Biblio

Traffic classification is fundamental to network operators to manage the network better. L7 classification and Deep Packet Inspection (DPI) using regular expressions are vital components to provide application-aware traffic classification. Nevertheless, there are open challenges yet, such as programmability and performance combined with security. In this paper, we introduce eBPFlow, a fast application layer packet classifier in hardware. eBPFlow allows packet classification with DPI on packet headers and payloads in runtime. It enables programming of regular expressions (RegEx) and security protocols using eBPF (extended Berkeley Packet Filter). We built eBPFlow on NetFPGA SUME 40 Gbps and created several application classifiers. The tests were performed in a physical testbed. Our results show that eBPFlow supports packet classification on the application layer with line rate. It only consumes 22 W.

Ciphertext-policy attribute-based encryption (CP-ABE) is applied to many data service platforms to provides secure and fine-grained access control. In this paper, a new CP-ABE system based on the algebraic decision diagram (ADD) is presented. The new system makes full use of both the powerful description ability and the high calculating efficiency of ADD to improves the performance and efficiency of algorithms contained in CP-ABE. First, the new system supports both positive and negative attributes in the description of access polices. Second, the size of the secret key is constant and is not affected by the number of attributes. Third, time complexity of the key generation and decryption algorithms are O(1). Finally, this scheme allows visitors to have different access permissions to access shared data or file. At the same time, PV operation is introduced into CP-ABE framework for the first time to prevent resource conflicts caused by read and write operations on shared files. Compared with other schemes, the new scheme proposed in this paper performs better in function and efficiency.