithm for computing the maximum multicast rate. We also extend our discussions to multiple communication sessions, as well as to overlay and ad hoc network models. Both our theoretical and simulation results conclude that, network coding may not be instrumental to achieve better maximum multicast rates in most cases; rather, it facilitates the design of significantly more efficient algorithms to achieve such optimality.