In modern data centers, enterprise cloud instances run not only foreground applications like web and databases, but also different background services (e.g., backup, virus/compliance scan, batch) to manage the cloud instances securely and improve the overall resource utilization. These background services often incur resource storms that suddenly consume a lot of shared resources on cloud instances. The resource storms significantly degrade the performance of foreground applications by interfering in the preemption of the shared resources, resulting in frequent SLA violations. However, stock OS schedulers are not designed to handle these situations, and prior works are insufficient to address such resource storms under highly dynamic cloud workloads. This article presents Orchestra, a cloud-specific framework for controlling multiple applications in the user space, aiming at meeting corresponding SLAs. Orchestra takes an online approach with lightweight monitoring and performance models for both applications on the fly. It optimizes the resource allocations to meet corresponding SLAs. We evaluate the performance of Orchestra on a production cloud with a diverse range of SLAs. Orchestra guarantees the foreground application's performance SLAs at all times. At the same time, Orchestra maintains the background's performance by minimizing its performance penalty with proper allocation of the shared resources.

Predictive cloud resource management has been widely adopted to overcome the limitations of reactive cloud autoscaling. The predictive resource management is highly relying on workload predictors, which estimate short-/long-term fluctuations of cloud application workloads. These predictors tend to be pre-optimized for specific workload patterns. However, such predictors are still insufficient to handle real-world cloud workloads whose patterns may be unknown a priori, may dynamically change over time and may be irregular. As a result, these predictors often cause over-/under-provisioning of cloud resources. To address this problem, we have created CloudInsight, a novel cloud workload prediction framework, leveraging the combined power of multiple workload predictors. CloudInsight creates an ensemble model using multiple predictors to make accurate predictions for real workloads. The weights of the predictors in CloudInsight are determined at runtime with their accuracy for the current workload using multi-class regression. The ensemble model is periodically optimized to handle sudden changes in the workload. We evaluated CloudInsight with various real workload traces. The results show that CloudInsight has 13–27 percent higher accuracy than state-of-the-art predictors. Moreover, the results from trace-based simulations with a cloud resource manager show that CloudInsight has 15–20 percent less under-/over-provisioning periods, resulting in high cost-efficiency and low SLA violations.

Many predictive approaches have been proposed to overcome the limitations of reactive autoscaling on clouds. These approaches leverage workload predictors that are usually targeted for a particular workload pattern and can fail to handle real-world cloud workloads whose patterns may be unknown a priori, may dynamically change over time, or may be irregular. The result is that resources are frequently under-and overprovisioned. To address this problem, we create a novel cloud workload prediction framework called CloudInsight, leveraging the combined power of multiple workload predictors that collectively provide a "council of experts". The weights of the predictors in this ensemble model are determined in real-time based on their accuracy for current workload using multi-class regression. Under real workload traces, CloudInsight has 13% - 27% better accuracy than state-of-the-art predictors. It also has low overhead for predicting future workload changes (<; 100 ms) and creating a new ensemble workload predictor (<; 1.1 sec.).

This paper presents Orchestra, a cloud-specific framework for managing both foreground applications (e.g., Web, DBMS) and background services (e.g., backup, security check, batch jobs) in the user space. Orchestra is designed to address "resource storms" caused by sudden executions of the background services on the cloud instances. The resource storms significantly degrade the performance of foreground applications by interfering in the preemption of the shared resources, resulting in frequent SLA violations and poor user experience. Orchestra takes an online approach using lightweight monitoring and creates performance models for multiple cloud applications on the fly. It then optimizes the allocations of shared resources to meet SLAs. We evaluate the performance of Orchestra on a production cloud (Amazon EC2) with a diverse range of SLA requirements. The experiment results show that Orchestra successfully guarantees the foreground application's performance to meet its SLA targets at all times. Moreover, Orchestra maintains the background's performance by minimizing its performance penalty with proper allocation of the shared resources.

Data quality control is one of the most time consuming activities within Research Infrastructures (RIs), especially when involving observational data and multiple data providers. In this work we report on our ongoing development of data rogues, a scalable approach to manage data quality issues for observational data within RIs. The motivation for this work started with the creation of the FLUXNET2015 dataset, which includes carbon, water, and energy fluxes plus micrometeorological and ancillary data measured in over 200 sites around the world. To create an uniform dataset, including derived data products, extensive work on data quality control was needed. The unpredictable nature of observational data quality issues makes the automation of data quality control inherently difficult. Developed based on this experience, the data rogues methodology allows for increased automation of quality control activities by systematically identifying, cataloging, and documenting implementations of solutions to data issues. We believe this methodology can be extended and applied to others domains and types of data, making the automation of data quality control a more tractable problem.

According to a recent study, 30% of VMs in private cloud data centers are "comatose", in part because there is generally no strong incentive for their human owners to delete them at an appropriate time. These inactive VMs are still scheduled and executed on physical cloud resources, taking valuable access away from productive VMs. In an extreme, cloud infrastructure may deny legitimate requests for new VMs because capacity limits have been hit. It is not sufficient for cloud infrastructure to identify such inactive VMs by monitoring resource utilization (e.g., CPU utilization) - e.g., management processes (e.g. virus-scan, software update) on inactive VMs often consume high CPU and memory resources, and active VMs with lightweight jobs (e.g. text editing) show almost zero resource utilization. To properly detect and address such inactive VMs, we present iCSI: a cloud garbage VM collector to improve resource utilization and cost efficiency of enterprise data centers. iCSI includes three main components, a lightweight data collector, a VM identification model and a recommendation engine. The data collector periodically gathers primitive information from VMs. The identification model infers the purpose of a VM from the data collection and extracts the most relevant features associated with the purpose. The recommendation engine offers proper actions to end users i.e., suspending or resizing VMs. In this prototype phase, iCSI is deployed into multiple data centers in IBM and manages more than 750 production VMs. iCSI achieves 20% better accuracy (90%) in identifying active/inactive VMs compared with state-of-the-art methods. With recommendations to end users, our estimation results show that iCSI can improve internal cost efficiency with 23% and resource utilization more than 45%.

Many predictive resource scaling approaches have been proposed to overcome the limitations of the conventional reactive approaches most often used in clouds today. In general, due to the complexity of clouds, these reactive approaches were often forced to make significant limiting assumptions in either the operating conditions/requirements or expected workload patterns. As such, it is extremely difficult for cloud users to know which - if any - existing workload predictor will work best for their particular cloud activity, especially when considering highly-variable workload patterns, non-trivial billing models, variety of resources to add/subtract, etc. To solve this problem, we conduct comprehensive evaluations for a variety of workload predictors under real-world cloud configurations. The workload predictors cover four classes of 21 predictors: naive, regression, temporal, and non-temporal methods. We simulate a cloud application under four realistic workload patterns, two different cloud billing models, and three different styles of predictive scaling. Our evaluation confirms that no workload predictor is universally best for all workload patterns, and shows that Predictive Scaling-out + Predictive Scaling-in has the best cost efficiency and the lowest job deadline miss rate in cloud resource management, on average providing 30% better cost efficiency and 80% less job deadline miss rate compared to other styles of predictive scaling.

Public clouds become essential for many organizations to run their applications because they provide huge financial benefits and great flexibility. However, it is very challenging to accurately evaluate the performance and cost of applications without actual deployment on the clouds. Existing cloud simulators are generally designed from the perspective of cloud service providers, thus they can be under-developed for answering questions for the perspective of cloud users. To solve this prediction and evaluation problem, we created a Public Cloud IaaS Simulator (PICS). PICS enables the cloud user to evaluate the cost and performance of public IaaS clouds along with such dimensions like VM and storage service, resource scaling, job scheduling, and diverse workload patterns. We extensively validated PICS by comparing its results with the data acquired from real public IaaS cloud using real cloud-applications. We show that PICS provides highly accurate simulation results (less than 5% of average errors) under a variety of use cases. Moreover, we evaluated PICS' sensitivity with imprecise simulation parameters. The results show that PICS still provides very reliable simulation results with imprecise simulation parameters and performance uncertainty.

Given the variety of resources available in public clouds and locally (hybrid clouds), it can be very difficult to determine the best number and type of resources to allocate (and where) for a given activity. In order to solve this problem we first define the requested computation in terms of an Integer Linear Programming (ILP) problem and then use an efficient ILP solver to make a provisioning decision in a few milliseconds. Our approach is based on the two most important metrics for the user: cost and job execution time. Thus, based on the user's preferences we can favor solutions that optimize speed or cost or a certain combination of both (e.g. Cheapest solution that meets a certain deadline). We evaluate our approach with two classes of cloud applications: MapReduce applications, and Monte Carlo simulations. A significant advantage in our approach is that our solution has been proved optimal by the ILP solver, the set of the scheduling decisions based on our model are plotted on a time vs. Cost graph that forms a Pareto efficient frontier. This way, we can avoid the pitfalls of a naïve strategy that can lead to a great increase in cost (91%) or job running time (21%) compared to optimal.

Watershed delineation is a process to compute the drainage area for a point on the land surface, which is a critical step in hydrologic and water resources analysis. However, existing watershed delineation tools are still insufficient to support hydrologists and watershed researchers due to the lack of essential capabilities such as fully leveraging scalable and high performance computing infrastructure (public cloud), and providing predictable performance for the delineation tasks. To solve these problems, this paper reports on WDCloud, which is a system for large-scale watershed delineation on public cloud. For the design and implementation of WDCloud, we employ three main approaches: 1) an automated catchment search mechanism for a public data set, 2) three performance improvement strategies (Data-reuse, parallel-union, and MapReduce), and 3) local linear regression-based execution time estimator for watershed delineation. Moreover, WDCloud extensively utilizes several compute and storage capabilities from Amazon Web Services in order to maximize the performance, scalability, and elasticity of watershed delineation system. Our evaluations on WDCloud focus on two main aspects of WDCloud; the performance improvement for watershed delineation via three strategies and the estimation accuracy for watershed delineation time by local linear regression. The evaluation results show that WDCloud can achieve 18x-111x of speed-ups for delineating any scale of watersheds in the contiguous United States as compared to commodity laptop environments, and accurately predict execution time for watershed delineation with 85.6% of prediction accuracy, which is 23%-13% higher than other state-of-the-art approaches.

The cloud has proven itself as a scalable platform for Web-based applications. However, scientists and medical researchers are still searching for a simple cloud-based architecture that enables secure collaboration and sharing of distributed datasets. To date, attempts at using the cloud for this purpose generally view the cloud as simply a pool of servers upon which to run their legacy software. This approach fails to leverage the unique platform capabilities of the cloud. In this paper, we describe our Cloud Distributed Research Network (CloudDRN). We leverage the cloud for availability, reliability, scalability, and improved security as compared to legacy distributed systems while still supporting site autonomy. Our philosophy is to adapt commercial software tooling that was originally designed for business use-cases, thereby benefiting from the large built-in user community. We describe our general architecture and show an example of our system created to share distributed clinical research data. We evaluate our system in Amazon Web Services (AWS) and in Microsoft Windows Azure and find that while each cloud achieves similar financial cost, representative queries are 3.5x slower on average in Windows Azure.

It remains a challenge to provision resources in the cloud such that performance is maximized and financial cost is minimized. A fixed budget can be used to rent a wide variety of resource configurations for varying durations. The two steps - resource acquisition and scheduling/allocation - are dependent on each other and are particularly difficult when considering complex resource usage such as workflows, where task precedence need to be preserved and the budget constraint is assigned for the whole cloud application instead of every single job. The ability to acquire resources dynamically and trivially in the cloud - while being incredibly powerful and useful - exacerbates this particular resource acquisition and scheduling problem. In this paper, we design, implement and evaluate two auto-scaling solutions to minimize job turnaround time within budget constraints for cloud workflows. The scheduling-first algorithm distributes the application-wide budget to each individual job, determines the fastest execution plan and then acquires the cloud resources, while the scaling-first algorithm determines the size and the type of the cloud resources first and then schedules the workflow jobs on the acquired instances. The scaling-first algorithm shows better performance when the budget is low while the scheduling-first algorithm performs better when the budget is high. The two algorithms can reduce the job turnaround time by 9.6% - 45.2% compared to choosing a fixed general machine type. Moreover, they show good tolerance (between -10.2% and 16.7%) to inaccurate parameters (±20% estimation error).

One of many advantages of the cloud is the elasticity, the ability to dynamically acquire or release computing resources in response to demand. However, this elasticity is only meaningful to the cloud users when the acquired Virtual Machines (VMs) can be provisioned in time and be ready to use within the user expectation. The long unexpected VM startup time could result in resource under-provisioning, which will inevitably hurt the application performance. A better understanding of the VM startup time is therefore needed to help cloud users to plan ahead and make in-time resource provisioning decisions. In this paper, we study the startup time of cloud VMs across three real-world cloud providers -- Amazon EC2, Windows Azure and Rackspace. We analyze the relationship between the VM startup time and different factors, such as time of the day, OS image size, instance type, data center location and the number of instances acquired at the same time. We also study the VM startup time of spot instances in EC2, which show a longer waiting time and greater variance compared to on-demand instances.

Cloud computing offers many possibilities for prospective users, there are however many different storage and compute services to choose from between all the cloud providers and their multiple datacenters. In this paper we focus on the problem of selecting the best storage services according to the application's requirements and the user's priorities. In previous work we described a capability based matching process that filters out any service that does not meet the requirements specified by the user. In this paper we introduce a mathematical model that takes this output lists of compatible storage services and constructs an integer linear programming problem. This ILP problem takes into account storage and compute cost as well as performance characteristics like latency, bandwidth, and job turnaround time, a solution to the problem yields an optimal assignment of datasets to storage services and of application runs to compute services. We show that with modern ILP solvers a reasonably sized problem can be solved in one second, even with an order of magnitude increase in cloud providers, number of datacenters, or storage services the problem instances can be solved under a minute. We finish our paper with two use cases, BLAST and MODIS. For MODIS our recommended data allocation leverages both cloud and local resources, it incurs in half the cost of a pure cloud solution and the job turnaround time is 52% faster compared to a pure local solution.

Understanding hydrologic systems at the scale of large watersheds and river basins is critically important to society when faced with extreme events, such as floods and droughts, or with concerns about water quality. A critical requirement of watershed modeling is model calibration, in which the computational model's parameters are varied during a search algorithm in order to find the best match against physically-observed phenomena such as streamflow. Because it is generally performed on a laptop computer, this calibration phase can be very time-consuming, significantly limiting the ability of a hydrologist to experiment with different models. In this paper, we describe our system for watershed model calibration using cloud computing, specifically Microsoft Windows Azure. With a representative watershed model whose calibration takes 11.4 hours on a commodity laptop, our cloud-based system calibrates the watershed model in 43.32 minutes using 16 cloud cores (15.78x speedup), 11.76 minutes using 64 cloud cores (58.13x speedup), and 5.03 minutes using 256 cloud cores (135.89x speedup). We believe that such speed-ups offer the potential toward real-time interactive model creation with continuous calibration, ushering in a new paradigm for watershed modeling.

To perform computational experiments at greater scale and in less time, enterprises are increasingly looking to dynamically expand their computing capabilities through the temporary addition of cloud resources (aka "cloudbursting"). Computational infrastructure can be dismantled in minutes with no long-term capital investments. However, research is needed to identify which properties of an application best determine the potential benefits of cloudbursting. For example, there are certainly situations where the cost to transfer the necessary input data from the enterprise to the cloud (to execute the application in the cloud) outweighs the value of simply waiting until resources become available in-house. To better understand and quantify these general issues, we perform a concrete analysis of the value of cloudbursting for a large-scale application we have previously created to process and derive environmental results from satellite imagery. More specifically, we compare three versions of the application (an all-cloud design, a version that runs in-house on our cluster, and a hybrid cloudbursting version) on dimensions of debug ability, fault tolerance, correctness, economics, usability, and run-time speed. We find that for our application, cloudbursting is effective primarily because we were able to design the application so that its I/O behavior does not preclude remote (cloud) execution, we were able to minimize developmental cost by constructing a cloud run-time environment that is very similar to our in-house environment, and we achieve good run-time performance in our cloud-based executions (for example, we describe how a representative computation that takes 2 ½ hours in-house is completed in 35 minutes via cloudbursting). By generalizing this analysis, we believe that we contribute guidance to the broader community on the value of cloudbursting for escience applications.

A goal in cloud computing is to allocate (and thus pay for) only those cloud resources that are truly needed. To date, cloud practitioners have pursued schedule-based (e.g., time-of-day) and rule-based mechanisms to attempt to automate this matching between computing requirements and computing resources. However, most of these "auto-scaling" mechanisms only support simple resource utilization indicators and do not specifically consider both user performance requirements and budget concerns. In this paper, we present an approach whereby the basic computing elements are virtual machines (VMs) of various sizes/costs, jobs are specified as workflows, users specify performance requirements by assigning (soft) deadlines to jobs, and the goal is to ensure all jobs are finished within their deadlines at minimum financial cost. We accomplish our goal by dynamically allocating/deallocating VMs and scheduling tasks on the most cost-efficient instances. We evaluate our approach in four representative cloud workload patterns and show cost savings from 9.8% to 40.4% compared to other approaches.

Historically, batch scheduling has dominated the management of High-Performance Computing (HPC) resources. One of the most significant limitations using this approach is an inability to predict both the start time and end time of jobs. Although existing researches such as resource reservation and queue-time prediction partially address this issue, a more predictable HPC system is needed, particularly for an emerging class of adaptive real-time HPC applications. This paper presents a design and implementation of a predictable HPC system using feedback control and admission control. By creating a virtualized application layer and opportunistically multiplexing concurrent applications through the application of formal control theory, we regulate a job's progress such that the job meets its deadline without requiring exclusive access to resources even in the presence of a wide class of unexpected events. Admission control regulates access to resources when oversubscribed. Our experimental results using five widely used applications show that the feedback and admission controller achieves highly predictable HPC system. The designed feedback controller regulates the HPC job's progress accurately, close to the prediction by theory, thereby, showing the successful application of classic control theory to HPC workloads. In week-long experiments, over 90 percent of jobs met deadlines and the jobs missing deadlines still finished close to the requested deadlines (12.4 percent error).

One of the large impediments for adoption of cloud computing is perceived vendor lock-in with respect to both low-level resource management and application-level storage services. Application portability is essential to both avoid lock-in as well as leverage the ever-changing landscape of cloud offerings. We present a storage abstraction layer to enable applications to both utilize the highly-available and scalable storage services provided by cloud vendors and be portable across platforms. The abstraction layer, called CSAL, provides Blob, Table, and Queue abstractions across multiple providers and presents applications with an integrated namespace thereby relieving applications of having to manage storage entity location information and access credentials. Overall, we have observed minimal overhead of CSAL on both EC2 and Windows Azure.

It can be natural to believe that many of the traditional issues of scale have been eliminated or at least greatly reduced via cloud computing. That is, if one can create a seemingly well functioning cloud application that operates correctly on small or moderate-sized problems, then the very nature of cloud programming abstractions means that the same application will run as well on potentially significantly larger problems. In this paper, we present our experiences taking MODISAzure, our satellite data processing system built on the Windows Azure cloud computing platform, from the proof-of-concept stage to a point of being able to run on significantly larger problem sizes (e.g., from national-scale data sizes to global-scale data sizes). To our knowledge, this is the longest-running eScience application on the nascent Windows Azure platform. We found that while many infrastructure-level issues were thankfully masked from us by the cloud infrastructure, it was valuable to design additional redundancy and fault-tolerance capabilities such as transparent idempotent task retry and logging to support debugging of user code encountering unanticipated data issues. Further, we found that using a commercial cloud means anticipating inconsistent performance and black-box behavior of virtualized compute instances, as well as leveraging changing platform capabilities over time. We believe that the experiences presented in this paper can help future eScience cloud application developers on Windows Azure and other commercial cloud providers.

A significant open issue in cloud computing is performance. Few, if any, cloud providers or technologies offer quantitative performance guarantees. Regardless of the potential advantages of the cloud in comparison to enterprise-deployed applications, cloud infrastructures may ultimately fail if deployed applications cannot predictably meet behavioral requirements. In this paper, we present the results of comprehensive performance experiments we conducted on Windows Azure from October 2009 to February 2010. In general, we have observed good performance of the Windows Azure mechanisms, although the average 10 minute VM startup time and the worst-case 2x slowdown for SQL Azure in certain situations -relative to commodity hardware within the enterprise- must be accounted for in application design. In addition to a detailed performance evaluation of Windows Azure, we provide recommendations for potential users of Windows Azure based on these early observations. Although the discussion and analysis is tailored to scientific applications, the results are broadly applicable to the range of existing and future applications running in Windows Azure.

The combination of low-cost sensors, low-cost commodity computing, and the Internet is enabling a new era of data-intensive science. The dramatic increase in this data availability has created a new challenge for scientists: how to process the data. Scientists today are envisioning scientific computations on large scale data but are having difficulty designing software architectures to accommodate the large volume of the often heterogeneous and inconsistent data. In this paper, we introduce a particular instance of this challenge, and present our design and implementation of a MODIS satellite data reprojection and reduction pipeline in the Windows Azure cloud computing platform. This cloud-based pipeline is designed with a goal of hiding data complexities and subsequent data processing and transformation from end users. This pipeline is highly flexible and extensible to accommodate different science data processing tasks, and can be dynamically scaled to fulfill scientists' various computational requirements in a cost-efficient way. Experiments show that by running a practical large-scale science data processing job in the pipeline using 150 moderately-sized Azure virtual machine instances, we were able to produce analytical results in nearly 90× less time than was possible with a high-end desktop machine. To our knowledge, this is one of the first eScience applications to use the Windows Azure platform.

Abstract Carbon‐climate, like other environmental sciences, has been changing. Large‐scale synthesis studies are becoming more common. These synthesis studies are often conducted by science teams that are geographically distributed and on data sets that are global in scale. A broad array of collaboration and data analytics tools are now available that could support these science teams. However, building tools that scientists actually use is difficult. Also, moving scientists from an informal collaboration structure to one mediated by technology often exposes inconsistencies in the understanding of the rules of engagement between collaborators. We have developed a scientific collaboration portal, calledfluxdata.org, which serves the community of scientists providing and analyzing the global FLUXNET carbon‐flux synthesis data set. The key things we learned or re‐learned during our portal development include: minimize the barrier to entry, provide features on a just‐in‐time basis, development of requirements is an on‐going process, provide incentives to change leaders and leverage the opportunity they represent, automate as much as possible, and you can only learn how to make it better if people depend on it enough to give you feedback. In addition, we also learned that splitting the portal roles between scientists and computer scientists improved user adoption and trust. The fluxdata.org portal has now been in operation for ∼2 years and has become central to the FLUXNET synthesis efforts. Published in 2010 by John Wiley & Sons, Ltd.

Abstract The cancer Biomedical Informatics Grid (caBIG) is revolutionizing the way medical researchers share information and collaborate. A key to caBIG's continued success will be interoperability. However, to date, only a single code base (in Java) has been used to create a set of tools and run‐time services for caBIG. This paper presents the first significant exploration into the use of Microsoft's .NET Framework and Visual Studio for caBIG. Given its substantial existing community, a .NET‐based set of tools for caBIG can significantly increase the pool of qualified software designers and developers for caBIG. Arguably more importantly, a second development foundation could facilitate revisiting a broad set of design decisions made to date in caBIG that have perhaps been unduly based directly or indirectly on a single underlying software technology. We begin by describing issues we have encountered in building relatively simple .NET‐based clients to existing caBIG services. Next, we describe how we leverage Microsoft ADO.NET Data Services as the foundation for caBIG Data Services, in particular for the caBIO data set. We find that ADO.NET Data Services has a uniquely strong potential to facilitate rapid development and deployment. We conclude with a discussion of the roadmap of our project's future activities. Copyright © 2010 John Wiley & Sons, Ltd.

Unpredictable access to batch-mode HPC resources is a significant problem for emerging dynamic data-driven applications. Although efforts such as reservation or queue-time prediction have attempted to partially address this problem, the approaches strictly based on space-sharing impose fundamental limits on real-time predictability. In contrast, our earlier work investigated the use of feedback-controlled virtual machines (VMs), a time-sharing approach, to deliver predictable execution. However, our earlier work did not fully address usability and implementation efficiency. This paper presents an online, software-only version of feedback controlled VM, called self-tuning VM, which we argue is a practical approach for predictable HPC infrastructure. Our evaluation using five widely-used applications show our approach is both predictable and practical: by simply running time-dependent jobs with our tool, we meet a jobpsilas deadline typically within 3% errors, and within 8% errors for the more challenging applications.

Many of today's large-scale scientific projects attempt to collect data from a diverse set of sources. The traditional campaign-style approach to ¿synthesis¿ efforts gathers data through a single concentrated effort, and the data contributors know in advance exactly who will use their data and why. At even moderate scales, the cost and time required to find, gather, collate, normalize, and customize data in order to build a synthesis dataset can quickly outweigh the value of the resulting dataset. By explicitly identifying and addressing the different requirements for each data role (author, publisher, curator, and consumer), our data management architecture for large-scale shared scientific data enables the creation of such synthesis datasets that continue to grow and evolve with new data, data annotations, participants, and use rules. We show the effectiveness of our approach in the context of the FLUXNET Synthesis Dataset, one of the largest ongoing biogeophysical experiments.

Abstract After seven years of life the Open Grid Forum (OGF), previously the Global Grid Forum, is beginning to produce standards that meet the needs of the community and that are being adopted by commercial and open source software providers. Accessing computational resources, specifically high performance computing (HPC) resources, is a usage scenario that predates the emergence of the Grid, is well understood within the community, and is represented in numerous gathered use cases in different areas of Grid computing. Building on this consensus the HPC Profile Working Group was established within the OGF to standardize access to HPC resources. Its first specification, the HPC Basic Profile 1.0 has been developed and has established interoperability within the community. Alongside the development of this protocol, another group within the OGF, the Simple API for Grid Applications (SAGA) working group has been defining a programmatic interface relevant to application developers that encompasses access to compute resources. This paper examines the relationship between the ‘standard’ protocol of the HPC Basic Profile and the programmatic interface of SAGA to access compute resources and assesses how well these address the problems faced by the community of users and application developers. Copyright © 2009 John Wiley & Sons, Ltd.

Existing workflow systems attempt to achieve high performance by intelligently scheduling tasks on resources, sometimes even attempting to move the largest data files on the highest-capacity links. However, such approaches are inherently limited, in that there is only minimal control available regarding the arrival time and rate of data transfer between nodes, resulting in unbalanced workflows in which one task is idle while waiting for data to arrive. This paper describes a data throttling framework that can be exploited by workflow systems to uniquely regulate the rate of data transfers between the workflow tasks via a specially-created QoS-enabled GridFTP server. Our workflow planner constructs a schedule that both specifies when/where individual tasks are to be executed, as well as when and at what rate data is to be transferred. Simulation results involving a simple workflow indicate that our system can achieve a 30% speedup when nodes show a computation/communication ratio of approximately 0.5. We reinforce and confirm these results via the actual implementation of the Montage workflow in the wide area, obtaining a maximum speedup of 31% and an average speedup with 16%. Overall, we believe that our data throttling grid workflow system both executes workflows more efficiently (by better establishing balanced workflow graphs) and operates more cooperatively with unrelated concurrent grid activities by consuming less overall network bandwidth, allowing such unrelated activities to execute more efficiently as well.

The emerging class of adaptive, real-time, data-driven applications is a significant problem for today's HPC systems. In general, it is extremely difficult for queuing-system-controlled HPC resources to make and guarantee a tightly-bounded prediction regarding the time at which a newly-submitted application will execute. While a reservation-based approach partially addresses the problem, it can create severe resource under-utilization (unused reservations, necessary scheduled idle slots, underutilized reservations, etc.) that resource providers are eager to avoid. In contrast, this paper presents a fundamentally different approach to guarantee predictable execution. By creating a virtualized application layer called the performance container, and opportunistically multiplexing concurrent performance containers through the application of formal feedback control theory, we regulate the job's progress such that the job meets its deadline without requiring exclusive access to resources even in the presence of a wide class of unexpected disturbances. Our evaluation using two widely-used applications, WRF and BLAST, on an 8-core server show our approach is predictable and meets deadlines with 3.4 % of errors on average while achieving high overall utilization.

Numerous Grid workflow engines exist, each generally specialized for a single application domain such as protein folding. Although the underlying purpose and functionality of the Grid workflow engines are similar, and they make use of a common set of Grid protocols, the implementations vary vastly, making interoperation among them nearly impossible. On the other hand, the concept of workflows of Web services is very popular in the enterprise domain and many engines exist for business workflows. These mostly revolve around the Business Process Execution Language (BPEL), an emerging standard for Web services workflow description. We study three different business workflow engines - Microsoft's BizTalk Server, Microsoft's Windows Workflow Foundation and Oracle's Business Process Manager and analyze how each of these engines can be adapted to e-science and the Grid environment. We have implemented widely-used grid workflows on each of these engines and show quantitatively and qualitatively that each business engine has positive and negative aspects for large-scale e-science.

E-Science often requires access to remote Grid computing platforms. Current authorization systems on these remote systems have largely based decisions solely on the identity of the submitter -- the job is permitted to execute on the local resource if the job originates from an authenticated and authorized end-user. The problem with this approach is that there is no consideration to what the job will/should do when executed, so an errorful or malicious job -- even from what purports to be a trusted user -- can create significant damage before an operator notices and can kill or suspend the job. This paper presents a novel end-to-end job execution framework in which the properties (behavior) of the job are taken into account for the authorization decision. Experimental results show the duration to perform the authorization and to establish a subsequent restrictive execution context is sufficiently low -- our observed overhead of 253.1 ms on commodity hardware is an acceptable cost for most Grid applications to pay to achieve this more secure execution environment.

Grid computing involves networks of heterogeneous resources working in collaboration to solve problems that cannot be addressed by the resources of any one organization. A pervasive problem for grid users is how best to discover the resources they need given dynamic grid environments. UDDI, the universal description, discovery and integration framework, is an OASIS standard for publishing and querying discovery information for Web services, which to date, has received surprisingly little analysis as a discovery mechanism for Web service-based grids, e.g. those based on the open grid services architecture (OGSA). This work identifies issues that must be addressed in order to make UDDI meet the requirements of OGSA discovery. We examine the performance implications of these issues using a freely available implementation of UDDI version 2. Based on our experimental results, we conclude that UDDI can be used for OGSA discovery, but the cost may be prohibitive for large grids.

Grid portals are an increasingly popular mechanism for creating customizable, Web-based interfaces to Grid services and resources. Due to the powerful, general-purpose nature of Grid technology, the security of any portal or entry point to such resources cannot be taken lightly. This is particularly true if the portal is running inside of a trusted perimeter, such as a Science Gateway running on an SDSC machine for access to the TeraGrid. To evaluate the current state of Grid portal security, we undertake a comparative analysis of the three most popular Grid portal frameworks that are being pursued as frontends to the TeraGrid: GridSphere, OGCE and Clarens. We explore general challenges that Grid portals face in the areas of authentication (including user identification), authorization, auditing (logging) and session management then contrast how the different Grid portal implementations address these challenges. We find that although most Grid portals address these security concerns to a certain extent, there is still room for improvement, particularly in the areas of secure default configurations and comprehensive logging and auditing support. We conclude with specific recommendations for designing, implementing and configuring secure Grid portals.

The Web services resource framework defines conventions for managing state in distributed systems based on Web services, and WS-notification defines topic-based publish/subscribe mechanisms. We analyze five independent and quite different implementations of these specifications from the perspectives of architecture, functionality, standards compliance, performance, and interoperability. We identify both commonalities among the different systems (e.g., similar dispatching and SOAP processing mechanisms) and differences (e.g., security, programming models, and performance). Our results provide insights into effective implementation approaches. Our results may also provide application developers, system architects, and deployers with guidance in identifying the right implementation for their requirements and in determining how best to use that implementation and what to expect with regard to performance and interoperability.

User authentication is a crucial security component for most computing systems. But since the security needs of different systems vary widely, authentication mechanisms are similarly diverse. In particular, independently-managed Web and grid services vary with regard to the type of security token (credential) used to prove user identity (username/password, X.509 signing, Kerberos, etc.). Forcing users to manage and present credentials manually for each service is tedious, error-prone and potentially insecure. In contrast, we present CredEx, an open-source, standards-based Web service that facilitates the secure storage of credentials and enables the dynamic exchange of different credential types using the WS-Trust token exchange protocol. With CredEx, a user can achieve single sign-on by acquiring a single (default) credential then dynamically exchanging that credential as needed for services that authenticate a different way. We describe the design and implementation of CredEx by focusing on its use in bridging password-based Web services and PKI-based grid services, illustrating how interoperability between these realms can be based upon the WS-Security and WS-Trust specifications.

Users of Web and grid services often must temporarily delegate some or all of their rights to a software entity to perform actions on their behalf. The problem with the typical grid services approach (X. 509 proxy certificates) is that commercial Web services tooling fails to recognize these certificates or process them properly. The security assertion markup language (SAML) is a standardized XML-based framework for exchanging authentication, authorization and attribute information. SAML has broadening commercial support but lacks delegation capabilities. To address this shortcoming, we exploit SAML's inherent extensibility to create a delegation framework for Web and grid services that supports both direct and indirect delegation. We develop a set of verification rules for delegation tokens that rely on WS-Security X.509 signatures, but do not force any trust relationship between the delegatee and the target service. We have implemented the framework on two common Web service hosting environments: Java/Tomcat and .NET. By leveraging existing Web services standards, we make it easier for Grid practitioners to build and consume Web and grid services without resorting to grid-specific protocols.

The Open Grid Services Architecture (OGSA) has been a major step forward for Grid Computing, but its de facto reliance on the Web Services Resource Framework (WSRF) and WS-Notification have left some in the community questioning if the Grid software and protocols have become too complex. In this paper, we consider the feasibility of an "alternative" software stack, based on WS-Transfer and WS-Eventing. We compare and evaluate WSRF/WS-Notification vs. WS-Transfer/WSEventing, first via a "hello world" service and then via a more complete Grid scenario for remote execution called "Grid-in-a-Box". By qualitatively and quantitatively evaluating each approach, we find that while subtle differences exist (e.g., the naming of resources, the creation of resources), the stacks are overwhelmingly equivalent in their functionality and implied performance. Overall, this paper uniquely shows that there could be alternative software stacks for OGSA-based Grids.

Securing a Grid environment presents a distinctive set of challenges. This work groups the activities that need to be secured into four categories: naming and authentication; secure communication; trust, policy, and authorization; and enforcement of access control. It examines the current state of the art in securing these activities and introduces new technologies that promise to meet the security requirements of Grids more completely.

Abstract The MyProxy online credential repository has been used by the Grid computing community for over four years for managing security credentials in the Grid public key infrastructure. MyProxy improves usability by giving users access to their credentials over the network using password authentication, allowing users to delegate their credentials via Web browser interfaces to the Grid, and supporting credential renewal for long‐running jobs. MyProxy helps administrators secure users' private keys by providing an online service from which users retrieve short‐lived credentials without distributing long‐lived keys to potentially vulnerable end‐systems. This paper describes the MyProxy system and its use. Copyright © 2005 John Wiley & Sons, Ltd.

Abstract As Grid deployments increase, the challenge remains to create a scalable, multi‐organizational authentication infrastructure. Public key infrastructures (PKIs) are widely used for authentication in Grids, due in large part to the success of the Globus toolkit, despite the challenges and difficulties both for PKI administrators and users. The Bridge Certificate Authority (CA) is a compromise between a strictly hierarchical PKI and a mesh PKI and achieves many of the benefits of the hierarchical PKI and mesh PKI but has been untested for use with Grid software. This paper reports on the use of a Bridge CA with two representative Grid software packages: the Globus Toolkit v2 and WSRF.NET. We find that both packages support Bridge CAs sufficiently today to be usable in Grid software architectures, although not without limitations. In this paper, and through these experiments, we build the case for using Bridge CAs for Grid computing. Copyright © 2005 John Wiley & Sons, Ltd.

The Open Grid Service Infrastructure (OGSI) has been designed to facilitate the creation of multiple, interoperable Grid service hosting environments, but to date only one fully OGSI-compliant hosting environment exists, Globus Toolkit version 3 (GT3). This paper describes the design and implementation of OGSI.NET, which is the second, independent hosting environment that is fully compliant with the OGSI specification. While the Microsoft suite of Visual Studio, Internet Information Services (IIS), and the Web Services Enhancements (WSE) provide a robust foundation upon which we implemented OGSI.NET, the challenges included constructing the Grid service container, parsing OGSI WSDL ("gwsdl"), and supporting Grid service handles (GSH). By describing our approach to these challenges, and by describing the unique Grid attribute programming. model we are developing as part of OGSI.NET, we contribute an early evaluation of OGSI and the broader Open Grid Services Architecture (OGSA).

The compact, mobile device, such as the PocketPC, is often regarded as little more than a handy, smaller "portal" by which to access information kept on larger back-end machines such as exchange servers and WWW servers. However, the true value of the device may ultimately result from more sophisticated approaches by which the device can fully recognize and change its behavior based on its context, such as location, remaining battery life, available networking, and user preferences. We present "UVa Bus.NET", a testbed at the University of Virginia for developing and evaluating general, context-aware, mobile solutions. We use .NET, .NET Compact Framework, GPS-enabled devices, and wireless networking inside buildings to notify students and professors of impending appointments and class meetings, give directions to their next appointment, and even direct them to the real-time location of the most appropriate bus to catch. The longer-term goals of UVa Bus.NET are also presented: to provide a more predictable experience to mobile device users by hiding and otherwise managing resource limitations.

A significant challenge for Computer Science departments is how best to get new graduate students involved with their chosen research projects. Ideally, the incoming graduate students will as a whole have both a solid understanding of computing principles behind large-scale software development and a broad "skill set", e.g., for conducting systems-oriented research. This rarely occurs, due to the diversity of backgrounds of incoming students--even the most qualified applicant can have deficiencies. To address this problem, we have developed a first-year graduate course that balances and integrates practical considerations with basic principles of complex software system development. To make the discussions of designing, implementing, and evaluating complex software systems more concrete, we situate the core of the class in the context of Web Services. We are currently teaching this class for the second time, and, while there will always be open issues given the nature and scope of this class, we have received positive feedback from the students and the other members of the department. Students recognize the practicality of Web Services. Students also appreciate the research possibilities that arise while evaluating the state of the art with regard to Web Services.

Abstract One benefit of a computational Grid is the ability to run high‐performance applications over distributed resources simply and securely. We demonstrated this benefit with an experiment in which we studied the protein‐folding process with the CHARMM molecular simulation package over a Grid managed by Legion, a Grid operating system. High‐performance applications can take advantage of Grid resources if the Grid operating system provides both low‐level functionality as well as high‐level services. We describe the nature of services provided by Legion for high‐performance applications. Our experiences indicate that human factors continue to play a crucial role in the configuration of Grid resources, underlying resources can be problematic, Grid services must tolerate underlying problems or inform the user, and high‐level services must continue to evolve to meet user requirements. Our experiment not only helped a scientist perform an important study, but also showed the viability of an integrated approach such as Legion's for managing a Grid. Copyright © 2004 John Wiley & Sons, Ltd.

This paper describes a formal feedback-control algorithm for dynamic voltage/frequency scaling (DVS) in a portable multimedia system to save power while maintaining a desired playback rate. Our algorithm is similar in complexity to the previously-proposed change-point detection algorithm [19] but does a better job of maintaining stable throughput and is not dependent on the assumption of an exponential distribution of the frame decoding rate. For approximately the same energy savings as reported by [19], our controller is able to keep the average frame delay within 10% of the target more than 90% of the time, whereas the change-point detection algorithm kept the average frame delay with 10% of the target only 70% or less of the time executing the same workload.

Globus is a powerful toolkit but lacks location transparency in its naming system, due to a reliance on URLs. In practical terms, this means that a Grid user (or software running on behalf of the user) must know precisely where Grid entities are. The problem is that hardware reconfiguration, file system reorganization, and changes in organizational structure can often result in dangling links. At the University of Virginia, we are designing and implementing a comprehensive project that combines the best aspects of Globus and Legion into Legion-G - roughly an "applications-level" interface from Legion to Globus, whereby Legion "runs on" key Grid functionality of Globus such as GSI. Among the capabilities already supported in Legion, and thus will be delivered to the Globus user, are: end-user tools for transparent remote execution and parameter-space studies; support for dynamic, transparent remote instantiation of transient Grid services, with integrated scheduling support; fine-grained access control for Grid services; and the Legion programming model which supports arbitrary, asynchronous, data-flow-style, secure Grid computations. This poster describes the Legion-G support for location-transparent naming in Grid Computing and illustrates its value in the context of Globus MPI computations that accesses LegionFS which is a location-transparent, Grid-enabled distributed file system.

Abstract The Legion Grid Portal is an interface to a Grid system. Users interact with the portal, and hence a Grid, through an intuitive interfacefrom which they can view files, submit and monitor runs, and view accounting information. The architecture of the portal is designed to accommodate multiple diverse Grid infrastructures, legacy systems, and application‐specific interfaces. The current implementation of the Legion Grid Portal is with familiar Web technologies over the Legion Grid infrastructure. The portal can be extended in a number of directions—additional support for Grid administrators, greater number of application‐specific interfaces, interoperability between Grid infrastructures, and interfaces for programming support. The portal has been in operation since February 2000 on npacinet, a worldwide Grid managed byLegion on NPACI resources. Copyright © 2002 John Wiley & Sons, Ltd.

Heterogeneous or federated clusters are a significant special case of grid computing. An important factor in efficiently executing applications on such clusters is the mapping (or scheduling) of application tasks onto cluster nodes. The cost/benefit estimating service aims at facilitating the search for efficient mappings both initially and during the evolution of a computation. This service dynamically evaluates alternative mappings using system and application information. Building the necessary database for use with this service involves profiling applications and running benchmark suites on cluster nodes. Recent data obtained at Sandia National Laboratories, NM, demonstrate the existence of differences in computation and communication speeds between the nodes of even simple homogeneous clusters, as well as the feasibility of using such data for predicting the efficiency of application mappings.

A Computational Grid is a collection of heterogeneous computers and resources spread across multiple administrative domains with the intent of providing users easy access to these resources. There are many ways to access the resources of a Computational Grid, each with unique security requirements and implications for both the resource user and the resource provider. A comprehensive set of Grid usage scenarios is presented and analyzed with regard to security requirements such as authentication, authorization, integrity, and confidentiality. The main value of these scenarios and the associated security discussions is to provide a library of situations against which an application designer can match, thereby facilitating security-aware application use and development from the initial stages of the application design and invocation. A broader goal of these scenarios is to increase the awareness of security issues in Grid Computing. The purpose of this paper is to review the various Grid usage scenarios and analyze their security requirements and implications.

One benefit of a computational grid is the ability to run high-performance applications over distributed resources simply and securely. We demonstrate this benefit with an experiment in which we studied the protein folding process with the CHARMM molecular simulation package over a grid managed by Legion, a grid operating system. High-performance applications can take advantage of grid resources if the grid operating system provides both low level functionality as well as high-level services. We describe the nature of services provided by Legion for high-performance applications. Our experiences indicate that human factors continue to play a crucial role in the configuration of grid resources, underlying resources can be problematic, grid services must tolerate underlying problems or inform the user, and high-level services must continue to evolve to meet user requirements. Our experiment not only helped a scientist perform an important study, but also showed the viability of an integrated approach such as Legion's for managing a grid.

Realizing that current file systems can not cope with the diverse requirements of wide-area collaborations, researchers have developed data access facilities to meet their needs. Recent work has focused on comprehensive data access architectures. In order to fulfill the evolving requirements in this environment, we suggest a more fully-integrated architecture built upon the fundamental tenets of naming, security, scalability, extensibility, and adaptability. These form the underpinning of the Legion File System (LegionFS). This paper motivates the need for these requirements and presents benchmarks that highlight the scalability of LegionFS. LegionFS aggregate throughput follows the linear growth of the network, yielding an aggregate read bandwidth of 193.8 MB/s on a 100 Mbps Ethernet backplane with 50 simultaneous readers. The serverless architecture of LegionFS is shown to benefit important scientific applications, such as those accessing the Protein Data Bank, within both local- and wide-area environments.

In contemporary computers and networks of computers, various application domains are making increasing demands on the system to move data from one place to another, particularly under some form of soft real-time constraint. A brute force technique for implementing applications in this type of domain demands excessive system resources, even though the actual requirements by different parts of the application vary according to the way it is being used at the moment. A more sophisticated approach is to provide applications with the ability to dynamically adjust resource requirements according to their precise needs, as well as the availability of system resources. This paper describes a set of principles for designing systems to provide support for soft real-time applications using dynamic negotiation. Next, the execution level abstraction is introduced as a specific mechanism for implementing the principles. The utility of the principles and the execution level abstraction is then shown in the design of three resource managers that facilitate dynamic application adaptation: Gryphon, EPA/RT-PCIP, and the DQM architectures.

Next-generation, hard real-time systems will require new, flexible functionality and guaranteed, predictable performance. This paper describes the UMass Spring threads package, designed specifically for multiprocessing in dynamic, hard real-time environments. This package is unique because of its support for new thread semantics for real-time processing. Predictable creation and execution of threads is achieved because of an underlying predictable kernel, the UMass Spring kernel. Design decisions and lessons learned while implementing the threads package are presented. Measurements affirm the predictability of this implementation on a representative multiprocessor platform. The adoption of the threads package in the UMass Spring kernel results in additional performance improvements, which include reduced context switching overhead and reduced average-case memory access durations.

This paper describes a tool called the Real-Time Scheduling Assistant (RTSA) that provides automated assistance in the areas of selection, evaluation, and implementation of scheduling algorithms for complex real-time systems. In RTSA, design elements relevant to real-time scheduling, including task set and processor characteristics, are specified using a graphical user interface. The tool's quantitative evaluation component provides a range of algorithms for analysis of the performance characteristics of systems and scheduling policies under consideration. The RTSA knowledge base contains real-time scheduling expertise that is encoded in the form of production rules, and applied using a forward chaining inference engine. Advice on multiple scheduling algorithms is offered at three levels: conceptual, analysis, and implementation.

The design of a kernel-level thread package for dynamic, hard real-time environments is presented. A highly integrated design is used to ensure predictability. A system description language and real-time programming language are used to specify key properties of threads and thread groups. For a thread, this includes whether or not the thread spawns other threads at run-time, the type of performance guarantee the thread requires, how the thread interacts with other threads, and what processors the thread may execute on. A predictable kernel uses this information along with on-line dynamic guarantees to ensure predictable execution of threads. The first phase of the thread package has been implemented and performance measurements have indicated a 66% improvement in context switching costs.

This paper investigates the effects of parallelism on blackboard system scheduling heuristics. A parallel blackboard system is described that allows multiple knowledge source instantiations (KSIs) to execute in parallel using a shared-memory blackboard approach. New classes of control knowledge are defined that order the agenda by using information about the relationships between the goals of the KSIs. This control knowledge is implemented and tested in the DVMT application on a Sequent multiprocessor using BB1-style control heuristics. The usefulness of the heuristics is examined by comparing the effectiveness of problem-solving with and without the heuristics (as a group and individually). Problem solving with the new control knowledge results in improved system performance.

Approximate processing is an approach to real-time AI problem solving in domains in which compromise is possible between the resources required to generate a solution and the quality of that solution. It is a satisficing approach in which the goal is to produce acceptable solutions within the available time and computational resource constraints. Previous work has shown how to integrate approximate processing knowledge sources within the blackboard architecture. However, in order to solve real-time problems with hard deadlines using a blackboard system, we need to have: (1) a predictable blackboard execution loop, (2) a representation of the set of current and future tasks and their estimated durations, and (3) a model of how to modify those tasks when their deadlines are projected to be missed, and how the modifications will affect the task durations and results. This paper describes four components for achieving this goal in an approximate processing blackboard system. A parameterized low-level control loop allows predictable knowledge source execution, multiple execution channels allow dynamic control over the computation involved in each task, a meta-controller allows a representation of the set of current and future tasks and their estimated durations and results, and a real-time blackboard scheduler monitors and modifies tasks during execution so that deadlines are met. An example is given that illustrates how these components work together to construct a satisficing solution to a time-constrained problem in the Distributed Vehicle Monitoring Testbed (DVMT).