Large service providers use load balancers to dispatch millions of incoming connections per second towards thousands of servers. There are two basic yet critical requirements for a load balancer:uniform load distributionof the incoming connections across the servers, which requires to support advanced load balancing mechanisms, andper-connection-consistency(PCC), i.e, the ability to map packets belonging to the same connection to the same server even in the presence of changes in the number of active servers and load balancers. Yet, simultaneously meeting these requirements has been an elusive goal. Today’s load balancers minimize PCC violations at the price of non-uniform load distribution. This paper presents Cheetah, a load balancer that supports advanced load balancing mechanismsandPCC while being scalable, memory efficient, fast at processing packets, and offers comparable resilience to clogging attacks as with today’s load balancers. The Cheetah LB design guarantees PCC foranyrealizable server selection load balancing mechanism and can be deployed in both stateless and stateful manners, depending on operational needs. We implemented Cheetah on both a software and a Tofino-based hardware switch. Our evaluation shows that a stateless version of Cheetah guarantees PCC, has negligible packet processing overheads, and can support load balancing mechanisms that reduce the flow completion time by a factor of$2-3 \times $.

We present PacketMill, a system for optimizing software packet processing, which (i) introduces a new model to efficiently manage packet metadata and (ii) employs code-optimization techniques to better utilize commodity hardware. PacketMill grinds the whole packet processing stack, from the high-level network function configuration file to the low-level userspace network (specifically DPDK) drivers, to mitigate inefficiencies and produce a customized binary for a given network function. Our evaluation results show that PacketMill increases throughput (up to 36.4 Gbps -- 70%) & reduces latency (up to 101 us -- 28%) and enables nontrivial packet processing (e.g., router) at ~100 Gbps, when new packets arrive >10× faster than main memory access times, while using only one processing core.

Today, datacenter operators deploy Load-balancers (LBs) to efficiently utilize server resources, but must over-provision server resources (by up to 30%) because of load imbalances and the desire to bound tail service latency. We posit one of the reasons for these imbalances is the lack of per-core load statistics in existing LBs. As a first step, we designed CrossRSS, a CPU core-aware LB that dynamically assigns incoming connections to the least loaded cores in the server pool. CrossRSS leverages knowledge of the dispatching by each server's Network Interface Card (NIC) to specific cores to reduce imbalances by more than an order of magnitude compared to existing LBs in a proof-of-concept datacenter environment, processing 12% more packets with the same number of cores.

Deployment of 100Gigabit Ethernet (GbE) links challenges the packet processing limits of commodity hardware used for Network Functions Virtualization (NFV). Moreover, realizing chained network functions (i.e., service chains) necessitates the use of multiple CPU cores, or even multiple servers, to process packets from such high speed links. Our system Metron jointly exploits the underlying network and commodity servers’ resources: ( i ) to offload part of the packet processing logic to the network, ( ii ) by using smart tagging to setup and exploit the affinity of traffic classes, and ( iii ) by using tag-based hardware dispatching to carry out the remaining packet processing at the speed of the servers’ cores, with zero inter-core communication. Moreover, Metron transparently integrates, manages, and load balances proprietary “blackboxes” together with Metron service chains. Metron realizes stateful network functions at the speed of 100GbE network cards on a single server, while elastically and rapidly adapting to changing workload volumes. Our experiments demonstrate that Metron service chains can coexist with heterogeneous blackboxes, while still leveraging Metron’s accurate dispatching and load balancing. In summary, Metron has ( i ) 2.75–8× better efficiency, up to ( ii ) 4.7× lower latency, and ( iii ) 7.8× higher throughput than OpenBox, a state-of-the-art NFV system.

While the current literature typically focuses on load-balancing among multiple servers, in this paper, we demonstrate the importance of load-balancing within a single machine (potentially with hundreds of CPU cores). In this context, we propose a new load-balancing technique (RSS++) that dynamically modifies the receive side scaling (RSS) indirection table to spread the load across the CPU cores in a more optimal way. RSS++ incurs up to 14x lower 95th percentile tail latency and orders of magnitude fewer packet drops compared to RSS under high CPU utilization. RSS++ allows higher CPU utilization and dynamic scaling of the number of allocated CPU cores to accommodate the input load while avoiding the typical 25% over-provisioning.

In modern (Intel) processors, Last Level Cache (LLC) is divided into multiple slices and an undocumented hashing algorithm (aka Complex Addressing) maps different parts of memory address space among these slices to increase the effective memory bandwidth. After a careful study of Intel's Complex Addressing, we introduce a slice-aware memory management scheme, wherein frequently used data can be accessed faster via the LLC. Using our proposed scheme, we show that a key-value store can potentially improve its average performance ~12.2% and ~11.4% for 100% & 95% GET workloads, respectively. Furthermore, we propose CacheDirector, a network I/O solution which extends Direct Data I/O (DDIO) and places the packet's header in the slice of the LLC that is closest to the relevant processing core. We implemented CacheDirector as an extension to DPDK and evaluated our proposed solution for latency-critical applications in Network Function Virtualization (NFV) systems. Evaluation results show that CacheDirector makes packet processing faster by reducing tail latencies (90-99th percentiles) by up to 119 μs (~21.5%) for optimized NFV service chains that are running at 100 Gbps. Finally, we analyze the effectiveness of slice-aware memory management to realize cache isolation.

The increasing density of globally distributed datacenters reduces the network latency between neighboring datacenters and allows replicated services deployed across neighboring locations to share workload when necessary, without violating strict Service Level Objectives (SLOs).

The growing popularity of Android and the increasing amount of sensitive data stored in mobile devices have lead to the dissemination of Android ransomware. Ransomware is a class of malware that makes data inaccessible by blocking access to the device or, more frequently, by encrypting the data; to recover the data, the user has to pay a ransom to the attacker. A solution for this problem is to backup the data. Although backup tools are available for Android, these tools may be compromised or blocked by the ransomware itself. This paper presents the design and implementation of RANSOMSAFEDROID, a TrustZone based backup service for mobile devices. RANSOMSAFEDROID is protected from malware by leveraging the ARM TrustZone extension and running in the secure world. It does backup of files periodically to a secure local persistent partition and pushes these backups to external storage to protect them from ransomware. Initially, RANSOMSAFEDROID does a full backup of the device filesystem, then it does incremental backups that save the changes since the last backup. As a proof-of-concept, we implemented a RANSOMSAFEDROID prototype and provide a performance evaluation using an i.MX53 development board.

Mobile devices such as smartphones are becoming the majority among computing devices. Currently, millions of persons use such devices to store and process personal data. Unfortunately, smartphones running Android are increasingly being targeted by hackers and infected with malware. Anti-malware software is being used to address this situation, but it may be subverted by the same malware it aims to detect. We present DroidPosture, a posture assessment service for Android devices. This service aims to securely evaluate the level of trust we can have on a device (assess its posture) even if the mobile OS is compromised. For that to be possible, DroidPosture is protected using TrustZone, a security extension for ARM processors. DroidPosture is configurable with a set of application and kernel analysis mechanisms that enable detecting malicious applications and rootkits. We implemented a DroidPosture prototype using a hardware board with an ARM processor with TrustZone, and evaluated its performance and security.

In less than a decade, mobile apps became an integral part of our lives. In several situations it is important to provide assurance that a mobile app is authentic, i.e., that it is indeed the app produced by a certain company. However, this is challenging, as such apps can be repackaged, the user malicious, or the app tampered with by an attacker. This paper presents the design of TRUAPP, a software authentication service that provides assurance of the authenticity and integrity of apps running on mobile devices. TRUAPP provides such assurance, even if the operating system is compromised, by leveraging the ARM TrustZone hardware security extension. TRUAPP uses a set of techniques (static watermarking, dynamic watermarking, and cryptographic hashes) to verify the integrity of the apps. The service was implemented in a hardware board that emulates a mobile device, which was used to do a thorough experimental evaluation of the service.

Recent approaches to network functions virtualization (NFV) have shown that commodity network stacks and drivers struggle to keep up with increasing hardware speed. Despite this, popular cloud networking services still rely on commodity operating systems (OSs) and device drivers. Taking into account the hardware underlying of commodity servers, we built an NFV profiler that tracks the movement of packets across the system’s memory hierarchy by collecting key hardware and OS-level performance counters. Leveraging the profiler’s data, our Service Chain Coordinator’s (SCC) run-time accelerates user-space NFV service chains, based on commodity drivers. To do so, SCC combines multiplexing of system calls with scheduling strategies, taking time, priority, and processing load into account. By granting longer time quanta to chained network functions (NFs), combined with I/O multiplexing, SCC reduces unnecessary scheduling and I/O overheads, resulting in three-fold latency reduction due to cache and main memory utilization improvements. More importantly, SCC reduces the latency variance of NFV service chains by up to 40x compared to standard FastClick chains by making the average case for an NFV chain to perform as well as the best case. These improvements are possible because of our profiler’s accuracy.

Modern distributed systems are geo-distributed for reasons of increased performance, reliability, and survivability. At the heart of many such systems, e.g., the widely used Cassandra and MongoDB data stores, is an algorithm for choosing a closest set of replicas to service a client request. Suboptimal replica choices due to dynamically changing network conditions result in reduced performance as a result of increased response latency. We present GeoPerf, a tool that tries to automate the process of systematically testing the performance of replica selection algorithms for geo-distributed storage systems. Our key idea is to combine symbolic execution and lightweight modeling to generate a set of inputs that can expose weaknesses in replica selection. As part of our evaluation, we analyzed network round trip times between geographically distributed Amazon EC2 regions, and showed a significant number of daily changes in nearest-K replica orders. We tested Cassandra and MongoDB using our tool, and found bugs in each of these systems. Finally, we use our collected Amazon EC2 latency traces to quantify the time lost due to these bugs. For example due to the bug in Cassandra, the median wasted time for 10% of all requests is above 50 ms.

Many geo-distributed systems rely on a replica selection algorithms to communicate with the closest set of replicas. Unfortunately, the bursty nature of the Internet traffic and ever changing network conditions present a problem in identifying the best choices of replicas. Suboptimal replica choices result in increased response latency and reduced system performance. In this work we present GeoPerf, a tool that tries to automate testing of geo-distributed replica selection algorithms. We used GeoPerf to test Cassandra and MongoDB, two popular data stores, and found bugs in each of these systems.

We examine a number of roles that a proxy server can play in location based services and how it can be used to provide protection of personal identifiable information. Location data, service requests, and privacy policies are encoded in XML by the mobile terminal and forwarded to a proxy server placed between the mobile terminal and the location based service(s). By a suitable architecture in the mobile terminal and in the proxy, we can hide the mobile device's network location, hide the identity of its user, and, in some cases, provide misleading physical location(s). We have applied our privacy model to location information obtained from a GPS receiver. The GPS-based method was chosen as being the only available method where the positioning calculation function (PCF) is fully under the user's control, since the position is calculated within the mobile terminal; other technologies rely on the network infrastructure, and hence some or all of the position data is outside the user's control. A proof of concept was implemented using Fastrax's iTrax02 small, ultra-low power consumption GPS receiver. We illustrate a number of different functions which can be provided by examining some scenarios.

Mobile ad hoc networking allows nodes to form temporary networks and communicate beyond the transmitter range by supporting multihop communication through IP routing. Routing in such networks is often reactive, i.e., performed on-demand, as opposed to Internet routing that is proactive. As ad hoc networks are formed on a temporary basis, any IP address should be allowed to appear in an ad hoc network. This paper presents MIPMANET, a solution for connecting an ad hoc network, in which on-demand routing is used, to the Internet. MIPMANET provides Internet access by using mobile IP with foreign agent care-of addresses and reverse tunneling. This allows nodes to enjoy the mobility services of mobile IP while at the same time the requirements on the ad hoc routing protocol are kept to a minimum. Simulations of MIPMANET have been performed in the Network Simulator 2. The ad hoc on-demand distance vector (AODV) routing protocol has been used for routing within the ad hoc network. These simulations show that the ability to choose the closest access point to the Internet is worth extra work, as less traffic is generated in the network resulting in lower delays and fewer dropped packets.

Article A mobile virtual-distributed system architecture for supporting wireless mobile computing and communications Share on Authors: George Liu System Research Department, Ericsson Radio Systems, S-164 80 Stockholm, SWEDEN System Research Department, Ericsson Radio Systems, S-164 80 Stockholm, SWEDENView Profile , Alexander Marlevi System Research Department, Ericsson Radio Systems, S-164 80 Stockholm, SWEDEN System Research Department, Ericsson Radio Systems, S-164 80 Stockholm, SWEDENView Profile , Gerald Q. Maguire Department of Teleinformatics, Royal Institute of Technology, S-164 40 Stockholm, SWEDEN Department of Teleinformatics, Royal Institute of Technology, S-164 40 Stockholm, SWEDENView Profile Authors Info & Claims MobiCom '95: Proceedings of the 1st annual international conference on Mobile computing and networkingDecember 1995 Pages 111–118https://doi.org/10.1145/215530.215563Online:01 December 1995Publication History 8citation802DownloadsMetricsTotal Citations8Total Downloads802Last 12 Months4Last 6 weeks0 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

This paper presents a novel mobile floating (MF) agent scheme for supporting global distributed mobile computing. The principal contribution of this paper is to innovatively apply virtual memory concepts to mobile systems by deploying MF-agents to decouple the service and resource from the underlying network and move around following or proceeding their mobile users. The MF-agents maintain data structures associated with a mobile user. By combining the mobile-floating agent functionality with a predictive mobility management algorithm, services and user data may be pre-connected and pre-assigned at the locations or cells to which the user is moving. Thus, the user can immediately receive services of maintain their data structures with virtually the same efficiency as at the previous location.

This paper calculates the capacity efficiency of various data link methods in wireless LAN communications. For LAN communications, the packet reachability between mobile stations within the same cell should be guaranteed, as intracell communication is important. In order to realize this, we have proposed a bridging functionality which automatically transfers the packet at an access point when the source cannot send the packet to destination directly. The theoretical capacity efficiency is calculated and compared against other methods, non-bridging (i.e., direct communications) and full-time bridging (i.e., the access point always bridges data). The evaluation results show that the proposed method is always efficient.

This paper proposes a new medium access control (MAC) procedure which adds bridging functionality to a multiple access control protocol. This bridging functionality can automatically forward a packet which is sent from a station to others in its local coverage area (i.e., cell). It realizes optimal path selection, from the MAC sublayer point of view. In addition, it provides a broadcast environment to all stations in the coverage area. By utilizing this functionality, throughput and transmission quality can be improved. The concept is simple and easily realized within the distributed foundation wireless medium access control (DFWMAC) proposed to IEEE802.11 standard committee for both infrastructure and ad-hoc networks. It can also effectively deal with the hidden station problem, reduce channel interference and provide throughput improvement. The advantages of this bridging functionality and its operation for both infrastructure networks and ad-hoc networks are discussed.

The design of flexible and efficient future mobile communication systems is a major challenge. The Walkstation Project involves researchers from different areas in order to find a solution via a global system approach. An important task is the investigation of new digital, highly integrated radio interfaces with low cost, small size and low power consumption based on direct sequence CDMA. The simplicity of the design of both the analog and digital parts will allow low power operation and small area in a eventual BiCMOS implementation.>

In the Swedish Walkstation project a device for mobile hosts and base stations is realized by the same kind of hardware but with different kinds of communication software. This device, called MINT (Mobile IP Router), consists mainly of three parts, one for the connection to the host or backbone net (Ethernet), one for connecting to wireless LANs (radio or infrared), and a processing part for computing the communication protocols. This device serves as more than a mobile modem, i.e., it actually routes packets over potentially multiple paths with varying connectivity and quality. By using Ethernet as an input channel, it should not be necessary to install special purpose wiring dedicated to mobile communication. Instead the existing network, which normally is globally available, is used to select suitable sites for base stations. To realize a large scale field trial the new router must be low cost, small in size, and have a low power consumption while offering high performance. The current phase of the project involves building a 68030 based router with multiple interfaces, including as host interfaces: SCSI, Ethernet, serial, parallel; and as wireless interfaces: IR, microwave-radio, or a-second Ethernet (supported for software development).>

We consider the problem of providing network access to hosts whose physical location clianges with time.Such hosts cannot depend on traditional forms of network connectivity and routing because their location, and hence the route to reach them, cannot be deduced from their network address.In this paper, we explore the concept of providing continuous network access to mobile computers, and present a set of IP-based protocols that achieve that goal.They are primarily targeted at supporting a campus environment with mobile computers, but also extend gracefully to accommodate hosts moving between different networks.The key feature is the dependence on ancillary machines, the Mobile Support Stations (MSSS), to track the location of the Mobile Hosts.Using a combination of caching, forwarding pointers, and timeouts, a minimal amount of state is kept in each MSS.The state information is kept in a distributed fashion; the system scales well, reacts quickly to changing topologies, and does not place an overwhelming burden on the network.

The task of concurrently computing alternative solutions to a problem where only one of the solutions is needed is examined. In this case the rule for selecting between the solutions is faster first, where the first successful alternative is selected. For problems where the required execution time is unpredictable, this method shows substantial execution time performance increases over other methods. In order to test the utility of the design, it is used for two application areas: distributed execution of recovery blocks and OR-parallelism in Prolog. The authors present: (1) a model for selection of alternatives in a sequential setting: (2) a transformation that allows alternatives to execute concurrently; (3) a description of the semantics-preservation mechanism; and (4) parameterization of where the performance improvements can be expected. Additionally, examples of application areas for the method are given.>