Cyber security has gained national and international attention as a result of near continuous headlines from financial institutions, retail stores, government offices and universities reporting compromised systems and stolen data. Concerns continue to rise as threats of service interruption, unauthorized access, stealing and altering of information, and spreading of viruses become ever more prevalent and serious. Controlling access to application layer resources is a critical component in a layered security solution that includes encryption, firewalls, virtual private networks, antivirus, and intrusion detection. In this paper we discuss the development of an application-level access control solution, based on an open-source access manager augmented with custom software components, to provide protection to both Web-based and Java-based client and server applications.

Swarm systems, which typically comprise a large number of lightweight mobile components, must be capable of self-healing. In this paper, we propose a self-organizing, self-healing framework called “superimposed” clustering for such systems. The framework makes a significant departure from traditional clustering algorithms that apply a single policy to form clusters through iterations. Specifically, our superimposed clustering protocol (SCP) selects a pair of diversified clustering polices to simultaneously build two sets of clusters, which we view as two cluster layers with one on top of the other. Via redundancy shadowing, SCP is able to extract and combine the complementary portions of the two layers to form a clustered network such that the vast majority of nodes can be organized through a single round. Moreover, SCP exploits shadow redundancy to enable gracefully degradable clustering coverage to mitigate cluster damage caused by node failure, death, or migration. We present the notion of superimposed clustering by devising a protocol and conducting a performability evaluation.

Embedded systems for closed-loop applications often behave as discrete-time semi-Markov processes (DTSMPs). Performability measures most meaningful to iterative embedded systems, such as accumulated reward, are thus difficult to solve analytically in general. In this paper, we propose a recurrence-relation-based (RRB) reward model to evaluate such measures. A critical element in RRB reward models is the notion of state-entry probability. This notion enables us to utilize the embedded Markov chain in a DTSMP in a novel way. More specifically, we formulate state-entry probabilities, state-occupancy probabilities, and expressions concerning accumulated reward solely in terms of state-entry probability and its companion term, namely the expected accumulated reward at the point of state entry. As a result, recurrence relations abstract away all the intermediate points that lack the memoryless property, enabling a solvable model to be directly built upon the embedded Markov chain. To show the usefulness of RRB reward models, we evaluate an embedded system for which we leverage the proposed notion and methods to solve a variety of probabilistic measures analytically.

While inherent resource redundancies in distributed applications facilitate gracefully degradable services, methods to enhance their dependability may have subtle, yet significant, performance implications, especially when such applications are stateful in nature. In this paper, we present a performability-oriented framework that enables the realization of software rejuvenation in stateful distributed applications. The framework is constructed based on three building blocks, namely, a rejuvenation algorithm, a set of performability metrics, and a performability model. We demonstrate via model-based evaluation that this framework enables error-accumulation-prone distributed applications to deliver services at the best possible performance level, even in environments in which a system is highly vulnerable to failures.

This paper reports our experience on the development of a design-for-safety (DFS) workbench called risk assessment and management environment (RAME) for microelectronic avionics systems. RAME is built upon an information infrastructure that comprises a test-reporting/failure-tracking system, an off-the-shelf data mining tool, a knowledge base, and a fault model. This infrastructure permits systematic learning from prior projects and enables the automation of failure mode, effect and criticality analysis (FMECA). More importantly, RAME is able to directly accept source code in hardware description languages (HDLs) for automated design validation.

The growing interest in ad hoc wireless network applications that are made of large and dense populations of lightweight system resources, calls for scalable approaches to fault tolerance. Moreover, the nature of these systems creates significant challenges for the development of failure detection services (FDSs), because their quality often depends heavily on reliable communication. In particular, ad hoc wireless networks are notoriously vulnerable to message loss, which precludes deterministic guarantees for the completeness and accuracy properties of FDSs. To meet the challenges, we propose an FDS based on the notion of clustering. Specifically, we use a cluster-based communication architecture to permit the FDS to be implemented in a distributed manner via intra-cluster heartbeat diffusion and to allow a failure report to be forwarded across clusters through the upper layer of the communication hierarchy. In doing so, we extensively exploit the message redundancy that is inherent in ad hoc wireless settings to mitigate the effects of message loss on the accuracy and completeness properties of failure detection. As shown by our mathematical analysis, the resulting FDS is able to provide satisfactory probabilistic guarantees for the desired properties.

We present in this paper an extension of the message-driven confidence-driven framework that we developed for onboard guarded software upgrading. The purpose of this work is to provide the framework with the capability of protecting distributed software upgrades that involve message-passing interface changes. To achieve this goal, we propose an approach to clustering the components involved in software upgrades and those involved in message-passing interface changes, such that from outside the cluster all those components can be perceived collectively as one virtual low-confidence component. Moreover, we develop a confidence-driven mechanism that enables combined use of sender- and receiver-side message logging for efficient, fine-grained error containment and recovery. The paper provides a detailed algorithm description.

Systems that are formed by massively distributed mobile resources, such as satellite constellations, often provide mission-critical functions. However, many existing fault tolerance schemes and quality-of-service (QoS) management concepts cannot be applied to those systems in a traditional way, due to the dynamically and continuously changing readiness-to-serve of their mobile resources. In this paper, we describe a case study that investigates a method called opportunity-adaptive QoS enhancement (QAQ).

When making an engineering design decision, it is often necessary to consider its implications on both system performance and dependability. We present a performability study that analyzes the guarded operation duration for onboard software upgrading. In particular, we define a "performability index" Y that quantifies the extent to which the guarded operation with a duration /spl phi/ reduces the expected total performance degradation. In order to solve for Y, we progressively translate its formulation until it becomes an aggregate of constituent measures conducive to efficient reward model solutions. Based on the reward-mapping-enabled intermediate model, we specify reward structures in the composite base model which is built on three stochastic activity network reward models. We describe the model-translation approach and show its feasibility for design-oriented performability modeling.

Group collaboration capabilities have been developed for Internet-based Mars rover mission operations. Internet-based operations enables scientists to participate in daily Mars rover mission operations from their home institutions. Group collaboration enables geographically separated users to collaboratively analyze downlinked data and plan new activities for the rover. The motivation for group collaboration in Mars rover mission operations and the technologies developed to provide group collaboration are discussed. The group collaboration capability was developed for use in rover mission operations in the 2003 NASA Mars Exploration Rover mission.

Message-driven confidence-driven (MDCD) error containment and recovery, a low-cost approach to mitigating the effect of software design faults in distributed embedded systems, is developed for onboard guarded software upgrading for deep-space missions. In this paper, we first describe and verify the MDCD algorithms in which we introduce the notion of "confidence-driven" to complement the "communication-induced" approach employed by a number of existing checkpointing protocols to achieve error containment and recovery efficiency. We then conduct a model-based analysis to show that the algorithms ensure low performance overhead. Finally, we discuss the advantages of the MDCD approach and its potential utility as a general-purpose, low-cost software fault tolerance technique for distributed embedded computing.

Describes an approach for enabling the synergistic coordination between two fault-tolerance protocols to simultaneously tolerate software and hardware faults in a distributed computing environment. Specifically, our approach is based on a message-driven confidence-driven (MDCD) protocol that we have devised for tolerating software design faults, and a time-based (TB) checkpointing protocol that was developed by N. Neves and W.K. Fuchs (1996) for tolerating hardware faults. By carrying out algorithm modifications that are conducive to synergistic coordination between volatile-storage and stable-storage checkpoint establishments, we are able to circumvent the potential interference between the MDCD and TB protocols, and to allow them to effectively complement each other to extend a system's fault tolerance capability. Moreover, the protocol coordination approach preserves and enhances the features and advantages of the individual protocols that participate in the coordination, keeping the performance cost low.

The authors revisit the problem of software fault tolerance in distributed systems. In particular, we propose an extension of a message-driven confidence-driven (MDCD) protocol we have developed for error containment and recovery in a particular type of distributed embedded system. More specifically, we augment the original MDCD protocol by introducing the method of "fine-grained confidence adjustment," which enables us to remove the architectural restrictions. The dynamic nature of the MDCD approach gives it a number of desirable characteristics. First, this approach does not impose any restrictions on interactions among application software components or require costly message-exchange based process coordination/synchronization. Second, the algorithms allow redundancies to be applied only to low-confidence or critical interacting software components in a distributed system, permitting flexible realization of software fault tolerance. Finally, the dynamic error containment and recovery mechanisms are transparent to the application and ready to be implemented by generic middleware.

To assure dependable onboard evolution, we have developed a methodology called guarded software upgrading (GSU). We focus on a low-cost approach to error containment and recovery for GSU. To ensure low development cost, we exploit inherent system resource redundancies as the fault tolerance means. In order to mitigate the effect of residual software faults at low performance cost, we take a crucial step in devising error containment and recovery methods by introducing the confidence-driven notion. This notion complements the message-driven (or communication-induced) approach employed by a number of existing checkpointing protocols for tolerating hardware faults. In particular, we discriminate between the individual software components with respect to our confidence in their reliability and keep track of changes of our confidence (due to knowledge about potential process state contamination) in particular processes. This, in turn, enables the individual processes in the spaceborne distributed system to make decisions locally at run-time, on whether to establish a checkpoint upon message passing and whether to roll back or roll forward during error recovery. The resulting message-driven confidence-driven approach enables cost-effective checkpointing and cascading-rollback free recovery.

The Mars Polar Lander (MPL) mission was the first planetary mission to use Internet-based distributed ground operations where scientists and engineers collaborate in daily mission operations from multiple geographically distributed locations via the Internet. This paper describes the operations system, the Web interface for telescience (WITS), which was used by the MPL mission for Internet-based operations. WITS was used for generating command sequences for the lander's robotic arm and robotic arm camera, and as a secondary tool for sequence generation for the stereo camera on the lander. WITS was also used as a public outreach tool. Results are shown from the January 2000 field test in Death Valley, California.

Automated planning and scheduling, including automated path planning, has been integrated with an Internet-based distributed operations system for planetary rover operations. The resulting prototype system enables faster generation of valid rover command sequences by a distributed planetary rover operations team. The Web Interface for Telescience provides Internet-based distributed collaboration, the automated scheduling and planning environment provides automated planning and scheduling, and an automated path planner provides path planning. The system was demonstrated on the Rocky7 research rover at JPL.

The Web Interface for Telescience (WITS) is an Internet-based tool that the Mars Pathfinder mission used for both mission operations at JPL and public outreach. WITS enables the viewing of downlinked images and results in various ways, terrain feature measurement and annotation, and planning of daily mission activities. WITS is written in the Java language and is accessible by mission scientists and the general public via a web browser. The public can use WITS to plan and simulate their own rover missions. WITS will also be used in the 1998 lander and 2001, 2003, and 2005 rover missions to Mars.

The Web Interface for Telescience (WITS) has been developed to enable scientists to participate in planetary rover missions from their home institutions, rather than having to travel to JPL as has been required in the past. A scientist accesses WITS via a commercial web browser. WITS provides various views of the scene: including a descent image view which allows the user to see where the rover has been and currently is in a global perspective, a panoramic view which is an overhead view of the area immediately around the rover, and a wedge view which is an image from a rover-mounted camera. Scientists can select science targets in a wedge image and science subtasks to perform at those targets. A mission planner can select rover waypoints to traverse between science targets, and waypoint subtasks to perform at those locations. A public version allows the general public to view the same information and plan their own simulated missions.

The new task lines and motion guides approaches to telerobotics are described. Motion guides is a new paradigm for teleoperation of a robot where the path is teleoperated rather than the robot, and the robot is constrained to follow the path. Continuous commands to the robot are only one dimensional: forward, back, or halt along the motion guide. Task lines have subtasks attached to motion guides. The task lines and motion guides have been implemented in a virtual reality environment to enable task description and execution to be done in a natural virtual reality graphics environment rather than via direct interaction with a command program. Subtasks are represented in the virtual reality environment by icons attached to the motion guides. The combination of task lines and motion guides is valuable for ground control of Space Station robots, which is the initial application for this technology.

An interactive user interface, UMI (User-Macro-Interface), and its complete task execution system have been developed and implemented for use by an operator to describe, simulate, and execute tasks on a multiarm telerobot. The operator interactively sets up the execution environment and specifies input parameters for a variety of available task primitives. Several task primitives can be stored together as a task sequence for later sequence execution. The primitives or sequences can be executed on a graphics simulator or on the JPL Telerobot, which includes two task execution manipulators, one manipulator used for positioning cameras, and two six-degree-of-freedom force reflecting hand controllers used for shared and teleoperation modes of execution. In supervisory control, the operator sets up a task primitive or a sequence of primitives and executes the task autonomously. In teleoperation, the user specifies desired initialization parameters and controls the arms with the hand controllers. In shared control, teleoperated inputs from the operator hand controllers are merged during task execution with inputs from user parameterized autonomous primitives. In all modes of operation, UMI allows the operator to stop execution at any time. The UMI interface is intended as the operator interface at a local command site to prepare and send commands to a remote space telerobot.>

A description is given of a complete robot control facility built at the CIT Jet Propulsion Laboratory as part of a NASA telerobotic program to develop a state-of-the-art robot control environment for laboratory-based spacelike experiments. This system has the following features: separation of the computing facilities into local and remote sites, autonomous motion generation in joint or Cartesian coordinates, dual-arm force reflecting teleoperation with voice interaction between the operator and the robots, shared control between the autonomously generated motions and operator controlled teleoperation, and dual-arm coordinated trajectory generation. The system has been used to carry out realistic experiments such as the exchange of an orbital replacement unit, bolt turning, and door opening, using a mixture of autonomous actions and teleoperation, with either a single arm or two cooperating arms.>

Autonomous robot task execution requires that the end effector of the robot be positioned accurately relative to a reference world-coordinate frame. The authors present a complete formulation to identify the actual robot geometric parameters. The method applies to any serial link manipulator with arbitrary order and combination of revolute and prismatic joints. A method is also presented to solve the inverse kinematic of the actual robot model which usually is not a so-called simple robot. Experimental results performed by utilizing a PUMA 560 with simple measurement hardware are presented. As a result of this calibration a precision move command is designed and integrated into a robot language, RCCL, and used in the NASA Telerobot Testbed.>