Regulatory policies such as EU privacy, HIPAA, and PCI-DSS place requirements on availability, integrity, migration, retention, and access of data, and compliance with such policies on stored data remains a key hurdle to cloud computing. This paper proposes a policy management service that offers scalable management of data retention policies attached to data objects stored in a cloud environment. An important aspect of any data retention service is permanent deletion of data. We achieve secure data deletion by encrypting the data when stored, and then deleting the encryption key at a specified retention time. Thus, we effectively delete the data object and its copies stored in online and offline environments. Our data retention service includes a highly scalable and secure encryption key store to manage encryption keys on-line. A prototype deployed on a 16-machine Linux cluster currently supports 56 MB/sec for encryption, 76 MB/sec for decryption, 31,000 retention policies/sec read and 15,000 retention policies/sec write.

Compliance with regulatory policies on data remains a key hurdle to cloud computing. Policies such as EU privacy, HIPAA, and PCI-DSS place requirements on data availability, integrity, migration, retention, and access, among many others. This paper proposes a policy management service that offers scalable management of data retention policies attached to data objects stored in a cloud environment. The management service includes a highly available and secure encryption key store to manage the encryption keys of data objects. By deleting the encryption key at a specified retention time associated with the data object, we effectively delete the data object and its copies stored in online and offline environments. To achieve scalability, our service uses Hadoop MapReduce to perform parallel management tasks, such as data encryption and decryption, key distribution and retention policy enforcement. A prototype deployed in a 16-machine Linux cluster currently supports 56 MB/sec for encryption, 76 MB/sec for decryption, 31,000 retention policies/sec read and 15,000 retention policies/sec write.

A key goal of the Services Oriented Architecture is the composition of independently written and managed services. However, managing access to these services has proven to be a problem. A particularly difficult case involves a service that invokes another service to satisfy an initial request. In a number of cases, implementations are able to achieve either the desired functionality or the required security, but not both at the same time. We say that this service composition suffers from the transitive access problem. We show that the problem arises from a poor choice of access control mechanism, one that uses subject authentication to make access decisions, and that the problem does not occur if we use delegatable authorizations.

The loss of customer account information makes headlines all too often. The Payment Card Industry (PCI) Data Security Standard (DSS) has generated resistance from merchants because of its cost and complexity. Unfortunately, innovating in the Point of Sale (PoS) space is hard because the protocols have been standardized, tightly constraining new ideas. Using mobile phones as payment devices opens up some opportunities, but any solution must minimize changes in the back-end processing. This paper describes a Near Field Communication (NFC) based mobile phone payment solution in a service-oriented environment, which provides the needed data protection without requiring costly changes to the payment processing infrastructure. In the payment transaction path, a personal mobile phone is viewed as a single, user-trusted touch point. Compared to other solutions available, our approach better protects user credentials, provides better user control over the transaction, and supports both proximity and remote transactions. The prototype has been integrated with an instore kiosk application and a HP multi-channel banking platform to demonstrate its value in the retail environment.

The mobile shopping assistant (MSA) is a mobile application platform to deliver real-time, in-store, and personalized services, such as personalized product offerings and in-store customer advisory support, to improve the shopping experiences of in-store customers. The service delivery network that powers the MSA involves retail stores and their business partners such as manufacturers. This paper presents the core technologies that we developed in this cross-organizational service network to support the MSA and its personalized services, with focus on service delivery, customer behavior understanding and information sharing. Our event-based techniques allow customers, stores and manufacturers to deliver and consume the services in a loosely coupled manner, thus solving a critical store-specific real-time engagement problem in a seamless way. Service response tracking enables the stores to construct a comprehensive view of a customerpsilas in-store shopping behavior. Finally, the cross-organizational authorization-based access control mechanism effectively enforces information sharing between the stores and their partners.

Most people agree with the statement, “There is an inevitable tension between usability and security. ” We don’t, so we set out to build a useful tool to prove our point. Since people in our line of work often share work on documents, such as this paper, we

We present a strategy for automatic negotiation that takes the same approach as computer programs that play games such as chess; we build the game tree. For every offer we look at every counteroffer, every counteroffer to each of them, and so on. The strategy then selects the counteroffer that has the largest expected payoff. A number of problems arise that are unique to using this strategy for negotiation. These include uncertainty in the opponent’s goals, the fact that a bad move can penalize both players, and moves that are continuous, as opposed to discrete. We show how the standard methods of building the tree and evaluating the results were adapted to this environment.

We present a framework for developing ontologies suitable for a dynamic environment, such as that for web services, and describe itsuse in a commercial system for resource discovery. This framework recognizes the importance of standards but allows for evolution in away that doesn't disrupt those adhering to the standards. The framework is based on the notion of discoverable resources which offer extensibility and security. The specific ontology we use in thesystem includes some salient features, such as attribute based matching rules and the corresponding constraint based search, attributes with dynamic values, and active queries.

We present division and square root algorithm for calculations with more bits than are handled by the floating-point hardware. These algorithms avoid the need to multiply two high-precision numbers, speeding up the last iteration by as much as a factor of 10. We also show how to produce the floating-point number closest to the exact result with relatively few additional operations.

No abstract available.

The Gordon Bell Prize recognizes significant achievements in the application of supercomputers to scientific and engineering problems.In this special session the winners of the 1990 pm"ze will give presentations about i!heir winning entries in the competition.

Explicit Runge-Kutta methods (RKMs) are among the most popular classes of formulas for the approximate numerical integration of nonstiff, initial value problems. However, high-order Runge-Kutta methods require more function evaluations per integration step than, for example, Adams methods used in PECE mode, and so, with RKMs, it is expecially important to avoid rejected steps. Steps are often rejected when certain derivatives of the solutions are very large for part of the region of integration. This corresponds, for example, to regions where the solution has a sharp front or, in the limit, some derivative of the solution is discontinuous. In these circumstances the assumption that the local truncation error is changing slowly is invalid, and so any step-choosing algorithm is likely to produce an unacceptable step. In this paper we derive a family of explicit Runge-Kutta formulas. Each formula is very efficient for problems with smooth solution as well as problems having rapidly varying solutions. Each member of this family consists of a fifty-order formula that contains imbedded formulas of all orders 1 through 4. By computing solutions at several different orders, it is possible to detect sharp fronts or discontinuities before all the function evaluations defining the full Runge-Kutta step have been computed. We can then either accpet a lower order solution or abort the step, depending on which course of action seems appropriate. The efficiency of the new algorithm is demonstrated on the DETEST test set as well as on some difficult test problems with sharp fronts or discontinuities.

A simple scheme is presented for computing the exponential of a floating point number using only shift, add, and multiply instructions. The algorithm involves no range reduction and handles overflow and underflow conditions automatically. It can be used to provide a result of any desired accuracy, provided only that sufficient precision is used during the calculation. The basic algorithm and three improvements are described. Both computational complexity and numerical precision are discussed. For the sake of symmetry, a method for computing the logarithm along similar lines is given.