NETWORK quality of service (QoS) and network security

Transcription

1 1138 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 9, SEPTEMBER 2008 Security and QoS Self-Optimization in Mobile Ad Hoc Networks ZhengMing Shen and Johnson P. Thomas, Member, IEEE Abstract Network quality of service (QoS) and network security have been considered as separate entities and research in these areas have largely proceeded independently. However, security impacts overall QoS and it is therefore essential to consider both security and QoS together when designing protocols for ad hoc environments as one impacts the other. In this paper, we propose a mechanism for a distributed dynamic management system which aims to maximize QoS and/or security while maintaining a minimum user acceptable level of QoS and/or security even as network resource availability changes. In order to achieve this objective, we propose three basic frameworks: a policy-based plug-in security framework, multilayer QoS guided routing, and a proportional, integral, derivative (PID) controller. Simulation results indicate the proposed PID optimized security and the QoS algorithm produces similar performance to nonsecure QoS routing protocols under various traffic loads. Index Terms Mobile computing, algorithm/protocol design and analysis, network-level security and protection. Ç 1 INTRODUCTION NETWORK quality of service (QoS) and network security have been considered as separate entities and research in these areas have largely proceeded independently with few exceptions. However, security impacts the overall network QoS as more security usually means more message overheads for authentication and other security functions, as well as additional delays imposed due to overheads caused by encryption, etc. This is especially true in an ad hoc network environment where security mechanisms such as authentication services are proposed to protect the communication on open mediums in wireless networks, thus introducing overheads that affect the QoS of communications significantly. It is therefore essential to consider both security and QoS together when designing protocols for ad hoc environments as one impacts the other. Very little work has been done on the interaction between security and QoS in networks. What little has been done is limited to wireless networks. Liang et al. [1], [2], [3], [4] study the impact of challenge/response authentication in wireless LANs. In [1], the emphasis is on a framework to model the effect of authentication on security and QoS in one-hop wireless networks. In [2] and [3], the authors investigate the impact of security levels, mobility, and traffic patterns on overall system performance in terms of authentication cost, delay, and call dropping probability. Wang et al. [4] introduce an authentication scheme for interdomain roaming for 3G/WLAN systems. The emphasis here is on an authentication architecture and a new authentication scheme.. Z. Shen is with Electronic Data System, Inc., 2304 Masonwood Way, Round Rock, TX zmshen@gmail.com.. J.P. Thomas is with the Department of Computer Science, Oklahoma State University, 700 N. Greenwood Ave., Tulsa, OK jpt@cs.okstate.edu. Manuscript received 21 July 2006; revised 22 May 2007; accepted 26 June 2007; published online 4 Sept For information on obtaining reprints of this article, please send to: tmc@computer.org, and reference IEEECS Log Number TMC Digital Object Identifier no /TMC Although the above research provided an analysis of the performance degradation caused by authentication and proposed an authentication scheme for interdomain roaming for 3G/WLAN systems, none of them propose an optimized solution between security and QoS. In other words, given the network resources and traffic, can an optimum QoS and security be achieved? This calls for a distributed dynamic management system that aims to maximize QoS and security while maintaining a minimum user acceptable level of QoS and security even as network resource availability changes. In all the previous work, the security feature (authentication specifically) is fixed and is permanent. No solution has been provided when changing available network resources due to traffic, mobility, etc., which results in security features producing too much overhead such that it significantly impacts routing QoS performance. Furthermore, security is not limited to authentication. Other security features such as access rights, for example, have not been considered. A mechanism to dynamically manage security and QoS such that minimum user requirements are met is needed. Although a user may specify minimum security and/or QoS requirements, the system should aim to provide the maximum security and/or QoS possible with the resources available. Although the user may have specified a minimum requirement, the unpredictability of an attack in terms of its time, point of attack, and maliciousness suggests that the maximum security possible should be implemented in the network. This is particularly needed in a mobile ad hoc environment where there are no central or other significant points that can be monitored and the medium is open. A QoS that is more than the minimum specified is always desirable from a user perspective. In this paper, we propose a distributed, on-demand security and QoS optimization architecture for a mobile ad hoc network which can automatically adapt the network security level along with changes in network topology, traffic conditions, and link QoS requirements to keep the security and QoS within the minimum requirements while aiming to provide more than the minimum security and QoS. In order to achieve this /08/$25.00 ß 2008 IEEE Published by the IEEE CS, CASS, ComSoc, IES, & SPS

2 SHEN AND THOMAS: SECURITY AND QOS SELF-OPTIMIZATION IN MOBILE AD HOC NETWORKS 1139 TABLE 1 Effect of Controllers Fig. 1. PID control. objective, we propose three basic frameworks: a policybased plug-in security framework, multilayer QoS guided routing, and a proportional, integral, derivative (PID) controller. The plug-in security framework provides a dynamic security policy management system, and the multilayer QoS-guided routing mechanism is an adaptable QoS routing mechanism for ad hoc networks to ensure QoS even as network resources change. Based on the plug-in security framework and the multilayer QoS-guided routing mechanism, the proposed network security and QoS optimization algorithm uses PID feedback control to constantly monitor and adjust the network security policy to ensure that the network satisfies all existing QoS requirements while making the network the most secure possible. When network topology changes or traffic loads become heavier, causing QoS to be degraded to an unacceptable level below the required level, the algorithm will selectively remove some security policy to reduce overhead until the QoS requirements can be satisfied. If a link in the path breaks, the multilayer QoS-guided routing mechanism is activated to realize a path with the desired QoS. Hence, in the proposed approach, if the QoS is below the user-specified level and the security level is above the minimum level, the security level is decreased to reduce the associated overheads. Alternatively, if more available resources are available due to reduced traffic, the security level can be increased through the plug-in security framework. The proposed approach is equally applicable to a system where the priority is security. Here, the QoS can be varied such that the required security is maintained. This approach is also appropriate to a system where both security and QoS are of importance based on some weightage mechanism. 2 FEEDBACK CONTROL THEORY We use the PID control theory to achieve security and QoS optimization. A typical feedback control system is shown in Fig. 1, where. Plant: A system to be controlled.. Controller: Provides the excitation for the plant; designed to control the overall system behavior. The transfer function of the PID controller is defined as follows [5]: K p þ K I s þ K Ds ¼ K Ds 2 þ K p s þ K I ; ð1þ s where K p ¼ Proportional gain, K I ¼ Integral gain, and K D ¼ Derivative gain. The variable (e) represents the tracking error, (R) the difference between the desired input value, and (Y) the actual output. This error signal (e) will be sent to the PID controller, and the controller computes both the derivative and the integral of this error signal. The signal (u) past the controller is now equal to the proportional gain ðk p Þ times the magnitude of the error plus the integral gain ðk I Þ times the integral of the error plus the derivative gain ðk D Þ times the derivative of the error: Z de u ¼ K p e þ K I edt þ K D dt : ð2þ This signal (u) will be sent to the plant and the new output (Y) will be obtained. This new output (Y) will be sent back to the sensor again to find the new error signal (e). The controller takes this new error signal and computes its derivative and its integral again. This process is repeated. A proportional controller ðk p Þ will have the effect of reducing the rise time and will reduce, but never eliminate, the steady-state error. An integral control ðk I Þ will have the effect of eliminating the steady-state error, but it may make the transient response worse. A derivative control ðk D Þ will have the effect of increasing the stability of the system, reducing the overshoot, and improving the transient response. The effects of each of the controllers K p, K I, and K D on a closed-loop system are summarized in Table 1. Note that these correlations may not be exactly accurate, because K p, K I, and K D are dependent of each other. In fact, changing one of these variables can change the effect of the other two. For this reason, the table should only be used as a reference when determining the values for K p, K I, and K D. For example, if a modeling equation of this system is M x þ b _x þ kx ¼ F; ð3þ taking the Laplace transform of the modeling equation Ms 2 XðsÞþbsXðsÞþkXðsÞ ¼F ðsþ; ð4þ the transfer function between the displacement XðsÞ and the input FðsÞ then becomes XðsÞ FðsÞ ¼ 1 Ms 2 þ bs þ k : 2.1 Proportional Control From the table shown above, we see that the proportional controller ðk p Þ reduces the rise time, increases the overshoot, and reduces the steady-state error. The closed-loop transfer function of the above system with a proportional controller is XðsÞ F ðsþ ¼ K p s 2 þ 10s þð20 þ K p Þ : ð5þ ð6þ

3 1140 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 9, SEPTEMBER 2008 Fig. 2. Steady-state graph. Fig. 2 shows that the derivative controller reduced both the overshoot and the settling time and had a small effect on the rise time and the steady-state error. 2.2 Proportional-Integral (PI) Control From the table, we see that an integral controller ðk I Þ decreases the rise time, increases both the overshoot and the settling time, and eliminates the steady-state error. For the given system, the closed-loop transfer function with a PI control is XðsÞ FðsÞ ¼ K p s þ K I : s 3 þ 10s 2 þð20 þ K p Þs þ K I The proportional gain ðk p Þ is reduced because the integral controller also reduces the rise time and increases the overshoot as the proportional controller does (double effect). Fig. 3 shows that the integral controller eliminates the steady-state error. 2.3 Proportional, Integral, Derivative Control Fig. 4 shows the system with a PID controller has no overshoot, fast rise time, and no steady-state error. The closed-loop transfer function of the given system with a PID controller is XðsÞ F ðsþ ¼ K D s 2 þ K p s þ K I : s 3 þð10 þ K D Þs 2 þð20 þ K p Þs þ K I ð7þ ð8þ Fig. 4. System with PID controller. 3 SECURITY AND QOS FEEDBACK CONTROL LOOP We use the PID feedback control loop to manage network security and QoS self-optimization. Fig. 5 shows the distributed optimization architecture present at each node in the network. Each application has one of three QoS requirements as input: Guaranteed, Controlled load, or Best effort. In the network, the QoS plant is a module of the routing protocol to handle the QoS request. Security policies are considered as another input to the network; all the security policies are implemented by the security plant, which is another module of the routing protocol. The QoS plant is responsible for creating new paths as well as managing the state information of any existing path and the state information of each node. It outputs the QoS path state information to the PID controller. The security plant is responsible for managing, adding, and removing security policies. Network security is controlled by a policy-based security management. The network security level can be adapted by the security plant module by adding or removing security policies at runtime. The security plant outputs the security policy state information to the PID controller. The PID controller module takes the network resource usage metrics (path latency, path throughput, and path stability), the state information of the node (buffer space available, for example), and the security policy state information as system output feedback to calculate the adjustments, which will be fed into the QoS plant and security plant to achieve optimization. This PID control loop will therefore constantly keep the network in the optimized state, that is, maximize the network resource usage to satisfy QoS requests and make the network as secure as possible. The PID controller at each node collects two levels of state information, the node s local state and the global path Fig. 3. Elimination of steady-state error. Fig. 5. Optimization architecture.

4 SHEN AND THOMAS: SECURITY AND QOS SELF-OPTIMIZATION IN MOBILE AD HOC NETWORKS 1141 state or state of each path. The global information is needed so that, if the security is upgraded, the other paths are not adversely affected. The node local state data include node buffer size, node throughput, and node stability lever. The path state data include path latency and path throughput. The state data is used to calculate network resource availability. If the network resource is sufficient to accommodate more security policies, the PID Controller will choose additional unimplemented security policies and apply them to the network. Alternatively, if the QoS requirement is not being satisfied due to security overheads, the security plant is activated to drop a policy based on the priority of the policy (low priority policies get dropped first). If a link in the route is broken due to mobility for example, the QoS plant is invoked to create a new path that satisfies QoS requirements. Hence, the algorithm will keep all existing paths satisfying the QoS requirements while making the network as secure as possible. This results in a distributed adaptable architecture for ensuring security and QoS. 4 MEASURING NETWORK RESOURCE AVAILABILITY We first describe the QoS plant. QoS routing in an ad hoc network is difficult because the network topology changes constantly, and the available state information for routing is inherently imprecise. In this paper, we propose a holistic multilayer QoS surface-guided routing which separates metrics at the different layers. In our model, each layer manages its own QoS and communicates with other layers through its QoS interface. Network layer metrics determine the quality of links in order to generate the paths with good quality. On the other hand, application layer metrics select exactly one path out of the paths that are most likely to meet the application requirements. Our model considers not only the QoS requirement, but also the cost optimality of the routing path to improve the overall network performance. The goal of QoS routing is twofold: 1) Selecting a network path that has sufficient resources to meet the QoS requirements of all admitted connections and 2) achieving global efficiency in resource utilization. QoS routing in ad hoc networks has received a lot of attention recently and a good review of QoS routing for ad hoc networks is given in [6]. In general, QoS routing can be classified into two basic paradigms: source QoS routing and hop-by-hop QoS routing [6]. With source routing, the source node of a communication request locally computes the entire constrained path to the intended destination with the global state information that it locally maintains. Gathering and maintaining global state information can introduce an excessive protocol overhead in dynamic networks. Moreover, the calculation of constraint(s)-based routes would be computationally intensive. In [7], a predictive location-based QoS routing protocol, each node broadcasts its node status (position, velocity, and available resources) across the network periodically. The Core- Extraction Distributed Ad Hoc Routing (CEDAR) algorithm [8] selects routes with sufficient bandwidth resources. The state information of high-bandwidth links is incrementally propagated. To implement hop-by-hop routing, there are three routing strategies: shortest path routing, flooding, and multiple paths routing. The shortest path routing strategy simply returns the shortest path if this path meets the QoS requirement(s) of an arriving request, or otherwise rejects the request [9]. Flooding works by flooding a route searching message across the entire network to search for a QoS route on demand. Intermediate nodes forward route searching messages that they receive, provided that the given QoS requirement(s) has not been violated yet [10]. Multiple path routing works by searching multiple paths in parallel for a QoS path [11]. Zhang and Mouftah [12] designed an alternate QoS routing mechanism that works by searching for alternate QoS-satisfied paths if the shortest path is not qualified to accommodate a request with a specific QoS requirement(s). The On-Demand Delay-Constrained Unicast Routing Protocol (ODRP) [6] employs hybrid routing that works to first probe the feasibility of the min-hop path connecting the source-destination pair of an arriving QoS request. This path is returned if feasible; otherwise, a destination-initiated route searching process via restricted flooding is enforced. In [20], an on-demand bandwidth reservation QoS routing protocol for multihop MANETs guides the destination to choose the route that is most likely to satisfy the QoS requirement and reserves the proper time slot. There are two main problems in dealing with QoS routing: First, the dynamic nature of an ad hoc network makes the available state information inherently imprecise. Second, nodes may join, leave, and rejoin an ad hoc network at any time and any location; existing links may disappear and new links may be formed as the nodes move. This raises new problems of maintaining and dynamically reestablishing the routing paths in the course of data transmission. Though some recent algorithms [15], [16] were proposed to work with imprecise information (for example, the probability distribution of link delay), they require precise information about the network topology, which is not available in an ad hoc network. The above approaches focus on a single layer, and we propose an approach that defines an extra QoS interface for each layer to provide a better handshake. The proposed holistic approach is novel as it considers the different factors that contribute to QoS at the different layers in contrast to current QoS routing protocols, which work primarily on ensuring that the QoS requirements are satisfied at a specific level. Furthermore, rather than designing new QoS architectures from scratch, which is expensive and impractical, our objective is to improve on existing models. 4.1 Multilayer QoS Interface Guided Routing We propose a multilayer QoS interface guided routing, which separates metrics at the different layers: Medium Access Control (MAC) layer metrics, network layer metrics, and application layer metrics. In our model, each layer manages its own QoS and communicates with other layers through its QoS interface. At the application layer, we propose to classify the QoS requirements into a set of three QoS priority levels with their corresponding application layer metrics. Level I guaranteed service corresponds to applications that have strong delay constraints such as voice. Level II controlled load service is suitable for

5 1142 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 9, SEPTEMBER 2008 applications requiring high throughput such as video broadcasting applications. Level III best effort service has no specific constraints. At the network layer, we recommend using nodes hop count state, buffer state, and stability state to characterize the quality of network, and we call them network layer metrics. The hop count represents the number of hops required for a packet to reach its destination. The buffer state stands for the available unallocated buffer. Stability means the connectivity variance of a node with respect to its neighboring nodes over time. In our algorithm, we use the metric of each node in one specific route to calculate the path quality. At the MAC layer, the MAC layer metric is the quality of a link as specified by the line signal to interference plus noise ratio (SINR). SINR has been recently receiving attention as a primary MAC layer metric [17], [18] for routing, scheduling, topology control, and power control. In [19], the authors argue that protocol design should move beyond the current graph-based models to SINR-based protocols. Link SINR determines the communication performance of the link: The data rate and associated probability of packet error rate or bit error rate (BER) that can be supported by the link. Links with low SINR are not typically used due to their poor performance, leading to partial connectivity among all nodes in the network. Moreover, it is essential to minimize the volume of traffic being transmitted over the wireless interface because of the lack of wireless resources. This can be achieved via our interface mapping algorithm. In each layer, the layer-specific QoS interface accepts requirements from the higher layer and translates them into layer metrics. For example, the network layer QoS interface accepts throughput service requirements from the application layer and translates them into network layer metrics such as buffer, power, and stability requirements. For QoS, each node maintains two levels of state information, the node s local state data and the state data of the path that originated from the node. The node local state data includes the node buffer size, node throughput, and node stability lever. The path state data includes path latency and path throughput. The state information is fed back to the PID controller (Fig. 5). Therefore, for any existing path, based on path link state information, it is known how much resource is already being used and how much resource is still available. If a new path has to be created, some of the nodes may already be used for other paths. Since each node knows how much buffer size has been taken to support other paths, how much is available can be determined. We utilize the QoS interface metrics defined above to guide the routing process, which includes the following:. Path generation. This generates paths according to the assembled and distributed state information of the network and application.. Path selection. This selects appropriate paths based on the network and application state information.. Data forwarding. This forwards user traffic along the selected path. Path generation is a process in which the quality of a path to route the data traffic is computed using the quality of individual nodes in the path. The quality should not only reflect the available resources that reside in the wireless Fig. 6. Multilayer QoS interface guided routing. medium and in each node, but also the stability of these resources. With the knowledge of the quality of paths, an application selects the most suitable path according to the desired QoS level (guaranteed service, throughput service, and best effort service). In order to be able to compute these metrics, a reasonable combination of network layer metrics are mapped into the application layer metrics, which we define as a QoS interface. Fig. 6 shows the mapping between QoS layers. In order to keep the routing overhead low and support fast routing decisions in QoS routing, we associate a state to the available network resources. In the path generation phase, the nodes use the state information to generate paths according to the available network resources. Then, in the path selection phase, this state is used in conjunction with the desired QoS level to select the most suitable path according to the application requirements. The model differentiates services and provides soft guarantees to network resources for an admitted application by using class-based weighted fair queuing (CB-WFQ) at intermediate nodes. 4.2 Path Generation QoS support in ad hoc networks depends not only on the available network resources, but also on the nodes mobility rate. Mobility may result in link failure, which in turn results in a broken path. Furthermore, we measure the quality of network and use it in the path generation process. The main objective of the network layer metric is to provide a trade-off between load balancing and resource conservation. We use the three network layer metrics

6 SHEN AND THOMAS: SECURITY AND QOS SELF-OPTIMIZATION IN MOBILE AD HOC NETWORKS 1143 defined earlier: buffer level, hop count, and stability level. A node broadcasts its network layer metrics to its neighbors, indicating its presence and its QoS state. Note that the hop count metric is related to resource conservation since a path with fewer hops is preferable. The buffer level metric is related to load balancing. If the buffer level of a node is low, it implies that a large number of packets are queued up for forwarding, which implies that a packet routed through this node would have to experience high queuing delays. We use high, medium, and low QoS states to represent the buffer level. A high QoS state indicates that the corresponding node has few or no packets queued up for forwarding. Since there is a delay between the broadcast of this metric and its use, the instantaneous buffer level may be misleading. Hence, a node should maintain the average buffer level. The exponentially weighted moving average (EWMA) may be used. The Stability level metric is used to avoid unstable nodes to relay packets. We calculate the stability S of a node n as SðnÞ ¼ jn t i \ N tiþ1 j jn ti [ N tiþ1 j ; ð9þ where N ti and N tiþ1 represent the nodes as neighbors of n at time t i and t iþ1, respectively. A node is unstable if a large number of its neighbors change. On the other hand, if most of the neighbors remain the same at the two times t i and t iþ1, then we call this node stable. A node has high stability if none of its neighbors change ðn ti ¼ N tiþ1 Þ; in this case, we have SðnÞ ¼1. A node is unstable if all its neighbors change ðn ti \ N tiþ1 ¼ Þ; in this case, we have SðnÞ ¼0. We define a node stability level: LOW 0 <¼ SðnÞ <;MEDIUM <¼ S(n) <; HIGH <¼SðnÞ <¼ 1; where 0 <<<1: In the path generation phase, network layer metrics are propagated through the nodes of the generated path. Suppose P is a path between source node s and destination node d, in which P is a sequence of nodes, P ¼fs; n 1 ;n 2 ;...;n i ;dg. The value of the metrics of P are where P:hop ¼ X 1; ð10þ n2p P:buffer ¼ min n2p ðn:bufferþ; P:stability ¼ min n2p ðn:stabilityþ; ð11þ ð12þ. P:hop is the path hop count;. P:buffer is the path unallocated (free) buffer size;. P:stability is the path stability level;. n:buffer is the node unallocated (free) buffer size; and. n:stability is the node stability level (9). The buffer level of P is represented by the node with the least buffer in P. This is appropriate for the route generation process, since a route is rendered broken even if one intermediate node has no buffer. Similarly, the TABLE 2 QoS Metrics Mapping Table stability level of P can also be calculated by the node with the least stability on P. The buffer level of P can also be calculated as the average over the buffer levels of the all the nodes in P : P:buffer ¼ X! n:buffer =P :hop: ð13þ n2p At the MAC layer, the quality of network is identified by the SINR (Section 4.1). As mentioned earlier, link SINR determines the communication performance of the link. In other words, the path SINR is defined by the node with the lowest SINR. Our algorithm will be greedy in that the information will be transmitted to the node that has the highest SINR, which means that no matter what the network layer QoS requirements are, the algorithm will always try to choose the highest SINR nodes available to generate the path unless the node buffer is full. On the other hand, as soon as one node buffer reaches full condition, the algorithm will suggest that the lower QoS level path use the lower SINR node to protect the high QoS level path and perform load balancing. 4.3 Path Selection In order to incorporate application requirements in the path selection process, they need to be translated into QoS metrics that specify the application QoS constraints. Thus, a combination of network layer metrics is mapped into each QoS metric. Furthermore, the MAC layer metrics are mapped into each network metric, that is, the mapping defines the relationship between the MAC layer metric SINR and the network layer metrics that are buffer, hop count, and stability. If guaranteed service is required, the network layer QoS interface will translate this requirement into the network QoS metric, which should select a path that has minimum delay based on the average buffer level and hop count. If the controlled load service is required, the network QoS interface needs to pick the highest buffer size path in this case to meet the application layer QoS requirements. Best effort service has no specific constraints. The network QoS interface will select the most stable path when the network mobility is high and the shortest path when the network mobility is low. Table 2 shows the mapping between each layer QoS metric. Guaranteed service defines the maximum latency required by the application. The total latency is experienced by a packet to traverse the network from the source to the destination. At the network layer, the end-to-end packet latency is the sum of processing delay, transmission delay, queuing delay, and propagation delay. Queuing delay contributes most significantly to the total latency, and all

7 1144 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 9, SEPTEMBER 2008 other delays are negligible. Therefore, the packet latency is calculated as P:latency ¼ X n2p½ðn:buffersize n:bufferþ=n:throughputš; where ð14þ. P:latency is the path latency,. n:buffersize is the node total buffer size,. n:buffer is the node unallocated (free) buffer size, and. n:throughput is the node throughput. ðn:buffersize n:bufferþ denotes the node buffer occupancy. Latency can also be represented as where P :latency ¼ P:hop ðp:buffersize P:bufferÞ ; ð15þ P :throughput. P:hop is the path hop count,. P:bufferSize is the path total buffer size,. P:buffer is the path unallocated (free) buffer size, and. P:throughput is the path throughput. ðp:buffersize P:bufferÞ denotes the path buffer occupancy. Controlled load service defines the minimum throughput required by the application. The throughput is defined as the rate at which packets are transmitted in the network. The throughput for an end-to-end connection can be estimated as P :throughput ¼ ¼ MINðn:throughputÞ P ðn:buffersize n:bufferþ n2p MINðn:throughputÞ P :hop ðp:buffersize P:bufferÞ : ð16þ The path throughput is determined by the minimum node throughput in the path divided by the total buffer used within the whole path. Therefore, the higher the throughput through the bottleneck node and the less the buffer used in the path, the higher the path throughput is. On the other hand, the lower the throughput through the bottleneck node and the more the buffer used in the path, the lower the path throughput is. Best effort service provides no service guarantees for the applications. It compromises between the most stable path in a high-mobility case and the shortest path in a lowmobility path case. In our model, it uses P :stability to determine which path to choose. 4.4 State Information Since our objective is to develop existing approaches, we build on AODV. In AODV, when a node needs a connection, it broadcasts a request and a number of possible routes are returned to it. The requesting node then begins using the route that has the least number of hops through other nodes. Our protocol adds the state information on top of the information returned by AODV. The state information of each node (buffer size, stability level, and SINR) is required to calculate the path QoS parameters. During the path generation phase, the nodes not only pass the request/acknowledge messages that are required to find a path, but also pass the additional state information along the path as well. The state information is received by the node requesting the path. After the state information has been collected, the requesting node will calculate the path s global state information (path buffer size and path stability level) and QoS parameters (path latency and path throughput). 4.5 QoS Interface A QoS interface translates high-layer QoS metrics to lower layer metrics. For instance, the QoS interface between the application layer and network layer (AN Interface) will translate guaranteed service requirements into the network layer buffer level and hop count requirements. For guaranteed service, the AN interface translates the QoS requirements to the maximum path latency and passes to the network layer as application layer QoS requirements. During the path selection process, a network layer will choose the qualified path by using the calculations defined in the last section and using the network layer metrics as an input parameter. For controlled load service, the AN interface translates the QoS requirements to the minimum path throughput and pass to the network layer as application layer QoS requirements. A network layer will choose the qualified path by calculating the path buffer level and hop count. For best effort service, the AN interface compromises between the most stable path in the high-mobility case and the shortest path in the low-mobility path case. In the former case, it applies a stability metric to establish the most stable path from the source to the destination in order to improve delay performance due to path failure caused by the node mobility. In the latter case, it uses the hop count metric in order to minimize network resource utilization since the more hops a flow traverses, the more resources it consumes. Our NM interface uses the greedy method to ensure that the information will be transmitted to the node that has the highest SINR, which means that no matter what the network layer QoS requirements are, the algorithm always tries to choose the highest SINR nodes available to generate the path unless the node buffer is full. On the other hand, as soon as one node buffer reaches full condition, the algorithm will suggest the lower QoS level path with the lower SINR node to maintain the required QoS level path and perform load balancing. 4.6 Performance Analysis The performance of the proposed QoS routing protocol is studied with simulations based on ns-2 [13], which supports the simulation of multihop wireless networks complete with physical, data link, and MAC layer models. The Evolutionary-TDMA scheduling protocol (E-TDMA) [14] is used at the MAC layer. It is a distributed protocol that dynamically generates and updates TDMA transmission schedules among the nodes. Our multilayer QoS interface guided routing protocol is implemented based on existing QoS-AODV and AODV

8 SHEN AND THOMAS: SECURITY AND QOS SELF-OPTIMIZATION IN MOBILE AD HOC NETWORKS 1145 Fig. 7. Throughput for v ¼ 5m=s. protocols in ns-2. By expanding the aodv.cc module in ns-2, we add four more parameters to this module: node SINR, node buffer, node stability, and path hop count (see above). For our simulations, both AODV and QoS-AODV protocols maintain a send buffer of 64 packets. To prevent buffering packets indefinitely, packets are dropped if they wait in the send buffer for more than 30 seconds. All packets sent by the routing layer are queued at the interface queue until the MAC layer can transmit them. The interface queue has a maximum size of 50 packets and is maintained as a priority queue with three priorities each served in FIFO order. Routing packets get higher priority than security packets, and security packets get higher priority than data packets. Traffic sources are continuous bit-rate (CBR). A network will carry all kinds of traffic guaranteed, controlled load, and best effort. For our simulations, we assumed that there were 10 communications in the network. Each one was randomly assigned a class (guaranteed, controlled load, or best effort). The source-destination pairs are spread randomly over the network. Data packets that are of 512 byte sizes were used. The number of source-destination pairs and the packet sending rate in each pair is varied to change the offered load in the network. The mobility model uses the random waypoint model in a rectangular field. We use a 1,500 m 300 m field with 50 nodes with a randomly chosen speed (uniformly distributed between 0-20 m/s). The simulation period is 900 seconds. Each data point represents an average of 10 runs with identical traffic models but different randomly generated mobility scenarios. Identical mobility and traffic scenarios are used across protocols. State information is obtained only when a new route is requested using AODV. Our approach is well suited to ad hoc networks and the higher the mobility, the better the proposed approach performs Simulation Results The multilayer QoS AODV routing protocol (mqos AODV) is compared with the QoS AODV and AODV protocols. Figs. 7 and 8 show the packet throughput and the average packet delay under different traffic loads at low mobility. Under light traffic, packet throughput and packet delay are very close for all three protocols because they often use the same routes. Fig. 8. Average packet delay for v ¼ 5m=s. The advantage of QoS routing protocols become apparent when traffic gets heavy. With the AODV protocol, a node has one active route to a destination and uses it for all the packets to the destination. As the network traffic becomes heavy, this route becomes heavily loaded, causing packets to be delayed and dropped. The average packet delay increases significantly under heavy traffic. On the other hand, the QoS routing protocols try to find and use routes satisfying bandwidth constraints for different flows, even between the same pair of source and destination. Two QoS routes may share the same path, but the protocol will ensure that enough bandwidth is reserved on this path to accommodate both flows. The traffic load is more balanced this way. The average packet delay increases with offered load slowly with the QoS routing protocols. There is not much difference between two QoS protocols in low mobility. Fig. 9 shows that when mobility increases, the throughputs of all protocols drop. Mobility affects network throughput at both the MAC layer and the routing layer. At the MAC layer, it takes time for E-TDMA to resolve the collisions caused by node movement and to reserve new slots. Essentially, a protocol like E-TDMA that is based on establishing a reservation has only limited capability to Fig. 9. Throughput for v ¼ 10 m=s.

9 1146 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 9, SEPTEMBER 2008 TABLE 3 QoS Interfaces Mapping Table Fig. 10. Average packet delay for v ¼ 10 m=s. handle network mobility. At the network layer, it takes time for the routing protocol to reestablish a route when it breaks. For the QoS routing protocols, the packet throughput drops roughly by 15 percent at v ¼ 10 m=s compared with v ¼ 5 m=s. As can be seen, our protocol performs better than the QoS AODV at high loads and at high speeds and better than AODV under all conditions (except very low loads when the performances are very similar). Fig. 10 shows that mobility also increases the average packet delay. The average packet delay increase roughly 50 percent at v ¼ 10 m=s compared with v ¼ 5m=s. When we compare the three routing protocols under mobility, the advantage of QoS routing protocols increases. Because the QoS routing protocols use different QoS routes for individual flows, when one of the QoS routes breaks, only this QoS route is repaired. Others are not affected. Packets of the flow on the broken route are temporarily forwarded using the best-effort route, which may coincide with one of the other QoS routes. There is more route redundancy with QoS routing (at the cost of increased routing table size). In the AODV protocol, when the only route to a destination breaks, all packets addressed to this destination are delayed or dropped. Here, our protocol performs better than the QoS AODV at high loads and at high speeds and better than AODV under all conditions (except very low loads when the performances are very similar). Our multilayer QoS routing protocol performs better than a traditional QoS routing protocol during high mobility and high load since it is always looking for a more reliable path during the path selection phase. The trade-off is that each node requires more memory to store path quality data. 5 MEASURING NETWORK RESOURCE AVAILABILITY Fig. 4 (Section 2.3) shows the system with a PID controller that has no overshoot, fast rise time, and no steady-state error. The displacement (value 1) is the required value by the application. The PID gives the target value that is the curve shown in Fig. 4. We use the application layer and network layer QoS metric parameter mapping to determine network resource availability. This mapping is shown in Table 3. For guaranteed service, application-network layer metric mapping translates the QoS requirements to the maximum path latency. If actual path latency is less than the guaranteed service target path latency, this path has sufficient resources to implement additional security policies. The target path latency can be calculated by the PID function: where p:latency target ðsþ p:latency required K D S 2 þ K p S þ K I ¼ S 3 þð10 þ K D ÞS 2 ; þð20 þ K p ÞS þ K I ð17þ. p:latency t arg et = target path latency at S,. p:latency required = required path latency,. K p = proportional gain of path latency,. KI = integral gain of path latency, and. K D = derivative gain of path latency. The PID controls the QoS plant. Hence, the required value is the latency required by the application for guaranteed service. The target value is the latency value determined by the PID. The latency that a path can provide is determined by (14) in Section 4.3. As long as the latency for a path is less than the target latency as derived in (17), the path is selected. For controlled load service, application-network layer metric mapping translates the QoS requirements to the minimum path throughput. If the actual path throughput is more than the controlled load target path throughput, this path has sufficient resources to implement an additional security policy. The target path throughput can be calculated by the PID function: where p:throughput t arg et ðsþ p:throughput required K D S 2 þ K p S þ K I ¼ ; S 3 þð10 þ K D ÞS 2 þð20 þ K p ÞS þ K I ð18þ. p:throughput t arg et = target path throughput at time S,. p:throughput required = required path throughput,. K p = proportional gain of path throughput,. K I = integral gain of path throughput, and. K D = derivative gain of path throughput. For best effort service, application-network layer metric mapping compromises between the most stable path in a high-mobility case and the shortest path in a low-mobility

10 SHEN AND THOMAS: SECURITY AND QOS SELF-OPTIMIZATION IN MOBILE AD HOC NETWORKS 1147 Fig. 11. Policy architecture. path case. There are no particular resource requirements in this case; all available security policies can be implemented. 6 SECURITY PLUG-IN ARCHITECTURE An expansible security framework is a key to provide a flexible security level in an ad hoc network to achieve the security and QoS optimization. Given the increasing sophistication of notebook computers, cell phones, PDAs, etc., which form ad hoc networks, as well as the increasing complexity of the services such networks provide, there is a need for well-defined security policies for resource protection. It is important to ensure that interactions between nodes are governed by well-defined policies that define the rules for accessing services and resources. Authentication policies ensure that a node can trust other nodes it interacts with, while access policies define the services and resources that it has access to in other nodes and the policies it must enforce in order to protect its resources and services. These policies introduce overheads. There are overheads associated with enforcing the policies (checking the authenticity of nodes, for example) dealing with violations of security policies, etc. All these overheads have the potential to severely impact the QoS. We propose a policy-based plug-in architecture to provide dynamic security policy management at runtime. Although this architecture is presented only in outline, to the best of our knowledge, no one has proposed a policy-based management architecture for ad hoc networks. Ad hoc security has focused on key management and secure routing. Such techniques can deliver messages securely but do not deal with resource protection, for example. Fig. 11 shows the proposed distributed security policy plug-in architecture that is present on each node in the network. The security policy manager monitors the network layer constantly. If there are more network resources available, the security policy manager will get the next available policy from the security policy stack and implement it into the network as a plug module. If the network is suffering from a lack of resources and the minimum QoS is not being met, the security policy manager will remove the least priority policy from the network and add it back into the available security policy stack. This process is repeated Fig. 12. Resource utilization. until the QoS is satisfied or the minimal user-defined acceptable security level is reached. 7 OPTIMIZATION ALGORITHM The path monitoring and PID feedback control loop mechanism allow each communication path to determine if there are extra resources available to support more security policies until the resource target utilization is reached. Resource target utilization is the optimized resource utilization at time t, which is calculated by the PID controller. As shown in Fig. 13, the network can reach its maximum resource utilization (most efficient) in the shortest time period in this manner. If every path in the policy domain agreed that the current resource is sufficient, the domain policy manager will choose the next security policy in the available policy stack and deploy it to every node. A greedy algorithm deploying a security policy to reach network resource target utilization is employed. As long as the network does not reach its target resource utilization, the policy manager will continue deploying new security policies into the network. Fig. 12 shows the greedy algorithm process flow. In the real-world scenario, it is Fig. 13. Acceptable and target utilization.

11 1148 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 9, SEPTEMBER 2008 Fig. 15. Validation process flow. Fig. 14. Acceptable utilization algorithm. impossible to keep an ad hoc network at target resource utilization due to various reasons, especially mobility. Therefore, we introduce the acceptable resource utilization, which is defined as follows: Utilization acceptable ¼ Utilization t arg et ; ð19þ where is the mobility factor ð0 <<1Þ. Fig. 13 shows the relationship between acceptable resource utilization and target resource utilization. The target resource utilization is calculated by the PID control theory, as outlined in Section 5, and the acceptable resource utilization is driven by the greedy algorithm. The greedy algorithm will drive the actual system resource utilization as close as possible to the target resource utilization (Fig. 13). NeedMorePolicy() routing shown in Fig. 14 verifies if the actual resource utilization reaches acceptable utilization. It returns TRUE if the actual resource utilization is below acceptable utilization; otherwise, it returns as FALSE. As long as the NeedMorePolicy() routing returns TRUE, the security policy manager will keep deploying the next security policy from an available stack until the resource usage reaches the target level, which is when NeedMorePolicy() returns FALSE. After that, the PID controller executes to calculate the next resource target utilization. 8 POLICY DEPLOYMENT POST VALIDATION The path monitoring and feedback PID control loop mechanism also need to verify that there is no existing path suffering from a lack of resources due to new security policy deployment. If there is any path that is not able to satisfy the original QoS requirements, this is due to the previous deployed security policy causing the network to use up more resources. In this case, the domain policy manager will remove the previous deployed security policy and log all the suffering paths. The greedy algorithm will not be called until at least one of the suffering paths changes state (for example, finish communication, change QoS requirement, etc.). The process flow is shown in Fig PERFORMANCE ANALYSIS The performance of the proposed PID-controlled security and QoS optimization algorithm is studied with simulations. In this study, we are using AODV as our base model and PS-AODV represents the policy-based secure AODV showing the performance characteristics when security policies are applied on top of AODV. In the policy-based secure AODV (PS-AODV), the security policy is permanent and fixed. QOS-AODV is AODV with QoS and PID-AODV is the performance when the PID controller is used to optimize both security and multilayer QoS. Here, the security policy is adaptable based on network QoS. The performance of the proposed QoS routing protocol is studied with simulations based on ns-2 [13]. The implementations of AODV, PS-AODV, QoS-AODV, and the proposed PID-AODV protocols were simulated in ns-2. The PID control module is created by the Object-oriented Tool Control Language (OTcl) as a plug-in implemented above the network layer. It collects path latency and throughput as network output parameters and sends security policy requests back to the network layer to perform optimization. All protocols maintain a send buffer

12 SHEN AND THOMAS: SECURITY AND QOS SELF-OPTIMIZATION IN MOBILE AD HOC NETWORKS 1149 TABLE 4 Security Priorities of 64 packets. To prevent buffering packets indefinitely, packets are dropped if they wait in the send buffer for more than 30 seconds. The traffic source is CBR. The sourcedestination pairs are spread randomly over the network. Data packets that are of 512 bytes in size are used. The mobility model uses the random waypoint model in a rectangular field. We use a 1,500 m 300 m field with 50 nodes with a randomly chosen speed (uniformly distributed between 0-20 m/s). The simulation period is 900 seconds. Each data point represents 10 runs with identical traffic models but different randomly generated mobility scenarios. Identical mobility and traffic scenarios are used across protocols. The main overhead with the proposed approach is obtaining state information to determine if QoS for a path is within the limits determined by the PID. When a new route is requested using AODV, state information is added to replies for route requests. The addition of state information requires extra bits to reply packets. If the network is highly mobile, new routes will be constantly created, and therefore, state information can be regularly obtained with no communication overhead. If the network is relatively static, extra communications at regular intervals may be needed to determine if QoS is being met. An alternative approach is to add state information to acknowledgment packets returned by the destination. Although this does increase packet size, it does not increase the communications overhead and communications is the most expensive function in ad hoc networks. The other main overhead is the computations at the PID controller and the PID and Security plants. These, however, are assumed not to be large. The proposed approach is therefore well suited to ad hoc networks since route requests happen frequently. 9.1 Security Policies It is important to note that security policies are not a continuum; instead, they are discrete quantized units that are selected based on priorities. Hence, the system can provide more security than requested by the user. We use three security policies in our simulations: domain join authentication, read access authorization, and write access authorization. We assume that there are one or more domains. In domain join authentication, a node needs to be authenticated before it can join a domain. This involves sending a {JOIN REQUEST} message to a node that is already a member of the domain. The credentials of the requesting node are checked and, if acceptable, a {JOIN REPLY} message is sent. Other nodes in the domain are informed of the new member. Hence, there is overhead in executing the domain join authentication and other policies. Each security policy has been assigned a priority level. Depending on the network resource utilization ratio, the Fig. 16. Throughput for v ¼ 10 m=s. algorithm will add or remove security policies based on the priority level of the policies to maintain the QoS (Table 4). 9.2 Simulation Results A network will carry all kinds of traffic guaranteed, controlled load, and best effort. For our simulations, we assumed that there were 10 communications in the network. Each one was randomly assigned a class (guaranteed, controlled load, or best effort). This process was repeated 10 times and the simulations show the average values. The proposed PID-optimized AODV routing protocol (PID- AODV) is compared with the AODV, QoS AODV, and static policy-based secure AODV protocols. Figs. 16 and 17 show the packet throughput and the average packet delay under different traffic loads in mobility v ¼ 10 m=s. The simulations show that, under light traffic, packet throughput and packet delay are very close for all four protocols. The advantage of QoS routing protocols becomes apparent when traffic gets heavy. With the AODV protocol, a node has one active route to a destination and uses it for all the packets to the destination. As the network traffic becomes heavy, this route becomes heavily loaded, causing packets to be delayed and dropped. The average packet delay increases significantly under heavy traffic. On the other hand, the QoS routing protocols try to find and use Fig. 17. Average packet delay for v ¼ 10 m=s.

13 1150 IEEE TRANSACTIONS ON MOBILE COMPUTING, VOL. 7, NO. 9, SEPTEMBER 2008 Fig. 18. Security policies used for v ¼ 10 m=s. routes satisfying bandwidth constraints for different flows, even between the same pair of source and destination. Two QoS routes may share the same path, but the protocol will ensure that enough bandwidth is reserved on this path to accommodate both flows. The traffic load is more balanced this way. The average packet delay increases with offered load slowly with the QoS routing protocols. Under light traffic, PID-AODV does not have much of an advantage in terms of performance compared with AODV and PS-AODV. As the network traffic becomes heavy, PID- AODV performs better. PID-AODV provides a varying array of security features depending on available resources; hence, it may sometimes provide more security than PS- AODV and at other times less, but it has almost identical throughput and packet delay compared with QoS AODV and much better throughput and packet delay compared with PS-AODV. Fig. 18 shows the number of security policies used in the PID-AODV protocol with mobility v ¼ 10 m=s. Initially, three security policies have been used under light traffic conditions because there is enough bandwidth resource in the network. When the traffic becomes heavier, the PID controller starts reducing the number of security policies to maintain the QoS requirements. Eventually, when the network traffic becomes very heavy, there is not sufficient bandwidth to handle any security feature and the security policy implemented drops to zero. 10 CONCLUSIONS Due to overheads caused by implementing security in ad hoc networks, security and QoS must be considered together. In this paper, we have proposed a distributed flexible mechanism to optimize security and QoS in mobile ad hoc networks based on three components: a policy-based plug-in security framework, multilayer QoS guided routing, and a PID controller. The multilayer QoS surface guided routing mechanism, which separates metrics at the different layers, provides an adaptable technique for obtaining desired QoS. The policy-based security framework provides a dynamic and modular approach to providing security and is well suited to ad hoc networks with little overhead. Simulation results indicate the proposed PID-optimized security and QoS algorithm can produce a similar performance as nonsecure QoS routing protocols. The level of security is adaptable to different traffic loads. The best case scenario is under light traffic, where it can provide the same security as any other secure protocol but the same performance as nonsecure QoS protocols. The worst case scenario is under extreme heavy traffic, where it provides similar performance as QoS protocols but with no security feature at all. Under medium and light traffic conditions, the proposed protocol can provide more security without compromising QoS performance. This work can be extended to cater to a network where security is of prime importance or where both QoS and security priorities are based on some weightage scheme. Various optimizations are possible to our approach. Rather than selecting the path with the maximum SINR, paths that meet minimum SINR levels to meet application requirements are sufficient. Further research is needed to determine the SINR thresholds associated with different applications. REFERENCES [1] W. Liang and W. Wang, An Analytical Study on the Impact of Authentication Local Area Networks, Proc. IEEE 13th Int l Conf. Comm. and Networks (ICCCN 04), pp , Oct [2] W. Liang and W. Wang, A Quantitative Study of Authentication Networks, Proc. IEEE INFOCOM, vol. 2, pp , [3] W. Liang and W. Wang, On Performance Analysis of Challenge/ Response Based Authentication in Wireless Networks, Computer Networks, vol. 48, no. 2, pp , June [4] W. Wang, W. Liang, and A.K. Agarwal, Integration of Authentication and Mobility Management in Third Generation and WLAN Data Networks, Wireless Comm. and Mobile Computing (WCMC), special issue on WLAN/3G integration for next-generation heterogeneous mobile data networks, vol. 5, no. 6, pp , Sept [5] B.C. Kuo, Automatic Control Systems. Prentice Hall, [6] B. Zhang and H.T. Mouftah, QoS Routing for Wireless Ad Hoc Networks: Problems, Algorithms, and Protocols, IEEE Comm. Magazine, vol. 43, no. 10, pp , Oct [7] S.H. Shah and K. Nahrstedt, Predictive Location-Based QoS Routing in Mobile Ad Hoc Networks, Proc. IEEE Int l Conf. Comm. (ICC 02), pp , Apr [8] P. Sinha, R. Sivakumar, and V. Bharghavan, CEDAR: A Core- Extraction Distributed Ad Hoc Routing Algorithm, IEEE J. Selected Areas in Comm., vol. 17, no. 8, pp , Aug [9] C.R. Lin and J.-S. Liu, QoS Routing in Ad Hoc Wireless Networks, IEEE J. Selected Areas in Comm., vol. 17, no. 8, pp , Aug [10] C. Zhu and M.S. Corson, QoS Routing for Mobile Ad Hoc Networks, Proc. IEEE INFOCOM, pp , June [11] S. Chen and K. Nahrstedt, Distributed Quality-of-Service Routing in Ad Hoc Networks, IEEE J. Selected Areas in Comm., vol. 17, no. 8, pp , Aug [12] B. Zhang and H.T. Mouftah, QoS Routing through Alternate Paths in Wireless Ad Hoc Networks, Int l J. Comm. Systems, vol. 17, no. 3, pp , Mar [13] S. McCanne and S. Floyd, NS-Network Simulator, [14] C. Zhu, Medium Access Control and Quality-of-Service Routing for Mobile Ad Hoc Networks, PhD dissertation, Dept. of Electrical and Computer Eng., Univ. of Maryland, [15] R. Guerin and A. Orda, QoS Based Routing in Networks with Inaccurate Information: Theory and Algorithms, Proc. IEEE INFOCOM, pp , [16] D.H. Lorenz and A. Orda, QoS Routing in Networks with Uncertain Parameters, IEEE/ACM Trans. Networking, vol. 6, no. 6, pp , Dec [17] T. Moscibroda, R. Wattenhofer, and A. Zollinger, Topology Control Meets SINR: The Scheduling Complexity of Arbitrary Topologies, Proc. ACM MobiHoc, pp , 2006.

14 SHEN AND THOMAS: SECURITY AND QOS SELF-OPTIMIZATION IN MOBILE AD HOC NETWORKS 1151 [18] R.L. Cruz and A.V. Santhanam, Optimal Routing, Link Scheduling and Power Control in Multi-Hop Wireless Networks, Proc. IEEE INFOCOM, pp , [19] T. Moscibroda, R. Wattenhofer, and Y. Weber, Protocol Design Beyond Graph-Based Models, Proc. ACM SIGCOMM Fifth Workshop Hot Topics in Networks, Nov [20] C.-S. Hsu, J.-P. Sheu, and S.-C. Tung, An On-Demand Bandwidth Reservation QoS Routing Protocol for Mobile Ad Hoc Networks, Proc. IEEE Int l Conf. Sensor Networks, Ubiquitous, and Trustworthy Computing, vol. 2, pp , ZhengMing Shen received the master s degree and the PhD degree in computer science from Oklahoma State University. He is currently a technical lead with Electronic Data Systems, Austin, Texas. His research interests include network security, QoS routing, and optimization in ad hoc networks. Johnson P. Thomas received the BSc degree in electrical engineering from the University of Wales, United Kingdom, the MSc degree from the University of Edinburgh, Scotland, and the PhD degree from the University of Reading, England, in He worked as a lecturer at the University of Reading, England, and as an associate professor at Pace University, New York. He is currently an associate professor of computer science at Oklahoma State University. His research interests include ad hoc and sensor network security, multimedia communications, and service-oriented architectures. He is on the editorial board of the Journal of Information Assurance and Security. He is a member of the IEEE.. For more information on this or any other computing topic, please visit our Digital Library at