Réseau privé virtuel | EPFL Graph Search

thumb|upright=1.8|Principe d'un VPN simple En informatique, un réseau privé virtuel (RPV) ou réseau virtuel privé (RVP), plus communément abrégé en VPN (de l'virtual private network), est un système permettant de créer un lien direct entre des ordinateurs distants, qui isole leurs échanges du reste du trafic se déroulant sur des réseaux de télécommunication publics. On utilise notamment ce terme dans le télétravail, ainsi que dans le cadre de l'informatique en nuage. Types Le VPN peut être de type point à point, utilisé entre un client et un concentrateur VPN (routeur spécialisé, pare-feu, ou logiciel sur ordinateur), sur Internet par le biais d'un logiciel de VPN. Dans une autre acception, le VPN peut exister sous la forme d'un réseau privé virtuel hermétique et distribué sur un nuage MPLS. Les ordinateurs sur ce VPN y sont souvent raccordés physiquement, la notion de « virtuel » se rapportant alors au fait que l'infrastructure MPLS fait circuler plusie

Object-oriented method and architecture for virtual private network service management

One of the major trends in the evolution of current corporate networking is an increasing need for high performance long distance communications. Provided as an alternative to leased lines networks, virtual private networks (VPNs) are gaining increasing acceptance among customers and network providers by providing corporate networking between geographically dispersed customer premises based on a shared public switched network infrastructure. As a contribution towards this evolution, the present thesis proposes a generic object-oriented architecture for open distributed VPN services integrating service and management issues all along the modeling process. The aim of this VPN architecture is not only to provide a descriptive model of VPNs but also to illustrate possible ways of operating on that model to solve VPN related service or management issues. The architecture proposed is generic in the sense that, firstly, it is network technology independent and, secondly, that it captures the fundamental characteristics common to all VPNs. This latter aspect is very important as, due to the lack of standardization in this area, current VPNs are more marketable products than well-defined telecommunications services. The notion of distribution is also very important as telecommunications systems in general, and VPNs in particular, are intrinsically distributed. Indeed, a VPN can be seen as a distributed application running on the multiple nodes of telecommunications networks. To effectively deal with this de facto distribution and to exploit at best the benefits it can provide the VPN service and management services have been conceived from the very beginning as distributed applications. For this purpose, and due to the lack of satisfactory existing solutions in this area, an object-oriented method for the specification and design of open distributed telecommunications and management services has been developed. The proposed method combines the ODP (Open Distributed Processing) concepts and stucturing rules with the systematic development process advocated by an object-oriented software engineering method called Fusion. This method provides an architectural framework and a seamless thread from problem definition to the realization of the distributed telecommunications system, based on hierarchically related abstraction levels. Mapping rules, guidelines and notations are proposed on how and when enterprise, information and computational models should be built, in particular based on models performed at a higher abstraction level. The method has then been applied to the specification of the generic VPN architecture itself. In the enterprise viewpoint the scope of the VPN service has been refined and limited to the provision, within the public domain boundary, of internetworking services between customer premises networks. The main actors involved in using, providing and managing the VPN service have been described as well as interactions between them. Based on their requirements, fundamental VPN characteristics have been identified, among which the notions of virtual resource and of closed user group are the most relevant. In the information viewpoint, a generic object-oriented network information model has been developed based on standard network resources. This model has been recursively applied to specify the object models pertaining to the different layers of the VPN architecture. Based on this architecture, a management service allowing customers to dynamically configure the logical connectivity of their VPN has been specified down to the network elements level. The realization of this functionality in terms of application components suitable for distribution and interactions between them has been the purpose of the computational viewpoint. Finally, the generic VPN architecture has been refined and applied to the particular context of ATM-based VPNs. In addition to describing how VPNs can be built on ATM networks this case study addresses a very important issue in such an environment, narnely bandwidth management. In this respect, an open distributed VPN bandwidth management service has been specified that allows VPN customers to dynamically modify the bandwidth allocated to the virtual path connections connecting the different sites of their organization. The final outcome of this specification process is the definition of a computational architecture for VPN bandwidth management extending from VPN level down to the physical network elements. This work has been carried out in the frame of the RACE (Research and Development in Advanced Communications Technologies in Europe) project R2041 PRISM (Pan-European Reference Configuration for IBC Services Management).

EPFL1996

Cooperative Data Exchange and Private Information Retrieval

Su Li

Coding techniques have been well studied and used for improving communication quality by combating noise and mitigating interference. Recently, it has been shown that the same coding techniques can also be exploited to further improve communication performance and provide specific communication features even when the communication channel is ideal. In this thesis, we study two problems where coding techniques are used for improving communications in distributed systems and protecting the privacy of the client from untrusted servers, respectively.\ The first part of this thesis studies the cooperative data exchange problem for fully connected networks. While many previous studies have shown that the problem can be solved by algorithms based on submodular function minimization, we tackle this problem via a concept we refer to as "conditioning basis", which is closely linked to linear coding schemes with particular additional properties. We show that such special linear coding schemes are optimal for the cooperative data exchange problem. Hence, by searching the existence of such a conditioning basis and special linear coding schemes, we can solve this problem with lower complexity. We propose a deterministic algorithm for this problem and briefly show how to construct the optimal linear coding schemes starting from a Vandermonde matrix. Moreover, we show that our new method can be used to solve two generalized problems, which are cooperative data exchange with weighted cost and successive local omniscience problems.\ The second part of this thesis investigates the problem of private information retrieval with side information. Specifically, three different extensions are studied: multi-message, multi-server, and multi-user, respectively. For each problem, we provide a proof of the converse for the download rate as well as propose efficient approaches to construct optimal coding schemes. For multi-message and multi-server cases, we give closed-form expressions for the download rates and introduce two useful tools, {\it conditioning answer string} and {\it virtual private information}, to analyze the problem. For multi-user cases, we show that the optimal download rate can be obtained by solving an optimization problem over all partitions of the total number of messages and propose a novel algorithm based on dynamic programming to solve the optimization problem.\

EPFL2020

Privacy and Dynamics of Social Networks

Pedram Pedarsani

Over the past decade, investigations in different fields have focused on studying and understanding real networks, ranging from biological to social to technological. These networks, called complex networks, exhibit common topological features, such as a heavy-tailed degree distribution and the small world effect. In this thesis we address two interesting aspects of complex, and more specifically, social networks: (1) users’ privacy, and the vulnerability of a network to user identification, and (2) dynamics, or the evolution of the network over time. For this purpose, we base our contributions on a central tool in the study of graphs and complex networks: graph sampling. We conjecture that each observed network can be treated as a sample from an underlying network. Using this, a sampling process can be viewed as a way to observe dynamic networks, and to model the similarity of two correlated graphs by assuming that the graphs are samples from an underlying generator graph. We take the thesis in two directions. For the first, we focus on the privacy problem in social networks. There have been hot debates on the extent to which the release of anonymized information to the public can leak personally identifiable information (PII). Recent works have shown methods that are able to infer true user identities, under certain conditions and by relying on side information. Our approach to this problem relies on the graph structure, where we investigate the feasibility of de-anonymizing an unlabeled social network by using the structural similarity to an auxiliary network. We propose a model where the two partially overlapping networks of interest are considered samples of an underlying graph. Using such a model, first, we propose a theoretical framework for the de-anonymization problem, we obtain minimal conditions under which de-anonymization is feasible, and we establish a threshold on the similarity of the two networks above which anonymity could be lost. Then, we propose a novel algorithm based on a Bayesian framework, which is capable of matching two graphs of thousands of nodes - with no side information other than network structures. Our method has several potential applications, e.g., inferring user identities in an anonymized network by using a similar public network, cross-referencing dictionaries of different languages, correlating data from different domains, etc. We also introduce a novel privacy-preserving mechanism for social recommender systems, where users can receive accurate recommendations while hiding their profiles from an untrusted recommender server. For the second direction of this work, we focus on models for network growth, more specifically where the number of edges grows faster than the number of nodes, a property known as densification. The densification phenomenon has been recently observed in various real networks, and we argue that it can be explained simply through the way we observe (sample) networks. We introduce a process of sampling the edges of a fixed graph, which results in the super-linear growth of edges versus nodes, and show that densification arises if and only if the graph has a power-law degree distribution.

EPFL2013