Technology advances in areas such as sensors, IoT, and robotics, enable new collaborative applications (e.g., autonomous devices). A primary requirement for such collaborations is to have a secure system that enables information sharing and information flow protection. A policy-based management system is a key mechanism for secure selective sharing of protected resources. However, policies in each party of a collaborative environment cannot be static as they have to adapt to different contexts and situations. One advantage of collaborative applications is that each party in the collaboration can take advantage of the knowledge of the other parties for learning or enhancing its own policies. We refer to this learning mechanism as policy transfer. The design of a policy transfer framework has challenges, including policy conflicts and privacy issues. Policy conflicts typically arise because of differences in the obligations of the parties, whereas privacy issues result because of data sharing constraints for sensitive data. Hence, the policy transfer framework should be able to tackle such challenges by considering minimal sharing of data and supporting policy adaptation to address conflict. In the paper, we propose a framework that aims at addressing such challenges. We introduce a formal definition of the policy transfer problem for attribute-based access control policies. We then introduce the transfer methodology which consists of three sequential steps. Finally, we report experimental results.

Deep neural network models have been very successfully applied to Natural Language Processing (NLP) and Image based tasks. Their application to network analysis and management tasks is just recently being pursued. Our interest is in producing deep models that can be effectively generalized to perform well on multiple network tasks in different environments. A major challenge is that traditional deep models often rely on categorical features, but cannot handle unseen categorical values. One method for dealing with such problems is to learn contextual embeddings for categorical variables used by deep networks to improve their performance. In this paper, we adapt the NLP pre-training technique and associated deep model BERT to learn semantically meaningful numerical representations (embeddings) for Fully Qualified Domain Names (FQDNs) used in communication networks. We show through a series of experiments that such an approach can be used to generate models that maintain their effectiveness when applied to environments other than the one in which they were trained.

Policy-based access control systems are crucial for secure information sharing in collaborative applications. However, policy management needs to be flexible in order to adapt to different environments and be able to support policy evolution. However, when dealing with large sets of evolving policies, it is critical that policies meet certainpolicy quality requirements. Policy sets must be complete, free of inconsistencies, and relevant. In this paper, we propose a framework to analyze policies to determine whether they meet such requirements. Our framework uses provenance techniques to collect comprehensive data about actions which were either triggered due to a network context or a user (i.e., a human or a device) action. The framework includes two approaches for policy analysis: structure-based and classification-based. For the structure-based approach, we designed tree structures to organize and assess the policy set efficiently. For the classification-based approach, we employed the classification techniques to learn the characteristics of policies and predict their quality. In addition, the framework includes the policy evolution module which mainly consists of recommendation and re-evaluation services for policy changes which both aim at fulfilling the policy quality requirements. The analysis framework has been implemented and experimental results from the prototype are reported.

To facilitate information sharing between systems and devices in a distributed environment, unstructured data from various sensors must be analysed accordingly. Recent work has developed the notion of a context-dependant generative policy framework capable of learning generative policy models from strings and text-based data in a tabular format. However, it is vital that unstructured contextual information can be analysed alongside tabular data, potentially at the edge of the network to enable generative policy models to be applied to more complex tasks. This paper performs a deep-dive into the field of neuralsymbolic machine learning with a view towards enabling future neural-symbolic generative policy models that are capable of analysing both structured and unstructured data, whilst providing full transparency and enabling edge of network reasoning capability. Firstly, an existing technique called DeepProbLog is investigated and applied to a policy inferencing task based on unstructured data and secondly, a recent inductive logic programming technique currently used for learning generative policy models is evaluated with respect to a policy learning task also based on unstructured data. Finally, the results of both tasks are discussed to provide a platform for future research into enabling neural-symbolic generative policy models.

With the growing importance of data in all aspects of the functioning of an enterprise, having good quality of data is crucial in support of business processes. However, there do not exist good metrics to measure the quality of data that is available within an enterprise. While there are several data quality standards, their complexity and their required customization makes them difficult to use in real-world industrial scenarios. In this paper, we discuss the challenges encountered in measuring data quality within asset management systems. We propose a policy-based approach for measuring data quality, and show how such an approach can be customized and interpreted easily by practitioners in the field.

When creating real-world machine learning applications, system developers have to deal with the challenges of a dynamic environment where conditions change frequently, data has uncertainty, and new unanticipated situations are encountered. This requires a flexible approach in deciding how to use, adapt and create an AI model. Ensemble learning, where multiple models are trained, and use concurrently provides one way to address some of the issues. However, ensembles as used within the AI literature have primarily focused on creating a better model in a static environment. If we couple ensemble models with the concept of policy based control, we can create a system that is able to deal better with real-world scenarios. If we further augment the system so that it can generate its own policies, we can make progress towards the goal of a broad AI which can dynamically adapt itself. In this paper, we present an architecture for policy based ensemble, and show how it can lead to an approach towards broad AI.

Cyber phyiscal systems are increasingly connected to the Internet for reasons of convenience and efficiency. However, such cyber-physical systems are exposed to new vulnerabilities since they may be compromised by an attack from the Internet. In addition to traditional network security mechanisms, such systems need additional mechanism which can prevent the exploitation of their physical vulnerabilities. We propose an architecture in which the behavior of the system can be controlled by having it generate the policies for its own protection automatically.

Policy systems are critical for managing missions and collaborative activities carried out by coalitions involving different organizations. Conventional policy-based management approaches are not suitable for next-generation coalitions that will involve not only humans, but also autonomous computing devices and systems. It is critical that those parties be able to generate and customize policies based on contexts and activities. This paper introduces a novel approach for the autonomic generation of policies by autonomous parties. The framework combines context free grammars, answer set programs, and inductionbased learning. It allows a party to generate its own policies, based on a grammar and some semantic constraints, by learning from examples. The paper also outlines initial experiments in the use of such a symbolic approach and outlines relevant research challenges, ranging from explainability to quality assessment of policies.

Federated learning distributes model training among a multitude of agents, who, guided by privacy concerns, perform training using their local data but share only model parameter updates, for iterative aggregation at the server to train an overall global model. In this work, we explore how the federated learning setting gives rise to a new threat, namely model poisoning, which differs from traditional data poisoning. Model poisoning is carried out by an adversary controlling a small number of malicious agents (usually 1) with the aim of causing the global model to misclassify a set of chosen inputs with high confidence. We explore a number of strategies to carry out this attack on deep neural networks, starting with targeted model poisoning using a simple boosting of the malicious agent’s update to overcome the effects of other agents. We also propose two critical notions of stealth to detect malicious updates. We bypass these by including them in the adversarial objective to carry out stealthy model poisoning. We improve its stealth with the use of an alternating minimization strategy which alternately optimizes for stealth and the adversarial objective. We also empirically demonstrate that Byzantine-resilient aggregation strategies are not robust to our attacks. Our results indicate that highly constrained adversaries can carry out model poisoning attacks while maintaining stealth, thus highlighting the vulnerability of the federated learning setting and the need to develop effective defense strategies.

Policy-based mechanisms are used to implement desired autonomic behavior of a managed system in a distributed environment. For modern dynamically changing systems, policy-based mechanisms tend to be too rigid, and quickly lose their efficacy when conditions of the autonomous system change during its operation. In this paper, we propose a generative policy framework that can generate policies for an autonomous system when conditions change. For changed conditions, the policy generation manager dynamically generates new set of policies optimized for the new situation. As a use case, we demonstrate how our generative policy framework generates policies for selecting optimal data for an AI model training. The policies are dynamically generated based on the availability and trustworthiness of data in a coalition environment.

The paper proposes an attribute-based policy framework for a coalition setting in which multiple parties provide data to be used in data fusion processes while at the same time retaining control of how their own data are used in these processes. The framework consists of three main types of policies: (a) access control policies - these allow one to specify controls on the fusion process (e.g., which user can use which data fusion tool) and on the input data to the fusion process; (b) fusion policies - these allow one to specify whether data needs to be pre-processed before being used (for example, whether data must be anonymized before being used, or encrypted and thus fusions must be performed on encrypted data); and, (c) derived data usage policies - these allow one to specify who is authorized to access the data resulting from the fusion. As all these policies are attribute-based policies, they support high-level, flexible, and expressive policy specifications. The paper also briefly discusses technologies for supporting policy enforcement and novel approaches supporting the automatic generation of policies.

Artificial Intelligence (AI) in the context of military systems has frequently been portrayed as dangerous, and as leading to humanity being put in danger by an errant AI system, such as the Skynet imagined in the Terminator movie series. At the same time, the benefits of using AI in such systems are numerous. Therefore, we need to develop techniques that will let military systems benefit from the advances in AI, while ensuring that a system like Skynet never turns against humanity. In this paper, we examine the problem from the perspective of device management, a set of intelligent systems that manage themselves and determine their own policies. We discuss mechanisms that could be used to prevent these systems from becoming malignant.

Access control for information has primarily focused on access statically granted to subjects by administrators usually in the context of a specific system. Even if mechanisms are available for access revocation, revocations must still be executed manually by an administrator. However, as physical devices become increasingly embedded and interconnected, access control needs to become an integral part of the resource being protected and be generated dynamically by resources depending on the context in which the resource is being used. In this paper, we discuss a set of scenarios for access control needed in current and future systems and use that to argue that an approach for resources to generate and manage their access control policies dynamically on their own is needed. We discuss some approaches for generating such access control policies that may address the requirements of the scenarios.

With the advancement in the technology, deploying connected assets - especially intelligent autonomous assets - to obtain the evolving picture of dynamic environments are fast becoming a reality - and a need - for effective and efficient decision making. In such environments, these assets need to function in unison with each other to achieve the goals, and especially in a collaborative environments (e.g., coalition environments) they need to respect the constraints placed on them by the collective as well as by the owner parties. Typically, policies are used to govern such constraints and interactions, but the existing state-of-the-art relies on predefined user policies to achieve the effect, which is not scalable nor practical in collaborative and dynamic environments. Motivated by this observation and the recent uptake in learning technologies, in this paper, we present our vision on a framework that can (a) employ multiple techniques to create domain knowledge that can help assets to determine which policies are critical for which context, how to solve conflicts among policies, and how to autonomously generate and refine existing policies; (b) represent knowledge in a localized wiki-like approach so that fault tolerant knowledge discovery is supported; (c) provide efficient query interface for assets to discover needed knowledge in a secure manner; and (d) contextualize knowledge so as to enable other similar assets to quickly bootstrap or initialize themselves in unknown contexts when new events occur.

Generative policies enable devices to generate their own policies that are validated, consistent and conflict free. This autonomy is required for security policy generation to deal with the large number of smart devices per person that will soon become reality. In this paper, we discuss the research issues that have to be addressed in order for devices involved in security enforcement to automatically generate their security policies - enabling policy-based autonomous security management. We discuss the challenges involved in the task of automatic security policy generation, and outline some approaches based om machine learning that may potentially provide a solution to the same.

The proliferation of connected IoT devices creates a big data problem for AI based approaches. The response time required by such devices necessitates IoT data to be processed at the edge, but the edge typically lacks the resources to learn the AI models. We present an architecture which preserves the advantages of both edge processing and server-based/cloud-centric computing for AI algorithms. We discuss how policy management can be used to improve and support this architecture.

The increasing use of big data comes along with the problem of ensuring correct and secure data access. There is a need to maximise the data dissemination whilst controlling their access. Depending on the type of users different qualities and parts of data are shared. We introduce an alteration mechanism, more precisely a restriction one, based on a policy analysis language. The alteration reflects the level of trust and relations the users have, and are represented as policies inside the data sharing agreements. These agreements are attached to the data and are enforced every time the data are accessed, used or shared. We show the use of our alteration mechanism with a military use case, where different parties are involved during the missions, and they have different relations of trust and partnership.

With the proliferation of technology, connected and interconnected devices (henceforth referred to as IoT) are fast becoming a viable option to automate the day-to-day interactions of users with their environment—be it manufacturing or home-care automation. However, with the explosion of IoT deployments we have observed in recent years, manually governing the interactions between humans-to-devices—and especially devices-to- devices—is an impractical task, if not an impossible task. This is because devices have their own obligations and prohibitions in context, and humans are not equip to maintain a bird’s-eye-view of the interaction space. Motivated by this observation, in this paper, we propose an end-to-end framework that (a) automatically dis- covers devices, and their associated services and capabilities w.r.t. an ontology; (b) supports representation of high-level—and expressive—user policies to govern the devices and services in the environment; (c) pro- vides efficient procedur es to refine and reason about policies to automate the management of interactions; and (d) delegates similar capable devices to fulfill the interactions, when conflicts occur. We then present our initial work in instrumenting the framework and discuss its details.

Next-generation collaborative activities and missions will be carried out by autonomous groups of devices with a large variety of cognitive capabilities. These devices will have to operate in environments characterized by uncertainty, insecurity (both physical and cyber), and instability. In such environments, communications may be fragmented. Proper policy-based management of such autonomous device groups is thus critical. However current policy management systems have many limitations, including lack of flexibility. In this paper, we articulate novel architectural approaches addressing the requirements for the effective management of autonomous groups of devices and discuss the notion of generative policies - a novel paradigm that enhances the flexibility of policy-based approaches to management. In this paper, we also survey types of policy that are essential for managing device groups. Even though many such policy types exist in conventional settings, their use in our context poses novel challenges that we articulate in the paper. We also introduce a research roadmap discussing several research directions towards the development of a cognitive and flexible policy-based approach to the management of autonomous groups of devices for collaborative missions. Finally, as our proposed policy paradigm is data-intensive, we discuss the problem of supplying the data required for policy decisions in environments characterized by mobility, uncertainly, and fragmented communications.

The ability to incorporate intelligence in even small devices and to make use of contextual information from widely deployed sensors has already begun to change management paradigms. As edge computing and IoT become more prevalent, systems will increasingly consist of cooperating, heterogeneous, distributed, autonomous elements. Architectures for cognitive, collaborative systems are evolving to deal with such complex environments. Concepts from multi-agent systems and autonomic computing are being applied to cope with the scope and breadth of large collections of interacting devices and services. Technologies for security and access control must evolve as well. Policy-based mechanisms are widely used and have been very successful in protecting information and controlling access to systems and services. They tend to rely, however, on a centralized infrastructure and on the automated enforcement of directives. Newer paradigms are being investigated that allow policy structures to be more dynamic and contextual, while still preserving the desired levels of control. We will present trends in the evolution of architectures for distributed, federated systems, and the technologies for managing them.

Successful collaborations require information and resource sharing and thus adequate access control policy management systems that control sharing among the collaborating entities. Such management systems need to be flexible in order to adapt to different environments and thus be able to support access control policy evolution. However, when dealing with large sets of evolving policies it is critical that policies meet certain "policy quality requirements". Specifically, policies of interest must be up-to-date, complete, free of inconsistencies, relevant. In this paper, we propose an approach to analyze policies in order to determine whether policies meet such requirements. Our approach is based on the use of provenance techniques that collect comprehensive data about actions executed by users in the context of workflows, that is, sets of tasks executed according to some ordering by users. Provenance data are used by services that support various types of analysis to determine whether the policies of interest verify the quality requirements.

In a federated database system, each independent party exports some of its data for information sharing. The information sharing in such a system is very inflexible, as all peer parties access the same set of data exported by a party, while the party may want to authorize different peer parties to access different portions of its information. We propose a novel query evaluation scheme that supports differentiated access control with decentralized query processing. Anew efficient join method, named split-join, along with other safe join methods is adopted in the query planning algorithm. The generated query execution reduces the communication cost by pushing partial query computation to data sources in a safe way. The proofs of the correctness and safety of the algorithm are presented. The evaluation demonstrates that the scheme significantly saves the communication cost in a variety of circumstances and settings while enforcing autonomous and differentiated information sharing effectively.

Federated coalition networks are formed by interconnected nodes belonging to different friendly-but-curious parties cooperating for common objectives. Each party has its policy regarding what information may be accessed by which other parties. Data delivery in coalition networks must provide both confidentiality and robustness. First, data should remain confidential when passing through intermediate nodes belonging to parties not authorized to see its content. Second, data delivery has to be robust against dynamic topology changes caused by frequent node churn and failures. We utilize the technique of linear network coding to transform the original data into multiple coded packets and send them along different paths in a way such that no other party can reconstruct the data. This lightweight approach provides confidentiality and robustness for friendly-but-curious coalitions with much less complexity than cryptography methods. In addition, we formulate an optimization problem to find minimum-cost paths, and use column generation framework to address the huge number of variables. Based on the proposed algorithms, we develop a Robust Confidentiality Preserving (R-CP) data delivery protocol. Our evaluation demonstrates that the proposed method can find the optimum solution in several seconds for networks of a few thousands nodes, and deliver data at a high success rate.

With the growing adoption of Role-Based Access Control (RBAC) in commercial security and identity management products, how to facilitate the process of migrating a non-RBAC system to an RBAC system has become a problem with significant business impact. Researchers have proposed to use data mining techniques to discover roles to complement the costly top-down approaches for RBAC system construction. An important problem is how to construct RBAC systems with low complexity. In this article, we define the notion of weighted structural complexity measure and propose a role mining algorithm that mines RBAC systems with low structural complexity. Another key problem that has not been adequately addressed by existing role mining approaches is how to discover roles with semantic meanings. In this article, we study the problem in two primary settings with different information availability. When the only information is user-permission relation, we propose to discover roles whose semantic meaning is based on formal concept lattices. We argue that the theory of formal concept analysis provides a solid theoretical foundation for mining roles from a user-permission relation. When user-attribute information is also available, we propose to create roles that can be explained by expressions of user-attributes. Since an expression of attributes describes a real-world concept, the corresponding role represents a real-world concept as well. Furthermore, the algorithms we propose balance the semantic guarantee of roles with system complexity. Finally, we indicate how to create a hybrid approach combining top-down candidate roles. Our experimental results demonstrate the effectiveness of our approaches.

In spite of the large effort behind the development of the WBEM and CIM standards for the management of distributed systems, there has been very little work addressing security in those standards. In this paper we present a role-based access control (RBAC) policy language to render fine-grained access control policies for WBEM and CIM. The language is an extension of CIM-SPL, a preliminary DMTF policy language standard. The CIM-SPL RBAC extension fully complies with the WBEM standards. Access control policies can be specified for CIM object constructs according to the standard NIST RBAC model as well as with an extended model adapted for CIM. This extension provides a policy-based RBAC mechanism in the WBEM infrastructure.

Role-based provisioning has been adopted as a standard component in leading Identity Management products due to its low administration cost. However, the cost of adjusting existing roles to entitlements from newly deployed applications is usually very high. In this paper, a learning-based approach to automate the provisioning process is proposed and its effectiveness is verified by real provisioning data. Specific learning issues related to provisioning are identified and relevant solutions are presented.

With the growing adoption of role-based access control (RBAC) in commercial security and identity management products, how to facilitate the process of migrating a non-RBAC system to an RBAC system has become a problem with significant business impact. Researchers have proposed to use data mining techniques to discover roles to complement the costly top-down approaches for RBAC system construction. A key problem that has not been adequately addressed by existing role mining approaches is how to discover roles with semantic meanings. In this paper, we study the problem in two settings with different information availability. When the only information is user-permission relation, we propose to discover roles whose semantic meaning is based on formal concept lattices. We argue that the theory of formal concept analysis provides a solid theoretical foundation for mining roles from userpermission relation. When user-attribute information is also available, we propose to create roles that can be explained by expressions of user-attributes. Since an expression of attributes describes a real-world concept, the corresponding role represents a real-world concept as well. Furthermore, the algorithms we proposed balance the semantic guarantee of roles with system complexity. Our experimental results demonstrate the effectiveness of our approaches.

The objectives of this paper are twofold. First, we introduce a novel policy language, called CIM-SPL (simple policy language for CIM) that complies with the CIM (common information model) Policy Model and fully incorporates CIM constructs. Currently, the CIM standards from distributed management task force (DMTF) include a policy model, but there is no satisfactory way to render this policy model. CIM-SPL is a language that has been defined for this purpose. Second, we address design and implementation issues for policy languages in general, and for CIM-SPL in particular. The design of CIM-SPL was inspired by our previous experiences in designing various policy languages (e.g., PDL from Bell Laboratories, and ACPL from IBM) and lessons learned from studying other well-known policy languages (e.g., Ponder from Imperial College). We will discuss our design choices, evaluating the pros and cons of various alternatives. The ideas presented in this paper are meant to shed light on our design decisions, and provide guidance for those who want to build a CIM-based policy system or some other policy system in the future.

In this paper, we present a novel policy middleware architecture for managing IT systems and applications that span multiple networks and administrative domains. The proposed policy middleware provides a standard infrastructure for the creation, storage, distribution, and execution of policies, and helps in reducing the cost of making IT systems policy-aware. In particular, we focus on three aspects of the proposed policy middleware that help in making the middleware fully general: (1) a platform-neutral and extensible specification of policies; (2) the local ratification of policies, which lets system administrators accept, reject, or flag an incoming policy; and (3) the transformation of policies, which allows system administrators to transform incoming policies to match their local environment. We present our experience in building an application on the proposed middleware to audit the configuration of a storage area network. We also present performance results from a prototype and show that our policy middleware design can scale to handle a large number of policies.

In this paper, we present a novel distributed algorithm that dynamically selects game servers for a group of game clients participating in large scale interactive online games. The goal of server selection is to minimize server resource usage while satisfying the real-time delay constraint. We develop a synchronization delay model for interactive games and formulate the server selection problem, and prove that the considered problem is NP-hard. The proposed algorithm, called zoom-in-zoom-out, is adaptive to session dynamics (e.g. clients join and leave) and lets the clients select appropriate servers in a distributed manner such that the number of servers used by the game session is minimized. Using simulation, we present the performance of the proposed algorithm and show that it is simple yet effective in achieving its design goal. In particular, we show that the performance of our algorithm is comparable to that of a greedy selection algorithm, which requires global information and excessive computation.

Motivated by the need to enable easier data sharing and curb rising storage management costs, storage systems are becoming increasingly consolidated and thereby shared by a large number of users and applications. In such environments, service differentiation becomes increasingly important. Since caching is a fundamental and pervasive technique employed to improve the performance of storage systems, providing differentiated services from a storage cache is a crucial component of the entire end-to-end QoS solution. In this paper we discuss a QoS architecture for a shared storage proxy cache which can provide long-term hit rate assurances to competing classes. The proposed architecture consists of three components: (a) per-class feedback controllers that track the performance of each class, (b) a fairness controller that allocates excess resources fairly in the case when all goals are met, and (c) a contention resolver that decides cache allocation in the case when at least one class does not meet its target hit rate. We compare the performance of various feedback per-class controllers, and provide guidelines for designing QoS mechanisms for such a dynamic environment.

This paper proposes a novel approach for managing IP-based services and applications, reflecting the authors' experience with the IBM Global Network. It describes how one can extend the existing network and systems management paradigms to address problems in the management of application services hosted by network service providers (NSP). We introduce the concept of "service management domains" which are virtual domains built from resources and dependency relationships pertaining to physically monitored domains in the network management layer. They form the basis for managing fault, performance and service level agreements related to application service offerings.

Presents an approach for modeling and solving the problem of fault identification and alarm correlation in large communication networks. A single fault in a large network may result in a large number of alarms, and it is often very difficult to isolate the true cause of the fault. This appears to be one of the most important difficulties in managing faults in today's networks. The problem may become worse in the case of multiple faults. The authors present a general methodology for solving the alarm correlation and fault identification problem. They propose a new alarm structure, propose a general model for representing the network, and give two algorithms which can solve the alarm correlation and fault identification problem in the presence of multiple faults. These algorithms differ in the degree of accuracy achieved in identifying the fault, and in the degree of complexity required for implementation.>

A report is presented on efforts to develop and manage a model of a real-time computer system. The computer systems of interest are large-scale, IBM mainframe computers that run the MVS operating system. The model interacts with both the computer system itself, and with heterogeneous software modules designed to control and manage the computer system. The work indicates that even in rule-based environments, an object-oriented status-model manager provides valuable functionality.>

One of the inherent complexities associated with queueing models for store and forward data communications networks arises from the fact that messages typically preserve their length as they traverse the system. The interarrival and service sequences at queues internal to the network are thus dependent, making standard methods of analysis realistically inappropriate (except in an approximate sense). In an effort to find methods of dealing with such nonstandard queueing systems, a model for sparsely-connected networks (or network segments) called a message channel has been studied. A message channel is defined as a tandem connection of single server queues in which the successive service times experienced by any particular customer are scaled versions of the same random variable. A number of recent results concerning the delay properties of such systems are presented. These include: ordering relations for the successive waiting times in the channel; characterizations of waiting time properties under extreme conditions (simultaneous arrival of all customers): and, simple bounds on performance parameters for systems with uniformly bounded service processes. A general integral equation for the distribution of the equilibrium cumulative waiting time inGI/(G/1)^{M}queueing systems (which are instances of uniform message channels) is also derived. The solution of this equation for systems with discrete service time distributions and Poisson arrivals is indicated and explicitly exhibited for the case of two discrete levels (corresponding to a message switching system with two packet classes).

A retransmission Protocol for a broadcast connection (point-to-multipoint) is proposed and its performance characteristics are considered. The protocol is designed for transfers of large files Over a satellite channel that is time-shared to carry both the data from the broadcasting transmitter and the set of acknowledgments from the multiple receiver sites. A mathematical model of the transmission system that includes separate error processes for uplink and downlink errors on data transmissions, and similar processes for errors on the acknowledgment frames as well, is used to analyze the performance of the scheme. Exact analytical expressions for the relative throughput of the channel are obtained for two special cases: 1) the uplink is error-free; and 2) the acknowledgments are error-free. For the general case, upper and lower bounds are derived and are shown to be virtually indistinguishable for many practical sets of system parameters. The results demonstrate that the broadcasting of large files to multiple receivers can be done both efficiently and reliably.