Search

Accepted manuscript version of the following article Gjerdrum, A.T., Pettersen, R., Johansen, H.D. & Johansen, D. (2018). Performance principles for trusted computing with intel SGX. Communications in Computer and Information Science, 864. © Springer International Publishing AG, part of Springer Nature 2018. Published version available at https://doi.org/10.1007/978-3-319-94959-8_1. Cloud providers offering Software-as-a-Service (SaaS) are increasingly being trusted by customers to store sensitive data. Companies often monetize such personal data through curation and analysis, providing customers with personalized application experiences and targeted advertisements. Personal data is often accompanied by strict privacy and security policies, requiring data processing to be governed by non-trivial enforcement mechanisms. Moreover, to offset the cost of hosting the potentially large amounts of data privately, SaaS companies even employ Infrastructure-as-a-Service (IaaS) cloud providers not under the direct supervision of the administrative entity responsible for the data. Intel Software Guard Extensions (SGX) is a recent trusted computing technology that can mitigate some of these privacy and security concerns through the remote attestation of computations, establishing trust on hardware residing outside the administrative domain. This paper investigates and demonstrates the added cost of using SGX, and further argues that great care must be taken when designing system software in order to avoid the performance penalty incurred by trusted computing. We describe these costs and present eight specific principles that application authors should follow to increase the performance of their trusted computing systems.

Performance isolation is essential to operating systems shared by dependable services. Unfortunately, most such systems, including real-time operating systems and VMMs, only fairly divide and account for CPU cycles. We submit that dependable services require specifying and enforcing policies for all resources, and that current metrics for evaluating fair sharing are insufficient. This paper proposes new policy specifications and metrics, and illustrates these with the help of a new operating system that supports holistic resource sharing.

Because software security patches relay information about vulnerabilities, they can be reverse engineered into exploits. Tools for doing this already exist. As a result, there is a race between hackers and end-users to first obtain patches. In this paper we present and evaluate FirePatch, an intrusion-tolerant dissemination mechanism that combines encryption, replication, and sandboxing such that end-users are able to win the security patch race.

Much of the content of popular Internet information sources is highly dynamic: urgent in nature and sometimes relevant only for a short time. The typical approach to querying such dynamic sources is polling for updates often.1 This strains the traditional pull-based Internet and wastes network resources on transmitting redundant information. This paper focuses on how to structure the Internet to avoid the unnecessary client-server interactions dominating the Internet. To that end, we extend the API of popular existing Internet services trough Web service wrappers. These wrappers use the API of, for instance, Google, but provide functionality that is richer. Initial experience shows that major performance gains can be achieved through this approach.

Events injected by publishers into a publish/subscribe system may reach users through a variety of devices: a stationary desktop, a laptop, a mobile phone, etc. We argue that the "last hop" -- from the network to the output device -- has unique properties, owing to the mobile nature of these devices, and as such demands special consideration. In particular, user's preferences and location may limit what should be forwarded to a device. Furthermore, technological constraints, such as network bandwidth availability and battery power, suggest that the decision when to forward messages is also important for optimizing user's experience. We describe a new publish/subscribe system with volume-limiting mechanisms and explain how user preferences, context, and device constraints can be accommodated in such a system. Notably, based on results of simulations, we propose a simple algorithm for low-cost "prefetching" of notifications to mobile devices in cases when network bandwidth is insufficient.

This exstended abstract presents an asymmetric and programmable (extensible) approach to pervasive computing. The idea is to off-load computations from light portable clients into a back-bone of seamlessly integrated servers. This way, a user can extend and personalize his pervasive computational environment by installing computations following his trajectory throughout the day. Focus on this extended abstract is on structural issues related to the back-end servers running mobile code off-loaded from the mobile user.

Vortex is a new multiprocessor operating system that is entirely event-driven. The Vortex kernel, as well as its applications, are structured as stagesthat communicate through event passing. Each stage is a small finite state machine. The event architecture is efficient and allows Vortex to balance load across the processors automatically. Vortex uses an Event Scheduling Tree (EST) on each CPU. An EST is a tree of event queues, where each event queue can be instantiated with its own scheduling policy. The EST mechanism unifies all CPU and I/O scheduling and allows for a wide variety of scheduling policies including weighted performance isolation between applications. The paper shows how a high-performance web server can be supported on Vortex. Compared to running the same web server on Linux on the same hardware, Vortex can sustain up to 80% higher throughput. Experiments with running multiple web servers on Vortex show that we can precisely divide resources between the web servers at low overheads. Microbenchmarks break down the costs of these overheads.

Vortex is a new multiprocessor operating system kernel intended for emerging Internet service applications. The architecture is based on SEDA's staged computational model. Vortex provides mechanisms for performance isolation and dynamic adaptation. Performance results validate that the resource control mechanisms of Vortex are effective, and that Vortex significantly outperforms Linux on single-threaded web servers. The paper concludes with a description of how we plan to support a highly scalable event stream filtering service.

In this paper we argue that the traditional model of a mobile agent provides a poor programming structure. We base our argument on our experience since 1993 in building distributed applications and mobile agent platforms. We have observed that every distributed applications contain three distinct aspects, which we call function, mobility and management. Separating an application into these three aspects and programming them separately affords great flexibility and leverage when designing mobile agent applications for distributed system management. Because of these observations, we have developed a programming model and a mobile agent system in which these three aspects are clearly separated.

For the past seven years, the TACOMA project has investigated software support for mobile agents. Several prototypes have been developed, with experiences in distributed applications directing the effort. This paper presents a new mechanism that supports implementing agent applications by creating troops of agents using wrappers. This solution requires little extra support from the agent system, and may be used to construct applications with a wide variety of functionality requirements.

Distributed systems are becoming harder to manage, in part because the uses we put to distributed systems are rapidly changing. Hence, the software used to manage a distributed system needs to be flexible enough to accommodate these new uses. It also has to be secure enough to not allow unauthorized changes to be made to the system. We present a library and a kernel that supports the management of distributed systems. This kernel, called the TACOMA Operating System (TOS), is an outgrowth of our research into mobile agent systems and applications. We have used TOS to implement several novel distributed management policies, one of which is discussed in detail in this paper. We conclude the paper with a discussion on the applicability of mobile agents to self-managing distributed applications.

In this paper we will show that it is possible to combine mobile agent technology with existing non-mobile data mining applications. The motivation for this is the advantage mobile agents offer in moving the computation closer to the data in a distributed system. This can save bandwidth and increase performance when the data is condensed as a result of data mining.

In this paper, we present experiences from adding software mobility to mobile, hand-held computers. In particular, we have built TACOMA Lite, a mobile code system, for this environment. With TACOMA Lite installed, hand-held computers can host and execute mobile code. TACOMA Lite has been used as platform for several mobile code applications. Through experience with these applications, we have derived a 3-layer software architecture suitable for this type of mobile computing. We conclude that, given certain constraints, mobile software can be a useful artifact in this environment.

Volume rendering is a useful but cpu-intensive method for visualizing large scalar fields. The time to render a single image may be reduced by parallel processing. This paper reports on performance experiments with the StormView volume renderer, which is parallelized on a set of 57 MIPS / 17 MFLOPS workstations connected by a 10 Mbps Ethernet. For certain user patterns, we show that our parallelization exhibits substantial speedups. We compare the performance of a dynamic and a static load balancing algorithm.

This report briefly introduces TACOMA Version 1.0. This distributed system supports agents, computations that can roam the internet. The report presents the TACOMA project, the computational model, how to get started, and the basic TACOMA abstractions.

This report presents the software architecture in the StormCast meteorological workbench. The focus is on the software interfaces in StormCast version 2.1. For each layer in the architecture the functionality, the call structure, the interfaces, the event diagrams and test data are described. In addition, further works are discussed. The identication of software interfaces are based on the StormCast prototype implementations and evaluations. The motivation is to derive an application program interface (API) to StormCast.

The paper describes the development of a prototype application for access to vital weather information from the Northern Atlantic sea region. The application gives meteorologists access to weather observations measured on sea vessels. Today the available information is very limited. On a daily basis, only 4-5 weather observations in the whole arctic sea-region are conducted. It is therefore suggested to use the available fishing-boat and the coast-guard as a basis for a full scale application. Communication is based on the Inmarsat-C global satellite system. This kind of communication offers limited data bandwidth, currently 600 bit/sec. In addition delays are introduced by the coast/earth-station due to message-queues and protocol-transformations. Based on the services of fered by the Inmarsat-C system, a simple prototype communication mechanism for data communication between terrestrial computers and computers on sea-vessels has been developed. It is, partly due to the nature of the satellite system, based on unreliable multicast of messages. A message may consist of a request which requires a reply (multicast RPC). Test results showed that doing a request and getting a reply takes from 1.5 - 4 minutes. The results depend on the type of message (supported by the Inmarsat-C system) which is used. The sea-vessels send weather observations in set intervals. This means higher availability on weather observations, and again a big step for meteorologists which today have to rely on observation which may be several hours old (if any at all).

Advances in computing power and graphics have increased the use of graphics in weather forecasting. This includes 3D animation sequences and geographical information systems. The paper addresses the main problems and presents preliminary results of the visualization of atmospheric models in conjunction with the underlying topography. The goal is among others to make a sort of 3D satellite pictures that present the weather described by the gridpoints in an atmospheric model, i.e., the weather of tomorrow.

Visual observations constitute important input to different meteorological tasks. Previously, these observations were made by human observers and manually reported to the meteorologists. With the employment of video technology, this kind of observations can be automated. This paper presents one approach to visual weather observations. This involves software compression and transmission of digital video. The paper presents a modified version of the PVC algorithm and shows that this algorithm is well suited for software compression of color video for use as visual information in the field of meteorology.

This paper addresses the cooperation between different expert system modules in a networking environment. StormCast - a distributed artificial intelligence application for severe storm forecasting is used as a case to obtain practical results. Two key aspects is investigated, first the representation of knowledge in this kind of environment is outlined. Then the cooperating nature of a group of expert system modules is discussed.

The advent of cloud computing alongside with pervasive form factors such as smart devices, introduces a new meaning to asymmetric system models. These new clients act as a presentational layer alleviating much of the computational and storage concerns to cloud services. The application platforms associated with these creates new opportunities for third party developers to provide domain specific applications (apps) to smart devices. Restricted interaction surfaces on smart device introduce new challenges to how apps are managed on these. Moreover, for security purposes as well as strict resource requirements, apps running in these environments are commonly subject to very strict isolation. We conjure that there are benefits with allowing automatic configuration apps onto a client system. Furthermore, we suggest that integration between apps residing at the same host, as well as different hosts, is beneficial to system functionality. By enabling this we could alleviate much of the interaction necessary for users and reduce the time consumed in using such smart devices. The concrete asymmetric system explored in this thesis is the Windows 8 app platform. This platform poses several hindrances to our conjecture. For security reasons, automatic configuration of apps onto a client system is prohibited. Apps run inside a sandboxed environment where they are isolated from the system and other apps. Access to resources is prohibited unless explicitly allowed by the user. As a consequence, communication between apps is forbidden. This is further complicated by the fact that apps in this environment are suspended when not in use. This thesis introduces Javza, a runtime to support dynamic app configuration and integration in Windows 8. Javza provides support for automatic installment of apps based on simplified contextual information. Furthermore, it provides app integration by allowing apps to share data, both within the same and across different systems. We present and evaluate the associated performance costs of deploying Javza inside a Windows 8 environment. We further evaluate the applicability of Javza by implementing a specific use case involving collaborative search. Lastly we discuss some of the security implications associated with our design, and some future improvements in Windows 8 to support our conjecture.