Currently, research community efforts are being carried out to develop new generation wireless mobile networks that provide broadband data communication in the high speed vehicular scenario. ITU-R (International Telecommunication Union, Radiocommunication Section) has proposed the IMT-Advanced (International Mobile Telecommunications) technical requirements for supporting such usage scenarios. IMT- Advanced identifies those mobile communication systems with capabilities which go further than those of IMT-2000. The IEEE 802.16 standard, supported under the WiMAX network, has evolved from a fixed scenario, in IEEE 802.16d, towards a mobile typical vehicular (up to 120 km/h) with IEEE 802.16e. In the near future, the IEEE 802.16m specification will cover the mobility classes and scenarios supported by the IMT-Advanced, including the high-speed vehicular scenario (up to 350 km or even up to 500 km/h). IEEE802.16 initial standards adopted DOCSIS (Data Over Cable Service Interface Specification) QoS (Quality of Service) mechanisms. Similarly, the IEEE802.16 MAC (Medium Access Control) Security Sublayer, responsible for providing security mechanisms such as privacy, authentication, and encryption over the air link, was also based on DOCSIS standard. However, DOCSIS is a wired based technology and QoS mechanisms in fixed wireless technologies, while sharing many details with QoS mechanisms for wired technologies, faces some extra limitations including: bandwidth limitations, longer end to end delays and higher packet losses due to channel-induced bit errors. Additionally, QoS mechanisms in mobile broadband wireless technologies represent a step further in complexity. The time variability and unpredictability of the channel become more acute and the main challenge arises from the need to hand over sessions from one cell to another as the user moves across their coverage boundaries. During this handover process, it is still necessary to provide session continuity and to offer the previously negotiated end-to-end QoS and security levels.

Neutral Access Networks (NAN) have appeared as a new model to overcome some restrictions and lack of flexibility that are present currently in broadband access networks. NAN brings new business opportunities by opening this market to new stakeholders. Although the NAN model is accepted, there are some technical issues that need to be resolved to facilitate wider NAN deployment. This paper proposes a new technical approach to neutral access networks, which is based on Carrier Ethernet technology. The proposal allows the user to independently select both the service provider and the network operator that will be used to deliver the service. To achieve this, a shared infrastructure is needed, which takes NAN as reference model. The main contributions of this proposal are the following: an Ethernet-based approach for neutral access networks; a mechanism for users to select which network operator is used to access each/target service provider; and an AAA (Authentication, Authorization and Accounting) infrastructure and access control policy profile to control service delivery over selected/requested NAN. Finally, a working prototype is described for validation of the proposal.

Systems based on the use of watermarking techniques are seen in recent times as the most interesting solutions to provide means of protecting Intellectual Property Rights in electronic commerce with digital contents environments. A key aspect of this secure e-commerce environment is security. It is important to be able to evaluate and to know the security level and the risks of die system providing these type of services, specially in open networks like Internet. 'Attack trees' technique has proved valid as a methodology for studying and analyzing the security of these distributed systems, and as a mean to compare the security level of similar schemes.

When there is a need to compare the characteristics of several similar global communications systems, security is often an important factor to consider in the comparison. However, in most situations it is difficult to deduce whether a system is more secure than other; and it is even more difficult to deduce how much more secure a system is compared to another. This paper presents a method based on the use of 'attack trees' for the analysis of the security level supported by communications systems. Specifically this paper presents the most relevant aspects of the application of this method to protocols for distributing digital contents with copyright protection; to compare the security level of different systems and to obtain quantitative information about the level of security supported by each protocol.

This paper presents FlowNAC, a Flow-based Network Access Control solution that allows to grant users the rights to access the network depending on the target service requested. Each service, defined univocally as a set of flows, can be independently requested and multiple services can be authorized simultaneously. Building this proposal over SDN principles has several benefits: SDN adds the appropriate granularity (fine- or coarse-grained) depending on the target scenario and flexibility to dynamically identify the services at data plane as a set of flows to enforce the adequate policy. FlowNAC uses a modified version of IEEE 802.1X (novel EAPoL-in-EAPoL encapsulation) to authenticate the users (without the need of a captive portal) and service level access control based on proactive deployment of flows (instead of reactive). Explicit service request avoids misidentifying the target service, as it could happen by analyzing the traffic (e.g. private services). The proposal is evaluated in a challenging scenario (concurrent authentication and authorization processes) with promising results.

The rise of cloud services poses considerable challenges on the control of both cloud and carrier network infrastructures. While traditional telecom network services rely on rather static processes (often involving manual steps), the wide adoption of mobile devices including tablets, smartphones and wearables introduce previously unseen dynamics in the creation, scaling and withdrawal of new services. These phenomena require optimal flexibility in the characterization of services, as well as on the control and orchestration of both carrier and cloud infrastructure. This paper proposes a unified programmability framework addressing: the unification of network and cloud resources, the integrated control and management of cloud and network, the description for programming networked/cloud services, and the provisioning processes of these services. In addition proofs-of-concept are provided based on existing opensource control software components.

Aware of the benefits that Software-Defined Networking (SDN) can entail for traffic engineered services, the pan-European National Research and Education Network (NREN) Géant has started to work on an SDN-based solution to provide Bandwidth on Demand (BoD) services. The proposed solution relies on a framework called DynPaC, which is able to provide resilient L2 services taking into account bandwidth and VLAN utilization constraints. DynPaC has been extended to be compliant with the Network Services Interface-Connection Service (NSICS) protocol, which makes the SDN-based BoD solution multidomain capable. The demo described in this paper demonstrates the establishment of multi-domain BoD services across OpenFlow and non-OpenFlow domains, how the traffic is limited at the networking devices to enforce the QoS constraints, also selecting the optimal intra-domain paths during the process, and how the traffic is re-routed to alternative pre-computed paths in case of link-failure, always without disrupting the service provisioning.

One of the key research issues in further strengthening the role of railways in the transportation system is to achieve the highest possible level of cyber security against significant threats to the signaling and telecom systems. The European Rail Traffic Management System (ERTMS) was designed in the 1990s with the security measures and strategies available at the time. However, ERTMS' underlying communication technology, GSM-R, needs replacing, and replacement strategies are already underway. Due to their direct effects on safety, ERTMS security mechanisms also need updating to face current security threats. This article provides a security analysis of ERTMS' safety layer, Euroradio, in terms of current security threats. After identifying its vulnerabilities, we present four main recommendations: a more robust cryptographic mechanism, a new key distribution scheme, a new key storage and system integrity module, and a set of countermeasures for avoiding radio jamming attacks.

With the development of the 6LoWPAN standard, sensors can be natively integrated into the IP world, becoming tiny information providers that are directly addressable by any Internet-connected party. To protect the information gathered by sensors from any potential attacker on the Internet, it is essential to have trustworthy real-time information about the legitimacy of every attempt to interact with a sensor. Our approach to address this issue is Ladon, a new security protocol specifically tailored to the characteristics of low capacity devices. In this paper, we study the performance of Ladon, showing that it successfully meets the requirements of the targeted environments. To that end, we evaluate the delay and energy consumption of the execution of Ladon. The obtained results show that the cost of Ladon is bounded, even in situations of high packet loss rates (20–80%) and comparable to that of other protocols that implement fewer security features.