Container technology provides a lightweight operating system level virtual hosting environment. Its emergence profoundly changes the development and deployment paradigms of multi-tier distributed applications. However, due to the incomplete implementation of system resource isolation mechanisms in the Linux kernel, some security concerns still exist for multiple containers sharing an operating system kernel on a multi-tenancy container-based cloud service. In this paper, we first present the information leakage channels we discovered that are accessible within containers. Such channels expose a spectrum of system-wide host information to containers without proper resource partitioning. By exploiting such leaked host information, it becomes much easier for malicious adversaries (acting as tenants in a container cloud) to launch attacks that might impact the reliability of cloud services. We demonstrate that the information leakage channels could be exploited to infer private data, detect and verify co-residence, build covert channels, and launch more advanced cloud-based attacks. We discuss the root causes of the containers' information leakage and propose a two-stage defense approach. As demonstrated in the evaluation, our defense is effective and incurs trivial performance overhead.

Distributed collaborative learning (DCL) paradigms enable building joint machine learning models from distrusted multi-party participants. Data confidentiality is guaranteed by retaining private training data on each participant's local infrastructure. However, this approach makes today's DCL design fundamentally vulnerable to data poisoning and backdoor attacks. It limits DCL's model accountability, which is key to backtracking problematic training data instances and their responsible contributors. In this paper, we introduce CALTRAIN, a centralized collaborative learning system that simultaneously achieves data confidentiality and model accountability. CALTRAIN enforces isolated computation via secure enclaves on centrally aggregated training data to guarantee data confidentiality. To support building accountable learning models, we securely maintain the links between training instances and their contributors. Our evaluation shows that the models generated by CALTRAIN can achieve the same prediction accuracy when compared to the models trained in non-protected environments. We also demonstrate that when malicious training participants tend to implant backdoors during model training, CALTRAIN can accurately and precisely discover the poisoned or mislabeled training data that lead to the runtime mispredictions.

Container technology provides a lightweight operating system level virtual hosting environment. Its emergence profoundly changes the development and deployment paradigms of multi-tier distributed applications. However, due to the incomplete implementation of system resource isolation mechanisms in the Linux kernel, some security concerns still exist for multiple containers sharing an operating system kernel on a multi-tenancy container cloud service. In this paper, we first present the information leakage channels we discovered that are accessible within the containers. Such channels expose a spectrum of system-wide host information to the containers without proper resource partitioning. By exploiting such leaked host information, it becomes much easier for malicious adversaries (acting as tenants in the container clouds) to launch advanced attacks that might impact the reliability of cloud services. Additionally, we discuss the root causes of the containers' information leakages and propose a two-stage defense approach. As demonstrated in the evaluation, our solution is effective and incurs trivial performance overhead.

In this work we present Scalable Attestation, a method which combines both secure boot and trusted boot technologies, and extends them up into the host, its programs, and up into the guest's operating system and workloads, to both detect and prevent integrity attacks. Anchored in hardware, this integrity appraisal and attestation protects persistent data (files) from remote attack, even if the attack is root privileged. As an added benefit of a hardware rooted attestation, we gain a simple hardware based geolocation attestation to help enforce regulatory requirements. This design is implemented in multiple cloud test beds based on the QEMU/KVM hypervisor, Open Stack, and Open Attestation, and is shown to provide significant additional integrity protection at negligible cost.

Adoption of hybrid clouds by enterprises has been hampered by the inability of current hybrid cloud infrastructures to provide scalable and efficient mechanisms (1) to ensure the trustworthiness and integrity of the software stack executing a hybrid application workload, or (2) to enforce governmental privacy, data jurisdiction and audit regulations by ensuring that remote data and computation do not cross specified geographic boundaries.

As mobile nodes roam in a wireless network, they continuously associate with different access points and perform handoff operations. However, frequent handoffs can potentially incur unacceptable delays and even interruptions for interactive applications. To alleviate these negative impacts, we present novel association control algorithms that can minimize the frequency of handoffs occurred to mobile devices. Specifically, we show that a greedy LookAhead algorithm is optimal in the offline setting, where the user's future mobility is known. Inspired by such optimality, we further propose two online algorithms, namely LookBack and Track, that operate without any future mobility information. Instead, they seek to predict the lifetime of an association using randomization and statistical approaches, respectively. We evaluate the performance of these algorithms using both analysis and trace-driven simulations. The results show that the simple LookBack algorithm has surprisingly a competitive ratio .of (log k + 2), where k is the maximum number of APs that a user can hear at any time, and the Track algorithm can achieve near-optimal performance in practical scenarios.

A large number of potential applications of sensor and actuator networks (SANETs) have emerged recently, for example in the areas of energy production and distribution and health care and telemedicine. SANETs integrate the tasks of sensing and actuation, the process of controlling the operation of a physical system by setting values for parameters of interest. Of particular importance in SANETs is the ability to set actuator parameters, typically depending on values observed by the sensors, so as to achieve a system-wide objective. However, SANETs with large number of nodes or covering wide geographical areas present scalability challenges that necessitate the use of summarization techniques resulting in sub-optimal actuation values. There is therefore a clear trade-off between the level of summarization and the quality of the computed actuation parameters. This paper focuses on two interdependent problems. The first is the issue of efficient aggregation and summarization of the measurements. The second is the distributed computation of optimal actuation parameters to achieve a system-wide objective. We first consider the problem under the assumption of semi-static sensed values and then extend our model to cover the general case where sensor state changes, triggering update events. We develop algorithms for efficient summarization of these events and demonstrate that they minimally impact optimal actuation. Our work is motivated by the domain of energy distribution networks and, in particular, intelligent electrical grids.

Value-added content resiliency services help to migrate the burden of resiliency provisioning and maintenance from service users, especially home users and small/medium organizations, who have difficulty in handling correlated failures that impact large areas. For service providers to achieve business success, however, the cost-effectiveness of their resiliency strategies is critical: while the content resiliency requirements specified by the end users have to be satisfied, excessive preventive operation costs caused by the over-reaction to potential risks should be avoided. In this paper, we study the problem of cost-effective configuration in content resiliency service networks under both independent and geographically correlated failures. We propose a new approach to modeling correlated failures in a representable, quantifiable and consistent way, which allows for both quantified availability guarantees and aggressive prevention cost optimization. We then formulate the costeffective configuration problem in content resiliency services and develop both real optimal and heuristic-based algorithms for solving the problem. Our experiments show that with the help of good models for correlated failures, the operation cost of the services can be significantly reduced without impairing the user-specified content resiliency.

We present a novel autonomic control system for high performance stream processing systems. The system uses bandwidth controls on incoming or outgoing streams to achieve a desired resource utilization balance among a set of concurrently executing stream processing tasks. We show that CPU prioritization and allocation mechanisms in schedulers and virtual machine managers are not sufficient to control such I/O-centric applications, and present an autonomic bandwidth control system that adaptively adjusts incoming and outgoing traffic rates to achieve system management goals. The system dynamically learns the bandwidth rate necessary to meet the system management goals using stochastic nonlinear optimization, and detects changes in the stream processing applications that require bandwidth adjustment. Our prototype Linux implementation is lightweight, has low overhead, and is capable of effectively managing stream processing applications.

Distributed, IP-based control architecture has been proposed for switched optical mesh networks, as a means to automate operations, enhance interoperability and facilitate the deployment of new applications. While distributed control in general enhances scalability and flexibility, it also offers challenges to path computation, especially for shared mesh restored paths, because of the summarization of link state information disseminated by the routing protocol. This paper discusses the tradeoffs between the path computation efficiency and the abstraction level of link state information. Several heuristic algorithms for computing shared mesh restored paths are described, which require different levels of abstraction and summarization of link resource sharing information. The performance of these algorithms is compared in term of the efficiency of network capacity utilization, the computation complexity, and the amount of required network information. We show that with appropriately aggregated link state information the proposed path computation algorithms are able to utilize the network resource very efficiently.

Efficient methods are needed to aggregate and disseminate the routing information, including the optical link resource availability and sharing, so that the amount advertised by the routing protocol is minimized and the information necessary for path computation is not lost. In this paper, the author proposed to extend the generalized multi-protocol label switching (GMPLS) OSPF-TE routing protocol to carry the necessary sharing information of the reserved resource on a TE link in support of computing the shared mesh restored paths. It is based on the OSPF routing extensions required to support traffic engineering (TE) and GMPLS. New optional sub-TLVs (type/length/value) are added to the link TLV of the TE link state advertisements (LSA) so that the sharing information of the restoration resource is disseminated.

Optical mesh network infrastructure has emerged as the technology of choice for next-generation transport networks. At the same time, distributed, IP-based, control architecture has been proposed for intelligent optical networks, as a means to automate operations, enhance interoperability, and facilitate the deployment of new applications. While distributed control in general enhances scalability and flexibility, it has also been observed that the requisite network topology and link-state information summarization may result in suboptimal path computation, especially for shared mesh restored paths. This paper presents a distributed control plane for optical mesh networks, focusing on distributed path computation and provisioning mechanisms. It discusses the tradeoffs between the path computation efficiency for shared mesh restored paths and the amount of network topology and link-state information that is disseminated via routing protocols. We show that with appropriately aggregated link resource availability and sharing information, the proposed distributed path computation algorithms are able to determine the shareability of restoration links with remarkable accuracy. A local channel assignment scheme, which is used in conjunction with the distributed path computation algorithms to assign shared channels when provisioning restoration paths, is also proposed. The additional information that signaling messages are required to carry in order to perform the local channel assignment at each node along the restoration path is discussed. Furthermore, we specify the extensions to the open shortest-path first (OSPF) routing protocol in support of shared mesh restoration. We analyze the performance of the proposed distributed path computation algorithms and the local channel assignment scheme, as well as the overhead of OSPF extensions. In particular, we study the tradeoffs between network capacity utilization, restoration path computation complexity, OSPF extension overhead, and memory requirements for storing the modified link-state database.

The Internet provides no support for privacy or authentication of multicast packets. However, an increasing number of applications require secure multicast services in order to restrict group membership and enforce accountability of group members. A major problem associated with the deployment of secure multicast delivery services is the scalability of the key distribution protocol. This is particularly true with regard to the handling of group membership changes, such as member departures and/or expulsions, which necessitate the distribution of a new session key to all the remaining group members. As the frequency of group membership changes increases, it becomes necessary to reduce the cost of key distribution operations. This paper explores the use of batching of group membership changes to reduce the frequency, and hence the cost, of key re-distribution operations. It focuses explicitly on the problem of cumulative member removal and presents an algorithm that minimizes the number of messages required to distribute new keys to the remaining group members. The algorithm is used in conjunction with a new multicast key management scheme which uses a set of auxiliary keys in order to improve scalability. In contrast to previous schemes which generate a fixed hierarchy of keys, the proposed scheme dynamically generates the most suitable key hierarchy by composing different keys. Our cumulative member removal algorithm uses Boolean function minimization techniques, and outperforms all other schemes known to us in terms of message complexity.

This paper describes a general methodology for constructing accurate source models of long sequences (full-length movies) of full-motion compressed VBR (variable bit rate) video, directly from empirical data sets of observed bit rate (frame size) records. The main idea is to first cluster scenes into classes and use TES (transform-expand-sample) processes to carefully model their duration and bit rate processes, and then modulate these scene class models by a Markov-renewal process that governs scene transitions. The resulting model is a Markov-renewal-modulated TES (MRMT) process. The fidelity criteria imposed are relatively stringent in that they call for the simultaneous capture of empirical histograms and autocorrelation functions, as well as the qualitative appearance of the empirical data, including burstiness. To illustrate the methodology, the paper provides a detailed description of the modeling procedure, using a JPEG-like coding trace of the "Star Wars" movie as a working example. The resulting MRMT model was validated by comparing its simulation-based statistics to their empirical counterparts, and by a performance study of the corresponding loss rates for various buffer sizes. The results support the efficacy of the modeling methodology and suggest that suites of realistic and compact source models can be developed for other types of movies under a variety of coding schemes. These may be used to drive realistic Monte Carlo simulations of broadband telecommunications networks.

An important challenge for the future growth of the Internet is to design routers that can forward the exponentially increasing volume of traffic, and at the same time provide the service differentiation needed by new applications. In this paper, we describe the architecture, implementation, and initial experiences with a system designed to meet this challenge. This system, which we call a QoS capable switch-router (QSR), combines the salient features of switching and routing technologies to provide high throughput and support the different classes of service being defined by the IETF. It consists of a core (ATM) switch fabric connecting intelligent adapters, each capable of both routing and switching pockets. A control engine is responsible for routing, RSVP signalling, and resource management. We have built a prototype network of 3 systems connected to several UNIX hosts, and have conducted preliminary performance measurements on this network.

We consider a multiuser network that is shared by noncooperative users. Each user sets up virtual paths that optimize its own selfish performance measure. This measure accounts for the guaranteed call level quality of service, as well as for the cost incurred for reserving the resource. The interaction among the user strategies is formalized as a noncooperative game. We show that the game has a unique Nash equilibrium and that it possesses a certain fairness property. We investigate the dynamics of this game and prove convergence to the Nash equilibrium of both a Gauss-Seidel scheme and a Jacobi scheme. We extend our study to various general network topologies. Finally, the formal results and some extensions thereof are tested by emulating the schemes on an experimental network.

We propose a new policy for virtual path bandwidth allocation in broadband networks. Based on a threshold scheme, our policy handles the inherent tradeoff between bandwidth utilization and processing costs. In each virtual path controller the thresholds are chosen so as to keep bandwidth utilization high, while obtaining a low rate of processing requests. Two novel ideas are used in our threshold scheme: adaptivity, which results in a better prediction of future bandwidth requirements; and hysteresis, which prevents excessive processing of requests due to oscillations around thresholds. We tested the performance of our new bandwidth control scheme, and compared it with previously suggested schemes. The performance measures were the expected amount of unused bandwidth, the average signaling load and the blocking probability. Performance has been evaluated through numerical computations as well as by simulations. Our analysis is based on a time segmentation technique which allows us to reduce a Markov chain with NM states into M Markov chains with N states and a one-dimensional chain with M states. Our results show that our policy significantly improves upon previously suggested approaches.

Considers a multi-user network that is shared by noncooperative users. Each user sets up virtual paths that optimize its own, selfish, performance measure. This measure accounts for both the guaranteed call level quality of service, as well as for the cost incurred for reserving the resource. The interaction between the user strategies is formalized as a game. The authors show that this game has a unique Nash equilibrium, and that it possesses a certain fairness property. They investigate the dynamics of this game, and prove convergence to the Nash equilibrium of both a Gauss-Seidel scheme and a Jacobi scheme. They extend their study to various general network topologies.