Jonathan M Smith Copyright (c) 2012 All rights reserved. http://works.bepress.com/jms Recent documents in Jonathan M Smith en-us Sat, 24 Nov 2012 19:12:07 PST 3600 Revision of QoS Guarantees at the Application/Network Interface http://works.bepress.com/jms/71 http://works.bepress.com/jms/71 Mon, 19 Sep 2011 02:28:01 PDT Connection management based on Quality of Service (QoS) offers opportunities for better resource allocation in networks providing service classes. "Negotiation" describes the process of cooperatively configuring application and network resources for an application's use. Complex and long-running applications can reduce the inefficiencies of static allocations by splitting resource use into "eras" bounded by renegotiation of QoS parameters. Renegotiation can be driven by either the application or the network in order to best match application and network dynamics. A key element in this process is a translation between differing perspectives on QoS maintained by applications and network service provision. We model translation with an entity called a "broker".

]]> Klara Nahrstedt et al. FPGA Viruses http://works.bepress.com/jms/70 http://works.bepress.com/jms/70 Mon, 19 Sep 2011 02:27:59 PDT Programmable logic is widely used, for applications ranging from field-upgradeable subsystems to advanced uses such as reconfigurable computing platforms which are modifiable at run-time. Users can thus implement algorithms which are largely executed by a general-purpose CPU, but may be selectively accelerated with special purpose hardware. In this paper, we show that programmable logic devices unfortunately open another avenue for malicious users to implement the hardware analogue of a computer virus.

We begin this paper with an outline of the general properties of FPGAs that create risks. We then explain how to exploit these risks, and demonstrate through directed experiments that they are exploitable even in the absence of detailed layout information. We prove our point by demonstrating the first known FPGA virus and its effect on the current absorbed by the device, namely that the device is destroyed. We close by outlining possible methods of defense and point out the similarities and differences between FPGA and software viruses.

]]> Ilija Hadžić et al. Power Management in Mobile Computing (A Survey) http://works.bepress.com/jms/69 http://works.bepress.com/jms/69 Mon, 19 Sep 2011 02:27:56 PDT Rapid advances in technology have resulted in laptop (mobile) computers with performance and features comparable to desktop (stationary) machines. Advances in rechargeable battery technology have failed to keep pace, decreasing the usefulness of mobile computers and portable wireless devices. Several methods of power management can be used to prolong the battery life of a mobile computer. We provide a detailed analysis of power consumption typically encountered in a networked laptop computer and the power management methods currently used. We also outline some novel proposed power management methods.

]]> Sanjay Udani et al. Automated Recovery in a Secure Bootstrap Process http://works.bepress.com/jms/68 http://works.bepress.com/jms/68 Mon, 19 Sep 2011 02:27:54 PDT Integrity is rarely a valid presupposition in much systems architecture, yet it is necessary to make any security guarantees. To address this problem, we have designed a secure bootstrap process, AEGIS, which presumes a minimal amount of integrity, and which we have prototyped on the Intel x86 architecture. The basic principle is sequencing the bootstrap process as a chain of progressively higher levels of abstraction, and requiring each layer to check a digital signature of the next layer before control is passed to it. A major design decision is the consequence of a failed integrity check. A simplistic strategy is to simply halt the bootstrap process. However, as we show in this paper, the AEGIS bootstrap process can be augmented with automated recovery procedures which preserve the security properties of AEGIS under the additional assumption of the availability of a trusted repository. We describe a variety of means by which such a repository can be implemented, and focus our attention on a network accessible repository. The recovery process is easily generalized to applications other than AEGIS, such as standardized desktop management and secure automated recovery of network elements such as routers or "Active Network" elements.

]]> William A. Arbaugh et al. Safety and Performance in an Open Packet Monitoring Architecture http://works.bepress.com/jms/67 http://works.bepress.com/jms/67 Mon, 19 Sep 2011 02:27:52 PDT Packet monitoring arguably needs the flexibility of open architectures and active networking. A significant challenge in the design of open packet monitoring systems is how to effectively strike a balance between flexibility, safety and performance. In this paper we investigate the performance of FLAME, a system that emphasizes flexibility by allowing applications to execute arbitrary code for each packet received. Our system attempts to achieve high performance without sacrificing safety by combining the use of a type-safe language, lightweight run-time checks, and fine-grained policy restrictions. Experiments with our prototype implementation demonstrate the ability of our system to support representative application workloads on Bgit/s links. Such performance indicates the overall efficiency of our approach; more narrowly targeted experiments demonstrate that the overhead required to provide safety is acceptable.

]]> Kostas G. Anagnostakis et al. MOSAIC: Multiple Overlay Selection and Intelligent Composition http://works.bepress.com/jms/66 http://works.bepress.com/jms/66 Mon, 19 Sep 2011 02:27:49 PDT Today, the most effective mechanism for remedying shortcomings of the Internet, or augmenting it with new networking capabilities, is to develop and deploy a new overlay network. This leads to the problem of multiple networking infrastructures, each with independent advantages, and each developed in isolation. A greatly preferable solution is to have a single infrastructure under which new overlays can be developed, deployed, selected, and combined according to application and administrator needs.

MOSAIC is an extensible infrastructure that enables not only the specification of new overlay networks, but also dynamic selection and composition of such overlays. MOSAIC provides declarative networking: it uses a unified declarative language (Mozlog) and runtime system to enable specification of new overlay networks, as well as their composition in both the control and data planes. Importantly, it permits dynamic compositions with both existing overlay networks and legacy applications. This paper demonstrates the dynamic selection and composition capabilities of MOSAIC with a variety of declarative overlays: an indirection overlay that supports mobility (i3), a resilient overlay (RON), and a transport-layer proxy. Using a remarkably concise specification, MOSAIC provides the benefits of runtime composition to simultaneously deliver application-aware mobility, NAT traversal and reliability with low performance overhead, demonstrated with deployment and measurement on both a local cluster and the PlanetLab testbed.

]]> Yun Mao et al. The Integrated Media Approach To Networked Multimedia Systems http://works.bepress.com/jms/65 http://works.bepress.com/jms/65 Mon, 19 Sep 2011 02:27:47 PDT Applications which require real-time multimedia services[13] face a number of difficult problems in the transmission of multimedia information. Among the most difficult problems are the heterogeneity of end nodes and the heterogeneity of media Quality of Service (QoS) requirements. End nodes typically consist of a computer and number of sensory input and output devices, such as displays, microphones, and cameras. QoS requirements[18] include degrees of reliability, jitter, and delay.

We propose an integrated approach to address these problems. Multimedia input data comprise a sensory environment which an application will make available; these data are packaged together into an Integrated Multimedia Message (IMM). From a received IMM, output data are selectively reproduced to create another sensory environment. We propose an IMM format and protocol behaviors for generation, presentation, and synchronization of these messages.

While IMM's are aesthetically pleasing, well-suited to proposed high- speed networks, and ease intramessage synchronization, they are potentially plagued by the need to deliver QoS which meets the worst-case requirements of all of their components[6]. We believe that this problem can be addressed, and are testing that belief experimentally with the U. Penn Experimental Multimedia Conferencing System, which will be embedded in the AURORA Gigabit Testbed.

]]> Klara Nahrstedt et al. Sub-Operating Systems: A New Approach to Application Security http://works.bepress.com/jms/64 http://works.bepress.com/jms/64 Mon, 19 Sep 2011 02:27:44 PDT Users regularly exchange apparently innocuous data files using email and ftp. While the users view these data as passive, there are situations when they are interpreted as code by some system application. In that case the data become "active". Some examples of such data are Java, JavaScript and Microsoft Word attachments, each of which are executed within the security context of the user, allowing potentially arbitrary machine access. The structure of current operating systems and user applications makes solving this problem challenging.

We propose a new protection mechanism to address active content, which applies fine-grained access controls at the level of individual data objects. All data objects arriving from remote sources are tagged with a non-removable identifier. This identifier dictates its permissions and privileges rather than the file owner’s user ID. Since users possess many objects, the system provides far more precise access control policies to be enforced, and at a far finer granularity than previous designs.

]]> Sotiris Ioannidis et al. Hardware/Software Organization of A High Performance ATM Host Interface http://works.bepress.com/jms/63 http://works.bepress.com/jms/63 Mon, 19 Sep 2011 02:27:42 PDT Concurrent increases in network bandwidths and processor speeds have created a performance bottleneck at the workstation-to-network host interface. This is especially true for BISDN networks where the fixed length ATM cell is mismatched with application requirements for data transfer; a successful hardware/software architecture will resolve such differences and offer high end-to-end performance.

The solution we report carefully splits protocol processing functions into hardware and software implementations. The interface hardware is highly parallel and performs all per-cell functions with dedicated logic to maximize performance. Software provides support for the transfer of data between the interface and application memory, as well as the state management necessary for virtual circuit setup and maintenance. In addition, all higher level protocol processing is implemented with host software.

The prototype connects an IBM RISC System/6000 to a SONET-based ATM network carrying data at the OC-3c rate of 155 Mbps. An experimental evaluation of the interface hardware and software has been performed. Several conclusions about this host interface architecture and the workstations it is connected to are made.

]]> C. Brendan S. Traw et al. Design, Implementation and Experiences of the OMEGA End-Point Architecture http://works.bepress.com/jms/62 http://works.bepress.com/jms/62 Mon, 19 Sep 2011 02:27:40 PDT New cell-switched network technologies and multimedia peripherals enable distributed applications with strict real-time requirements such as remote control with feedback. Time-bounded network communications services are necessary, but not sufficient, to meet application-to-application real-time requirements. Real-time communication must be coupled with real-time computing support at the network end-points. An end-point architecture for the computation/communications coupling must be flexible and robust to support a diversity of applications.

The OMEGA architecture, when coupled with cell-switched networks (or others which can make bandwidth and delay guarantees), can approximate the behavior of dedicated microcontrollers connected by dedicated circuits in support of an application. The essence of the OMEGA architecture is resource reservation and management within the set of multimedia endpoints. Communications is preceded by a call set-up period where requirements, expressed in terms of Quality of Service (QoS) parameters, are negotiated, and guarantees are made at several logical levels, such as between applications and the network subsystem, applications and the operating system, and the network subsystem and the operating system. This establishes customized connections and allocation of resources appropriate to the application requirements and OS/network capabilities. To facilitate this resource management process, a new paradigm called the 'QoS Brokerage' is used. This paradigm requires new services and protocols across all layers of the protocol stack (i.e., the higher layers of B-ISDN), as well as re-architecting the application/network interface.

A prototype of OMEGA has been implemented and tested with a master/slave telerobotics application using a dedicated 155 Mbps ATM LAN. This application employs media with highly diverse QoS requirements and therefore provides a good platform for testing how closely one can approximate a dedicated circuit and controller with workstation hosts and cell-switching. Experience with this implementation has helped to identify new challenges to extending these techniques to a larger domain of applications and systems, and raises several new research questions.

]]> Klara Nahrstedt et al. The Price of Safety in an Active Network http://works.bepress.com/jms/61 http://works.bepress.com/jms/61 Mon, 19 Sep 2011 02:27:37 PDT Lack of security is a major threat to "Active Networking," as programmability creates numerous opportunities for mischief. The point at which programmability is exposed, e.g., through the loading of code into network elements, must therefore be carefully crafted to ensure security. This paper makes two contributions. First, it describes the implementation of a solution, the Secure Active Network Environment (SANE), which is intended to operate on an active network router. The SANE architecture provides a secure bootstrap process, which includes cryptographic certificate exchange and results in execution of a module loader for introducing new code, as well as a packet execution environment. SANE thus permits a direct comparison of security implications of active packets (such as "capsules") with active extensions (used for "flows" of packets). The second contribution of the paper is a performance study using a combination of execution traces and end-to-end throughput measurements. The example code performs an "active ping" and allows us to break down costs into categories such as authentication. In our SANE implementation on 533 Mhz Alpha PCs, securing active packets effectively increases the time required to process a packet by a third. This result implies that the majority of packets must remain unauthenticated in high performance active networking solutions. We discuss some solutions which preserve security.

]]> D. Scott Alexander et al. A Secure and Reliable Bootstrap Architecture http://works.bepress.com/jms/60 http://works.bepress.com/jms/60 Mon, 19 Sep 2011 02:27:35 PDT In a computer system, the integrity of lower layers is treated as axiomatic by higher layers. Under the presumption that the hardware comprising the machine (the lowest layer) is valid, integrity of a layer can be guaranteed if and only if: (1) the integrity of the lower layers is checked, and (2) transitions to higher layers occur only after integrity checks on them are complete. The resulting integrity "chain" inductively guarantees system integrity. When these conditions are not met, as they typically are not in the bootstrapping (initialization) of a computer system, no integrity guarantees can be made. Yet, these guarantees are increasingly important to diverse applications such as Internet commerce, intrusion detection systems, and "active networks." In this paper, we describe the AEGIS architecture for initializing a computer system. It validates integrity at each layer transition in the bootstrap process. AEGIS also includes a recovery process for integrity check failures, and we show how this results in robust systems. We discuss our prototype implementation for the IBM personal computer (PC) architecture, and show that the cost of such system protection is surprisingly small.

]]> William A. Arbaugh et al. Flexible Network Monitoring with FLAME http://works.bepress.com/jms/59 http://works.bepress.com/jms/59 Mon, 19 Sep 2011 02:27:32 PDT Increases in scale, complexity, dependency and security for networks have motivated increased automation of activities such as network monitoring. We have employed technology derived from active networking research to develop a series of network monitoring systems, but unlike most previous work, made application needs the priority over infrastructure properties.

This choice has produced the following results: (1) the techniques for general infrastructure are both applicable and portable to specific applications such as network monitoring; (2) tradeoffs can benefit our applications while preserving considerable flexibility; and (3) careful engineering allows applications with open architectures to perform competitively with custom-built static implementations.

These results are demonstrated via measurements of the lightweight active measurement environment (LAME), its successor, flexible LAME (FLAME), and their application to monitoring for performance and security.

]]> Kostas G. Anagnostakis et al. The STRONGMAN Architecture http://works.bepress.com/jms/57 http://works.bepress.com/jms/57 Mon, 19 Sep 2011 02:27:28 PDT The design principle of restricting local autonomy only where necessary for global robustness has led to a scalable Internet. Unfortunately, this scalability and capacity for distributed control has not been achieved in the mechanisms for specifying and enforcing security policies. This shortcoming must be overcome if end-to-end security mechanisms (such as IPsec or TLS) are to ever replace solutions of short-term convenience such as firewalls.

The STRONGMAN (for Scalable TRust Of Next Generation MANagement) system offers three new approaches to scalability, applying the principle of local policy enforcement complying with global security policies. First is the use of a compliance checker to provide great local autonomy within the constraints of a global security policy. Second is a mechanism to compose policy rules into a coherent enforceable set, e.g., at the boundaries of two locally autonomous application domains. Third is the "lazy instantiation" of policies to reduce the amount of state that enforcement points need to maintain.

We demonstrate the use of these approaches in the design, implementation, and measurements of a distributed firewall. Our experiments show that, under certain circumstances, performance can improve over the traditional-firewall approach.

]]> Angelos D. Keromytis et al. GNOSIS: Global Network Operations Status Information System http://works.bepress.com/jms/56 http://works.bepress.com/jms/56 Mon, 19 Sep 2011 02:27:26 PDT Monitoring the global state of a network is a continuing challenge for network operators and users. It has become still harder with increases in scale and heterogeneity. Monitoring requires status information for each node and to construct the global picture at a monitoring point. GNOSIS, the Global Network Operations Status Information System, achieves a global view by careful extraction and presentation of locally available node data. The GNOSIS model improves on the traditional polling model of monitoring schemes by 1.) collecting accurate data 2.) decreasing the granularity with which network applications can detect change in the network and 3.) displaying status information in near real-time.

We define the Network Snapshot as the basic unit of information capture and display in GNOSIS. A Network Snapshot is a visualization of locally available state collected during a common time interval. A sequence of these Network Snapshots over time represent the evolution of network state.

In this paper, we motivate the need for a network monitoring system that can detect global problems, in spite of both scale and heterogeneity. We present three design criteria, Accuracy, Continuity and Timeliness for a global monitoring system. Finally, we present the GNOSIS architecture and demonstrate how it better detects network problems which are currently of concern. The goal of GNOSIS is to present a stream of consistent, accurate local data in a timely manner.

]]> Jessica Kornblum et al. A Study of Cache-based IP Flow Switching http://works.bepress.com/jms/55 http://works.bepress.com/jms/55 Mon, 19 Sep 2011 02:27:24 PDT Meeting the service demands from QoS-based network applications is a very challenging task performed in many high-end routers and switches. This task involves management of resources like bandwidth and memory in network devices. The memory in the form of a very fast cache that instruments wire-speed classification, discrimination, and forwarding of network packets needs to be managed very effectively. We examine the management of a specific IP flow-cache architecture through simulations based on traffic traces collected from a campus intranet. A probabilistic cache install policy is examined over a range of cache sizes and install probabilities. This policy successfully identifies the flows that warrant caching and slightly improves deployable policies based on site-specific traffic information can increase the switching performance even higher.

]]> Osman Ertugay et al. Engineering Privacy in Public: Confounding Face Recognition http://works.bepress.com/jms/54 http://works.bepress.com/jms/54 Mon, 19 Sep 2011 02:27:21 PDT The objective of DARPA’s Human ID at a Distance (HID) program "is to develop automated biometric identification technologies to detect, recognize and identify humans at great distances." While nominally intended for security applications, if deployed widely, such technologies could become an enormous privacy threat, making practical the automatic surveillance of individuals on a grand scale. Face recognition, as the HID technology most rapidly approaching maturity, deserves immediate research attention in order to understand its strengths and limitations, with an objective of reliably foiling it when it is used inappropriately. This paper is a status report for a research program designed to achieve this objective within a larger goal of similarly defeating all HID technologies.

]]> James Alexander et al. The AURORA Gigabit Testbed http://works.bepress.com/jms/53 http://works.bepress.com/jms/53 Mon, 19 Sep 2011 02:27:19 PDT AURORA is one of five U.S. networking testbeds charged with exploring applications of, and technologies necessary for, networks operating at gigabit per second or higher bandwidths. The emphasis of the AURORA testbed, distinct from the other four testbeds, BLANCA, CASA, NECTAR, and VISTANET, is research into the supporting technologies for gigabit networking.

Like the other testbeds, AURORA itself is an experiment in collaboration, where government initiative (in the form of the Corporation for National Research Initiatives, which is funded by DARPA and the National Science Foundation) has spurred interaction among pre-existing centers of excellence in industry, academia, and government.

AURORA has been charged with research into networking technologies that will underpin future high-speed networks. This paper provides an overview of the goals and methodologies employed in AURORA, and points to some preliminary results from our first year of research, ranging from analytic results to experimental prototype hardware. This paper enunciates our targets, which include new software architectures, network abstractions, and hardware technologies, as well as applications for our work.

]]> David D. Clark et al. The Software Design Laboratory http://works.bepress.com/jms/52 http://works.bepress.com/jms/52 Mon, 19 Sep 2011 02:27:17 PDT Software Design Laboratory is an undergraduate practicum in software design, which focuses on principles and practices of large-scale software design. Concepts and examples borrowed from elsewhere in Computer Science are applied to the construction of a significant project, namely a command interpreter resembling the Bourne shell. The course focus is on long-lived software systems of a size requiring group effort. We therefore address maintenance, testing, documentation, code readability, version control, and group dynamics.

]]> Jonathan M. Smith A Secure Active Network Environment Architecture http://works.bepress.com/jms/51 http://works.bepress.com/jms/51 Mon, 19 Sep 2011 02:27:15 PDT Active Networks are a network infrastructure which is programmable on a per-user or even per-packet basis. Increasing the flexibility of such network infrastructures invites new security risks. Coping with these security risks represents the most fundamental contribution of Active Network research. The security concerns can be divided into those which affect the network as a whole and those which affect individual elements. It is clear that the element problems must be solved first, as the integrity of network-level solutions will be based on trust of the network elements.

In this paper, we describe the architecture and implementation of a Secure Active Network Environment (SANE1), which we believe provides a basis for implementing secure network-level solutions. We guarantee that a node begins operation in a trusted state with the AEGIS secure bootstrap architecture. We guarantee that the system remains in a trusted state by applying dynamic integrity checks in the network element's run time system, a novel naming system, and applying node-node authentication when needed.

The SANE implementation is for x86 architectures, currently those running one of several varieties of UNIX.

]]> D. Scott Alexander et al.