Application caching is a key feature to enable fast application switches for mobile devices by caching the entire memory pages of applications in the device's physical memory. However, application caching requires a prohibitive amount of memory unless a swap feature is employed to maintain only the working sets of the applications in memory. Unfortunately, mobile devices often disable the invaluable swap feature as it can severely decrease the flash-based local storage device's already marginal lifespan due to the increased writes to the device. As a result, modern mobile devices suffering from the insufficient memory space end up killing memory-hungry applications and keeping only a few applications in the memory. In this paper, we propose CloudSwap, a fast and robust swap mechanism for mobile devices to enable the memory-oblivious application caching. The key idea of CloudSwap is to use the fast local storage as a cache of read-intensive swap pages, while storing prefetch-enabled, write-intensive swap pages in a cloud storage. To preserve the lifespan of the local storage, CloudSwap minimizes the number of writes to the local storage by storing the modified portions of the locally swapped pages in a cloud. To reduce the remote swap-in latency, CloudSwap exploits two cloud-assisted prefetch schemes, the app-aware read-ahead scheme and the access pattern-aware prefetch scheme. Our evaluation shows that the performance of CloudSwap is comparable to a fast, but lifespan-critical local swap system, with only 18% lifespan reduction, compared to the local swap system's 85% lifespan reduction.

In this work, we propose a Raptor codes-based energy-efficient multipath multimedia transport protocol over heterogeneous wireless networks (HetNets) in order to provide seamless high-quality video streaming service in an energy efficient way. In the proposed protocol, systematic Raptor codes are employed to mitigate the video quality degradation. For energy saving, the proposed protocol not only shapes a video stream into bursts, but also determines the Raptor encoding parameters including code rate, symbol size, and the number of source symbols for energy saving. The proposed protocol is fully implemented on an Android-based smartphone, and examined over real HetNets.

In this paper, we present the design and implementation of an Open Computing Language (OpenCL) framework that targets heterogeneous accelerator multicore architectures with local memory. The architecture consists of a general-purpose processor core and multiple accelerator cores that typically do not have any cache. Each accelerator core, instead, has a small internal local memory. Our OpenCL runtime is based on software-managed caches and coherence protocols that guarantee OpenCL memory consistency to overcome the limited size of the local memory. To boost performance, the runtime relies on three source-code transformation techniques, work-item coalescing, web-based variable expansion and preload-poststore buffering, performed by our OpenCL C source-to-source translator. Work-item coalescing is a procedure to serialize multiple SPMD-like tasks that execute concurrently in the presence of barriers and to sequentially run them on a single accelerator core. It requires the web-based variable expansion technique to allocate local memory for private variables. Preload-poststore buffering is a buffering technique that eliminates the overhead of software cache accesses. Together with work-item coalescing, it has a synergistic effect on boosting performance. We show the effectiveness of our OpenCL framework, evaluating its performance with a system that consists of two Cell BE processors. The experimental result shows that our approach is promising.

Although Xen's isolated driver domain (IDD) model enables strong system isolation by limiting the impact of driver faults to the driver domain itself, it results in severe security problems when malware in a guest domain tries to abuse mobile device's limited system resources by sending an extreme number of I/O requests to the IDD. In order to solve this problem, this paper presents a fine-grained I/O access control mechanism in an IDD. Requests from guest domains are managed by an accounting module in terms of CPU usage, with the calculation of estimated CPU consumption using regression equations. The requests are scheduled by an I/O access control enforcer according to security policies. As a result, our mechanism provides precise control on the CPU usage of a guest domain due to I/O device access, and prevents compromised guest domains from CPU overuse, performance degradation, and battery drain. We have implemented a prototype of our approach considering both network and storage devices with a real smart phone (SGH-i780) that runs two para-virtualized Linux kernels on top of Secure Xen on ARM. The evaluation shows our approach effectively protects a smart phone against excessive I/O attacks and guarantees availability.

Owing to the benefits of system virtualization, even CE devices have come to take advantage of the technology. However, due to the lack of windowing system which fits virtualization-based CE devices, it is not only inefficient but also difficult for end users to utilize the CE devices running multiple domains. In this paper we present an effective virtual window system for CE devices based on system virtualization. Our approach has three major advantages: (1) by modifying X window system, it provides shared windowing services between domains without dependency of a specific network protocol; (2) by providing a unified graphical user interface which integrates icons of all the applications from every domain, it frees users from remembering which applications are located in which domain and from doing tedious operations for application launching and installation; (3) it provides efficiency in terms of size (storage and memory) and performance to CE devices. We have implemented a prototype of the virtual window system on the basis of Secure Xen on ARM. Our evaluation shows that our approach is usable and efficient enough to be practically adopted for CE devices based on system virtualization.

System virtualization is now available for mobile devices allowing for many advantages. Two of the major benefits from virtualization are system fault isolation and security. The isolated driver domain (IDD) model, a widely adopted architecture, enables strong system fault isolation by limiting the impact of driver faults to the driver domain itself. However, excessive I/O requests from a malicious domain to an IDD can cause CPU overuse of the IDD and performance degradation of applications in the IDD and other domains that share the same I/O device with the malicious do-main. If the IDD model is applied to mobile devices, this failure of performance isolation could also lead to battery drain, and thus it introduces a new severe threat to mobile devices. In order to solve this problem, we propose a fine-grained I/O access control mechanism in an IDD. Requests from guest domains are managed by an accounting module in terms of CPU usage, with the calcula-tion of estimated CPU consumption using regression equations. The requests are scheduled by an I/O access control enforcer ac-cording to security policies. As a result, our mechanism provides precise control on the CPU usage of a guest domain due to I/O device access, and prevents malicious guest domains from CPU overuse, performance degradation, and battery drain. We have implemented a prototype of our approach considering both network and storage devices with a real smart phone (SGH-i780) that runs two para-virtualized Linux kernels on top of Secure Xen on ARM. The evaluation shows our approach effectively protects a smart phone against excessive I/O attacks and guarantees availability.

Mobile phones security is becoming an important issue because they are being connected to an Internet through wireless modem technologies. System virtualization technology provides trusted computing capability by running isolated multiple virtual machines under hypervisor. In this paper, we propose a design of system virtualization for ARM CPU architecture and describe implementation of prototype called Xen on ARM using Xen hypervisor. Secure and nonsecure guest Linux virtual machines are executing under Xen on ARM isolated with each other and virtualization overhead is shown to be moderate compared to native Linux running on bare metal H/W.

In this paper we present a multi-layer mandatory access control mechanism (ACM) for mobile devices based on system virtualization technology. We discuss a detailed threat model to mobile devices in the real world to develop an ACM fitted to mobile devices. Then, we propose a novel multi-layer access control mechanism for mobile devices, which provides strong protection against the identified mobile threats as well as performance efficiency. Our Virtual Machine Monitor (VMM) and secure domain have independent access control modules to effectively control mobile device's resources. Access control module at VMM controls access requests from a domain to physical/virtual resources in order to confine sharing resources among domains for confidentiality. It also protects a mobile device against DoS attacks draining limited system resources such as battery and memory to guarantee availability. In addition, access control at secure domain enforces fine-grained control of resources (e.g., file system access control) in upper layer without degrading performance of a mobile device due to additional hypercall invocations. Furthermore, there is no bypass of our access control since our ACM is placed inside VMM which is simple and small enough to verify its safety and we eliminated the chance of VMM corruption by checking integrity of VMM including ACM during bootstrap time.

Today, people usually find it difficult to work seamlessly on PCs in different places. It is mainly because the PCs have different computing environments in terms of versions of applications and desktop settings like fonts or languages. The Software Mobility technology enables people to use their own personalized computing environment on any PC ensuring seamless work We designed our Software Mobility solution with an visualization layer. Because this layer decouples applications from the operating system, applications can be moved and run on any PC without disruption. We will demonstrate our Software Mobility implementation that shows people can use Windows XP applications and user preference desktop settings on any PC without any installation or configuration.

Stateless computing is a new computing service focused on migrating user's computing contexts among different devices. In the near future, seamless computing will make computing environment easier to use and human centric. Users will not have spend time doing computing environment setup such as installation and upgrade. They will bring their own computing contexts, which consist of programs, files, and execution states, inside their pockets as saved in a small memory stick. The computing contexts will be restored on various devices, e.g. TV, desktops, mobile phone, PDA, etc. Our demonstration will show the early step to the seamless computing vision. We will demonstrate a seamless computing prototype which migrates computing contexts among different mobile embedded devices. The core technology inside the prototype which enables this computing state capability is the embedded virtual machine monitor (VMM), named as Secure Xen on ARM. We will migrate the whole state of a virtual machine between two HW platforms. Secure Xen on ARM run on the two platforms. A virtual machine running under the VMM on one platform is saved during its execution to USB memory stick, then the memory stick is plugged in to the other platform and the saved context is restored and continue execution of the virtual machine.

We will demonstrate a prototype of the beyond 3G mobile terminal based on system virtualization technology, which meets both security and flexibility requirements. In the proposed architecture, two domains, secure domain and normal domain, run on top of secure virtual machine monitor (VMM) which includes mandatory access control and domain integrity check mechanisms. Only security critical applications and services (e.g., banking, trading, and DRM) can run on the secure domain, and malware is prohibited from accessing the secure domain. Both flexibility and rich user experiences are provided by allowing users to install and execute application software, which might be potentially vulnerable, on the normal domain. Even in the case of malware attack, it cannot cause security threats to the secure domain because of the isolation and our access control features. This demonstration will show how secure our mobile terminal is against malware attacks compared to conventional single OS based mobile terminal.