The Service-Based Architecture (SBA) of the fifth generation (5G) of cellular networks introduced great advancements in flexibility, efficiency, and performance of modern networks, thanks to the distribution and softwarization of core network entities called Network Functions (NFs). Due to the distributed nature of 5G systems, these NFs are usually located in different sites to provide better Quality of Service (QoS) or specific services, which poses a great challenge regarding security. However, even though the 3GPP standard identifies security requirements by leveraging Transport Layer Security (TLS) authentication and OAuth2.0 authorization, current experimental and commercial deployments often disregard these aspects for the sake of simplicity and performance. In fact, even though data and communication protection is crucial, the implementation of security protocols and mechanisms complicates the deployments and may reduce the efficiency of 5G systems. This paper presents a novel solution that implements TLS for authentication and encryption leveraging entanglement-based Quantum Key Distribution (QKD), ensuring that all the communications between NFs in the 5G core network are secured by QKD keys, and are therefore quantum-safe. Additionally, this paper presents a QKD key repository using the Network Repository Function (NRF), which stores and relays TLS session keys to authenticated consumer NFs to access producer NFs in a fast but quantum-safe process. The solution was validated in a real hardware environment, and obtained results demonstrate that the proposed solution enhances the security of the SBA communications in an efficient way, reducing an 85% the service request time compared to the traditional TLS-based procedure, as well as 29.96% fewer bytes transmitted throughout the process.

Network softwarization has significantly evolved since programmable data planes became topical in academia and industry. Programming Protocol-Independent Packet Processors (P4) is a language to define packet forwarding behavior. Forwarding devices that are programmed with the P4 language support a flexible way to define headers, parse graphs, and data plane logic. However, extending the data plane with additional functionalities has an impact on packet data plane latency. For this reason, this paper analyzes the key factors that affect data pane latency to packets processed by the Tofino-based target (Tofino Native Architecture (TNA)), which can be considered the de facto production-ready and P4-programmable Application-Specific Integrated Circuit (ASIC). Our work first provides an extensive set of latency measurements and, afterwards, it includes a set of data plane latency predictions using the model derived from the latency results and machine learning (ML) algorithms. We demonstrate that the PCA-lasso polynomial (PLP) obtains the best results among the algorithms tested. The best-case results show that PLP obtained an accuracy of 98.22% prediction accuracy when considering the parser, deparser, and the control block for traffic running at 10 G/s (SFP+) and 100 G/s (QSFP28). To the best of our knowledge, this is the first work that provides such a comprehensive profiling, including a method to predict data plane latency in production-grade Tofino ASIC-based switching hardware, which could be leveraged to yield accurate latency values prior to investment and deployment.

Quick handling of link failures remains a challenging issue in current communication networks, although it is crucial to many routing algorithms. Link failures are the leading cause of packet losses and delays, therefore, failure recovery is tied to stringent requirements for certain services, such as the sub-50 millisecond completion time for carrier-grade networks, which is sometimes difficult to achieve in traditional routing schemes. For this reason, fast recovery strategies are key pillars of modern communication networks. In this paper, we demonstrate the benefits of the devices with Programmable Data Planes (PDP) for fast reacting to link failures. We first review the link failure detection, reaction and recovery procedures and then we discuss the main fast failure recovery mechanisms employed by different types of devices in current communication networks. In addition, we present a novel method to measure the link failure reaction time of an Intel Tofino switch with PDP, as well as the results obtained when measuring such time using real hardware equipment. Our results show that such hardware devices provide a failure reaction time in the order of microseconds, with an average of 472.88 μs, which poses PDP as a key technology to achieve zero packet loss and zero delay failure recovery.

The use of advanced communications and smart mechanisms in industry is growing rapidly, making cybersecurity a critical aspect. Currently, most industrial communication protocols rely on the Transport Layer Security (TLS) protocol to build their secure version, providing confidentiality, integrity and authentication. In the case of UDP-based communications, frequently used in Industrial Internet of Things (IIoT) scenarios, the counterpart of TLS is Datagram Transport Layer Security (DTLS), which includes some mechanisms to deal with the high unreliability of the transport layer. However, the (D)TLS handshake is a heavy process, specially for resource-deprived IIoT devices and frequently, security is sacrificed in favour of performance. More specifically, the validation of digital certificates is an expensive process from the time and resource consumption point of view. For this reason, digital certificates are not always properly validated by IIoT devices, including the verification of their revocation status; and when it is done, it introduces an important delay in the communications. In this context, this paper presents the design and implementation of an in-network server certificate validation system that offloads this task from the constrained IIoT devices to a resource-richer network element, leveraging data plane programming (DPP). This approach enhances security as it guarantees that a comprehensive server certificate verification is always performed. Additionally, it increases performance as resource-expensive tasks are moved from IIoT devices to a resource-richer network element. Results show that the proposed solution reduces DTLS handshake times by 50–60 %. Furthermore, CPU use in IIoT devices is also reduced, resulting in an energy saving of about 40 % in such devices.

Digital certificates are regarded as the most secure and scalable way of implementing authentication services in the Internet today. They are used by most popular security protocols, including Transport Layer Security (TLS) and Datagram Transport Layer Security (DTLS). The lifecycle management of digital certificates relies on centralized Certification Authority (CA)-based Public Key Infrastructures (PKIs). However, the implementation of PKIs and certificate lifecycle management procedures in Industrial Internet of Things (IIoT) environments presents some challenges, mainly due to the high resource consumption that they imply and the lack of trust in the centralized CAs. This paper identifies and describes the main challenges to implement certificate-based public key cryptography in IIoT environments and it surveys the alternative approaches proposed so far in the literature to address these challenges. Most proposals rely on the introduction of a Trusted Third Party to aid the IIoT devices in tasks that exceed their capacity. The proposed alternatives are complementary and their application depends on the specific challenge to solve, the application scenario, and the capacities of the involved IIoT devices. This paper revisits all these alternatives in light of industrial communication models, identifying their strengths and weaknesses, and providing an in-depth comparative analysis.

Industrial networks are introducing Internet of Things (IoT) technologies in their manufacturing processes in order to enhance existing methods and obtain smarter, greener and more effective processes. Global predictions forecast a massive widespread of IoT technology in industrial sectors in the near future. However, these innovations face several challenges, such as achieving short response times in case of time-critical applications. Concepts like in-network computing or edge computing can provide adequate communication quality for these industrial environments, and data plane programming has been proved as a useful mechanism for their implementation. Specifically, P4 language is used for the definition of the behavior of programmable switches and network elements. This paper presents a solution for industrial IoT (IIoT) network communications to reduce response times using in-network computing through data plane programming and P4. Our solution processes Message Queuing Telemetry Transport (MQTT) packets sent by a sensor in the data plane and generates an alarm in case of exceeding a threshold in the measured value. The implementation has been tested in an experimental facility, using a Netronome SmartNIC as a P4 programmable network device. Response times are reduced by 74% while processing, and delay introduced by the P4 network processing is insignificant. View Full-Text

Industry 4.0 heavily builds on massive deployment of Industrial Internet of Things (IIoT) devices to monitor every aspect of the manufacturing processes. Since the data gathered by these devices impact the output of critical processes, identity management and communications security are critical aspects, which commonly rely on the deployment of X.509 certificates. Nevertheless, the provisioning and management of individual certificates for a high number of IIoT devices involves important challenges. In this paper, we present a solution to improve the management of digital certificates in IIoT environments, which relies on partially delegating the certificate enrolment process to an edge server. However, in order to preserve end-to-end security, private keys are never delegated. Additionally, for the protection of the communications between the edge server and the IIoT devices, an approach based on Identity Based Cryptography is deployed. The proposed solution considers also the issuance of very short-lived certificates, which reduces the risk of using expired or compromised certificates, and avoids the necessity of implementing performance expensive protocols such as Online Certificate Status Protocol (OCSP). The proposed solution has been successfully tested as an efficient identity management solution for IIoT environments in a real industrial environment.

The market prediction for network deployments has positioned Software-Defined Networks (SDN) as the first of the options for changing local, transport, or cloud networks. Since the OpenFlow protocol gained traction and evolved in the last versions, the possibilities for expanding network capabilities to deploy custom services have risen considerably. With next-generation SDN (NG-SDN), flexibility has grown as data plane programming languages, such as P4, and Data-Control Plane Interface (DCPI) protocols like P4Runtime have appeared. Furthermore, the ability to program the data plane has opened the possibilities to develop new network telemetry approaches, such as In-band Network Telemetry (INT). A transition to partially incorporated SDN, also known as hybrid SDN, often involves considerable complexity, especially when legacy devices implement non-open standards and protocols. Therefore, incorporating programmable SDN devices and deploying network telemetry protocols on top of existing legacy devices is still challenging. This research focuses on deploying and integrating the INT protocol using programmable P4 switches over a hybrid SDN network. We describe and implement the required control plane applications and data plane configuration, and discuss the constraints that need to be managed so that P4 programmable switches can interact with the rest of the MPLS legacy devices. In this sense, we discuss P4 switch placement alternatives to maximize their performance and usability in a hybrid SDN network. Then, we validate the INT-based monitoring system by ensuring traffic forwarding using several INT header placements. In these tests, we demonstrate the feasibility of merging P4 switches running INT traffic and legacy devices, presenting the requirements to accomplish hybrid next-generation SDN (HNG-SDN) architectures. Besides, we provide new monitoring features, such as MPLS label verification, and we also use telemetry data to feed back traffic forwarding applications for traffic engineering purposes. We finally show the time that packets spend in the pipeline comparing different parsing and actions performed in different cases.

Electromagnetic (EM) disturbances and compatibility issues are the most common problems affecting communication and signaling systems. The duration of field testing to solve these railway EM interference (EMI) problems may vary between three and 12 months, with the cost of the complete process between €25,000 and €1.5 million [1]. Currently, the railway industry demands the building of strategies and tools to promote paths toward zero on-site testing [2] and reduce the duration of field tests; however, there is a lack of laboratory testing resources for these approaches.

The aim of this article is to present an architecture to support reconfigurable multimedia services for a practical emergency environment use case of rescue operations. Specifically, radio communication and video surveillance services are provided by means of a small device carried by a mobile vehicle. This solution is validated by implementing a digital mobile radio (DMR) standard radio hotspot and a video streaming server in an unmanned aerial vehicle (UAV) that conveys a device with scarce resources in order to minimize power consumption. To achieve a fast and flexible deployment of the envisioned services, a virtualization-based approach is proposed. Namely, a Kubernetes orchestrator is used to manage the life-cycle of services deployed on a small resource device, endowing the architecture with scalability and management flexibility. This article describes the executed performance tests that measured key parameters such as deployment time and recovery time after disconnection. Highly promising results were obtained, showing that the proposed architecture can be deployed in less than 4 minutes and can recover from network disconnections in less than 10 seconds. Thus, the performance, reliability and flexibility of the overall solution are demonstrated.

The Industry 4.0 revolution envisions fully interconnected scenarios in the manufacturing industry to improve the efficiency, quality, and performance of the manufacturing processes. In parallel, the consolidation of 5G technology is providing substantial advances in the world of communication and information technologies. Furthermore, 5G also presents itself as a key enabler to fulfill Industry 4.0 requirements. In this article, the authors first propose a 5G-enabled architecture for Industry 4.0. Smart Networks for Industry (SN4I) is introduced, an experimental facility based on two 5G key-enabling technologies—Network Functions Virtualization (NFV) and Software-Defined Networking (SDN)—which connects the University of the Basque Country’s Aeronautics Advanced Manufacturing Center and Faculty of Engineering in Bilbao. Then, the authors present the deployment of a Wireless Sensor Network (WSN) with strong access control mechanisms into such architecture, enabling secure and flexible Industrial Internet of Things (IIoT) applications. Additionally, the authors demonstrate the implementation of a use case consisting in the monitoring of a broaching process that makes use of machine tools located in the manufacturing center, and of services from the proposed architecture. The authors finally highlight the benefits achieved regarding flexibility, efficiency, and security within the presented scenario and to the manufacturing industry overall. View Full-Text

Industry 4.0 uses a subset of the IoT, called Industrial IoT (IIoT) to achieve connectivity, interoperability and decentralisation. The deployment of industrial networks rarely considers security by design, but this becomes imperative in smart manufacturing as connectivity increases. The combination of OT and IT infrastructures in Industry 4.0 adds new security threats beyond those of traditional industrial networks. Defence-in-Depth (DiD) strategies tackle the complexity of this problem by providing multiple defence layers, each of these focusing on a particular set of threats. Additionally, the severe requirements of IIoT networks demand lightweight encryption algorithms. Nevertheless, these ciphers must provide E2E (End-to-End) security, as data pass through intermediate entities, or middleboxes, before reaching its destination. If compromised, middleboxes could expose vulnerable information to potential attackers if it is not encrypted throughout this path. This paper presents an analysis of the most relevant security strategies in Industry 4.0, focusing primarily on DiD. With these in mind, it proposes a combination of DiD, a lightweight E2E encryption algorithm called Attribute-Based-Encryption (ABE) and object security (i.e., OSCORE) to get a full E2E security approach. This analysis is a critical first step to develop more complex and lightweight security frameworks suitable for Industry 4.0.

Although the risk assessment discipline has been studied from long ago as a means to support security investment decision-making, no holistic approach exists to continuously and quantitatively analyze cyber risks in scenarios where attacks and defenses may target different parts of Internet of Things (IoT)-based smart grid systems. In this paper, we propose a comprehensive methodology that enables informed decisions on security protection for smart grid systems by the continuous assessment of cyber risks. The solution is based on the use of attack defense trees modelled on the system and computation of the proposed risk attributes that enables an assessment of the system risks by propagating the risk attributes in the tree nodes. The method allows system risk sensitivity analyses to be performed with respect to different attack and defense scenarios, and optimizes security strategies with respect to risk minimization. The methodology proposes the use of standard security and privacy defense taxonomies from internationally recognized security control families, such as the NIST SP 800-53, which facilitates security certifications. Finally, the paper describes the validation of the methodology carried out in a real smart building energy efficiency application that combines multiple components deployed in cloud and IoT resources. The scenario demonstrates the feasibility of the method to not only perform initial quantitative estimations of system risks but also to continuously keep the risk assessment up to date according to the system conditions during operation.

For the time being, companies and organisations are being forced to compete in utterly complex and globalised environments, facing massive natural, economic, and technological challenges on a daily basis. Addressing these challenges would be impossible without a proper approach that helps them identify, measure, understand, and control the performance of their organisations. Lean principles and techniques rise as a solution. This paper justifies and proposes the use of lean principles and techniques to identify key performance indicators (KPIs) in project-based organisations based on their organisational and operational needs. The research focuses mainly on the identification and categorisation of KPIs through a qualitative approach, based on systematic literature review (SLR) of performance indicators, project management, and project success. As a case study, an analysis of relevant information of an R&D and innovation project-based organisation, such as quality manuals, a benchmarking process, internal studies, and surveys regarding what success means for different kinds of stakeholders and for the organisation itself was conducted. As a result, this research is of a high value for project-based organisations, especially those that are not apprised of how to correctly formulate a series of KPIs, or whose path to it is still not clear. View Full-Text

With the advent of 5G technologies, vertical markets have been placed at the forefront, as fundamental drivers and adopters of technical developments and new business models. Small Unmanned Aerial Vehicles (SUAVs) are gaining traction in multiple vertical sectors, as key assets to generate, process, and distribute relevant information for the provision of value-added services. However, the enormous potential of SUAVs to support a flexible, rapid, and cost-effective deployment of vertical applications is still to be exploited. In this paper, we leverage our prior work on Network Functions Virtualization (NFV) and SUAVs to design and build a multi-site experimentation testbed based on open-source technologies. The goal of this testbed is to explore synergies among NFV, SUAVs, and vertical services, following a practical approach primarily governed by experimentation. To verify our testbed design, we realized a reference use case where a number of SUAVs, cloud infrastructures, and communication protocols are used to provide a multi-site vertical service. Our experimentation results suggest the potential of NFV and SUAVs to flexibly support vertical services. The lessons learned have served to identify missing elements in our NFV platform, as well as challenging aspects for potential improvement. These include the development of specific mechanisms to limit processing load and delays of service deployment operations.

Safety-critical systems are evolving into complex, networked, and distributed systems. As a result of the high interconnectivity among all networked systems and of potential security threats, security countermeasures need to be incorporated. Nonetheless, albeit cutting-edge security measures are adopted and incorporated during the system development, such as latest recommended encryption algorithms, these protection mechanisms may turn out obsolete because of the long operational periods. New security flaws and bugs are continuously detected. Software updates are then essential to restore the security level of the system. However, system shutdowns may not be acceptable when high availability is required. As expressed by the European Union Agency for Network and Information Security (ENISA) “the research in the area of patching and updating equipment without disruption of service and tools” is needed. In this article, a novel live updating approach for zero downtime safety-critical systems named Cetratus is presented. Cetratus, which is based on a quarantine-mode execution and monitoring, enables the update of non-safety-critical software components while running, without compromising the safety integrity level of the system. The focus of this work lies on the incorporation of leading-edge security mechanisms while safety-related software components will remain untouched. Other non-safety-related software components could also be updated.

Research and education networks (RENs) worldwide, attracted by the benefits of software-defined networking (SDN) for services involving traffic engineering (TE) such as bandwidth on demand (BoD), have started to include SDN in their network evolution plans. BoD allows users to request end-to-end connectivity services of known duration with a guaranteed bandwidth. Considering such a scenario, this paper presents a set of algorithms and two novel data structures for provisioning of the BoD service in SDN-based RENs. First, network snapshots are used to represent a period of time during which resource availability remains constant. Second, the network snapshot tree (NSTree) allows for different network snapshots to be arranged hierarchically using a time-based node aggregation policy. Additionally, each network snapshot stores multiple alternative paths for each source-destination pair. This innovative approach allows for the network resource utilization and number of service requests being accepted in the network to be improved compared to the most common approach of a single shortest path being considered for each destination. As a result, our approach allows for network resource utilization to be improved by approximately 30%. Furthermore, the two-phase procedure used to pre-compute alternative paths and perform admission control makes it possible to achieve response times on the order of milliseconds, enabling the real-time provision of the service.

Establishing collaboration strategies with interdisciplinary networks in research is a crucial success factor for the companies in any sector, especially in manufacturing for aeronautics. In the aeronautical supply chain, Small and Medium-sized Enterprises (SMEs) lack of these types of alliances with universities and other research institutions, which could give them access to shared and specialized knowledge, may strictly limit those companies to learning from their own experience. One way to break this dynamic for industrial companies is to be an active part of research, development, and innovation centres. In this paper, a study to create new advanced manufacturing centres is presented, centres whose activities are focused on Technology Readiness Levels (TRL) 5–7. The approach is based on a project management methodology, and it is applied to the aeronautical sector in the Basque Country. An initial study of the international experience and state of the art in this type of facility, as well as an analysis of the current socioeconomic environment of the Basque Country are presented. A benchmark study was done to identify the key processes that this centre must promote for this initiative to succeed, or those areas of knowledge that can make or break the initiative. Finally, the results showed a definitive picture for establishing an advanced manufacturing centre in the Basque Country. This work lays both the foundations of knowledge in the sector and the difficulties noted, so it can serve as guidance for similar initiatives.

Railway communications are closely impacted by the evolution and availability of new wireless communication technologies. Traditionally, the critical nature of railway services, the long lifecycle of rolling stock, and their certification processes challenge the adoption of the latest communication technologies. A current railway telecom trend to solve this problem is to design a flexible and adaptable communication architecture that enables the detachment of the railway services—at the application layer—and the access technologies underneath, such as 5G and beyond. One of the enablers of this detachment approach is software-defined networking (SDN)—included in 5G architecture—due to its ability to programmatically and dynamically control the network behavior via open interfaces and abstract lower-level functionalities. In this paper, we design a novel railway train-to-ground (T2G) communication architecture based on the 5G technological enabler SDN and on the transport-level redundancy technique multipath TCP (MPTCP). The goal is to provide an adaptable and multitechnology communication service while enhancing the network performance of current systems. MPTCP offers end-to-end (E2E) redundancy by the aggregation of multiple access technologies, and SDN introduces path diversity to offer a resilient and reliable communication. We carry out simulation studies to compare the performance of the legacy communication architecture with our novel approach. The results demonstrate a clear improvement in the failover response time while maintaining and even improving the uplink and downlink overall data rates. View Full-Text

In the incoming internet of things (IoT) applications, smart sensors expose services to interact with them, to be parameterised, managed and maintained. Therefore, fine-grained end-to-end access control enforcement is mandatory to tackle the derived security requirements. However, it is still not feasible in very constrained devices. There is an innovative access control model that conveys an expressive policy language and an optimised codification for tight and flexible access control enforcement in very constrained devices. Such tightness enabled by the expressiveness of the policy language leads to detailed policy instances that might impact on the performance and therefore, in the feasibility and further applicability. In this context, this study assesses how the policy length impacts the performance of the establishment of a security association through the protocol named Hidra proposed by such an adapted access control model. Consequently, the notable results of the performance evaluation prove the feasibility and adequacy of this access control model for the new smart IoT scenarios.

In terms of diagnosis, planning and treatment, when a dental patient needs a complex restoration or presents a temporomandibular disorder, it is necessary to reproduce the mandibular movements out from mouth. The best tool for this purpose is the virtual articulator. Virtual articulators enable a design that takes into account the kinematics necessary for the design process of dental restorations and at the same time, avoids possible collisions. The location of the hinge axis constitutes just one step in attempting to reproduce mandibular movement. However, the importance of this step arises from the fact that almost all movements start at the axis and return to it. Therefore, this study focuses on the virtual acquisition of the patient’s mandible rotation axis (kinematic axis) using reverse engineering devices.

21st century engineers have to confront global society’s competitiveness, so technical and technological competences have to be enriched with critical thinking, problem solving, collaboration, communication and creativity skills. To this end, teaching methodologies like Project-Based Learning (PBL) together with cooperative work, to cover the educational needs of future engineering graduates, should be promoted in class. This paper presents the SimABP project, an action where we simulate a work experience in the CAD subject presenting a real challenge to the students, tightly linking academy to real labour reality. In addition, we also define specific rubrics for evaluating the competences and we show the most significant results obtained. Our action has increased the satisfaction and motivation of the students, and the marks obtained in technical skills have been higher.

Which didactic methodology is the most appropriate considering the contents of my subject? What are the activities that suit my possibilities? What evaluation method is fair and formative for the competences of my subject? The teaching team of the subject of Graphic Expression in the Engineering of the Engineering School of Bilbao (UPV/EHU) decided to act in order to improve the teaching-learning process. For this purpose a restructuring of the entire subject that would be carried out by making a disruptive approach to redesign the subjetc was thought. The main objective was to capture the students’ interest in the subject and, as a result, improve the success rate. For this purpose, a restructuring of the whole subject was sought by applying educational methodologies and updated technologies according to the new requirements by the students and the teachers. The main idea is to give importance to the knowledge and ability of extracting the necessary data to represent graphically the reality, identifying the real problem posed with a method of theoretical resolution. At the same time, to minimize the importance of memorizing steps, data can be consulted in the bibliography. With the objective of implementing the main ideas above, the teaching team inquired about pedagogic models, and found that the Flipped Classroom suited the necessary characteristics, mainly the effective use of time in the classroom. Finally, it is important to notice that the creative process followed has allowed the teaching team to unify criteria and agree on results. This way, all members have felt involved in the project.

The Internet of Things (IoT) and Industrial Internet of Things (IIoT) trends, where high connectivity is envisioned, are giving rise to new applications, services, and paradigms, such as smart cities. Due to this connectivity and information sharing features, security, and privacy protection mechanisms need to be implemented, which may become obsolete at some future time. Software updates are, then, crucial. However, software updates requiring system shutdown and restarts might not be acceptable from the business and service point of view when high availability is demanded. In this paper, a mixed-criticality software architecture and design for a building energy management system, built upon the Cetratus runtime framework, is presented, where partitioning techniques are employed to ensure temporal and spatial isolation. Through this framework, software updates are dynamically accomplished, without the need for system shutdown and restarts. A live patching example is also presented, where customers privacy is enhanced by means of homomorphic encryption.

This paper presents a novel method to evaluate the maturity of projects and organizations in order to minimize the risks. It is assumed that the higher the project management maturity (PMM) level is, the higher the performance of projects is, but a high PMM level requires investment. So far, the maturity of the major stakeholders to ensure they have enough competence to perform successfully, project complexity and success have not been considered by maturity evaluation methods. in this paper we go a step forward and investigate the relationship between those elements. As a result of this research, we present a novel model to evaluate the maturity of the Client and the Contractor and the complexity of the projects.. We have applied our model in qualitative research studies and demonstrate that it is a concise and useful framework for companies that seek optimum maturity levels. Our method is useful when the trust among organizations is low, and it provides stronger position to organizations facing a business opportunity.

This paper presents a solution to increase bandwidth utilization and to reduce the time necessary to recover from network failures in multi-domain bandwidth on demand service provisioning. The proposed solution is based on software-defined networking (SDN) in order to implement novel traffic engineering (TE) techniques. In fact, most standards development organizations and researchers agree that the logically centralized control plane and high programmability of SDN can revolutionize TE with novel and powerful strategies. In this context, the dynamic path computation (DynPaC) framework, relies on the OpenFlow SDN protocol to provide resilient layer 2 services with bandwidth guarantees within OpenFlow domains. In order to make DynPaC support multi-domain service provisioning, it has been extended with an additional operational mode and REST API calls, making it fully compliant with the Network Services Interface-Connection Service protocol. In this way, DynPaC can behave as a network resource manager (NRM) in the network services framework. As a result, the presented solution is the first OpenFlow-enabled NRM with resiliency capabilities that implements novel TE strategies that enhance the utilization of network resources. In order to validate the proposal, it has been implemented using the ONOS network operating systems and several tests have been conducted using diverse service demand patterns. The obtained results show that DynPaC is suitable to be used as an NRM and that the number of accepted services increases thanks to the flow reallocation mechanism included in the framework, achieving in this way a better utilization of network resources.

Higher interconnectivity among devices, machines, the cloud and humans is envisioned in the actual trend of automation, also known as Industrial Internet of Things (IIoT). These industrial control systems, which may require high availability and/or safety related capabilities, are no longer isolated from the corporate environment or Internet. Software updates will be needed during the product life cycle, due to the long service life, the increasing number of security related vulnerabilities discovered on these industrial control systems and the high interconnectivity desired in IIoT. These updates aim at fixing all these security weaknesses, bugs and vulnerabilities that could appear, while the required safety integrity levels are ensured. Security-related concerns have just been addressed by the safety engineering community, because of the increasing number of cyber-attacks against safety-critical systems, such as Stuxnet. Moreover, system shut-downs caused by software updates could not be plausible when high availability is required. Typically, in order to perform the software update, the whole industrial process or the production is halted, so that the software upgrade is safely applied. However, this scenario might not be applied in critical infrastructures, such as nuclear or hydro- electrical power plants, where these production and service interruptions are not acceptable from the business and service point of view. This article presents an analysis of existing dynamic software updating techniques, which may be applied for safe and secure industrial control systems. These techniques aim at updating the running code, without the need of a halt and restart, increasing the availability of the industrial system.

Security is a key aspect in the development of innovative and valuable services based on Cyber-Physical Systems (CPSs). In the last years, the research area related to CPS security has received a significant attention, dealing with the design of different architectures, security protocols, and policy models. However, beyond monitoring data publishing behavior, CPSs are expected to offer some manageability-related services, and the proper fine-grained and flexible access control model remains challenging due to both criticality and feasibility. In fact, traditional security countermeasures cannot be applied directly to any sensor in CPS scenarios, because they are too resource-consuming and not optimized for resource-deprived devices. Different access control models facing both feasibility and enforcement tightness are arising as a way to solve the mentioned issues related to resource limitations, and this study provides a deep survey on them.

Software Defined Networking (SDN) is a new network paradigm that decouples the control from the data plane in order to provide a more structured approach to develop applications and services. In traditional networks the routing of flows is defined by masks and tends to be rather static. With SDN, the granularity of routing decisions can be downscaled to single TCP sessions, and can be performed dynamically within a single data stream. In this context We propose a novel approach – coined as micro flow aware routing – aimed at implementing routing of flows based on the properties of transport-level information, which is closely related to the type of application. Our proposed scheme relies on the early characterization of the flow based on statistical predictors, which are computed over a time window spanning the first exchanged packets over the session. We evaluate different window lengths over real traffic data to examine the Pareto trade-off between the earliness of flow characterization and its predictive accuracy. These results stimulate further research towards ensuring the practicality of the scheme.

Network monitoring is a paramount aspect for the detection of abnormal and malicious activity. However, this feature must go hand by hand with mitigation techniques. On SDN environments, control techniques may be easily developed as a result of its ability for programming the network. In this work, we take advantage of this fact to improve the network security using the sFlow monitoring tool along with the SDN controller. We present an architecture where sFlow is in charge of detecting network anomalies defined by user rules, while the SDN technology is responsible to mitigate the intrusion. Our testbed has been implemented on Mininet and the SDN environment is governed by Opendaylight controller and the OpenFlow southbound protocol. Experimental validation demonstrate that our system can effectively report various types of intrusion associated with the reconnaissance phase of an attack.